Zero Incidents Reported: When the Metrics and the Audits Stop Telling the Truth
Aurelia Distribution operates four distribution centres and employs 1,100 people. Its SeMS dashboard tracks two metrics: recorded security incidents and lost-time hours arising from security events. Recorded incidents fell from 41 in 2023 to 9 in 2024 and to zero in the last two quarters - a result the security manager presents as 'the system working'. In January the reporting app was changed so that an incident is only logged once the shift manager has approved the submission. Internal audits are performed three times a year by the quality manager, who also owns the security programme; the checklist is the ISO 9001 checklist with a 'security' line added, and the two sites audited in 2024 were chosen because they were the easiest to reach. The management review in January signed off the SeMS as 'effective, no issues' eleven days before the first internal audit of the year; the minutes record no decisions, no actions, and no review of risk changes or interested-party feedback.
1. Evaluate Aurelia's monitoring and measurement approach. What does the incident trend actually tell you, and what should be measured instead?
Read the worked answer
The trend is ambiguous, and the reporting change makes it more likely to be an artefact than an improvement. Introducing a shift-manager approval gate before an incident can be logged creates a filter at exactly the point where operational pressure is highest; suppression needs no conspiracy, only inconvenience and a manager who would rather not have the conversation. A fall from 41 to zero in six quarters is possible, but in a 1,100-person, four-site operation it should prompt an investigation, not a celebration.
The deeper design fault is that both metrics are lagging outcomes. Measuring only incidents tells you what has already gone wrong and nothing about whether controls are working. Useful leading indicators for this business include: percentage of carriers approved against security criteria before first load; seal discrepancies per 1,000 shipments; access-control exception counts and resolution time; percentage of high-value loads tracked with deviation alerts actioned; near-miss reports per 100 staff (a rising figure is usually a good sign); training and drill completion; overdue supplier re-assessments.
Monitoring also requires defined methods, timing, responsibility and the analysis and evaluation of results - not just a dashboard. Practical steps: remove the approval gate and separate data validation from decisions to act; publish near misses and incidents without blame; build a small basket of leading and outcome indicators with targets and trend analysis; and calibrate internal data against external sources such as insurer claims, customer claims and police reports. If external claims stay flat while internal reports fall to zero, the dashboard is measuring reporting behaviour, not security.
2. Assess the internal audit programme against ISO 28000 requirements, and explain how an auditor would interpret it.
Read the worked answer
Three requirements are compromised.
Impartiality and objectivity. The quality manager owns the security programme and audits it. That is self-review, and it fails the requirement for auditors to be objective and impartial in the audit process, whichever way the organisation chart is drawn. This is not a technicality: the audit exists precisely to test the owner's assumptions.
Audit criteria and competence. The checklist is a quality management checklist with a security line. Auditing against the wrong criteria will miss the security-specific requirements - risk assessment currency, carrier and outsourced process control, competence, incident response, monitoring design. The auditor also needs security competence, not just a quality background.
Risk-based programme. The programme must be planned with intervals set by the importance of the processes, changes affecting the organisation and previous audit results. Choosing the two sites that are easiest to reach is the inverse of risk-based; the two unaudited sites are, by definition, the ones the system knows least about.
An auditor would treat this as a failure of the whole evaluation layer, not a paperwork gap. The evidence is convergent: no audit coverage of half the estate, an audit performed before the management review that relied on it, and an audit function that cannot challenge the programme owner. Expect a nonconformity against internal audit, with the corrective action requiring independence (trained auditors from other functions, or an external competent body with no design role), documented criteria derived from ISO 28000 and the organisation's own requirements, and a schedule built from risk rather than convenience.
3. What is wrong with the January management review, and what inputs and outputs does ISO 28000 require?
Read the worked answer
The review is unusable as evidence of top management oversight on three counts: it was held before the year's audit results existed, so it could not consider them; it recorded 'no issues' without decisions, actions, owners or dates; and it evaluated effectiveness without the evidence base needed to do so.
The standard sets out the inputs the review must consider: the status of actions from previous reviews; changes in external and internal issues relevant to the SeMS; the security needs and expectations of interested parties, including complaints and feedback; the extent to which security objectives have been met; the performance of the system, including nonconformities, corrective actions, monitoring and measurement results and audit results; the adequacy of resources; the effectiveness of actions taken to address risks; and opportunities for improvement. The outputs must include decisions on improvement opportunities, any need for changes to the SeMS, and resource needs.
A January review covering a calendar year should follow the audits, not precede them. Practical rework: publish an annual cycle that sequences the internal audits and the risk reassessment before the review; use a standing agenda mapped one line to each required input, with the evidence attached; make the outcome a decision log with owners and due dates; and track those decisions into the next review so there is a visible trail of action and closure. The 'no issues' minute is worse than no minute at all, because it demonstrates that the review happened without doing its job - which is how a certification auditor will read it.