Agency staff and contractors at Cedarline
Cedarline Distribution has 400 staff, of whom 60% are agency workers, with annual turnover of 45%. Security induction is a ten-minute video at agency onboarding, and there is no record of completion for agency workers. The twelve control-room operators have no competence matrix, and last month one operator did not know how to verify a badge alert. Cleaners are subcontractors with master keys and are vetted only by a name check. Contractor access uses a shared PIN that has not changed for two years. After a warehouse reconfiguration, CCTV blind spots appeared and emergency exits moved, but the security procedure still shows the old layout. A lone-worker check-in app was introduced, but supervisors do not review the alerts. There is no security communication plan.
1. Identify the main nonconformities against Clauses 7 and 8 and explain why each matters in this setting.
Read the worked answer
Clause 7.2 requires competence for persons whose work affects security performance. The control-room operators have no competence matrix and one failed a basic badge-alert check, so competence is not ensured. Clause 7.3 requires awareness of the policy, their contribution and the implications of not conforming. Agency workers receive a ten-minute video with no completion record, so awareness is not demonstrated. Clause 7.4 requires internal and external communication relevant to the SeMS; there is no communication plan. Clause 7.5 requires documented information to be controlled; the outdated layout procedure is a clear failure. Clause 8.1 requires operational planning and control; shared PINs, unvetted cleaners with master keys, unreviewed lone-worker alerts and changed CCTV coverage are controls that are not being managed.
These matter because the risks are practical. Shared PINs defeat accountability. Unvetted cleaners with master keys create an insider threat. Unreviewed lone-worker alerts mean the control exists only on paper. Outdated layouts create both security and safety gaps. High agency turnover magnifies the risk because awareness and competence must be repeated constantly.
2. Propose a risk-based 90-day plan to close the most serious gaps. What should be done first and why?
Read the worked answer
In the first two weeks, revoke the shared PIN and issue individual credentials or supervised access, and restrict or re-vet cleaners with master keys. These are immediate because they remove anonymous access and a high-consequence insider route. Update the layout procedure after a physical walk-through and brief control-room staff on the new CCTV and exit positions. Start recording induction completion for every agency worker.
In weeks three to six, build a competence matrix for control-room operators covering badge alerts, CCTV, access exceptions and escalation. Train and assess, with supervised shifts until competence is demonstrated. Add contractor security requirements to cleaning and agency contracts, including vetting and the right to audit. Assign a supervisor to review lone-worker alerts daily and record the review. Introduce a simple communication plan: shift briefings, a reporting channel and toolbox talks.
In weeks seven to twelve, sample the controls through an internal audit, review indicators such as percentage of vetted contractors, induction completion and badge exceptions, and take corrective action where the indicators show failure. The sequence is risk-based: remove anonymous access first, then build competence and awareness, then verify effectiveness.
3. How should Cedarline handle awareness for agency workers without delivering generic annual training?
Read the worked answer
Awareness should be role-specific and repeated at the frequency the risk requires. Warehouse agency workers need to understand tailgating, badge use, pilferage indicators, product handling and how to report concerns. Cleaners need key control, restricted areas, suspicious items and the limits of their access. Control-room staff need escalation and verification procedures. A generic annual video will not change behaviour in a 45% turnover population.
Cedarline should use short briefings at shift start, language-appropriate materials, and a signed or electronic record of completion. The message should include what the worker must do, why it matters to them and to the customer, and what happens if they do not comply. Supervisors should reinforce it during the shift. Agency contracts should require the agency to deliver basic security awareness and should allow Cedarline to verify records.
Awareness is not the same as competence. Awareness means understanding the policy and their contribution; competence means being able to perform a task. The control-room operators need assessed competence, while agency workers mainly need awareness and clear reporting routes.