I85PREP
⌘ K
PECB ISO 18788 Lead Auditor study materials
PECB ISO 18788 Lead Auditor study resources

PECB ISO 18788 Lead Auditor practice questions

One question at a time. Build your PECB ISO 18788 Lead Auditor understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a Security Operations Management System (SOMS)

In an ISO 18788 security operations management system, which statement best describes the primary purpose of the SOMS?

  1. To establish, implement, maintain and improve a framework for managing security operations and their risks Correct answer.
  2. To replace the organization's financial management system with a security reporting system
  3. To certify individual security guards against a national licensing standard
  4. To guarantee that no security incident can ever occur within the organization

Explanation

A management system standard provides a structured, repeatable framework of processes for governing security operations and the risks connected to them. It is a governance and improvement tool, not a guarantee of outcomes or a personnel certification scheme.

Question 2Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which concept describes the principle that security operations should be authorized by law and conducted with respect for human rights?

  1. Documented information
  2. Legitimacy and the rule of law Correct answer.
  3. Risk-based thinking
  4. Continual improvement

Explanation

ISO 18788 places legitimacy and respect for human rights at the centre of security operations, requiring that activities be lawful and consistent with human rights obligations. This principle distinguishes security operations management from purely commercial risk management.

Question 3Fundamental principles and concepts of a Security Operations Management System (SOMS)

What does the term 'context of the organization' refer to in an ISO 18788 SOMS?

  1. The set of contracts signed with external security service providers
  2. The physical layout of the organization's security control room
  3. The internal and external issues, interested parties and legal obligations that affect the security operations and its intended outcomes Correct answer.
  4. The organizational chart of the security department only

Explanation

Context covers the external and internal issues relevant to the organization's purpose, including interested parties and their requirements, which shape how security operations must be managed. It is broader than any single structural or contractual element.

Question 4Fundamental principles and concepts of a Security Operations Management System (SOMS)

In SOMS terminology, what is an 'interested party'?

  1. A supplier that has signed a fixed-price procurement agreement
  2. Only a shareholder holding voting rights in the organization
  3. A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity Correct answer.
  4. Only a government regulator with statutory inspection powers

Explanation

An interested party is any person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. This includes communities, clients, regulators, employees and others, not just one category.

Question 5Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which term describes the organization's enduring purpose and the direction it intends to pursue in managing security operations?

  1. Scope statement
  2. Strategic direction Correct answer.
  3. Operational plan
  4. Security policy

Explanation

Strategic direction expresses the organization's long-term purpose and orientation, and the security policy must be aligned with it. Scope defines boundaries, while operational plans address shorter-term execution.

Question 6Fundamental principles and concepts of a Security Operations Management System (SOMS)

What is the role of leadership in an ISO 18788 SOMS?

  1. Assign the security policy to the lowest operational level to ensure ownership
  2. Demonstrate leadership and commitment by taking accountability for the effectiveness of the SOMS Correct answer.
  3. Delegate all security decisions to the outsourced guarding contractor
  4. Limit involvement to approving the annual security budget

Explanation

Top management must demonstrate leadership and commitment and remains accountable for the effectiveness of the management system. Accountability cannot be outsourced to a contractor or delegated downward.

Question 7Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which statement best reflects the process approach in a security operations management system?

  1. Each department works independently to maximize its own local security metrics
  2. Activities are managed as interrelated processes whose inputs, outputs and interactions are understood and controlled Correct answer.
  3. Processes are documented once and then frozen to prevent change
  4. Security processes are managed only after an incident has occurred

Explanation

The process approach means understanding activities as interrelated processes with defined inputs, outputs and interactions so that results are consistent and predictable. It encourages integration and control rather than isolation or reactive management.

Question 8Fundamental principles and concepts of a Security Operations Management System (SOMS)

An organization identifies that a new law changes the reporting obligations for security incidents. Into which SOMS element does this most directly feed?

  1. The context of the organization and compliance obligations Correct answer.
  2. The internal audit schedule only
  3. The competence matrix for guards only
  4. The management review agenda only

Explanation

Legal and regulatory changes are external issues that form part of the organization's context and its compliance obligations, which then flow into requirements, planning and controls. Audits, competence and reviews are downstream activities that respond to such changes.

Question 9Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which of the following best illustrates the principle of 'risk-based thinking' in security operations?

