Every year, a security risk assessment should be completed to identify high risks and that information should in turn be the focus of efforts to fix the gaps. Does the assessment include a review of policies and procedures, crime reports, local crime, as well as building security including lighting and landscape?