If 5% of employees are responsible for 95% of theft, what does this imply for control strategies?

• A. Targeted controls on a small group of high-risk employees.
• B. Spread resources evenly across all employees.
• C. Ignore the data and rely on external audits.
• D. Limit controls only to management.

Answer: (A)

This reflects a risk-based approach to controls guided by the idea that a small group drives most of the risk. If only 5% of employees are responsible for 95% of theft, concentrating screening, monitoring, and access controls on that high-risk group yields far more impact than spreading resources evenly.

Why this is the best approach: targeting resources where the theft risk is concentrated maximizes prevention with less wasted effort. You can tailor measures to the specific risks those employees pose—enhanced background checks, tighter access to valuable assets, more rigorous verification, separation of duties, and continuous monitoring—while keeping general controls lighter for the rest. This leverages data to reduce overall risk more efficiently.

Context for implementation: identify high-risk individuals through risk indicators such as past incidents, job role and access level, unusual patterns in behavior or transactions, and network or asset access logs. Then apply layered controls around those assets and processes, and periodically reassess as patterns shift.

Other options fall short because they dilute focus and miss ongoing risk: spreading controls evenly wastes scarce resources on low-risk workers; ignoring data and relying solely on external audits leaves gaps between audits where theft can occur; limiting controls to management ignores the fact that non-management staff can access, handle, or process valuable assets as well.