  1. Waiting for a regulator to mandate controls before implementing them
  2. Applying identical controls to every site regardless of threat profile
  3. Applying controls in proportion to the likelihood and impact of identified security threats Correct answer.
  4. Documenting every possible threat without assessing which ones matter

Explanation

Risk-based thinking means prioritizing and sizing controls according to assessed likelihood and impact, so effort is proportionate to the actual risk. Uniform controls or unprioritized lists ignore differences in exposure.

Question 10Fundamental principles and concepts of a Security Operations Management System (SOMS)

What does 'continual improvement' require of an ISO 18788 SOMS?

  1. Reducing the scope of the SOMS whenever a nonconformity is found
  2. A one-time upgrade of security technology at the start of the program
  3. Replacing the entire security workforce every audit cycle
  4. Ongoing enhancement of security performance through the systematic use of policy, objectives, audit results, analysis and corrective actions Correct answer.

Explanation

Continual improvement is a recurring process that uses policy, objectives, audit results, data analysis, corrective actions and management review to enhance performance over time. It is not a single event or a way to avoid addressing problems.

Question 11Fundamental principles and concepts of a Security Operations Management System (SOMS)

In ISO 18788, what is the relationship between the SOMS and human rights risk?

  1. Human rights obligations apply only to government agencies, not private security providers
  2. Human rights are considered only if a client explicitly requests it in a contract
  3. Human rights risks are identified and addressed as part of the organization's security risk assessment and controls Correct answer.
  4. Human rights are outside the scope because the standard addresses only physical security

Explanation

Human rights considerations are integrated into the identification of risks and the selection of controls, reflecting the standard's emphasis on legitimacy and respect for human rights. They are not optional or limited to public bodies.

Question 12Fundamental principles and concepts of a Security Operations Management System (SOMS)

What is the purpose of defining the scope of the SOMS?

  1. To state the boundaries and applicability of the management system so that its coverage is clear Correct answer.
  2. To identify which auditors will conduct the certification audit
  3. To list every employee's job description
  4. To specify the price of security services to clients

Explanation

The scope establishes the boundaries and applicability of the management system, making clear which activities, sites and functions are covered. It is a governance statement, not a pricing, staffing or audit-assignment document.

Question 13Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which of the following is the best example of a 'documented information' requirement in a SOMS?

  1. Retaining records of security risk assessments and their reviews Correct answer.
  2. Verbally briefing guards without any record
  3. Relying on informal conversations to communicate the security policy
  4. Storing incident data only in employees' personal memory

Explanation

Documented information includes records and documents that the system needs to operate, such as risk assessment results and their reviews. Verbal or memorized communication does not provide the evidence and control the standard expects.

Question 14Fundamental principles and concepts of a Security Operations Management System (SOMS)

What does 'competence' mean in the context of a security operations management system?

  1. The willingness of an employee to work overtime
  2. The ability to apply knowledge and skills to achieve intended results Correct answer.
  3. The number of years an employee has worked for the organization
  4. The formal rank held within the security department

Explanation

Competence is the ability to apply knowledge and skills to achieve intended results, which is why the standard requires determining necessary competence and ensuring personnel are competent. Tenure, rank and willingness are not measures of competence.

Question 15Fundamental principles and concepts of a Security Operations Management System (SOMS)

A security manager wants to ensure that outsourced guarding services align with the SOMS. What does the standard require?

  1. Externally provided processes, products and services must be controlled, and the controls must be defined and applied Correct answer.
  2. Outsourced providers must be audited by the certification body on behalf of the organization
  3. Outsourced providers are entirely outside the SOMS and require no oversight
  4. Only the contract price must be monitored for outsourced services

Explanation

Where processes, products or services are externally provided, the organization must control them and define the controls to be applied, consistent with the management system requirements. Outsourcing does not remove the need for oversight.

Question 16Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which statement best describes the concept of 'accountability' in a security operations management system?

  1. The obligation to answer for decisions and results, which cannot be delegated away Correct answer.
  2. A task that can be fully transferred to a subcontractor
  3. A financial liability insurance policy
  4. A synonym for operational authority to issue orders

Explanation

Accountability is the obligation to answer for decisions and outcomes, and it remains with the accountable party even when work is delegated. Authority may be delegated, but accountability cannot be shifted away.

Question 17Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which of the following best represents an 'objective' in a SOMS?

