Continual improvement of an SeMS based on ISO 28000
What the exam tests
Continual improvement covers ISO 28000 clause 10: improvement and nonconformity/corrective action. The exam tests whether you can distinguish correction from corrective action and whether improvement is driven by data, incidents and risk changes.
Core rules and concepts
- When a nonconformity occurs, contain it, correct it, assess its impact and decide whether action is needed to eliminate the cause.
- Root cause analysis should go beyond the individual. Ask why the control failed, why it was not detected and why the management system allowed it.
- Corrective action must address the cause, assign an owner and date, and be verified for effectiveness. Closing a ticket is not evidence of effectiveness.
- Update risks, controls, procedures, training and supplier requirements when changes or incidents reveal gaps.
- Use improvement opportunities from trends, audits, near misses, exercises, technology and stakeholder feedback, not only from failures.
- Maintain an improvement register or action log with status, priority and verification.
Worked example
Repeated seal tampering is reported at one carrier. Correction: suspend the carrier and re-seal the load. Root cause: seal numbers were recorded after departure and no one reconciled them on arrival. Corrective action: reconcile seal numbers at loading and receipt, add a system edit check, and audit 20 shipments per week for eight weeks. Effectiveness is verified when reconciliation reaches 100% and tampering reports fall. The reasoning links cause, action and evidence.
Traps that cost marks
Calling a correction a corrective action; writing human error as the root cause; closing actions without effectiveness checks; treating continual improvement as incident response only; and failing to update the risk assessment after a change.