Security Operations Management System (SOMS)
What this domain tests
Domain 2 covers the management system itself: the clause architecture, what must be documented, and how conformity is demonstrated through internal audit, management review and certification.
Skeleton of the standard
- Clause 4 Context - internal and external issues, interested parties, scope of the SOMS.
- Clause 5 Leadership - top-management commitment, policy, roles and authorities.
- Clause 6 Planning - risks and opportunities, security and human rights risk assessment, legal and other requirements, objectives.
- Clause 7 Support - resources, competence, awareness, communication, documented information.
- Clause 8 Operation - operational planning and control, incident management, use of force, detention and handover of persons, supply-chain due diligence.
- Clause 9 Performance evaluation - monitoring and measurement, internal audit, management review.
- Clause 10 Improvement - nonconformity, corrective action, continual improvement.
Rules worth memorising
- The policy must suit the organization's purpose, commit to human rights, the rule of law and continual improvement, be documented, communicated, and available to interested parties.
- Objectives must be measurable, monitored and traceable to the risk assessments.
- Documented information must be controlled: available where needed, protected, version-managed.
- The audit programme is planned by risk and covers SOMS processes, not only guarding sites; management review uses audit results, incidents, grievances and performance data as inputs.
Worked example
A 60-guard firm fails its Stage 1 audit. Findings: the policy is signed by the operations manager rather than top management; objectives read "improve quality"; internal audit covered only guarding sites; management review minutes list no inputs. The fixes follow directly - policy approved at top level, objectives made measurable and time-bound, audit programme extended to support and planning processes, review agenda built from the standard's stated inputs. Reason: the auditor tests whether the system functions as a system, not whether individual guards perform well.
Traps that cost marks
- A good policy that top management never approved or communicated.
- Objectives with no baseline, target or measurement method.
- Management review run as a site meeting instead of a strategic review with defined inputs.
- Forgetting certification is a three-year cycle with surveillance audits.