  1. A measurable target for reducing unauthorized site access incidents by a stated percentage within a defined period Correct answer.
  2. A statement that security is important to the business
  3. A list of all security technologies available on the market
  4. A general aspiration to be 'the safest organization in the world'

Explanation

Objectives in a management system are specific, measurable and time-bound targets consistent with the security policy. General aspirations and statements of importance are not measurable objectives.

Question 18Fundamental principles and concepts of a Security Operations Management System (SOMS)

How does the SOMS concept of 'planning' relate to security risk?

  1. Planning addresses risks and opportunities that must be handled to give assurance that the SOMS can achieve its intended outcomes Correct answer.
  2. Planning is optional for organizations with a low perceived threat level
  3. Planning is only required after certification has been achieved
  4. Planning is limited to scheduling guard shifts

Explanation

Planning requires the organization to consider risks and opportunities and determine how to address them so that the system can achieve its intended outcomes. It is a continuous requirement, not limited to rostering or to certified organizations.

Question 19Fundamental principles and concepts of a Security Operations Management System (SOMS)

What is the purpose of management review in a SOMS?

  1. To approve individual guard disciplinary actions
  2. To confirm that top management evaluates the continuing suitability, adequacy and effectiveness of the system and decides on improvement actions Correct answer.
  3. To replace internal audits with a single annual meeting
  4. To negotiate security service fees with clients

Explanation

Management review is a top-management activity that evaluates the continuing suitability, adequacy and effectiveness of the management system and drives decisions on improvement. It complements, rather than replaces, internal audit.

Question 20Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which situation best demonstrates a failure of the 'process approach' in security operations?

  1. Process inputs and outputs are defined and monitored
  2. Interactions between processes are identified and managed
  3. Sites share common procedures and coordinate handoffs between them
  4. Each site optimizes its own procedures without regard to how its outputs affect other sites and the overall security outcome Correct answer.

Explanation

The process approach requires understanding how processes interact and contribute to overall results; local optimization that ignores interdependencies breaks this systemic view. Shared procedures and managed interactions are examples of the approach working correctly.

Question 21Fundamental principles and concepts of a Security Operations Management System (SOMS)

An organization's security policy commits to respecting human rights, but its operational procedures authorize detention of suspects without legal basis. What does this indicate?

  1. A normal operational discretion that requires no further action
  2. An acceptable practice provided the suspects are later released
  3. An inconsistency between the policy commitments and operational practice that undermines legitimacy Correct answer.
  4. A matter solely for the legal department outside the SOMS

Explanation

When operational practice contradicts the policy's commitments to legality and human rights, the management system is not being implemented consistently, and legitimacy is undermined. Policy must be reflected in practice and controls.

Question 22Fundamental principles and concepts of a Security Operations Management System (SOMS)

A company claims its SOMS covers 'all security operations' but excludes its remote monitoring centre and its subcontractors. What is the most accurate assessment?

  1. The exclusion is acceptable because remote monitoring is not a security activity
  2. The exclusion is acceptable because subcontractors are never part of a scope
  3. The scope is irrelevant as long as a policy exists
  4. The stated scope is misleading because the excluded functions are integral to the security operations described Correct answer.

Explanation

The scope must accurately reflect the boundaries of the management system, and excluding integral functions while claiming full coverage misrepresents it. Subcontractors and monitoring centres carrying out security operations cannot simply be declared outside the system.

Question 23Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which statement best distinguishes 'corrective action' from 'continual improvement' in a SOMS?

  1. Corrective action eliminates the cause of a detected nonconformity, while continual improvement proactively enhances overall performance Correct answer.
  2. Corrective action is proactive, while continual improvement is only reactive
  3. Continual improvement applies only to documentation, while corrective action applies only to personnel
  4. Corrective action and continual improvement are identical and interchangeable

Explanation

Corrective action is reactive in the sense that it responds to a detected nonconformity by eliminating its cause to prevent recurrence, whereas continual improvement proactively seeks to enhance performance beyond current levels. They are related but distinct concepts.

Question 24Fundamental principles and concepts of a Security Operations Management System (SOMS)

Why does ISO 18788 emphasize 'legitimacy' as a foundational principle for private security operations?

  1. Because legitimacy reduces the need for any documented procedures
  2. Because security operations that lack legal authority and community acceptance can themselves become a source of risk and harm Correct answer.
  3. Because legitimacy guarantees immunity from regulatory inspection
  4. Because legitimacy applies only to armed guarding services

Explanation

Security operations exercised without legal authority or acceptance can generate harm, distrust and additional risk, undermining their purpose. Legitimacy therefore underpins how security activities are authorized and conducted, regardless of whether they are armed.

