Eleven Findings, Three Weeks: Managing Stage 2 Readiness and Certification Scope
Kestrel Logistics has applied for ISO 28000 certification with an application scope of 'warehousing and distribution of consumer electronics'. The organisation has five sites: two owned warehouses, two leased warehouses operated under the Kestrel brand, and a returns-refurbishment facility staffed by 60 agency workers. Stage 1 was conducted on 14 November; Stage 2 is booked for 9-11 December. Stage 1 raised eleven findings, including: the security policy is signed by the Operations Director rather than the CEO; no internal audit has covered two of the five sites; management review has never considered security risk changes or audit results; the risk assessment has not been reviewed in eighteen months; and there is no evidence that the 40 agency workers at the returns site are aware of the security policy. The consultant supporting Kestrel proposes to 'close all eleven by writing the missing procedures, running a desktop audit of the two unaudited sites, and circulating the policy by email' before 9 December.
1. Advise Kestrel on whether these findings can be closed in three weeks as proposed. Separate findings that are documentation gaps from those requiring implementation evidence.
Read the worked answer
Very few of these are documentation gaps, and the proposed fixes misread what Stage 1 and Stage 2 each test. Stage 1 evaluates whether the management system is designed and whether the evidence exists to support a Stage 2; Stage 2 tests implementation and effectiveness. Writing procedures in December addresses the design question that Stage 1 has already answered in the negative, and creates no implementation evidence for Stage 2.
Take the findings individually. The policy signature is an authority question: if the Operations Director is a member of top management with a defined role in the SeMS, the signature may be defensible and the corrective action is to document the delegation and the evidence of top-management involvement. If not, the policy must be issued by top management, and an email will not change who signed it. Awareness of the agency workers cannot be closed by email circulation; awareness must be evidenced by briefings with attendance records, comprehension checks and observable behaviour on site, and agency workers are persons working under the organisation's control who must be covered. The risk assessment review requires an actual reassessment against current context, not a new date stamp. The internal audit gap requires audits performed by competent, impartial auditors examining site evidence; a desktop review by someone who has never looked at the site's records is not an internal audit of that site. The management review requires a meeting that actually considers the required inputs and produces decisions.
The realistic options are: postpone Stage 2 to a date that allows genuine implementation, or proceed and accept that major nonconformities will be raised. Kestrel should discuss this with the certification body rather than with the consultant alone; the decision to proceed to Stage 2 rests with the certification body on the basis of its Stage 1 conclusions.
2. How should the certification scope and the multi-site situation be handled, given the leased warehouses and the returns facility?
Read the worked answer
Two different problems are being conflated.
The leased warehouses operated under the Kestrel brand raise a control question. Multi-site sampling depends on the sites being under the organisation's central control, through a central function, with the same activities managed under the same system. If Kestrel does not have legal or organisational control over a partner-operated site, it cannot simply present it as one of its own sites; the activity must instead be controlled as an external provider process, with contractual security requirements, verification and performance review. Whether such a site is included in the certificate depends on the control arrangement and on the certification body's judgement, and the body will validate the scope itself.
The returns-refurbishment facility is a different case. It is staffed by agency workers but operated by Kestrel, and it is part of the handling of the customer's product. Excluding an activity the organisation actually performs, and which carries real security exposure (reverse logistics is a recognised loss route), makes the scope statement inaccurate and the certificate misleading. If it is performed, it belongs inside the scope and the workers must be covered by awareness, competence and access controls.
The remedy is a scope statement written in activity and boundary terms, with any exclusion explicitly justified and shown not to undermine the security of the activities covered. Kestrel should also check its customer and insurer contracts, which may require the returns activity to be covered, and should expect the certification body to adjust sampling to the validated scope.
3. What should Kestrel understand about the consultant's role, the certification process and the consequence of the different categories of nonconformity?
Read the worked answer
The consultant's proposal reveals a role confusion that can damage the certification. A certification body cannot consult, and a consultant who designed the system should not be the person who audits it internally, because the audit's value is independent challenge. The consultant can advise, draft, train and help prepare; the internal audit must be performed by someone with security competence and no stake in the design. If no internal resource is impartial, an external competent auditor may be engaged for the internal audit, but not the same person who built the system, and never the certification body.
Kestrel should also understand the audit sequence. Stage 1 is a readiness assessment: it checks that the management system is designed, that statutory and internal requirements are understood, and that there is enough evidence for Stage 2. Stage 2 tests implementation and effectiveness through sampling and interview, and its findings are graded. A major nonconformity - for example, a management system that has never been internally audited across part of the scope - normally means no certificate until corrective action is implemented and verified, often at a follow-up visit. Minor nonconformities can usually be closed through an accepted corrective action plan within a defined period, commonly up to 90 days.
The strategic point is that the December dates are a scheduling decision, not a security decision. Proceeding to Stage 2 with unimplemented corrective actions produces findings, cost and a weaker position at the next attempt; moving Stage 2 by a quarter, and using the time to perform the audits and reviews properly, is the cheaper route to a certificate that survives surveillance.