Restaurant Security Checklist

Walk every exterior opening — front of house, kitchen back door, dumpster gate, patio fence, basement bulkhead. Check that the back door auto-closer engages and isn't propped with a milk crate (the most common after-hours breach point).

Cycle every lock on the building. Walk-in cooler and freezer interior releases must open with a single push from inside — OSHA citation territory if not. Note any sticking deadbolts or worn strike plates for the locksmith.

Confirm the DVR is recording all channels — bar, POS terminals, back door, safe, dish pit. Spot-check 30 seconds from each camera. Verify retention is set to at least 30 days; insurers and law enforcement routinely request older footage.

Open a ticket with the security vendor the same day. Note the camera channel, the time window of the gap, and whether other channels were affected. A camera down at the safe or back door is a same-week fix, not a someday-soon fix.

Pull the user list from Toast, Square, or Aloha. Deactivate anyone separated since the last review. Confirm no shared manager PINs — a shared 1234 is how comp and void abuse hides.

Disable each stale account in the POS, online ordering platform, reservation system, and scheduling tool (7shifts or Homebase). Document the date — the offboarding audit trail matters if a former server's login appears in a later void report.

Pull last week's comp and void percentages by server. Flag anyone above 3% of their sales for a one-on-one — chronic outliers are the leading indicator of skim. Look at no-sale drawer pops on the bar terminal too.

Pull voided and comped tickets for the flagged employee, match against DVR for the corresponding service window, and check whether the comp had a manager override or was self-applied. Document findings before any conversation with the employee.

Verify the POS is on a segmented network from guest Wi-Fi, the latest firmware is installed, and the annual PCI-DSS self-assessment questionnaire (SAQ) is on file. Card-reader tampering checks should already be part of opening — confirm the line cooks know what to look for.

Confirm only current managers and the chef hold building keys or alarm codes. Rekey if a key-holder has left in the last 30 days without returning the key — locksmith cost is small versus a bad-faith after-hours entry.

Cover the named cases: comply during a robbery, never chase, hit the silent panic button only when safe. Show what a tampered card reader looks like (loose bezel, mismatched color, extra wires). New hires get this in their first week, everyone else quarterly.

Pull the list of hires since the last review. For any role with cash or safe access (managers, bartenders, bookkeeper), confirm the background check cleared before the first shift. FCRA disclosure and authorization must be on file before pulling the report.

Pull the week's cash-out reports from the POS. Variances over $5 per shift or recurring shorts from the same server warrant a conversation. Tracked per-employee, not in aggregate — that is how skim hides.

Match each closing-shift drop bag to the log entry and the bank deposit slip. Any gap between drop time and deposit time should be reconcilable on the safe-camera footage. Two-person count for any drop over $2,000.

The person who counts deposits should not be the same person who reconciles the bank statement. The person approving vendor invoices should not be the same person cutting checks. Common single-operator gap; document the workaround if one person necessarily wears two hats.

Pull the merchant processor's chargeback report and any fraud alerts. Patterns — same card type, same hour, repeated declines — point at a compromised reader or an employee using a skimmer. Dispute deadlines are short (often 7-10 days from notification).