My evidence is mainly from an infosec perspective: you aren't going to get your front desk to report suspicious activity if they have no incentive, or if they feel like they are fobbed off every time they try to report a potential issue. Every report of a problem, no matter how big or small, should at least be taken seriously enough to record the report and investigate its credibility - otherwise you'll set up a culture of issues going unreported because they get poo-pooed when they are reported. I'll see if I can find the talk where this concept was first put in such plain words to me, but I believe it was a Defcon talk called "Steal Everything, Kill Everyone, Cause Total Financial Ruin".