Application review when a security company wants to exclude armed operations

SOMS principles engaged A security operations management system is not a generic quality system with a security label. It requires the organisation to understand its context and interested parties, identify legal and human rights risks, control security operations, ensure competence and suitability of personnel, manage incidents and use of force, control subcontractors, and improve based on performance data. The managing director's view that human rights apply only to the military is incompatible with ISO 18788, which applies human rights due diligence to private security operations.

Armed operations Three armed contracts are still security operations. The proportion of revenue is irrelevant to the risk. Firearms, use of force, detention-like situations and the safety of mall customers and bystanders create significant human rights and life-safety risks. The client's control over the guards does not remove the provider's responsibility for the conduct of its personnel. Excluding armed operations would remove the highest-risk activity from the audit while the certificate implies that the organisation's security operations are controlled.

Can the exclusion be accepted? Generally no, if the armed contracts are part of the same legal entity and management system. A certification body could define a narrower scope only if the armed operations are genuinely separate, with separate management, personnel, procedures and risk controls, and if the exclusion is clearly stated and not misleading. Here, the same management directs the company, the same guards may rotate, and there is no documented use-of-force policy. The exclusion should be refused.

Subcontractors The 30 subcontractor guards are also within the scope of control. ISO 18788 requires control over externally provided processes. The absence of a screening process is a gap that must be addressed before certification.

Pre-Stage 1 requirements The client needs a documented SOMS, not a certificate application. Minimum requirements include:

• A scope statement covering all security services, including armed contracts and subcontractors.
• A context analysis and interested-party analysis, including clients, guards, mall customers, communities and regulators.
• A legal and other requirements register, including Philippine law and client contracts.
• A human rights risk assessment and due diligence process.
• A written use-of-force policy aligned with law and human rights principles, including necessity, proportionality, reporting and investigation.
• Competence and vetting requirements for guards and subcontractors.
• Incident management and investigation procedures.
• Internal audit and management review.
• Objectives and performance monitoring.

Risks to flag

• Certification within eight weeks is unrealistic given the gaps; a rushed audit would produce a certificate that is not credible.
• The UN tender is not a valid reason to compress the audit or exclude armed operations.
• The absence of a use-of-force policy is a significant risk that could lead to serious incidents and reputational damage.
• Subcontractor screening gaps may expose the client to human rights violations.

Certification body position The certification body should decline to proceed until the scope is corrected and the minimum system is in place. If the client refuses, the application should be rejected or deferred. Accepting it would compromise impartiality and the integrity of the certificate.

Different risk focus A quality management system focuses on meeting customer requirements and enhancing satisfaction. A SOMS focuses on security operations and their potential impact on people: use of force, human rights, detention, weapons, subcontractor conduct, incident response and continuity. Customer satisfaction matters, but it is not the primary risk driver.

Interested parties A SOMS must consider affected communities, guards, clients, regulators and potentially vulnerable people. The managing director's belief that human rights are only a military concern shows a context analysis that has not been done. A quality system might never require that analysis.

Operational control A SOMS requires documented use-of-force rules, competence and vetting, incident investigation, and control over subcontractors. A quality system may control service delivery, but it does not normally address whether a guard should discharge a firearm or how an allegation of excessive force is investigated.

Performance evaluation A SOMS monitors incident trends, complaints, use-of-force reviews, legal compliance and human rights indicators. A quality system monitors customer satisfaction, process performance and product conformity. Some metrics overlap, but the SOMS metrics are risk and harm oriented.

Implication for the audit An auditor cannot treat ISO 18788 as a documentation exercise. The absence of a human rights risk assessment and a use-of-force policy is not a paperwork gap; it goes to the purpose of the management system. That is why the exclusion request and the eight-week timetable are incompatible with a credible certification audit.