Case Study: Enterprise Risk Assessment

Click here to download the PDF version of this case study


Butchko, Inc. was engaged by a privately-held, multi-billion dollar retail company to provide a first-ever enterprise physical security risk assessment of its corporate, warehouse, cross-dock, and retail locations.


Butchko designed a program to efficiently and effectively evaluate and monitor risk at their 900 facilities without the direct and indirect costs of visiting each site. The result was an enterprise-level risk assessment with current information in a fraction of the time that would otherwise have been required.

Don’t Reinvent the Wheel

Butchko followed a systematic approach to the program. Initially we identified facilities and operations of similar type and selected representative locations with a variety of threat profiles for in-depth sample assessments. Those assessments established baseline datasets and became the basis from which all other similar facilities were assessed.

Next we characterized the threats, assets, and vulnerabilities of all remaining locations through a combination of document review, tailored online surveys, site visits, and personnel interviews. The Online Survey Questionnaires were developed for specific facility types. We asked stakeholders at those facilities to provide input for review and incorporation into the assessment database. Where individual site data and responses deviated significantly from baseline expectations,, additional investigation was performed (either remotely or onsite) to refine and validate the assessment data.


All 900 sites were assessed within six (6) months with a cost savings of 75% over the original client program. In addition, the limited onsite time at all sites visited reduced operations disruptions by almost 50%.

Current Information Provides Greater Value

Utilizing our proprietary bSMART platform to perform and manage the process, the client security leaders can update the risk profile for each facility or the enterprise as a whole with the touch of a button. When conditions change, alerts are generated to advise corporate personnel. No longer was the client forced to wait weeks for an assessment report and then make decisions in real-time based upon information that could be years out-of-date.