In August, the U.S. was struck by back-to-back mass shootings in El Paso, Texas, and Dayton, Ohio. These attacks — which took place in publicly accessible locations — sent shockwaves through communities and businesses across the country, and underscored the disturbing truth that such attacks can happen to virtually anyone, anywhere. Once again, these tragedies stirred nationwide debate about how best to address gun violence, and about how to most effectively minimize the likelihood and impact of future attacks.

While it is unfortunate and disturbing that such attacks have now become a seemingly permanent feature of the day-to-day risk environment, retailers, restaurateurs and their employees are beginning to address the issue head-on. In the aftermath of the Walmart shooting in El Paso, media accounts highlighted that many retail employees felt compelled to design their own escape procedures to avert a dangerous situation.

Companies including Dave & Buster's Entertainment and Del Taco Restaurants outlined in recent SEC filings that active shooters are among the potential risks, a clear indication that the c-suite is similarly aware of this new risk environment. These reports of increased awareness and response are in line with our experience at Pinkerton, as an increasing number of our clients have built active shooter scenarios into their crisis management and preparation plans. Each new high-profile incident compels more companies to review their policies and procedures, sparking discussion and prompting change.

Still, the nature of the retail industry forces many companies into a unique balancing act. While they need to make sure appropriate safety measures are in place to protect employees and visitors from an unanticipated attack, these businesses also need to maintain an open and welcoming environment that encourages brand loyalty. To successfully achieve these dual objectives, there are certain key steps retailers can consider.

Evaluate your total risk profile

Retailers that understand their total risk profile can make much more strategic decisions about how to maximize the safety of their operations, addressing overlooked vulnerabilities before a crisis hits.

When assessing a company's "total risk profile," we evaluate both structural and variable risks. Structural risks are the risks that are faced by every company in a given industry and/or region. For an active shooter scenario, the possibility of a "lone wolf" attack is a structural risk faced by every company. The randomness of the attack makes any company equally likely to be exposed to such an attack.

Variable risks are the risks that are based on decisions a company makes and the level at which they are willing to accept risks. For an active shooter scenario, variable risks may include whether the company chooses to have regular active shooter drills, or whether they have in place visible security measures such as cameras and guards. While some companies may feel compelled to enact these measures, others may consider it alarming for customers and personnel, going against their objective of being open and welcoming.

To navigate this risk landscape, business leaders must continually update and refresh the data that they use to evaluate their vulnerabilities, and conduct regular risk assessments. Some companies may opt to use internal staff for these assessments while others will prefer the non-biased analysis by an outside risk management organization. The former offers deep familiarity with the company's operation, and the latter provides an independent examination of the company's departments and personnel without the pressure of being a "whistleblower."

Develop a crisis response scenario

In preparing for an active shooter scenario — as well as any other emergency situation — the most fundamental step is to have an up-to-date crisis plan that provides a clear roadmap for what employees should do in the event of an attack, from immediate response to long-term recovery and business continuity.

Beyond outlining the steps to be employed during and immediately following an attack, crisis plans should also address potential mid- to long-term business continuity challenges, including how to support victims and employees, how to address potential litigation and public relations challenges, and the best method for stakeholder communication.

The most effective crisis plans are established and communicated well in advance of a crisis. A good plan can help business leaders avert the chaos and ambiguity that comes after an incident while focusing efforts more effectively on recovery and supporting the community. To ensure that everything is up-to-date, crisis plans should be tested and updated at least once per year.

Identify the most effective form of training for employees

Beyond a detailed roadmap about what to do in an active shooter scenario, a company also needs to discern the best way to train employees for a potential attack. It's also critical that all employees are fully trained in how to execute the company's response strategy and responsibilities. These plans will vary depending on location, so particularly for retail chains with multiple stores, it's important for scenario planning to involve local managers as well as central leadership.

Company culture often plays a large role in determining what form of active shooter training will be most effective and viewed as most appropriate by employees. While some companies may prefer to conduct regular active shooter drills, others may instead choose to convey necessary information in the form of handouts or other written materials, in order to avoid over-emphasizing what they perceive to be a low-probability scenario or disrupting their culture in a manner that could negatively impact their ability to retain talent and business.

In deciding the best form of training to offer employees, there are several risk factors that companies should consider:

• Does the company have locations in neighborhoods that are considered high-crime?
• Do company operations, supply chain or products leave employees vulnerable to theft or assault?
• Does the company rely on a large percentage of contractors or temporary workers, who may not have undergone strict background checks?

Evaluate and reinforce physical security measures

Many times, companies will address security issues by increasing security staff. However, it is unrealistic to think that they will solve all their security challenges by simply employing a security guard. Companies must address their specific vulnerabilities with a strategic mix of technology and personnel to create concentric rings of security that will help them deter, detect, delay and respond to attacks.

Companies today have an array of technology that can go a long way in detecting and delaying threats. For example, devices that can identify the sound of gunshots and automatically contact the police can result in faster response times. Auto magnetic lock-in systems can control the movements of potential attackers and reduce harm by controlling access points. The speed of technology advancement enables new mitigation solutions to constantly hit the market, improving a company's ability to deal with active shooter threats.

To ensure that risk management efforts are effective, it's important for the response steps to be clear, and for staff to be trained and know their responsibilities, including escorting customers to a safe spot or supporting individuals injured during the course of an attack. In deciding the best mix of technology and personnel, a rule of thumb is to evaluate the security environment in the vicinity and ensure that community standards are met and, if possible, exceeded.

Coordinate with local law enforcement

Particularly in higher-risk locations, it's critical to be in communication with local law enforcement professionals and to give them the opportunity to become acquainted with the layout of a facility. In the event that law enforcement needs to respond quickly to an escalating event, this familiarity — knowing what the floor plan looks like, where the exits are located — will enable them to provide the most effective assistance.

Looking ahead

Recent active shooter activities have resulted in an increased awareness of the changing risk landscape, and retail business leaders have prioritized an increasing range of safeguards and measures to proactively mitigate the risks. No longer can those responsible for the safety of employees and customers rely on an "it will never happen here" mentality. The randomness of these attacks has put everyone on alert. The retail industry is moving decisively to counter the potential risks they face and being as prepared as they can through awareness, training and tactics. Being prepared today can save lives — as well as significant business costs — tomorrow.