Sixty-Eight Per Cent Subcontracted: Operational Control After a Cargo Theft

The organisation has outsourced the activity but not the accountability. Where a process within the SeMS scope is performed by an external provider, the organisation must retain control over it: define the criteria for the process, apply controls proportionate to the risk, and verify that the provider performs as required. Meridian outsourced linehaul and then delegated the risk along with it.

The specific failures map directly to the incident: carrier selection on price only (no risk-based approval), no contractual security requirements, no driver verification, no seal issuance or recording control, no route or rest-stop planning for high-value loads, no tracking or arrival confirmation, no exception management, and no route for a carrier to report an incident.

Controls to establish, risk-tiered so that low-value lanes are not overburdened:

• Carrier approval: a pre-qualification questionnaire covering insurance, driver vetting practices and secure parking; approval status recorded and reviewed.
• Contracts: security schedule with seal and trailer-integrity rules, no-unscheduled-stop requirements, incident notification within a defined window, audit rights, and consequences.
• Loading control: seal numbers recorded on the consignment and evidenced (photo or gate record), matched at destination.
• In-transit: tracking on high-value lanes, geofenced deviation alerts, defined secure parking list, driver check-in.
• Exception management: automatic escalation when arrival is overdue by a defined margin - the two-day blind spot is a control design failure, not bad luck.
• Performance review: security incidents, near misses and seal discrepancies reviewed alongside on-time delivery.

On-time delivery alone cannot evidence security performance; it did not detect a theft at all.

The organisation must determine the competence necessary for work affecting security performance, ensure people are competent, take action where they are not, and retain evidence. The starting point is not a training course; it is an analysis of what each role actually does within the control set. If a coordinator's duties include carrier vetting, seal control, exception escalation or incident investigation, those tasks define the required knowledge and skill.

A defensible sequence: define role profiles with the specific competencies (carrier assessment, cargo integrity and seal management, incident investigation and evidence preservation, sanctions screening awareness, knowledge of the relevant legal requirements); assess current holders against the profiles; close gaps through training, coaching or reassignment where the gap cannot be closed; and retain records - training completion, assessment results, experience, licences. Awareness is a separate requirement: all staff and persons working under the organisation's control must be aware of the policy, their contribution and the implications of non-compliance.

Regarding drivers: the drivers are not Meridian's personnel, so competence management does not apply to them directly. The correct mechanism is the external provider requirement - contractual driver-vetting standards, verification that the provider applies them (records sampled, not just asserted), and consequences for non-compliance. Trying to train every owner-operator driver would be unmanageable and would not discharge the obligation, because the obligation is to control the outsourced process, not to employ the people performing it.

It is a reaction, not a corrective action. The standard requires responding to the nonconformity and evaluating the need to eliminate its cause so that it does not recur or occur elsewhere, and that evaluation is where Meridian's proposal stops.

A conforming sequence would be:

1. Contain and react - notify the customer, insurer and, where applicable, the authorities; secure evidence; recover or write off the load.
2. Assess the scope of the problem - is this an isolated carrier or a pattern? Sample other high-value movements for missing seal records and late-arrival detection. In a spot-market model with 22 carriers, the answer is almost certainly a pattern.
3. Root cause - the warning letter blames a driver. The systemic causes are in Meridian's own design: price-only selection, no contractual requirements, no seal process, no overdue-arrival alert. Those causes sit inside the scope of the SeMS.
4. Action - implement the controls in the carrier-management process, not a one-page memo.
5. Update the risk assessment - the incident is evidence about likelihood and effectiveness of existing controls; the register must change.
6. Effectiveness review - define in advance how success will be measured (for example, seal records present on 100% of high-value loads and overdue alerts actioned within two hours, audited at 90 days).
7. Records - of the incident, the analysis, the actions and the review.

There is also a cultural point the auditor will test: if the only visible response to a EUR 340,000 loss is a warning letter to a supplier, staff will conclude that reporting problems attracts blame, and the reporting rate will fall.