Leadership vacuum at Helios Pharma
Helios Pharma has 800 staff across research and distribution. The new security manager reports to the facilities manager, not to an executive. The security policy was approved by the facilities director, not the CEO, and says only that Helios will comply with all laws; it makes no link to identified security risks. The security objective is to reduce incidents by 20%, set by the security team, with no owner, no deadline and no definition of incident. Line managers say security is the security department's job. A contractor recently walked into cold-chain storage with an expired badge and nobody challenged him. Top management has not discussed security in management review for 18 months. The CEO speaks positively about security but has not signed the policy or approved the badge-system upgrade budget.
1. Assess Helios against the leadership requirements of Clause 5. What evidence would an auditor expect, and what is missing?
Read the worked answer
Clause 5 requires top management to demonstrate leadership and commitment, not just express support. The auditor would expect top management to ensure the security policy and objectives are compatible with strategic direction, to integrate security requirements into business processes, to provide resources, to communicate the importance of the SeMS, and to assign responsibilities and authorities. The policy should be appropriate to the organization's purpose and include commitments to satisfy requirements and improve continually.
The facts show gaps. Policy approval by the facilities director could be acceptable if authority was properly delegated, but there is no evidence of top management accountability. The policy is not linked to risks and is generic. The objective lacks an owner, deadline and metric, so it cannot be planned or monitored. The badge-system budget has not been approved, which undermines the claim that resources are provided. The near-miss shows that staff and contractors do not challenge access, which is a culture and communication issue that leadership must address. Eighteen months without security in management review is strong evidence that security is not integrated into business decisions.
An auditor would look for minutes, decisions, resource approvals, policy communication and role assignments, not just a signed page.
2. Advise Helios on how to improve the security policy and the security objective so they meet Clause 5 and support planning.
Read the worked answer
The policy should be short, specific and signed at the right level. It should state the organization's security purpose, the commitment to satisfy applicable requirements, the commitment to continual improvement, and the expectation that all staff and contractors report concerns. It should refer to the risk-based nature of the SeMS without turning into a procedure. The CEO should sign it, or there should be documented delegated authority and visible executive sponsorship.
The objective reduce incidents by 20% should be rebuilt. First, define incident: what counts, who records it, and at what severity. Second, establish a baseline from at least six to twelve months of data. Third, assign an owner, for example the distribution director for warehouse access incidents and the security manager for the SeMS. Fourth, set a deadline and a measurement method. Fifth, add leading indicators such as percentage of contractors with valid badges, access exceptions closed within 24 hours, and challenge rates in drills. A single lagging target can be met by under-reporting, so leading indicators matter.
The policy and objectives should be communicated to employees and contractors and reviewed in management review. That turns leadership commitment into something auditable.
3. Which roles, responsibilities and authorities should be assigned, and how should they be documented and communicated?
Read the worked answer
Top management remains accountable for the SeMS. The security manager should have authority to coordinate the system, stop unsafe access, maintain the risk assessment and report performance. Line managers should be responsible for security controls in their areas, including challenging unknown persons, enforcing badge rules and ensuring contractor supervision. HR should own pre-employment and agency worker vetting, competence records and disciplinary interfaces. Procurement should own supplier security requirements and contract clauses. Facilities should own physical controls such as locks, CCTV and access systems. All staff and contractors should be responsible for reporting incidents and suspicious behaviour.
These assignments should appear in role profiles, job descriptions and contractor agreements, not only in a security manual. Communication should be practical: shift briefings, intranet, induction and visible management announcements. The near-miss with the expired badge shows that the authority to challenge is unclear. Helios should explicitly state that any employee may challenge an unescorted person and that no one will be penalized for doing so. Responsibilities should be reviewed in management review and tested through drills and audits.