IFPO CPO common mistakes
IFPO CPO · Understand the traps and how to avoid them.
When asked how to train a new guard on a post, the candidate lists tasks the guard must perform (patrol hourly, log visitors) instead of describing how the training is delivered and confirmed - task demonstration, supervised practice, and sign-off on competence.
Candidates conflate a post order (what the job is) with instruction (how someone is taught to do it). CPO content separates the two, and writing the task list feels like a complete answer because it is detailed and true.
What to do instead
Before writing, ask 'am I describing the job or the teaching of the job?' Structure training answers as four steps: state the objective, demonstrate, have the learner perform under observation, then assess and record. Name the assessment method explicitly (observed performance checklist, oral questioning, written test).
The candidate answers a mentoring scenario by prescribing discipline - a warning, a report, removal from post - for a guard who is capable but demoralised or newly promoted and struggling, skipping coaching, feedback, and a development plan.
Discipline is the most familiar supervisory tool and the easiest to write about. Exam scenarios often describe performance gaps caused by confidence or skill, where the expected answer is supportive intervention first.
What to do instead
Read the scenario for signals of capability and intent. If the person can do the job but is not doing it, or is new to the role, answer with coaching: private feedback on specific behaviour, agreed goals, a follow-up date, and escalation only if improvement fails. Reserve discipline for wilful or repeated misconduct and say so.
Asked to design instruction for adult security staff, the candidate proposes a lecture-only session with a slide deck and a written test, with no practical exercise, discussion, or job-relevant scenario.
Candidates default to how they were taught at school rather than how adults in a operational role learn, and lecture is the fastest format to describe under time pressure.
What to do instead
Build every training answer around adult-learning principles: relevance to the learner's actual post, hands-on practice, problem-solving scenarios, and immediate feedback. Include at least one practical element and one check of understanding beyond a written test, and state how the session is evaluated afterwards.
In a risk or asset-protection question, the candidate jumps straight to recommending guards, cameras, or barriers without first identifying the asset, its value, the credible threats, and the likelihood and impact of each.
Controls are concrete and easy to name; the analytical steps feel like preamble. Candidates under time pressure skip to the visible answer, and the question often rewards the process more than the hardware.
What to do instead
Use a fixed sequence in every such answer: asset identification and criticality, threat and vulnerability assessment, risk rating, then layered controls (deter, detect, delay, respond), then review. Even in a short answer, name the asset and the threat before naming the control.
The candidate treats physical, personnel, and information security as separate silos - for example, answering a perimeter-breach scenario with fence height and lighting only, ignoring vetting, access authorisation, visitor control, and incident reporting.
Exam questions are often tagged to one topic, so candidates answer only within that topic. Real protection is layered, and scenario questions typically expect controls across more than one layer.
What to do instead
For any protection scenario, run through the layers deliberately: physical (barriers, lighting, locks), procedural (access control, visitor management, key control), personnel (vetting, training, awareness), and information (need-to-know, records). State which layer each recommended control belongs to.
The candidate describes an emergency response in the wrong order - for example, evacuating or confronting before raising the alarm and notifying, or omitting the post-incident steps of preservation of scene, reporting, and debrief.
Candidates remember the dramatic middle of a response (evacuate, restrain, fight) and forget the bookends. Written answers list actions as they come to mind rather than in a defensible sequence.
What to do instead
Memorise a generic response cycle - recognise, alert and notify, contain or evacuate as the plan directs, preserve life first, then secure the scene, record, report, and debrief. Apply the cycle to the specific scenario and state the priority you are applying (life safety before property).
When asked about supervising a shift, the candidate describes doing the guards' work - personally checking every door, taking over the patrol - rather than describing how they set standards, allocate tasks, monitor performance, and correct deviations.
Candidates with operational backgrounds identify supervision with being useful on the ground, and 'I would check the doors myself' reads as diligent rather than as a failure to delegate and control.
What to do instead
Frame supervision answers around the control cycle: plan and brief, allocate and deploy, observe and verify (through records, spot checks, and reports), correct and coach, then review. Personal checks can appear as one verification method, not as the whole answer.
The candidate answers a leadership scenario by describing what they would tell people or how they would feel, without naming the management tool - a briefing, a written post order, a performance appraisal, a rota, a budget line, a training record.
Leadership is often written about in abstract terms of communication and motivation, which feels like a complete answer but gives the marker nothing concrete to credit.
What to do instead
For each leadership answer, name at least one concrete instrument and its purpose. 'I would improve communication' becomes 'I would introduce a documented shift briefing with a standard agenda and a signed attendance sheet, reviewed monthly'. Keep the human element but anchor it to a mechanism.
The candidate designs or evaluates a security programme without stating how success will be measured - no key performance indicators, no audit or inspection schedule, no review cycle, and no link back to the original risk assessment.
Candidates focus on activity (patrols, systems, staff) rather than outcomes. Measurement feels like an optional extra at the end of an answer, and under exam time limits it is the first thing dropped.
What to do instead
End every programme-management answer with a measurement paragraph: two or three indicators (incident rates, response times, training completion, audit findings closed), the frequency of review, who receives the report, and how findings feed back into the risk assessment. Even one sentence of this earns credit that is otherwise lost.
The candidate answers a scenario question in general theory - reciting definitions of risk, leadership, or access control - without applying them to the named organisation, site, or role in the question.
Memorised definitions feel safe and are quick to reproduce. Candidates fear that committing to specifics will be marked wrong, so they stay abstract, which is precisely what scenario questions penalise.
What to do instead
Use the definition as a single opening sentence, then spend the body of the answer on the scenario's specifics: name the site, the asset, the role, and the constraint. If the scenario is silent on a detail, state an explicit assumption and answer on that basis rather than retreating into generalities.