PECB ISO 18788 Lead Auditor common mistakes
PECB ISO 18788 Lead Auditor · Understand the traps and how to avoid them.
Treating ISO 18788 as a generic ISO management system and answering questions about 'security operations' with ISO 27001 or ISO 9001 language, for example describing SOMS scope purely in terms of information assets or product quality rather than the organisation's security operations for clients and personnel.
Candidates often come from information security or quality auditing backgrounds and default to the framework they know. ISO 18788 is a management system for security operations, built on the ISO management system structure but anchored in private security operations and human rights due diligence, so generic answers miss the operational context.
What to do instead
Before the exam, build a one-page map of the SOMS context: what 'security operations' covers (personnel, contracts, guarding, risk assessment, client obligations), the human rights due diligence thread, and the legal/regulatory and voluntary commitments (Montreux Document, International Code of Conduct). Practise restating each clause in security-operations terms rather than IT or quality terms.
Confusing the roles of the auditee's security operations management with the auditor's job, and answering process questions by describing what the auditor should do rather than what the organisation's SOMS should contain. For example, when asked about management review inputs, listing audit findings instead of the SOMS inputs required by the standard.
The exam mixes SOMS content questions with audit-process questions, and candidates under time pressure blur the two. They also over-learn audit mechanics and under-learn the standard's requirements, so they reach for the audit answer by default.
What to do instead
Read each question stem and label it mentally as 'SOMS requirement' or 'audit activity' before answering. Make a two-column table of the standard's clauses and the audit tasks that test them, and drill the SOMS column until requirement content is as fluent as audit procedure.
Treating the security risk assessment as a one-off document produced at certification rather than an ongoing process, and failing to link risk assessment outputs to operational controls, objectives, and performance monitoring. Answers describe a risk register but not how it drives control selection and review.
Candidates memorise 'risk-based thinking' as a slogan and can recite the clause, but the exam tests whether they understand the feedback loop between risk assessment, operational planning, objectives, and monitoring. Shallow recall produces a document-centric answer.
What to do instead
Trace the loop explicitly in study notes: context and interested parties feed risk assessment; risk assessment feeds operational planning and controls; controls feed monitoring and measurement; monitoring feeds management review and risk reassessment. Practise explaining one realistic security-operations scenario through all five stages.
Describing audit evidence as whatever documents the auditee provides, and treating document review as sufficient evidence of conformity. Answers state that records 'prove' implementation without checking whether the records reflect actual practice.
Document-heavy preparation encourages a paperwork mindset, and candidates confuse 'the procedure exists' with 'the process is effective'. The audit principles of evidence-based approach and sampling are understood abstractly but not applied.
What to do instead
For each requirement, ask what evidence would show implementation and effectiveness, not just existence. Practise writing evidence statements that name the source, the sample, and the observation, and practise identifying when a document alone is insufficient and a follow-up interview or observation is needed.
Mixing up the audit principles and the audit programme or audit plan, for example describing 'independence' as a scheduling rule or 'risk-based approach' as a clause of the standard rather than an auditing principle. Answers blend principles, programme management, and audit conduct into one paragraph.
The principles (integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach) sound similar to programme and planning concepts, and candidates learn them as a list without separating their functions.
What to do instead
Memorise the principles as a short list with one concrete behaviour each, and keep a separate list of programme and plan elements. When a question asks about principles, answer only with principles and give the behaviour, not the scheduling or documentation mechanics.
Producing an audit plan that ignores the organisation's context and risk, for example allocating equal time to all clauses and not prioritising high-risk security operations such as armed guarding, use of force, or work in high-risk environments. The plan reads as a clause checklist.
Candidates default to clause-by-clause coverage because it feels complete, and they under-use the context information (scope, risk assessment, previous findings, legal obligations) that should drive sampling and time allocation.
What to do instead
Practise drafting plans from a one-paragraph scenario: identify the highest-risk processes, justify time allocation against risk, and state sampling rationale. Show explicitly how scope, previous audit results, and risk assessment shaped the plan, and include the audit criteria, objectives, and team roles.
Writing audit criteria that cite only ISO 18788 and omit the organisation's own commitments, contractual obligations, legal and regulatory requirements, and voluntary codes it has signed up to. Answers treat the standard as the sole benchmark.
Candidates focus on the standard they are being examined on and forget that audit criteria are defined by the client and include applicable requirements the organisation has committed to, which is central to security operations with human rights exposure.
What to do instead
Always state audit criteria as a set: ISO 18788, the organisation's policies and objectives, applicable legal and regulatory requirements, contractual and client requirements, and voluntary commitments such as the International Code of Conduct. Practise listing criteria for a scenario before writing any findings.
Classifying every nonconformity as major or minor without a defensible rule, and writing findings that state a conclusion ('the process is ineffective') without the objective evidence, the requirement, or the location. Findings lack the evidence-requirement link.
Candidates know findings need evidence but write them in a hurry, and they have no consistent test for severity, so they guess based on how serious the topic sounds rather than on whether the system can achieve its intended results.
What to do instead
Use a fixed finding structure: requirement reference, objective evidence, gap, and severity rationale. Apply a stated test for major versus minor, for example whether the nonconformity affects the capability of the management system to achieve intended results or represents a systemic breakdown versus an isolated lapse, and practise writing three findings from one scenario.
Handling the closing activities mechanically, for example accepting the auditee's corrective action plan at face value, not verifying root cause analysis, and closing findings without checking effectiveness. Answers describe the closing meeting as a formality.
Candidates concentrate on conducting the audit and treat follow-up as administrative. They also confuse correction with corrective action and do not distinguish verification of implementation from verification of effectiveness.
What to do instead
Study the corrective action cycle separately: containment or correction, root cause analysis, corrective action, implementation, and effectiveness verification with a defined timeframe. Practise writing follow-up questions that test whether the root cause was addressed and how effectiveness would be evidenced.
Treating the audit programme as a single audit plan, and answering programme questions with scheduling details for one audit. Answers omit programme-level elements such as objectives, risk-based scheduling, competence of auditors, monitoring and review of the programme, and reporting to top management.
The words 'programme' and 'plan' are easily conflated, and candidates prepare for the conduct of a single audit rather than the management of a series of audits over time. They also underweight auditor competence and impartiality as programme controls.
What to do instead
Keep a clear distinction: the programme is the set of arrangements for one or more audits over a period, with objectives, risks, resources, competence, and review; the plan covers one audit. Practise describing how a programme is established, monitored, reviewed, and improved, and how auditor competence and impartiality are maintained across it.