Scope boundary at a river port terminal
Northline Port Services is seeking ISO 28000 certification for 'security management of container handling and storage at Terminal 2.' The terminal handles 1.8 million TEU annually. About 40% of containers are trucked to an off-dock depot 12 km away for customs inspection and temporary storage before release. The depot is operated by a separate company under a services contract. The contract requires the depot to follow Northline's security plan, but gives Northline no right to audit and no requirement to report incidents. In the last six months the depot recorded two unauthorized entries into its yard and one lost container, none reported to Northline until the certification auditor asked. Northline's security risk assessment scores the depot as 'low' because it is 'outside the port perimeter.' The security manager says the scope excludes the depot because Northline does not own it. Top management wants certification before peak season.
1. As lead auditor, how should you evaluate whether the proposed scope is acceptable for certification? Identify the evidence you would examine and the decision you would reach if the evidence supports the setup.
Read the worked answer
Start from the scope requirement: the scope must be documented and must reflect the organization's activities, interfaces and dependencies, not simply the legal entities it owns. I would trace three containers from Terminal 2 to the off-dock depot, review the services contract, the depot's incident reports, the risk assessment, and the interface controls (handover records, seals, escort, reporting). I would interview the Northline contract manager and the depot supervisor.
If the depot performs a step that can affect container security and Northline has no audit right, no incident reporting requirement and no performance monitoring, the proposed scope is not credible: the certification would cover only part of the process that creates the risk. I would raise this with top management and require either an expanded scope with control evidence or a narrowed scope that genuinely excludes the depot, which is unlikely given that 40% of containers flow through it. If unresolved, I would not recommend certification for the stated scope.
2. The security manager argues that because the depot is a separate legal entity, ISO 28000 does not require Northline to control it. How do you respond, and what audit finding, if any, is supported?
Read the worked answer
Outsourcing does not transfer responsibility for conformity. ISO 28000 expects the organization to control processes that affect security, including outsourced ones, through contractual requirements, monitoring and review. The absence of an audit right is not by itself a nonconformity if alternative oversight exists, but here the contract lacks reporting, audit and performance requirements, and three incidents were not reported. That is a control gap.
The finding should be framed against operational control of outsourced processes and the risk assessment: the depot was scored low without evidence, and no reporting channel existed. I would classify it major if the gap is systemic and affects the ability to meet security objectives; the two unauthorized entries and the lost container show real risk. The corrective action would need contract amendment, incident reporting, monitoring and reassessment of the depot risk, not just a request for reports.
3. What sampling and interview approach would you use to test the interface between Terminal 2 and the depot, given only two audit days on site?
Read the worked answer
With two days, I would use a risk-based sample: select three high-value or high-risk container movements that passed through the depot and trace seal numbers, gate transactions, handover signatures and exception reports. I would review the last six months of depot incident reports and Northline's complaint log. I would interview the Northline contract manager, a gate supervisor and the depot security lead, ideally by phone or video if the depot is off-site, and observe one handover.
I would sample access records for contractors, not only employees. I would document the sample size and limitations. I would not rely on the security manager's statement that 'they follow our plan.' If the records cannot be produced, that is itself evidence of missing control, and I would escalate before the closing meeting.