Proportionality at a Freight Forwarder Facing a Client Ultimatum

Copying the bank's manual is not proportionate. ISO 37301's principle of proportionality requires the CMS to be designed around the organization's context, size, complexity, risk profile and compliance obligations, not around another sector's control set. A retail bank manual will be dominated by prudential, consumer-credit and financial-crime controls that do not map to a 640-person freight forwarder. The immediate effect would be a large document that staff cannot use, while the real exposures - customs misclassification, sanctions screening and agent commissions - remain under-controlled. Proportionality does not mean minimal paperwork; it means the intensity of controls and documentation is justified by risk. The compliance manager should use the bank manual only as a source of ideas, then perform a risk-based gap analysis and design controls for the high-exposure processes first. The decision and its rationale should be documented because auditors and the client will ask why certain controls were omitted. The CEO's deadline is an interested-party requirement, but it does not override the need for a risk-based design.

First, confirm the CMS scope and context (Clauses 4.1 and 4.3): list the five offices, the customs and transport activities, the client contract and the regulators involved. This prevents the manual from becoming an untargeted group-wide document. Second, run a compliance risk assessment (Clause 6.1) across the three high-exposure areas, scoring likelihood, impact and existing control effectiveness with process owners. That produces the evidence for prioritisation and for what can be deferred. Third, set a short compliance policy and measurable objectives (Clauses 5.2 and 6.2) that commit to customs accuracy, sanctions screening and anti-bribery controls. Supporting actions should follow: competence and training for the 40% of customs agents without classification training (Clause 7.2), written procedures for the two offices without them (Clause 7.5), and operational controls such as second-line review of declarations and agent due diligence (Clause 8.1). The sequence matters: scope and risk first, then policy and controls, then training and documentation. Issuing a manual before this work reverses the logic of the standard.

The compliance manager should not simply refuse or comply. Refusal without an alternative will be treated as obstruction; compliance would embed a document that cannot be maintained. A better response is to present the CEO with a one-page risk-ranked plan and a phased manual. By quarter-end, issue a short policy, a sanctions screening procedure, a customs classification procedure and an anti-bribery rule for agent commissions, each with an owner and effective date. Defer low-risk payroll and facilities content and say so explicitly. Record the board's decision on residual risk and the client deadline. This demonstrates leadership commitment (Clause 5.1) and planning of changes (Clause 6.3) while keeping documentation proportionate (Clause 7.5). The compliance manager should also ask the client whether a credible implementation plan and gap analysis can satisfy the contractual intent; a certificate obtained by copying documents would create integrity and transparency risks. The aim is a defensible CMS, not a fast document set.