Loss prevention metrics: separate alerts, losses and recoveries

Start with coverage

Define the population: stores, tills, channels, dates and operation types. Track expected sales, voids, refunds and discounts against records received with the required fields. When a source is missing, fewer alerts may mean less visibility.

Use operations eligible for each control as the denominator. A refund rule should not use every ticket if only some tickets are eligible. Explain exclusions, windows and rule versions so periods can be compared.

Separate four monetary categories

Exposure is the value of flagged operations awaiting investigation. Confirmed loss requires evidence and a reviewed conclusion. Recovery needs a verifiable credit, returned goods or another case-specific outcome. Avoided cost is an estimate whose assumptions should remain separate.

Do not add these categories as independent benefits. One operation flagged by three rules counts once in the case exposure. Recovery reduces the outstanding amount associated with a loss; it does not erase the loss history.

Ten alerts do not equal ten losses

Illustrative example: ten refund alerts relate to seven operations because three triggered multiple rules. Their total value, counted once per operation, is COP 700,000. This is exposure under review, not confirmed loss or savings attributable to the system.

The investigation confirms a COP 100,000 loss on one operation and clears four cases with valid authorization. Two operations remain pending. If COP 40,000 is later recovered on the confirmed case, its outstanding loss is COP 60,000. Exposure, loss and recovery must not be added together to inflate claimed benefits.

The dashboard must show evidence status alongside value. Store comparisons require equivalent populations: eligible operations, period and applied controls. A store that has just supplied more files may generate more alerts because coverage improved, without deterioration in its operations.

Measure investigation capacity too. A growing queue of unassigned cases does not demonstrate better prevention. Track age by reason and value, time to obtain evidence and the share of closures whose conclusions can be reproduced. Evaluate a new rule using reviewed cases and a comparable sample before expansion.

Measure review quality

Track open cases, age, time to first review, missing evidence and closure reasons. Define false positives before measuring them: a valid signal on an ultimately authorized operation may differ from a technically incorrect rule.

The finding rate among reviewed cases describes that sample, not every operation. Reviewing the largest amounts first introduces selection bias. Keep a comparable sample when evaluating rule changes.

Compare equivalent operations

A store with more refunds may have different volume, merchandise or commercial policies. Normalize by eligible operations and compare equivalent periods. An operator-level indicator does not establish misconduct; it requires context, appropriate access and review.

Inventory shrink also does not automatically mean theft. It may combine several causes and depends on the measurement method. Keep confirmed causes separate from observed differences.

Turn metrics into decisions

Assign an action to each indicator: restore coverage, request evidence, adjust a rule or resolve overdue cases. Fewer alerts are only favorable if missing sources or disabled controls did not cause the decline.

Keep each result linked to its case and evidence. Reviewers should be able to move from an aggregate amount to the facts supporting it without turning a dashboard into a list of accusations.

• Deduplicate operations
• Review and classify cases
• Separate outcome and recovery