Question 25Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which of the following best describes the concept of 'consultation and participation' of workers in a SOMS?

  1. Workers are excluded because security matters are confidential by definition
  2. Workers are informed of decisions only after they are implemented
  3. Workers are involved in the development and review of security arrangements that affect them Correct answer.
  4. Workers participate only by paying for their own training

Explanation

Consultation and participation means involving workers in the development and review of arrangements that affect them, which improves relevance and buy-in. Informing after the fact or excluding workers does not constitute participation.

Question 26Fundamental principles and concepts of a Security Operations Management System (SOMS)

ISO 18788 frames the security operations management system around a set of interrelated principles. Which pairing correctly describes a foundational principle and its practical consequence for a contracted security provider?

  1. Profitability: guarding contracts are priced to maximize margin, which justifies reducing staffing at low-risk sites
  2. Confidentiality: client information is withheld from workers so that leaks cannot occur
  3. Rule of law: operations are conducted within applicable legal frameworks, and personnel are trained on the legal limits of their authority Correct answer.
  4. Deterrence: visible guards replace the need for documented procedures because presence alone prevents incidents

Explanation

ISO 18788 is built on principles such as the rule of law, respect for human rights, and accountability, and these principles must translate into operational practice. Respecting the rule of law means personnel understand and operate within legal limits on their authority, including use of force and detention. Principles in the standard are not commercial or secrecy maxims, so options framed around margin, deterrence replacing procedures, or withholding information from workers do not reflect the framework.

Question 27Fundamental principles and concepts of a Security Operations Management System (SOMS)

A private security company operating in a post-conflict region states that its SOMS is grounded in respect for human rights. Which action most directly operationalizes that principle within the management system?

  1. Increasing the number of armed guards at checkpoints to discourage unlawful behaviour
  2. Displaying the human rights commitment on the company website and in the reception area
  3. Screening personnel for past human rights abuses and providing training on the use of force and grievance reporting Correct answer.
  4. Adding a clause to client contracts stating that the client accepts responsibility for any incidents

Explanation

A human rights commitment becomes part of the management system when it drives concrete controls such as personnel screening, training on lawful conduct and use of force, and accessible grievance mechanisms. These are verifiable activities that can be monitored and audited. Public statements, contractual risk transfer, or simply adding guards do not by themselves embed the principle in operational practice.

Question 28Fundamental principles and concepts of a Security Operations Management System (SOMS)

In ISO 18788, why is the concept of 'legitimacy' treated as distinct from mere legal compliance when a security provider operates on behalf of a client?

  1. Because legitimacy only concerns how the organization is perceived by the media, whereas compliance concerns auditors
  2. Because legitimacy is achieved once the organization holds a valid business licence and insurance policy
  3. Because legitimacy requires that authority be lawfully conferred and accepted by the community and stakeholders, which can exceed what a permit alone demonstrates Correct answer.
  4. Because legitimacy applies exclusively to government forces and never to contracted providers

Explanation

Legitimacy concerns whether the security provider's authority and conduct are lawful and accepted by the community and other stakeholders it affects, not simply whether paperwork exists. A licence or permit may satisfy a legal formality while operations still generate community resistance or exceed a defensible mandate. ISO 18788 therefore treats legitimacy as a governance principle tied to consent, accountability and stakeholder relationships.

Question 29Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which statement best captures the intended relationship between the SOMS and the organization's overall business management systems?

  1. The SOMS replaces existing management systems once certification is achieved
  2. The SOMS is only relevant to the security department and has no bearing on broader organizational governance
  3. The SOMS should be integrated with the organization's other management systems so that policy, risk and improvement activities are aligned Correct answer.
  4. The SOMS must operate as a standalone system isolated from quality, safety or environmental management to avoid conflicts

Explanation

ISO 18788 is structured on the same high-level management system framework as other ISO management system standards, which allows alignment and integration. Integrating the SOMS with related systems helps ensure consistent policy, shared risk assessment and coherent improvement activity. Isolation, replacement or confinement to one department undermines that alignment.

Question 30Security Operations Management Systems (SOMS)

In an ISO 18788 security operations management system, which document establishes the organization's top-level commitment to security operations and provides the framework for setting security objectives?

