The Many Challenges of Protecting 25 Million Customers Every Day
When you serve 25 million people every single day, security isn’t just a department. It’s a cornerstone of the entire operation. In the latest episode of Conversations with CAP, Walter Palmer of CAP Index sat down with Rob Holm, the head of Security and Asset Protection for McDonald’s USA, for a wide-ranging discussion on what it really takes to protect the world’s largest quick-service restaurant brand.
Rob brings 43 years of corporate security experience across six Fortune 300 companies to his role, including time at Honeywell, 3M, Tribune Company (which owned the Chicago Cubs), Navistar, and two separate stints at McDonald’s. He’s been back at McDonald’s since July 2011 and has built a geographically dispersed team of 10 direct reports that reflects his deep commitment to diversity in background, thought, and experience.
The Scale Challenge
One key aspect of the conversation is how Rob frames the sheer complexity of McDonald’s. Taco Bell, Burger King, Dunkin’, and Wendy’s combined don’t match McDonald’s US volume. With 14,000 franchisee-operated restaurants and roughly 2,000 independent owner-operators (each averaging more than 10 locations and nearly 1,000 employees), the security mandate is unlike almost anything else in the retail or food-service world.
Bridging the Corporate–Franchise Gap
One of Rob’s proudest achievements is developing the Restaurant Risk Assessment Management Program (R2AMP) in collaboration with CAP Index. This first of it’s kind holistic risk model is tailored specifically for the quick-service restaurant environment. After proving its value in company-owned restaurants starting in 2015, Rob navigated the complex legal landscape of the franchisor-franchisee relationship to extend the program to independent operators as FR2AMP (Franchise R2AMP).
The key insight: customers don’t know or care whether a restaurant is corporate-owned or franchise-operated. The brand experience, and the safety of employees and guests, must be consistent. Today, the program is available at no cost to operators.
Industry Advocacy: Competitors Become Colleagues
Rob is also a passionate advocate for the broader quick-service restaurant security industry through his involvement with RLPSA (Restaurant Loss Prevention and Security Association), where he is a former board president, and through the National Retail Federation (NRF) Protect group, where he sits on the Loss Prevention Advisory Council. His perspective is simple: when industry professionals walk through the doors of an RLPSA or NRF conference, they leave their competitive hats at the door and share best practices, war stories, and solutions.
He’ll be speaking at NRF Protect in Dallas in June, joining panelists from Teneo, Louis Vuitton, and Signet Jewelers to discuss crisis response and crisis management in today’s complex geopolitical environment.
Advice for the Next Generation
The conversation closed with Rob’s advice for young professionals entering the security field. His top recommendations: invest heavily in networking and mentorship early (and be an active, engaged mentee — not just a passive recipient), and become a skilled storyteller. The ability to connect security investments to business outcomes and communicate their value to executives and budget holders is, in his view, the single most important skill that separates good security professionals from great ones.
Key Takeaways
- Scale demands structure. Serving 25 million customers daily means the probability of encountering any given risk isn’t theoretical…it’s near-certain. McDonald’s security model is built around that reality.
- The brand is only as safe as the least-prepared franchisee. Rob’s work extending R2AMP to independent operators reflects the understanding that safety and brand equity are inseparable, regardless of who signs the lease.
- Legal hurdles can be overcome with the right story. By framing security guidance to franchisees through the lens of property ownership (McDonald’s owns most of the real estate), Rob made the case that supporting operators isn’t joint employment, it’s responsible ownership.
- Industry collaboration is a competitive advantage. Sharing best practices across the QSR industry, even with direct competitors, raises the floor for everyone and gives smaller operators access to expertise they wouldn’t have access to on their own.
- Be a business professional first. The security professionals who advance are those who can speak the language of the business, connect risk to revenue, and earn the trust of executive stakeholders, not just those with the deepest technical expertise.
Summary
Rob Holm’s insights demonstrate that effective security is built on consistency, collaboration, and a strong connection to business goals. From supporting thousands of franchise operators to sharing best practices across the industry, his work reflects a commitment to protecting both people and brand reputation. His career is a reminder that the most impactful security leaders are those who can translate risk management into business value.
To hear Rob Holm’s full perspective and career insights, listen to the complete episode of Conversations with CAP.
Don’t miss this episode of Conversations with CAP!
Walter Palmer sits down with Scott Glenn, Vice President of Asset Protection for The Home Depot. Scott discusses how he collaborated with CAP Index to build an AP strategy that reduces risk and strengthens ROI.
It’s worth a listen…check it out here!
Recent Posts
Why Prioritizing Branches by Risk is the Smartest Security Strategy
From Catastrophe Models to Operational Intelligence
