Retail loss prevention: from signals to loss controls

Define the loss you want to control

Start with a specific question: unsupported refunds, discounts outside policy, cash differences or goods released without a valid sale. Each problem requires different data and decisions. A generic anomaly control rarely explains what should happen next.

Reconciliation checks the relationship between records and expected or received money. Loss prevention also examines whether an operation was legitimate and met the applicable conditions. A perfectly reconciled refund may still need authorization review; a late file may create a difference without a loss.

Link events before looking for patterns

Collect the ticket and its lines, store, till, date, payment method and later events. Add inventory or settlement when the hypothesis requires them. Preserve the original-operation link to distinguish a partial refund from a separate sale.

Check duplicates, cutoffs, time zones and missing periods. An event received twice does not represent two operations. If the original source is incomplete, record that limitation before escalating a suspicion.

From a till event to a loss prevention case

Illustrative example: a COP 200,000 sale is paid by card and later refunded in cash. The change in payment method warrants checking policy and authorization. It does not itself establish fraud: a documented business exception may be permitted.

Connect three paths. The business path includes receipt, refund and authorization. The money path includes the original charge, cash outflow and any processor reversal. The goods path checks receipt where required. If cash is returned and the card is also refunded, two financial effects must be investigated against one operation.

Reconciliation helps establish amounts and their movement; loss prevention adds the applicable policy and operational context. A reconciled credit does not validate discount authorization. Business authorization does not confirm that money moved only once. Keeping both checks prevents closing a case with evidence from only one side.

Define the control action before operation: request evidence, hold a pending second execution where that capability exists, or escalate to an owner. Record the rule and version, triggering events and reviewed conclusion. Only an evidence-based investigation can turn the signal into a confirmed loss.

Design controls that lead to action

Each rule needs a population, condition, exclusions, evidence and owner. For a refund without a linked sale, the first action may be retrieving the original source. For a discount, it may be checking the campaign, authorization and validity period.

A concentration of operations at one till may guide review but needs context on volume, shifts and sales mix. Do not present an isolated comparison as proof of misconduct. A control should explain the data supporting its signal and the verification still required.

Investigate cases instead of accumulating alerts

Group multiple signals about one event without multiplying its amount. Record alternative hypotheses, evidence, next action and decision. Distinguish valid operations, technical errors, confirmed losses and insufficient evidence.

Preserve the rule version and reviewer’s conclusion. Tuning a rule can improve precision but should not erase history to make a metric look better. Evaluate changes on a comparable sample with reviewed outcomes.

Scale with evidence

Start with a limited cohort and a team able to resolve cases. Expand when coverage is verifiable and review produces consistent decisions. More sources and rules do not help if an ownerless queue keeps growing.

Measure exposure, confirmed loss and recovery separately. Inventory shrink does not identify a cause by itself and should not automatically be interpreted as theft. A useful program explains both findings and operations ultimately determined to be valid.

• Link sale and refund
• Check policy and money
• Investigate before concluding