ISO 28000 Lead Auditor — Lesson 2: Supply-Chain Risk, Security Objectives, Audit Planning, Sampling, and Evidence

Learning Objectives

• Assess the dependencies, responsibilities, and control choices involved in supply-Chain Risk, Security Objectives, Audit Planning, Sampling, and Evidence for a multinational logistics provider preparing for an independent ISO 28000 certification audit.
• Complete a guided exercise and preserve risk-based audit plan and evidence matrix as reproducible evidence.
• Challenge the result with sampling overlooks a high-risk cargo route, then document the smallest effective correction.

Detailed Topics

• Supply-Chain Risk
• Security Objectives
• Audit Planning
• Sampling
• Evidence
• Decision ownership, prerequisites, and acceptance evidence for supply-Chain Risk, Security Objectives, Audit Planning, Sampling, and Evidence
• Security, compliance, resilience, documentation, and support implications for supply-chain audit

Instructor Demonstration

The demonstration follows supply-Chain Risk, Security Objectives, Audit Planning, Sampling, and Evidence from preparation through validation for a multinational logistics provider preparing for an independent ISO 28000 certification audit. Learners review risk-based audit plan and evidence matrix and observe a safe diagnostic sequence for the case where sampling overlooks a high-risk cargo route.

Hands-On Exercise

Analyze and perform supply-Chain Risk, Security Objectives, Audit Planning, Sampling, and Evidence for a multinational logistics provider preparing for an independent ISO 28000 certification audit. Use risk-based audit plan and evidence matrix to compare intended and observed behavior, then resolve the condition where sampling overlooks a high-risk cargo route and verify downstream impact.

1. Confirm the requirement, stakeholders, environment, assumptions, inputs, and expected result.
2. Perform the supply-chain audit workflow and capture evidence before and after each material decision.
3. Test normal, boundary, failure, security, compliance, recovery, and operational conditions where relevant.
4. Document the root cause, correction, rollback, owner, support action, and next improvement priority.

Scenario Analysis

• Identify the business or assurance decision required within a multinational logistics provider preparing for an independent ISO 28000 certification audit.
• Compare control strength, evidence quality, operational impact, cost, resilience, and stakeholder trade-offs.
• Define escalation, communication, recovery, acceptance, and follow-up requirements for risk-based audit plan and evidence matrix.

Troubleshooting Guidance

Treat “sampling overlooks a high-risk cargo route” as a testable hypothesis. Reconstruct the expected workflow, compare it with risk-based audit plan and evidence matrix, isolate the control or evidence gap, and verify recovery without an unapproved production change.

Validation Checklist

• risk-based audit plan and evidence matrix identifies the approved baseline, accountable owner, inputs, and expected result.
• Evidence confirms supply-Chain Risk, Security Objectives, Audit Planning, Sampling, and Evidence under normal and relevant exception conditions.
• The response to “sampling overlooks a high-risk cargo route” is reversible, tested, and supported by before-and-after records.
• Residual supply-chain audit risk, support ownership, deadlines, and the next action are recorded.

Lesson Outcome

Learners can apply Supply-Chain Risk, Security Objectives, Audit Planning, Sampling, and Evidence, explain the choices made, and defend the result using risk-based audit plan and evidence matrix.