Scope creep, maritime exclusion and audit-day pressure before Stage 1

Scope is a boundary, not a marketing statement The certification scope must describe the activities, services and sites covered, and it must not be misleading. ISO 18788 certification applies to the organisation's security operations management system within that defined scope. A division of the same legal entity is not automatically outside the scope simply because it is commercially inconvenient.

Maritime division Embarked maritime guards are security operations. They involve firearms, use of force, detention, human rights risk, client vessels and possibly international law. If the maritime division shares top management, HR, procurement, risk assessment, incident reporting or internal audit with the rest of the company, excluding it would leave a significant part of the management system unaudited while the certificate implies control. That is normally unacceptable. The certification body could offer a separate certification for a genuinely separate legal entity with its own management system, or include maritime in the scope. The applicant's 'separate business line' argument is not a valid exclusion.

Training academy If the academy trains the company's own guards, it is a support function and should be included as part of the SOMS. If it delivers training to external clients, it may be a separate service, but the interfaces - competence, vetting, use-of-force training - still need audit coverage. Excluding it as 'education' mischaracterises the competence requirements of ISO 18788.

Police investigation An investigation does not prevent certification, but it affects access, confidentiality and evidence. The auditor should not investigate the criminal allegation; the audit should test the organisation's incident management, legal compliance and client communication. The investigation should be recorded as a context factor and a possible limitation.

Conclusion Accept the application only with a scope that includes maritime and the academy, or require a restructured application with clear legal and operational boundaries. A certificate limited to unarmed static guarding would not cover the applicant's actual security operations and would risk misleading interested parties.

Sampling logic The sample must be risk-based, not a convenient list. The population includes headquarters, eight static sites, two mobile patrol contracts, the maritime division, three vessels, and the training academy. A defensible Stage 2 sample would include:

• Headquarters: top management, risk assessment, legal register, incident management, internal audit, management review.
• At least three static sites, including the site under police investigation and at least one night shift.
• Mobile patrol: observe a handover and a night patrol, not only a day briefing.
• Maritime: Mombasa office plus at least one vessel or a simulated embarked operation if access to a vessel is not possible.
• Training academy: training records, use-of-force instruction, vetting of trainees.

Audit days Ten days for 1,850 employees, four divisions and maritime operations is not credible. ISO 18788 has no single mandated duration table, but the certification body must apply a risk-based calculation. A realistic Stage 2 estimate is 14–20 days, plus Stage 1, depending on travel, language and vessel access. The audit should cover shift work, including nights and weekends, because that is when control failures often appear.

Competence The team needs a lead auditor with SOMS experience, a maritime specialist, a human rights or legal specialist, and a local auditor or interpreter. The general security auditors can cover static guarding, but they cannot substitute for maritime and human rights competence. The team must understand Kenyan law, client contracts, ICoC expectations and the use-of-force rules applicable at sea.

Communication Provide the audit plan with sites, shifts, dates, team roles and access requirements. Explain that the sample is indicative, not exhaustive, and that the certification body may change it if risks emerge.

Documentation request Before Stage 1, require the context analysis, scope statement, organogram, legal and other requirements, risk assessment and risk treatment, security objectives, use-of-force policy, incident register and investigation reports, client contracts and site list, shift patterns, subcontractor list, training and vetting records, internal audit reports, management review minutes, and previous certification or audit reports. For maritime, require vessel access arrangements, flag-state and port-state requirements, embarked guard procedures and insurance evidence.

Communication Send a documented audit plan and access protocol. Confirm confidentiality, safety arrangements, personal protective equipment, vessel access, and the names of interviewees. Explain that the audit will sample records and may interview client representatives only with the auditee's agreement. Clarify that the audit is not an investigation of the police case.

Police investigation Treat it as a context and risk factor. Request the organisation's incident report, client communication, disciplinary or corrective action, and legal advice, while respecting the criminal process. Do not ask for privileged material or interfere with witnesses. If access to the site or records is restricted, record the limitation and consider whether the audit can still reach a reliable conclusion. If the investigation suggests a systemic failure in use of force or client handling, expand the sample to comparable sites.

Decision point If the applicant refuses to include maritime and the academy, or refuses access to the investigation-related records, the certification body should decline or defer the application. Certification cannot be based on an incomplete scope or on evidence the auditor cannot verify.