Scoping a freight network at NorthBridge
NorthBridge Freight has its headquarters in Rotterdam and 340 staff. It owns two warehouses in the Netherlands and Germany and leases a third warehouse in Antwerp operated by a partner, Ardent, with 45 Ardent staff. Twelve subcontractor hauliers perform last-mile transport, and IT is hosted by a cloud provider. A customer contract with a pharmaceutical shipper requires ISO 28000 certification covering all facilities handling its products, plus audit rights. The board wants certification in nine months. The draft scope says: provision of freight forwarding and warehousing services globally. It does not mention Ardent, the hauliers or the cloud provider. The security manager says Ardent refuses ISO audits and the hauliers are just transport. An €80,000 pilferage loss recently occurred at Ardent's site. An internal audit found no list of interested parties and no analysis of external issues.
1. Evaluate the draft scope against Clause 4. What decisions should NorthBridge make about Ardent, the hauliers and the cloud provider?
Read the worked answer
The draft scope is too vague and does not meet the intent of Clause 4. A scope must state boundaries and applicability, consider external and internal issues, and reflect interested party requirements. The word globally provides no boundary and cannot be audited. The scope should name the sites and activities covered.
The Ardent warehouse cannot simply be left out. It handles the pharmaceutical customer's products and the customer requires coverage of all facilities handling those products. NorthBridge must either include the outsourced activity within the scope and establish control or influence through contractual audit rights, security requirements, incident reporting and performance monitoring, or exclude it and justify the exclusion. Exclusion would likely breach the customer contract and leave an €80,000 loss site outside the system, which is not credible.
The hauliers are part of the transport process and should be covered as externally provided processes with defined security requirements, not dismissed as just transport. The cloud provider is a support process whose availability and access controls affect security; it needs contractual security requirements and monitoring. NorthBridge should document the scope decision, the justification, and the controls over outsourced processes.
2. Identify the relevant interested parties and explain how two of their requirements should shape the SeMS.
Read the worked answer
Relevant interested parties include the pharmaceutical customer, Ardent, the hauliers, the cloud provider, insurers, regulators, employees and agency staff. The customer requires certification covering all facilities handling its products and audit rights. This should shape the scope, the supplier control process and the evidence NorthBridge can produce during audits. If NorthBridge cannot demonstrate control at Ardent, the customer requirement is not met.
Insurers may require evidence of physical security, access control and incident reporting before providing cover. That requirement should shape operational controls and monitoring indicators, such as badge exceptions and tamper reports. Employees and agency staff need clear reporting channels because insider theft and pilferage often depend on someone speaking up.
Clause 4 requires NorthBridge to determine these requirements and monitor changes. A customer contract change, a new insurer condition or a regulatory update can alter the risk picture. The SeMS should include a process for identifying, accessing and reviewing interested party requirements, not a one-off list produced for the audit.
3. Recommend a defensible scope decision and explain the risks of the alternatives.
Read the worked answer
A defensible scope would cover the owned warehouses in the Netherlands and Germany, the Ardent warehouse as a controlled outsourced process, and the haulier and cloud activities as externally provided processes subject to security requirements. It should name the sites and activities rather than use global. The justification should reference the customer contract, the pilferage loss and the need for supply chain continuity.
If Ardent genuinely refuses audit rights, NorthBridge has two realistic alternatives. It can negotiate audit rights or agreed evidence before certification, or it can exclude Ardent and disclose that exclusion to the customer. The first preserves the customer relationship; the second risks losing the contract and leaves a known loss site outside the system. Including Ardent without any control would be worse because the scope would claim coverage that NorthBridge cannot substantiate.
Using the vague global scope is not defensible. It hides the Ardent problem and creates a certification risk. The scope decision should be documented with boundaries, applicability and justification, and reviewed when the Ardent contract or customer requirements change.