Evaluation of the performance of an SeMS based on ISO 28000
What the exam tests
Evaluation covers ISO 28000 clause 9: monitoring, measurement, analysis and evaluation; internal audit; and management review. The exam tests whether you can show the SeMS is performing and whether its results feed decisions.
Core rules and concepts
- Define what to monitor, the method, frequency, responsibility and criteria for success. Lagging indicators such as theft losses need leading indicators such as seal-check compliance, access-review completion and supplier assessment rates.
- Analyse trends, not just individual events. Compare results with objectives, risk appetite and previous periods.
- Run an internal audit programme that is risk-based and covers the full SeMS over time. Auditors should be competent and independent of the activity being audited.
- Audit against ISO 28000 requirements and the organization’s own arrangements. Sampling should follow risk, not convenience.
- Hold management reviews with required inputs and outputs: status of actions, changes, performance, incidents, nonconformities, audit results, resource needs and improvement decisions.
- Record decisions, owners and dates; follow up before the next review.
Worked example
A logistics company sets a KPI of seal-check compliance at 98%. Monthly sampling shows 91% in one depot because night-shift staff skip the second check. Internal audit finds no supervisor review of logs. Management review decides to change the shift handover, add a daily exception report and retrain supervisors. The following quarter reaches 97%. The reasoning: measurement identified a gap, audit found the control weakness, and review allocated action.
Traps that cost marks
Monitoring without criteria; treating an inspection as an internal audit; auditing only documents; holding a management review that is a presentation with no decisions; and closing actions without verifying effectiveness.