How to Conduct a Physical Security Risk Assessment: Step-by-Step Guide for Bangladesh Enterprises

Every effective physical security programme begins not with cameras and access control hardware, but with a structured understanding of what you are protecting, from whom, through which vulnerabilities, and what the consequences of failure would be. This structured understanding is the physical security risk assessment — the document that should drive every security investment decision your organisation makes.

Without a risk assessment, security spending is reactive and often misallocated. You invest in the areas that recently had incidents (recency bias), in the systems that vendors most actively promote, or in what your peers appear to have (benchmarking without context). The result is security infrastructure that may miss the most significant risks to your organisation while investing heavily in lower-priority areas.

This guide walks through the risk assessment process in 6 practical steps, with specific Bangladesh context at each stage.

Why Risk Assessment Is the Foundation of Security Planning

A physical security risk assessment serves multiple purposes:

Investment prioritisation — It tells you where to spend limited security budget first. Not every risk can be eliminated, and not every countermeasure can be funded simultaneously. Risk assessment provides the logic for saying "we invest in X before Y because X carries higher risk."

Regulatory compliance foundation — Bangladesh Bank ICT Guideline v4.0 requires banks to conduct formal risk assessments as the basis for security controls. ISO 27001 Annex A requires risk assessment as a core management activity. RSC HSE standards expect factories to identify and address safety risks through a documented process.

Insurance and legal basis — An organisation that has conducted a documented risk assessment and implemented reasonable countermeasures has a stronger position if a security incident leads to an insurance claim or legal action. "We had a risk assessment that identified this threat and these were our countermeasures" is a defensible position. "We had cameras but didn't really think about the risks" is not.

Management communication — A risk register with quantified risk levels is the most effective tool for communicating security investment needs to boards and senior management who may not intuitively understand security terminology.

Step 1: Define Assets and Their Value

Begin by identifying what you need to protect. Physical security assets fall into several categories:

People — Employees, customers, contractors, visitors. People are the highest-priority asset in any risk assessment — human safety is the first and non-negotiable concern.

Physical assets — Cash, inventory, equipment, vehicles, raw materials, finished goods. In a bank, the cash vault and ATMs. In a factory, finished goods in the warehouse. In a data centre, the server hardware.

Information assets — Data stored on physical media, paper records, information that is physically accessible. Server rooms and document stores are the physical containers of information assets.

Infrastructure and facilities — Buildings, power systems, communications infrastructure. Disruption to physical infrastructure can be as damaging as direct theft.

Operational continuity — The ability to continue operations. A security incident that shuts down production for 3 days has a quantifiable cost beyond any direct asset loss.

For each asset category, assign a value — either a financial value (replacement cost or revenue impact) or an ordinal scale (Low/Medium/High/Critical). The Bangladesh Bank framework suggests categorising assets by impact on operations: critical assets are those whose compromise would immediately affect core banking operations.

Bangladesh context: For RMG factories, finished goods in the export warehouse (often worth crores of taka before shipment) are a critical asset requiring specific security attention. For banks, ATM cash and the physical security of server rooms are critical assets under regulatory obligation.

Step 2: Identify Threats

A threat is any event or actor that could cause harm to your assets. Physical security threats fall into several categories:

External Threats

Theft and burglary — The most common physical security threat across all sectors in Bangladesh. Organised theft gangs target commercial premises, factories, and construction sites. ATM fraud (card skimming and physical ATM attacks) is a documented threat to the Bangladesh banking sector.

Robbery — Armed or threatened robbery of cash during transit or at point-of-sale. Banks, money exchanges, retail jewellers, and petrol stations face elevated robbery risk.

Vandalism — Deliberate damage to property, including security systems themselves (cameras, access control readers). Security equipment vandalism is often a precursor to a subsequent attack.

Arson — Deliberate fire-setting, motivated by commercial rivalry, extortion, or sabotage. Industrial facilities, markets, and garment factories are documented arson targets in Bangladesh.

Industrial espionage — Physical access to trade secrets, product designs, or commercial intelligence. Relevant to pharmaceutical manufacturers, technology companies, and enterprises competing in sensitive commercial markets.

Terrorism and civil unrest — Bangladesh has experienced periods of political unrest that created security risks for commercial premises, particularly in Dhaka city centre. Enterprises should assess this threat in the context of their location and sector.

Internal Threats

Employee theft — The most statistically significant source of financial loss for most organisations. Insider theft is harder to detect than external theft because the perpetrator has legitimate access and may understand the gaps in security coverage.

Fraud — Financial fraud often has a physical component — access to documents, systems, or cash that enables fraudulent transactions. The access control and CCTV record is often critical evidence in fraud investigation.

Sabotage — Deliberate damage to systems or property by employees, often disgruntled departing employees. IT systems sabotage by employees with technical access is a specific concern.

Unauthorised disclosure — Employees removing confidential documents or devices from secured areas.

Environmental and Accidental Threats

Fire — Accidental fire from electrical faults, cooking, or industrial processes. Bangladesh has experienced significant factory fire losses, particularly in the RMG sector.

Flood — Bangladesh's geographic vulnerability to flooding makes flood-related asset loss a genuine threat for many enterprises, particularly those in low-lying areas.

Power failure — Extended power outages, common during monsoon season, can expose physical vulnerabilities (electronic security systems offline) and cause equipment damage (through power surge at restoration).

Step 3: Identify Vulnerabilities

A vulnerability is a weakness in your current security posture that a threat actor could exploit. The gap between where threats exist and where your controls are effective defines your vulnerabilities.

Identify vulnerabilities through:

Physical walkthrough — Walk the entire site with fresh eyes. Look for unmonitored access points, blind spots in camera coverage, doors that should be locked but are left propped open, fence sections that are damaged, lighting that is inadequate for camera function at night.

