Logistics Risk Register Misses the Supply Chain
Harbourline Logistics operates 180 road vehicles from six depots and holds an ISO 28000:2007 certificate. Its security risk register lists 60 assets - trailers, fuel tanks and IT servers - each scored by depot managers on a five-point likelihood × impact matrix. A transition consultant proposes keeping this register as the security risk assessment for ISO 28000:2022. A pharmaceutical customer now requires temperature-controlled trailers and verified driver identity. A recent hijacking attempt at Depot 4 involved a subcontractor driver. The register does not mention subcontractors, driver identity or the pharmaceutical contract. The operations director says 'risk is risk - the scores are the same' and wants no additional assessment. The certification body has scheduled a transition audit in four months.
1. Does the asset-based register satisfy the 2022 security risk assessment requirements in 6.1.2? Identify the gaps and explain why an auditor would or would not accept it.
Read the worked answer
It only partly satisfies 6.1.2. An asset inventory scored on likelihood × impact can be an input to risk analysis, but 6.1.2 requires a process, not just a list. The organization must consider its context and interested parties, establish risk criteria, identify security risk sources and events, analyse consequences and likelihood, evaluate risks, and retain documented information. The register omits threats and vulnerabilities, process and supply-chain views, the pharmaceutical customer's requirements, and the subcontractor incident at Depot 4. The scores may also be stale and not comparable across depots. An auditor would likely raise a nonconformity because there is no evidence of a methodology covering the supply chain and interested parties, and no evidence that the register has been reviewed against the new context.
2. How should Harbourline treat the subcontractor and the pharmaceutical contract in the risk treatment plan under 6.1.3? Give examples of treatment options and plan content.
Read the worked answer
Clause 6.1.3 requires treatment options and a security risk treatment plan. For subcontractors, options include avoiding the activity, reducing risk through vetting, identity checks, contractual security clauses, driver training, vehicle tracking and route controls, transferring residual financial risk through insurance, or accepting risk with a documented justification. For the pharmaceutical contract, the consequence is higher because of product integrity, patient safety and contractual penalties. Controls could include verified driver identity, sealed trailers, temperature monitoring, chain-of-custody records, secure parking and incident reporting. The plan should state what will be done, what resources are needed, who is responsible, the completion date, how effectiveness will be evaluated, and the resulting residual risk. The Depot 4 incident should trigger an urgent review rather than being left out of the register.
3. Evaluate the operations director's 'risk is risk - the scores are the same' argument.
Read the worked answer
The argument is flawed. The same asset score can hide different consequences, vulnerabilities and legal or contractual requirements. A temperature-controlled pharmaceutical load has different consequences from a trailer of low-value goods, and a subcontractor driver changes the threat exposure and the effectiveness of existing controls. Clause 6.1.2 requires evaluation against criteria that reflect the organization's context and interested-party requirements, not just a generic likelihood × impact score. Retaining the register without revision would also fail to reflect the new customer contract and the near-miss at Depot 4. The correct response is to update the risk assessment, document the criteria and treatment decisions, and show that the transition is risk-based rather than a paperwork exercise.