Audit plan for a multi-site logistics certification audit
Global Forwarding Ltd. applies for ISO 28000 certification. The audit scope covers head office, a 24/7 bonded warehouse and a regional distribution center. The certification body plans a three-day audit with two auditors. The audit plan schedules head office on day 1, warehouse on day 2 from 09:00 to 16:00, and distribution center on day 3 from 10:00 to 15:00. No night-shift activity is scheduled, although 60% of warehouse dispatches occur between 22:00 and 06:00. One auditor has 12 years in manufacturing quality but no logistics security experience; the other is a security manager from a retail chain. The client asks that the audit team not interview unionized drivers because 'it may create unrest.' The team plans to conduct the distribution center audit remotely to save travel costs. Document review is scheduled for the morning of day 1.
1. Evaluate the audit plan. What changes would you require before accepting it?
Read the worked answer
The plan is not adequate for the scope. The warehouse is 24/7, and 60% of dispatches occur between 22:00 and 06:00; scheduling only 09:00-16:00 means the audit would miss the period of highest security activity, including guard handover, night access control and seal checks. I would require at least one evening or night sampling session, with the team working a shifted schedule.
The auditor competence mix is weak for logistics: manufacturing quality experience does not automatically cover cargo security, and a retail security manager may not understand bonded warehouse controls. I would add a team member with logistics or supply-chain security competence or adjust the assignment. Document review should be completed before day 1, not on the morning of the audit, so that the team can plan sampling. The remote distribution center audit should be justified by risk and access; physical perimeter controls may need onsite verification. The client's restriction on driver interviews also affects the plan.
2. How should the audit team respond to the client's request not to interview unionized drivers?
Read the worked answer
I would not accept a blanket ban on interviewing unionized drivers. Drivers are relevant personnel: they can evidence access control, seal integrity, escorting, reporting of incidents and driver vetting. The audit team needs access to those involved in the scope. I would explain the purpose, offer confidentiality and a private setting, and ask the client to facilitate a representative sample rather than a group interview that might create unrest.
If the client maintains the restriction, I would record it as an audit limitation, assess whether other evidence can provide sufficient confidence, and consider whether the limitation is so significant that the audit conclusion cannot be reached. I would escalate to the audit program manager and the client's top management. The client cannot unilaterally define the evidence; that would undermine the audit's impartiality and completeness.
3. What competence and evidence issues arise from the distribution center remote audit?
Read the worked answer
Remote auditing can be acceptable for some records and interviews, but it is weaker for physical security: perimeter fencing, lighting, gate layout, seal control, CCTV coverage and access turnstiles. For the distribution center, I would require a live video walk-through, screen sharing of access logs, and interviews with site security, plus a plan for onsite verification if anything looks inconsistent. I would document the ICT platform, connectivity, confidentiality and the fact that the sample was remote.
Competence is also an issue: the team needs someone who can judge distribution-center security, not just retail store security. If the remote audit cannot verify key controls, the team should either schedule an onsite visit or limit the scope of the conclusion. Saving travel costs is not a sufficient reason to accept an evidence gap.