  1. The security operations policy Correct answer.
  2. The guard deployment roster
  3. The client contract schedule
  4. The incident register

Explanation

The security operations policy is the governing statement of intent that frames objectives, is controlled by top management, and drives the rest of the management system. Operational records such as rosters and incident registers implement the policy rather than establish it.

Question 31Security Operations Management Systems (SOMS)

A security services provider is defining the scope of its ISO 18788 management system. Which approach best reflects the standard's expectations for scope determination?

  1. Scope defined by the marketing department to maximize tender scores
  2. Scope limited to the head office where contracts are signed
  3. Scope reflecting the actual security operations, locations and interfaces the organization controls Correct answer.
  4. Scope copied from a competitor's certification certificate

Explanation

Scope must be based on the organization's actual activities, locations and interfaces, including outsourced or subcontracted elements it controls. It must be documented and defensible, not chosen for marketing convenience or imitation.

Question 32Security Operations Management Systems (SOMS)

Which element is most characteristic of the 'context of the organization' clause when applied to a private security company?

  1. The training matrix for first aid certificates
  2. The identification of interested parties and the legal, regulatory and contractual obligations affecting security operations Correct answer.
  3. The list of corrective actions closed last quarter
  4. The internal audit schedule for the coming year

Explanation

Context determination covers external and internal issues plus the needs and expectations of interested parties, including legal and contractual obligations relevant to security operations. Audit schedules, action logs and training matrices are outputs of later clauses.

Question 33Security Operations Management Systems (SOMS)

During a lead audit, the auditor finds that risk assessments for a new guarding contract were performed but no risk treatment options were selected or authorized. Which clause area is most directly deficient?

  1. Management review inputs
  2. Competence and awareness
  3. Document control
  4. Risk treatment planning Correct answer.

Explanation

Risk assessment only becomes actionable when treatment options are selected and planned, with owners and authorization. The absence of treatment decisions is therefore a planning deficiency rather than a competence or documentation issue.

Question 34Security Operations Management Systems (SOMS)

In the SOMS, what is the primary purpose of a security operations plan for a specific site?

  1. To satisfy a client's invoicing requirements
  2. To replace the need for site risk assessment
  3. To describe how risks will be controlled, resources deployed and performance monitored at that site Correct answer.
  4. To record the disciplinary history of assigned personnel

Explanation

A site security plan translates the organization's policy and risk decisions into concrete controls, resource deployment and monitoring arrangements. It complements rather than replaces risk assessment, and it is not a commercial or HR record.

Question 35Security Operations Management Systems (SOMS)

An auditor is verifying that the organization has determined the legal and other requirements applicable to its security operations. Which evidence provides the strongest confirmation?

  1. A maintained register of applicable legislation, licensing requirements and contractual obligations with evidence of periodic review Correct answer.
  2. An oral assurance from a site supervisor
  3. A signed statement from the sales director
  4. A general reference to 'all applicable laws' in the policy

Explanation

A compliance obligations register that identifies specific requirements and shows periodic review demonstrates a systematic process. General statements, oral assurances and sales statements do not show that requirements were identified and kept current.

Question 36Security Operations Management Systems (SOMS)

Which of the following best describes the role of top management in an ISO 18788 management system?

  1. Approving each incident report personally
  2. Reviewing individual guard shift reports daily
  3. Delegating all security decisions to the client's representative
  4. Demonstrating leadership by integrating security requirements into business processes and providing resources Correct answer.

Explanation

Top management must show leadership by integrating management system requirements into the organization's business processes and ensuring resources are available. Personal approval of individual operational records is not required and would not scale.

Question 37Security Operations Management Systems (SOMS)

What distinguishes a 'security operations management system' from a collection of standalone security procedures?

  1. It uses interconnected processes with defined objectives, measurement, review and improvement Correct answer.
  2. It removes the need for documented information
  3. It applies only to armed guarding services
  4. It is audited only by the client

Explanation

A management system links processes through objectives, performance measurement, review and improvement, creating a coherent cycle. Standalone procedures lack these interconnections and the feedback loop that drives improvement.

Question 38Security Operations Management Systems (SOMS)

An auditor reviews competence records for security personnel and finds that training was delivered but effectiveness was never evaluated. How should this be characterized?

