PECB ISO 18788 Lead Auditor key terms

A structured framework of policies, processes, and controls by which an organisation directs, delivers, and improves the security services it provides to clients, including governance, risk treatment, and performance evaluation.

The ongoing activities through which an organisation protects people, assets, information, and client interests, including planning, guarding, monitoring, incident response, and reporting performed under defined accountability.

The needs and expectations a customer or contracting party places on a security services provider, expressed as contractual, legal, or stated obligations that the management system must plan for and satisfy.

A person or organisation that can affect, be affected by, or perceive itself to be affected by a decision or activity, such as clients, personnel, regulators, communities, or shareholders.

The combination of internal and external issues, including legal, social, cultural, and market factors, that influences how an organisation designs and operates its security operations management system.

The documented boundaries of the management system, stating which activities, locations, services, and organisational units are covered by the security operations management system and which are excluded.

The likelihood and severity of adverse impacts on the rights of individuals arising from security activities, including use of force, detention, privacy intrusion, and discrimination, which must be identified and treated.

The application of physical or other coercive measures by security personnel, governed by principles of legality, necessity, proportionality, and accountability, and requiring clear rules, training, and reporting.

The ongoing process of identifying, preventing, mitigating, and accounting for how an organisation addresses actual and potential adverse impacts linked to its operations, including those involving contracted providers.

A document listing the applicable requirements or controls chosen by the organisation, with justification for inclusion or exclusion and a description of how each is implemented.

The process of identifying risks to the organisation and its stakeholders, analysing their likelihood and consequence, and evaluating whether they require treatment within the management system.

The selection and implementation of measures intended to modify risk, such as avoiding, reducing, transferring, or accepting it, together with the residual risk that remains after action.

The level of risk that remains after treatment measures have been applied, which must be evaluated against the organisation's risk acceptance criteria and monitored over time.

An activity needed by the management system that is performed by an external provider, for which the organisation retains responsibility and must apply controls and monitoring.

The process of selecting, assessing, and monitoring external providers of security personnel, equipment, or services against defined criteria, including legal compliance and human rights expectations.

A documented agreement defining the services to be delivered, performance measures, responsibilities, and remedies agreed between a security provider and its client.

The coordinated process for detecting, reporting, responding to, investigating, and learning from security incidents, including escalation, evidence handling, and communication with affected parties.

The demonstrated ability of personnel to apply knowledge and skills to perform assigned security tasks, established through education, training, experience, and verification of effectiveness.

A measurable value used to track how effectively the management system and its security services achieve intended results, supporting monitoring, analysis, and informed decision-making.

A planned top-management evaluation of the management system's suitability, adequacy, and effectiveness, using defined inputs and producing decisions on improvement, resources, and change.

A systematic, independent, and documented process for obtaining objective evidence and evaluating it against audit criteria to determine the extent of conformity.

The set of requirements, policies, procedures, or standards used as a reference against which audit evidence is compared, agreed with the client and communicated to the auditee.

Records, statements of fact, or other verifiable information relevant to the audit criteria that can be examined and confirmed, forming the basis for audit findings and conclusions.

The results of evaluating collected evidence against audit criteria, recorded as conformity, nonconformity, or opportunities for improvement, and communicated clearly to the auditee.

A failure to meet a requirement, whether of the standard, the organisation's own procedures, or applicable obligations, classified by significance and requiring documented correction and corrective action.

A nonconformity that significantly affects the capability of the management system to achieve intended results, or a systemic failure, typically requiring prompt correction before certification is granted.

An isolated or limited lapse that does not indicate a systemic failure of the management system, but which still requires correction and appropriate corrective action.

Action taken to eliminate the cause of a detected nonconformity or incident so that it does not recur, including analysis of root cause and verification of effectiveness.

The outcome of an audit after consideration of audit objectives and all findings, stating the overall level of conformity, effectiveness, and any recommendations for the auditee.

A set of one or more audits planned for a specific time frame and directed towards a common purpose, including arrangements, resources, and schedules for their conduct.

A description of the activities and arrangements for an individual audit, covering objectives, criteria, scope, schedule, roles, and the methods to be used.

The extent and boundaries of an audit, including the organisational units, locations, processes, and time period covered, agreed with the client and stated in the audit plan.

The purpose or intended outcome of an audit, such as determining conformity, evaluating effectiveness, or assessing suitability for certification, which drives planning and evidence collection.

The selection of less than the total population of available evidence for examination, using a defined rationale so that conclusions drawn are reasonably representative of the whole.

A formal meeting at the start of an audit to confirm the plan, scope, criteria, schedule, roles, communication arrangements, and confidentiality, and to address auditee questions.

A formal meeting at the end of an audit to present findings, conclusions, and recommendations, confirm agreement on facts, and explain follow-up and reporting arrangements.

A documented record of the audit that presents objectives, scope, criteria, findings, conclusions, and any agreed actions, distributed to identified recipients under defined confidentiality arrangements.

A subsequent audit activity to verify that corrections and corrective actions for previously reported nonconformities have been implemented and are effective.

The absence of bias or conflict of interest that could influence audit judgements, safeguarded by auditor selection, rotation, and separation of auditing from operational responsibility.