We recently conducted a security assessment at an electronics manufacturing company. This company uses microprocessors, memory modules, and many other high-value electronic components in their production process. The company had many good security procedures in place, including a package inspection procedure where employees leaving the facility were required to have their purses, briefcases, and lunch boxes inspected by a security officer as they exited the building.

 

Interestingly, we found a major weakness in this companies security procedures: employees could easily mail a package containing high-value merchandise out of the facility!

 

As a convenience, the company's mail room could be used as a "post office" by employees. An employee desiring to send a personal package could simply drop it by the company mail room. The package would be weighed by a mail room person, and the employee would be charged the appropriate postage. This service was reportedly used heavily by employees, particularly during the holiday season. While convenient for employees, this procedure created a real potential for losses, since the packages were sealed and addressed prior to being accepted by the mail room.

 

An employee intent on theft could easily fill a box with expensive electronic components, seal the box, and then mail it to himself or a friend. Since the mail room did not keep a record of personal shipments, it would be impossible to trace this type of theft.

 

How are outgoing shipments by employees handled at your company? Would you be vulnerable to this type of theft?

 

Here are a few suggestions concerning the control of outgoing shipments:

 

• The security manager should meet with the manager responsible for the mail room or shipping/receiving department. Review existing procedures to identify any potential security weaknesses.

​​

• Discourage the use of the company's mail room for personal shipments.

​​

• If personal shipments are permitted, require that a mail room person inspect and seal the package prior to shipment. Keep a log of all personal shipments that includes the name of the employee who shipped the package, the mailing address of the recipient, and a brief description of the contents of the package.

​​

• Provide good physical security at the mail room. Make it difficult for a non-mail room employee to place a package (with or without postage) in the outgoing mail bin.

​​

• Make mail room employees aware of the potential for unauthorized outgoing shipments.

​​

• Have mail room employees be on the lookout for suspicious outgoing packages (mailed to an unknown addressee, mailed to a personal address, non-standard shipping labels, etc.)

​​

• Have mail room employees be alert for what appear to be inappropriate outgoing shipments (for example, the Human Resources department would not normally be making an outgoing shipment of electronic components.