PECB ISO 18788 Lead Auditor cheat sheet

ISO 18788 applies to organizations that conduct or contract security operations; it is a management system standard, not a guard-force tactics manual.

Core logic is Plan-Do-Check-Act applied to security operations: establish policy and objectives, implement controls, monitor and measure, then improve.

The standard is built on the ISO High-Level Structure (identical clause numbering to ISO 9001 and ISO 14001), enabling integrated management systems.

Risk-based thinking: security risk assessment determines which controls are necessary; the standard does not prescribe a fixed control catalogue.

Human rights conformance is a defining feature: operations must respect applicable human rights law and the organization's human rights commitments.

Accountability runs to top management, who must demonstrate leadership, set policy, and ensure resources for the SOMS.

Applicability is scalable: a small single-site firm and a multinational contractor apply the same clauses with proportionate documentation.

Legal and other requirements include national law, licensing regimes, contractual obligations, and voluntary commitments the organization adopts.

Context of the organization (internal and external issues, interested parties) is the starting point that shapes scope and risk criteria.

Clause 4: determine external and internal issues, interested parties and their requirements, then define SOMS scope and processes.

Clause 5: top management establishes policy, assigns roles and authorities, and integrates SOMS requirements into business processes.

Clause 6: risk and opportunity actions; security risk assessment methodology must be defined, applied, and documented.

Clause 7: resources, competence, awareness, communication, and documented information needed to support the SOMS.

Clause 8: operational planning and control, including change control and control of outsourced security providers.

Clause 9: monitoring, measurement, analysis, internal audit, and management review as the performance-evaluation block.

Clause 10: nonconformity and corrective action, plus continual improvement of the SOMS and security performance.

Documented information must be controlled for availability and protection; retention periods derive from legal, contractual, and risk needs.

Incident management is a core operational element: reporting, investigation, escalation, and lessons learned feed corrective action.

Audit: systematic, independent, documented process for obtaining objective evidence and evaluating it against audit criteria.

Audit criteria are the set of requirements used as reference (ISO 18788 clauses, legal requirements, internal procedures, contractual terms).

Audit evidence consists of records, statements, observations, and other verifiable information relevant to the criteria.

Findings are classified by evaluation: conformity, nonconformity (major or minor), observation or opportunity for improvement.

Major nonconformity: system failure or absence of a required element that undermines the SOMS; minor: isolated lapse not affecting the system.

Independence: auditors must not audit their own work; impartiality is a continuing obligation, with threats identified and managed.

Evidence-based approach: findings must rest on verifiable evidence, not opinion; sampling risk is acknowledged in every audit.

Risk-based auditing allocates audit time and depth according to the significance of processes and identified risks.

Audit types: first-party (internal), second-party (supplier/contractor), third-party (certification); each has different objectives and independence.

Define audit objectives, scope, and criteria before planning; scope states sites, activities, and period covered.

Perform document review of the security policy, risk assessment, legal register, incident records, and prior audit results.

Audit plan assigns dates, durations, auditees, and clause/process coverage; it must be communicated and agreed with the auditee.

Sampling plan: select sites, shifts, contracts, and records to cover risk-significant activities, including night operations.

Prepare working documents: checklists, audit trails, and forms for recording evidence and nonconformities.

Competence check: the team needs SOMS knowledge, sector knowledge, and legal/human rights awareness for the audit scope.

Review the previous audit's nonconformities and corrective actions to plan follow-up verification.

Confirm logistics and access: security clearances, site safety inductions, and confidentiality arrangements for sensitive records.

Opening meeting confirms scope, criteria, schedule, communication channels, and confidentiality; attendance is recorded.

Use interviews, observation of operations, and document/record examination; triangulate evidence across at least two sources.

Interview a cross-section: top management, security managers, supervisors, and operational personnel including contracted staff.

Observe actual practice against procedure; a gap between documented procedure and observed practice is itself evidence.

Record evidence precisely: who, what, where, when, and which requirement; vague notes cannot support a finding.

Classify findings against criteria, and confirm factual accuracy of each nonconformity with the auditee before closing the audit.

Track audit time and adjust coverage if a process proves more risk-significant than planned, documenting the change.

Daily team meetings consolidate findings, prevent duplication, and check coverage against the audit plan.

Closing meeting presents findings and conclusions; the auditee may dispute facts but the lead auditor decides the finding.

Closing meeting content: audit conclusions, nonconformities, conformity status, and any recommendations; no new findings introduced.

Audit report includes objectives, scope, criteria, team, dates, findings, and a clear conclusion on conformity.

Nonconformity reports state the requirement, the evidence, and the gap; they do not prescribe the corrective action.

Corrective action is the auditee's responsibility; the auditor verifies implementation and effectiveness within an agreed timeframe.

Report distribution and retention follow the audit programme rules and confidentiality commitments.

Follow-up: verify correction and root-cause action; unresolved major nonconformities affect certification or contract decisions.

Audit completion occurs when all planned activities are done and the report is issued, not when corrective actions close.

Record lessons learned and auditor performance feedback to feed the next audit cycle.

An audit programme is the set of audits planned for a defined period, designed to meet a specific objective.

Programme manager establishes extent, frequency, methods, and responsibilities, considering risk, results, and change.

Audit frequency is risk-based: higher-risk operations, poor prior results, or significant change justify more frequent audits.

Programme resources include auditor competence, time, and impartiality; competence must be evaluated and maintained.

Monitor and review the programme: track completion, finding trends, and whether objectives were met, then adjust.

Records of the programme include plans, reports, findings, and auditor competence evidence, retained per procedure.

Impartiality risk at programme level: avoid over-reliance on one auditor and rotate assignments where threats exist.

Integration with other management system audits is permitted where criteria and objectives align, provided coverage is complete.