Risk management is the process of identifying what could happen, estimating how likely and how costly it would be, and choosing how to treat it. The options are to avoid, reduce, transfer or accept the risk. Security spending should follow the assessment, not a product list.
Risk is likelihood times consequence, not a feeling about a neighborhood. Writing it down is what makes the conversation productive.
Assessing the exposure
Walk the site and list the threats that apply: forced entry, theft, vandalism, workplace violence, network intrusion. For each, estimate likelihood and impact with the people who run the building daily.
Choosing what to treat
Reduce the risks that are likely and damaging, accept the rest knowingly and record the decision. A measure that looks impressive but addresses an unlikely event is usually money better spent elsewhere.
Related:Commercial security systemsGlossary: Physical security systems