Stadium Stewarding and the Labor Broker
A security provider supplies 300 stewards for a 40,000-seat stadium event; 120 come from a labor broker. The contract requires crowd-management training and human-rights awareness for all staff. On event day, 30 broker staff arrive without accreditation; one steward uses a chokehold on a spectator during a pitch invasion; a lost child is left with a turnstile supervisor for 40 minutes. A video trends online. The provider's operations manager says, 'The broker employs them; the broker is responsible.' The provider has no supplier evaluation records, no pre-event joint drill, and records incidents in a WhatsApp group. The provider's own 180 staff were trained last year, but the broker's staff received a 20-minute briefing. The venue's safety plan requires all stewards to be accredited and briefed. The client is demanding a refund and a public apology.
1. Is the operations manager's position defensible under ISO 18788? Explain.
Read the worked answer
No. Outsourcing the employment relationship does not outsource the provider's responsibility for the security operations it supplies. ISO 18788 expects control over externally provided processes, products, and services, including supplier evaluation, contract requirements, competence, and monitoring. The provider put 120 broker staff in steward roles at a 40,000-seat event and had no supplier evaluation records, no joint drill, and only a 20-minute briefing.
The manager's statement also misreads accountability. The broker may be accountable to the provider, but the provider is accountable to the client, the venue, and the public for the stewards it deploys. The chokehold and the lost child are human-rights and safety incidents, not just contract breaches. The WhatsApp incident log is not a controlled record and would not support investigation or learning.
A defensible position would require evidence of supplier selection, verified training, accreditation checks, supervision, and incident reporting. On these facts, the provider cannot show that it controlled the outsourced work. Blaming the broker after the event is not a control.
2. What controls should have been in place before the event and what immediate corrective actions are needed?
Read the worked answer
Before the event, the provider should have evaluated and approved the broker, with contract clauses on training, accreditation, conduct, use of force, and replacement of unsuitable staff. It should have verified training records and run a joint briefing or drill with all 300 stewards. Accreditation should have been checked at the gate, with a no-badge-no-deployment rule. Supervision ratios and a child-protection procedure should have been agreed with the venue. Incident reporting should have used a controlled log, not WhatsApp.
Immediate actions: care for the spectator and the child, preserve video and records, notify the client and police as required, and remove the involved steward from duty pending investigation. The provider should cooperate with the venue's review, communicate factually with the public, and not issue a premature apology that admits facts not yet established. It should audit the broker immediately and suspend further deployments until controls are verified.
The judgment is to separate care and investigation from commercial damage control. A refund discussion can follow, but safety and evidence come first.
3. How should the provider use this event to drive continual improvement and what should be reported to top management?
Read the worked answer
The provider should treat the event as a nonconformity with root causes, not a one-off embarrassment. Root-cause analysis should examine supplier selection, contract terms, training verification, accreditation controls, supervision, incident reporting, and child protection. Corrective actions should include a supplier approval process, pre-event readiness checks, a joint drill requirement, a controlled incident system, and a use-of-force policy for stewards. Effectiveness should be checked at the next event.
Top management should receive a report covering the facts, the human-rights and safety impact, the suppliers involved, the immediate actions, the root causes, and the corrective-action plan with owners and dates. The report should also state whether other events use the same broker. Management review should consider whether the provider's growth model depends on unverified subcontracting.
Continual improvement means changing the system, not just apologizing. The provider should update its risk assessment for crowd events, monitor supplier performance, and communicate lessons learned to its own staff and brokers. If the same model is used again without change, the incident is likely to recur.