How can you reduce risk in a shopping centre? Facilities management helps control contractors, incidents, evidence and operational response.
It's time to break the reactive loop. Becoming a Strategic Facilities Manager shows you how.
Learn moreSecurity in a shopping centre is about far more than guards on patrol or cameras on the wall. These are sites that see thousands of visitors a day, and any incident can turn into operational, financial and reputational fallout within minutes.
That fallout tends to land on the shopping centre itself. In the UK, the Occupiers' Liability Act 1957 places a duty of care on whoever controls the premises, requiring reasonable steps to keep visitors safe. Get that wrong, and a single incident, an escalator fall, a wet floor, a faulty handrail, can turn into a genuine legal and financial problem. For leadership, the real question is how to get ahead of these risks before they turn into cost, disruption or public exposure, not just what could go wrong in the first place.
This article covers four risks shopping centres need to control to protect visitors, tenants, staff and the value of the asset.
Before you even get to security proper, there's infrastructure risk to deal with. A shopping centre's revenue runs on every hour it's open, and that's exactly what's at stake, at least in part, every time a critical asset goes down:
Main switchboard or substation: a fault here isn't measured in minutes. Losing power to one wing can take out lifts, escalators and refrigeration all at once, sometimes for days rather than hours.
Chiller or central HVAC system: without proper maintenance, these lose 10% to 20% of their energy efficiency within the first 12 to 18 months. Once a fault gets bad enough to need emergency repair, the typical cost runs 3 to 5 times that of scheduled maintenance.
Fire suppression system (alarms, sprinklers): a false trigger caused by the system's own fault can force the evacuation of an entire wing, cutting off access to shops and the food court for hours, with no actual fire anywhere near.
The legal exposure is real too. Under a duty-of-care standard like the UK's, a shopping centre that can't show it inspected and maintained an asset properly is in a far weaker position once something goes wrong, and claims for falls, faulty equipment and poorly maintained fixtures are common enough that most centres will face one eventually.
For the COO, an asset failure like this means losing control over continuity. For the CFO, it means growing exposure to unplanned cost and liabilities. For the management team, reputation is on the line.
Best practice: prioritise maintenance by what threatens the operation, not by whoever called it in first. That means treating operational risk as a governance matter, with visibility over severity, recurrence, ownership, deadlines and evidence.
Running a shopping centre depends on a wide network of suppliers. Maintenance, cleaning, security, parking, construction and events all extend what the operation can do, but they extend its exposure just as much.
Security itself is usually outsourced, and in most markets, private security providers are separately licensed and subject to their own regular inspections. Fire evacuation training for on-site teams is typically a legal requirement too, not an optional extra. These areas usually sit with a dedicated security lead, who's often also responsible for a regular loss-prevention audit, one of the handful of formal metrics the on-site operations manager reports on.
The risk with a contractor comes down to proof: can you actually show the work was done properly?
Maintenance without a paper trail produces recurring faults;
poorly done cleaning creates a health risk;
slow security response becomes a reputational problem;
unsupervised construction work leads to accidents;
inconsistent parking management creates friction for every visitor.
Best practice: track critical suppliers by performance, SLA, evidence of work completed and how often faults recur, not just whether the contract's being met on paper. That's what supports decisions on renewal, renegotiation, replacement and where to invest next.
Every shopping centre deals with operational incidents. What separates a strategic operation from a reactive one is what happens after today's problem gets sorted.
An incident logged loosely, "sorted the flooding in the second-floor toilets", teaches the operation nothing. One logged with structure, date, location, type, action taken, closure, is a different matter entirely: it lets you cross-reference and spot, say, that the same toilets flood every time it rains hard, or that one supplier is behind half of this month's repeat faults.
It's that structure, more than the sheer volume of data, that turns an incident into something you learn from. Two indicators do most of the work here: recurrence by fault type (which points to a structural cause, not a one-off) and time to resolution (which shows whether a problem is being pushed along rather than actually fixed).
Best practice: require every incident to close with date, location, type, action taken and owner, not just a "resolved" tag. That's the structure that lets a security or operations lead learn from the pattern instead of reacting to isolated cases.
Visibility matters because investment decisions and operational decisions run on different clocks. The operation knows, in real time, that a supplier has been repeating the same fault for three weeks. Leadership often only finds out at the next scheduled review, by which point the pattern has already turned into an expensive repeat problem.
That's where the loss happens, in the gap between the two clocks. The data exists, but it sits with whoever actioned it, a closed work order, a resolved job, a call to a supplier, without ever reaching whoever holds the budget. By the time it reaches the monthly report, it's a summary of what already happened, not an early warning.
Questions like "which suppliers have the most repeat faults" or "what does each type of failure actually cost" only get quick answers when the operational data is already organised before the meeting, not scrambled together for it.
Protecting visitors, tenants and staff is still the priority. But for leadership, security also means protecting revenue, reputation and asset value, and the four risks covered here make that case on their own.
To see how this connects to the rest of the operation, read the guide Operational management for shopping centres: how to improve infrastructure, experience and performance.
If your team is still relying on spreadsheets, emails or disconnected systems to manage suppliers, incidents and critical assets, Infraspeak brings all of it into one platform, with the kind of visibility that today only shows up once a month, in a report.
Talk to a specialist and find out how to turn operational data into real predictability and control: book a demo.
How can shopping centres improve security?
Improving security means integrating infrastructure, suppliers, maintenance, incidents and operational processes. The more visibility you have over risk and incidents, the better positioned you are to prevent them.
What role do contractors play in risk management?
Contractors are directly involved in critical activities like maintenance, cleaning, security and construction. That's why their performance, documentation, SLAs and evidence of work need continuous monitoring, not a one-off check.
Which indicators help reduce operational risk?
Response time, fault recurrence, incidents by area, supplier SLA performance and incident history all help identify vulnerabilities and guide investment decisions.
)
){kind=logo}
)