Ten Weeks to Transition With a 2007 Audit Checklist
A certification body schedules a transition audit for a warehouse operator in 10 weeks. The operator has three sites and 220 staff, and a tender closes two weeks after the audit. The internal audit team, trained on the 2007 edition, has completed an audit using a checklist of clauses 4.1–4.8. The report has no findings on 6.1 risk treatment, 6.2 objectives, 7.5 documented information or 9.1 monitoring. Last month's management review minutes cover only incidents, audit findings and corrective actions. The quality manager says the internal audit is sufficient because 'the processes are the same'. Top management wants the transition audit to be a 'paper exercise' because the certificate is needed for the tender.
1. Identify the gaps in the internal audit and management review relative to ISO 28000:2022, and explain why the 2007 checklist is not sufficient.
Read the worked answer
The internal audit is not sufficient because it was scoped to the 2007 clause structure. Clause 9.2 requires audits of the 2022 requirements, and auditors must be competent for the new content. The checklist misses context and interested parties (4.1 and 4.2), security risk treatment (6.1.3), security objectives and planning (6.2), documented information (7.5), monitoring and measurement (9.1), and the changed leadership and policy requirements. The management review is also incomplete. Clause 9.3 requires inputs on the status of previous actions, changes in external and internal issues, changes in interested-party needs, security performance trends, risk assessment results, audit results, resource adequacy and improvement opportunities. The minutes cover only incidents, audits and corrective actions, and there is no evidence of decisions or actions on changes to the SMS. Saying 'the processes are the same' ignores the new evidence requirements.
2. Outline a 10-week transition plan to close the gaps before the certification audit.
Read the worked answer
Weeks 1–2: complete a clause-by-clause gap assessment against ISO 28000:2022 and assign owners. Weeks 3–4: update the context and interested-party analysis, risk assessment and risk treatment plan, and security objectives with plans. Weeks 5–6: revise documented information, train staff and brief top management on leadership and policy evidence. Week 7: conduct a supplementary internal audit covering the missed clauses, using competent auditors. Week 8: hold a management review with the full 9.3 inputs and record decisions and actions. Week 9: close corrective actions and verify evidence. Week 10: pre-audit readiness review and logistics. The tender deadline makes prioritization important, but evidence cannot be fabricated; the plan should focus on real gaps and owners.
3. What risks arise from treating the transition as a paper exercise, and what should you tell top management?
Read the worked answer
Treating the transition as paperwork creates certification risk and business risk. The certification body may raise major nonconformities, suspend or withdraw the certificate, which would undermine the tender rather than support it. There is also false assurance: an SMS that looks compliant but does not control warehouse security, risk treatment or performance monitoring can fail customers, insurers and regulators. Top management should be told that clause 5.1 requires leadership and integration of security into business processes, not just document updates. Resources, management review time and internal audit competence are required. The credible route is a short, risk-based transition plan with real evidence, clear owners and a management review that records decisions. The tender depends on a defensible certificate, not a paper exercise.