Ninety-Day Certification Plan for a Cash-in-Transit Provider
A 500-employee cash-in-transit and guarding company wants ISO 18788 certification within 90 days. Top management proposes a scope covering 'head office administration and static guarding' and excluding cash-in-transit because it is 'the highest-risk activity and we want a quick win'. The internal audit found 14 nonconformities: no management review in 14 months, two branches never audited, 18 guard licenses expired, risk assessments not updated after a route robbery in which a driver was injured, and corrective actions closed without evidence. The consultant's plan is a 12-page gap analysis and a document rewrite. The operations director says, 'Certification is a sales tool; the auditors won't check the armored cars if they are out of scope.'
1. Evaluate the proposed scope. What does ISO 18788 require and what are the risks?
Read the worked answer
The scope must be documented and must reflect the organization's context, interested parties, legal requirements, and the security operations it actually performs. A scope can be limited, but it must not be drawn to avoid the organization's highest-risk activities while implying that the SOMS covers the business. Here, cash-in-transit is not a side activity; it is central to the company's security operations and to its legal and human-rights risk.
The operations director's reason, 'the auditors won't check the armored cars', is a warning sign. If the scope excludes cash-in-transit, the certification may be technically limited but commercially misleading. Customers, insurers, and regulators may assume coverage that does not exist. ISO 18788 also expects top management to be accountable for the system, not for a certificate that avoids the main risk.
A defensible scope statement would define the sites, services, and boundaries precisely and explain exclusions. But excluding the highest-risk service weakens the risk-based logic of the SOMS. The judgment is whether the exclusion is a genuine business boundary or an avoidance tactic. On these facts, it looks like avoidance.
2. Prioritize the 90-day actions and explain why 'document rewrite' is insufficient.
Read the worked answer
Priority should go to the items that create immediate legal and operational exposure: the 18 expired guard licenses, the route-robbery risk assessment, and corrective actions closed without evidence. In parallel, top management should schedule a management review and require an internal audit plan that covers the two unaudited branches. These are not paperwork tasks; they produce evidence that the system is operating.
A document rewrite is insufficient because ISO 18788 is a management system, not a document set. Auditors look for implementation: risk assessments used to set controls, competent guards, incidents investigated, corrective actions verified, and management reviewing performance. Rewriting procedures without training, operation, and evidence creates a gap between documents and practice.
The 90-day plan should sequence leadership commitment, legal compliance, risk assessment, operational control, internal audit, corrective action, and management review. If the organization cannot produce evidence in 90 days, it should extend the timeline rather than fake readiness. The consultant's 12-page gap analysis may be useful, but it cannot substitute for top management's decisions.
3. What should top management do about the operations director's statement that certification is a sales tool?
Read the worked answer
Top management should challenge the statement directly. Certification may support sales, but the SOMS exists to protect people, assets, and the organization's license to operate. Treating certification as a sales tool encourages scope manipulation and document-only implementation. ISO 18788 expects top management to demonstrate leadership and accountability, including for the scope and for the integrity of claims made to customers.
Top management should require a clear scope decision, documented rationale, and a communication plan that does not overstate coverage. If cash-in-transit is excluded, customer-facing statements should say so. If it is included, the 90-day plan must address its risks. The operations director should be given a role in the risk assessment and corrective actions, not just in sales.
This is a judgment call about integrity. A certificate obtained by narrowing scope while implying full coverage can damage trust and create legal exposure. Top management's response is itself evidence of whether the organization has the leadership commitment the standard requires.