Air Cargo Objectives Without Baselines or Owners
SkyFreight Cargo handles air cargo at a mid-sized airport and holds an ISO 28000:2007 certificate. Its current objectives are 'reduce pilferage by 15%' and 'complete 12 guard patrols per shift'. The 2022 transition team drafts new objectives: 'improve security culture', 'enhance cargo screening' and 'reduce insider threat'. None has a baseline, target date, owner or measurement method. The security manager says clause 6.2 only requires objectives, not metrics, and that the patrol count is a good KPI. The company has installed a new X-ray scanner and now screens 60% of outbound pallets with it, but 30% of operators have not been trained. A customer requires monthly performance reports.
1. Evaluate the draft objectives against 6.2 and rewrite two of them so they would satisfy the standard.
Read the worked answer
The drafts do not satisfy 6.2. Objectives must be established at relevant functions and levels, be consistent with the security policy, be measurable where practicable, be monitored, communicated and updated, and be supported by plans that state what will be done, what resources are required, who is responsible, when it will be completed and how results will be evaluated. 'Improve security culture' and 'reduce insider threat' are aspirations without a baseline or owner. A rewritten objective could be: 'Reduce substantiated insider-threat incidents in airside cargo handling from four in the previous year to no more than one by 31 December, owned by the Head of Cargo Security, with actions for background checks, access reviews and awareness, measured quarterly.' Another could be: 'Screen 95% of outbound pallets using trained operators by the end of Q3 and 100% by the end of Q4, owned by the Operations Manager, with a plan to train the remaining 30% and verify competence.'
2. Advise on monitoring and measurement under 9.1, including how to handle the untrained X-ray operators.
Read the worked answer
Clause 9.1 requires the organization to determine what needs monitoring and measurement, the methods, the criteria and indicators, when monitoring will occur, who will analyse and evaluate results, and how results will be reported. For X-ray screening, useful measures include training completion, competence assessment, image-interpretation audits, screening rate, reject rate, false-negative results from test images, equipment downtime and incident trends. The 30% untrained operators are a competence gap under 7.2 and a live risk. Until trained, they should not screen unsupervised, or the process should be restricted to trained staff. Training records and competence checks should be retained. The monthly customer report should use verified data and state the measurement criteria, not just activity counts.
3. Is the patrol count a good KPI? Justify your answer with reference to 9.1 and 6.2.
Read the worked answer
The patrol count is a process or compliance indicator, not a sufficient security KPI. It shows that patrols occurred but not whether access control, detection or response improved. Under 9.1, monitoring should be evaluated against criteria that reflect security performance, such as incident rates, alarm response times, access-control exceptions, screening results, near misses and audit findings. Under 6.2, objectives should be measurable and linked to planned actions, not just to activity volume. Patrol completion can remain as one indicator, but it should be combined with outcome measures and reviewed for relevance. Reporting only patrol counts to the customer would give a misleading picture of security performance.