Documentation review — Review access control records for anomalies. Who has access to areas they have no operational reason to enter? Are there active credentials for departed employees? Are access logs being reviewed?

System testing — Test whether alarms function. Test whether CCTV cameras are recording and whether footage can actually be retrieved for historical dates. Test whether fire detection responds appropriately. Systems that appear operational may have silent failures.

Staff interviews — Ask security guards, reception staff, and department managers about security concerns they have observed. Frontline staff often know exactly where the vulnerabilities are — they just have not had a formal channel to report them.

Bangladesh-specific vulnerability patterns — Common vulnerabilities we encounter across Bangladesh enterprises include:

• ATMs with outdated camera housings that do not capture faces clearly enough for identification
• Access control systems with shared PIN codes (defeating the purpose of individual access control)
• NVR storage insufficient for 90-day retention (a common Bangladesh Bank compliance gap)
• Fire exit doors that are kept locked because staff find them inconvenient
• CCTV blind spots at loading docks and vehicle access points — precisely the areas most vulnerable to theft

Step 4: Calculate Risk

Risk is a product of two factors: the likelihood that a threat exploits a vulnerability, and the impact if it does. The standard risk calculation is:

Risk Level = Likelihood × Impact

Use a simple 1-5 scale for both:

Risk scores therefore range from 1 (lowest) to 25 (highest). Risks scoring above 15 are typically classified as High or Critical and require immediate attention. Risks scoring 10-15 are Medium and require planned attention. Risks scoring below 10 are Low and can be monitored.

Bangladesh banking context example: Cash ATM robbery risk. Likelihood = 3 (possible, given documented incidents across the sector). Impact = 4 (significant — financial loss, reputational damage, staff trauma, regulatory attention). Risk score = 12 (Medium). Countermeasure: CCTV at ATM meeting Bangladesh Bank v4.0 specification, panic button integrated with CCTV and alarm, guard presence during peak hours.

Step 5: Define Risk Treatment

For each identified risk, there are four treatment options:

Risk Avoidance — Eliminate the activity that creates the risk. If a particular cash-handling process creates unacceptable risk, redesign the process to eliminate the cash handling. Not always possible, but should be considered for the highest-risk activities.

Risk Mitigation — Implement controls that reduce the likelihood or impact of the risk. This is where most physical security investment goes — CCTV, access control, alarms, guards, fencing, and procedures are all risk mitigation controls.

Risk Transfer — Transfer the financial consequence of the risk to a third party, typically through insurance. Insurance does not eliminate the risk, but it limits the financial impact. Many Bangladesh enterprises under-insure physical assets — the cost of adequate commercial insurance is significantly less than the cost of a major uninsured loss.

Risk Acceptance — Formally accept that a risk exists and will not be further mitigated. This is appropriate for low-risk items where the cost of further mitigation exceeds the expected value of the risk. Risk acceptance must be an active management decision, documented in the risk register — not a passive failure to address the risk.

Step 6: Prioritise Countermeasures by ROI

Not all countermeasures are equally cost-effective. Prioritise your security investment using a ROI framework:

Countermeasure cost: What does the control cost to implement and maintain annually (amortised capital cost + AMC)?

Risk reduction value: What is the expected annual loss before the countermeasure, minus the expected annual loss after? (This requires making reasonable assumptions about loss frequency and severity.)

ROI ratio: Risk reduction value divided by countermeasure cost. Controls with ROI ratios above 1.0 are cost-justified on financial grounds alone.

For non-quantifiable risks (reputational damage, regulatory penalties), use qualitative prioritisation: controls that address regulatory obligations (Bangladesh Bank, FSCD, PDPO 2025) take priority over controls that address non-regulatory risks, even if the financial ROI calculation does not clearly differentiate them.

Risk Register Template

A risk register documents all identified risks and their treatment status. At minimum, each row should capture:

Review the risk register at least annually, or after any significant security incident, major operational change, or change in the threat landscape.

Bangladesh Context: Industry-Specific Threat Profiles

Each major industry in Bangladesh carries a distinct threat profile that should shape the risk assessment:

Banking — Highest exposure to ATM fraud, cash vault robbery, and cyber-physical attacks. Bangladesh Bank ICT Guideline v4.0 mandates a formal risk-based approach to security controls.

RMG/Garment factories — Fire risk is the dominant threat (electrical faults in high-density production environments). Employee theft of finished goods is a significant secondary risk. Access control to warehouse areas is critical.

Healthcare — Patient safety threats (infant abduction, drug theft), workplace violence risk in emergency departments, and data privacy risks for patient records. A unique threat profile requiring careful assessment.

Commercial real estate — Multi-tenant environments where tenants' different risk profiles must be managed within a shared infrastructure. Car park crime is a consistent priority.

Government facilities — Social unrest, targeted attack, and espionage threats that most commercial organisations do not face. Classified information and VIP protection requirements add complexity.

SSAL Security Risk Assessment Service

We offer facilitated physical security risk assessments for Bangladesh enterprises across all major sectors. Our service includes:

• On-site walkthrough and documentation review by experienced security consultants
• Threat modelling specific to your sector and location
• Vulnerability identification including technical testing of existing systems
• Risk scoring and risk register production
• Countermeasure recommendations with indicative costs
• Implementation priority roadmap

The risk assessment output provides the business case for your security investment decisions and the documentation baseline required by Bangladesh Bank, ISO 27001, and other frameworks.

Get Free Consultation

A physical security risk assessment is the most valuable investment you can make before spending on security systems. It ensures that every taka of security budget addresses your most significant risks.

Get Free Consultation — contact us to discuss commissioning a physical security risk assessment for your organisation.