Management review at a freight forwarder
Eastbridge Freight Forwarding has an ISO 28000 certificate covering its head office and two cross-dock facilities. The security management committee meets quarterly; minutes from the last four meetings show the same six standing agenda items: guard headcount, CCTV uptime, vehicle dwell time, customer complaints, training completion and budget. The risk assessment was last updated 26 months ago. Since then Eastbridge has started moving pharmaceuticals on a new route through a region with a documented increase in cargo theft; the route represents 18% of revenue. A corrective action from an internal audit in January-an unlocked server room door-is still open in September; the action owner left the company in May. The management review in July noted 'security performance stable' and 'no additional resources required,' but did not review the new route, the open action or changes in customer security requirements. The security manager says the committee is 'operational, not strategic.'
1. Evaluate the effectiveness of management review. What specific evidence would you use to support a nonconformity, and which requirement is most directly engaged?
Read the worked answer
The review exists but is not effective. Management review must be a strategic input-output process: it should consider changes in context and risk, security performance, status of previous actions, resource needs and opportunities for improvement. The minutes show only standing operational metrics, no review of the new pharmaceutical route (18% of revenue), no review of the 26-month-old risk assessment, and no status of the open server-room action. The July conclusion 'no additional resources required' was made without those inputs.
The most direct requirement is management review (clause 9.3), supported by risk assessment and planning (6.1) and corrective action (10.2). Evidence: four sets of minutes, risk assessment version and date, route approval and customer contracts, action tracker, and interviews with committee members. A nonconformity is supported because the review did not perform its intended function, not merely because a meeting was held.
2. The security manager claims the committee reviews 'operational metrics' and that strategic risk is handled by the commercial team. How would you test that claim, and what would change your conclusion?
Read the worked answer
I would test the claim by asking the commercial team for the security risk assessment of the new route, the customer security requirements, and any decision record showing that security risk was considered and transferred into the SMS. I would check whether the committee received that information, even if only as a briefing note.
If the commercial team did assess the route and the SMS has evidence that the assessment was used to update controls, my conclusion might change to a minor documentation or communication issue rather than a management review failure. But the claim alone is not evidence. The 26-month-old risk assessment and the absence of any route review in the SMS records point to a gap. I would also check whether the open action was reassigned after the owner left; if not, the corrective action process is ineffective.
3. What corrective action would you expect for the open server-room finding, and how would you verify closure?
Read the worked answer
For the server-room door, the correction is to lock the door and restore access control. Corrective action must address why it was unlocked: who had access, whether contractors were escorted, whether the door alarm was monitored, whether staff knew the requirement, and whether similar secure areas have the same weakness. Since the owner left, the action should be reassigned with a due date and evidence of handover.
I would expect a root-cause analysis, revised access procedure, training or communication, and a check of other sensitive areas. To verify closure I would review the action record, interview the new owner, sample access logs and door alarm tests, and check whether the daily security check now includes the door. One locked door is not sufficient evidence of effectiveness; I would look for sustained records over at least a month.