A nonprofit HQ lobby has after-hours access with no badge control or camera coverage despite a documented theft history. Which statement best reflects appropriate organizational precautions?

Security measures such as access control and monitoring belong among appropriate organizational precautions when a nonprofit headquarters lobby allows after-hours access with no badge control or camera coverage despite a documented theft history. Raising insurance deductibles alone addresses risk financing after loss patterns appear; it does not deter entry, detect intruders, or protect donor assets and staff property still on site. Friendly daytime reception staff do not constitute after-hours access control when the lobby remains open without credentials or monitoring. Cameras alone do not replace access policy or key and badge management because detection without entry control still permits loss and may only record it after the fact. Layered precautions—written after-hours policy, credentials, monitoring, and response contacts—fit premises with demonstrated exposure in civic and nonprofit settings. Insurance is transfer or financing, not a substitute for reasonable physical and administrative security controls expected in corporate risk practice. Exam caveat: history of theft is a leading reason to upgrade precautions, not merely to revisit deductibles. Operational check: implement after-hours badge or key control, add monitoring coverage for the lobby, document visitor and contractor entry rules, assign a security owner, review theft trends after upgrades, and ensure incident response contacts are posted for staff locking the building.