Outsourced Warehouse Falls Outside a Convenient Scope
Vale Circuits is a contract electronics manufacturer certified to ISO 28000:2007 for its main plant. It outsources printed circuit board assembly to two suppliers in another country and uses a third-party warehouse for finished goods. The warehouse handles 40% of finished goods, and the suppliers hold customer designs. The 2007 scope statement reads 'security management at the Main Plant'. The 2022 transition team proposes keeping that scope because 'the standard is about our own site'. A customer audit found no access controls at the third-party warehouse and no driver badge checks for one supplier. The operations manager says these are commercial contracts, not the SMS. Top management wants transition completed in six months with no increase in headcount.
1. Assess the proposed scope against 4.3. What factors must be considered, and can the outsourced warehouse be excluded?
Read the worked answer
The proposed scope is not automatically acceptable. Clause 4.3 requires the organization to determine the SMS scope considering 4.1 issues, 4.2 interested-party requirements, external and internal factors, interfaces, and the organization's activities, products and services. The scope must be documented and available. The warehouse handles 40% of finished goods, so excluding it would create a boundary that does not reflect how security performance is actually achieved. Exclusion might be defensible only if the warehouse has no effect on security performance and interface controls are demonstrated, which the customer audit contradicts. The design-holding suppliers also create intellectual-property and supply-chain risks. The scope should either include these activities or define them as externally provided processes controlled under 8.1, with clear responsibilities and interfaces.
2. Explain how 8.1 applies to the warehouse and suppliers, and what controls should be in place.
Read the worked answer
Clause 8.1 requires operational planning and control, including control of externally provided processes, products or services. The organization retains responsibility for conformity even when work is outsourced. Controls should be proportionate to risk and should include contractual security requirements, access control, badge and identity checks, personnel vetting, incident reporting, audit rights, performance monitoring and business-continuity arrangements. For suppliers holding customer designs, controls should cover confidentiality, access to design data, subcontractor flow-down and secure transmission. For the warehouse, controls should cover perimeter and entry control, segregation of goods, CCTV, visitor management and dispatch verification. The customer audit findings are evidence that the current controls are ineffective, so 8.1 and 10.2 both require action. Simply calling the warehouse a commercial contract does not remove the SMS responsibility.
3. Given the six-month and no-headcount constraints, outline a realistic transition approach.
Read the worked answer
A six-month transition is possible only if the scope decision and high-risk controls are addressed early. Weeks 1–4 should complete a gap assessment, document the scope and confirm whether the warehouse and suppliers are included or treated as external providers. Weeks 5–8 should update the risk assessment and treatment plan, prioritize the warehouse and design-holding suppliers, and assign existing procurement, security and operations staff as owners. Weeks 9–12 should revise documented information, train staff, and implement access, badge and contract controls. Weeks 13–16 should run an internal audit and management review. No headcount increase does not remove the resource requirement in 7.1; top management must allocate time and budget. Deferring the warehouse issue would undermine the transition.