  1. Not applicable, because competence is the client's responsibility
  2. Observation only, because training records exist
  3. Nonconformity, because the organization must evaluate the effectiveness of actions taken to acquire competence Correct answer.
  4. Conformity, because training was delivered

Explanation

Competence management requires determining necessary competence, taking action to achieve it and then evaluating whether that action was effective. Delivering training without evaluating effectiveness leaves the requirement partially unmet.

Question 39Security Operations Management Systems (SOMS)

A guarding company subcontracts night patrols to a smaller provider. Under ISO 18788, how should the lead auditor treat this arrangement?

  1. Ignore it because the subcontractor is separately licensed
  2. Treat the subcontractor as outside the scope of the management system
  3. Require the subcontractor to hold ISO 18788 certification before any audit evidence is accepted
  4. Verify that outsourced processes are controlled and that the subcontractor's performance is monitored against agreed security requirements Correct answer.

Explanation

Outsourced processes remain part of the organization's responsibility and must be controlled and monitored against defined requirements. Certification of the subcontractor is not a precondition for control, and licensing alone does not demonstrate control.

Question 40Security Operations Management Systems (SOMS)

During a site audit, the auditor observes that incident reports are completed but never analyzed for trends. Which requirement is most directly affected?

  1. Internal audit programme frequency
  2. Monitoring, measurement, analysis and evaluation of security performance Correct answer.
  3. Control of documented information retention
  4. Calibration of security equipment

Explanation

Collecting incident data without analysis means the organization is not evaluating its security performance as required. Monitoring and measurement must lead to analysis and evaluation that informs decisions.

Question 41Security Operations Management Systems (SOMS)

An internal audit found a nonconformity six months ago. The organization's file shows only a corrective action to 'remind staff of the procedure'. What should the lead auditor conclude?

  1. The nonconformity should be closed because time has passed
  2. The matter is outside the auditor's remit
  3. The corrective action is adequate because staff were reminded
  4. The correction addresses symptoms but root cause analysis and action to eliminate the cause appear insufficient Correct answer.

Explanation

Corrective action requires evaluating the cause and acting to eliminate it so the nonconformity does not recur. A reminder addresses the symptom without demonstrating root cause analysis or effectiveness review.

Question 42Security Operations Management Systems (SOMS)

Which set of inputs would most appropriately drive a management review of the security operations management system?

  1. Only the financial audit report
  2. Audit results, incident trends, compliance status, customer feedback and risk assessment updates Correct answer.
  3. The list of new employees hired this year
  4. Marketing campaign results and social media metrics

Explanation

Management review must consider management system performance information such as audit outcomes, incident trends, compliance, customer feedback and changes to risks. Financial or marketing data alone does not address the system's security performance.

Question 43Security Operations Management Systems (SOMS)

An auditor is sampling guard post instructions and finds several are undated and unsigned, with no record of who authorized changes. Which requirement is most clearly implicated?

  1. Control of documented information Correct answer.
  2. Management commitment
  3. Operational planning
  4. Emergency preparedness

Explanation

Undated, unsigned and unauthorised post instructions indicate weak control of documented information, including approval and change control. The content may be adequate, but its control is not demonstrated.

Question 44Security Operations Management Systems (SOMS)

A security provider's risk assessment has not been updated since a major change in the local threat environment and a new client site was added. What is the most significant audit finding?

  1. The threat environment is outside the organization's control
  2. The client should have performed the risk assessment
  3. Risk assessment is a one-time activity and needs no update
  4. Risk assessment was not repeated in response to changed circumstances and new operations Correct answer.

Explanation

Risk assessment must be repeated when significant changes occur, including new sites and shifts in the threat environment. Treating it as a one-time exercise undermines the risk-based foundation of the management system.

Question 45Security Operations Management Systems (SOMS)

How should an auditor evaluate the organization's handling of a serious use-of-force incident involving a guard?

  1. Confirm only that the guard was disciplined
  2. Confirm that the incident was removed from the register to protect confidentiality
  3. Confirm the incident was reported, investigated, reviewed for lessons and that any required notification to authorities or clients occurred Correct answer.
  4. Confirm only that the client was invoiced for the shift

Explanation

Serious incidents require reporting, investigation, review for lessons learned and any legally or contractually required notifications. Disciplinary action alone or financial handling does not demonstrate adequate incident management.

Question 46Security Operations Management Systems (SOMS)

An auditor finds that security personnel are unaware of the organization's security operations policy and their contribution to it. Which requirement is deficient?

  1. Awareness Correct answer.
  2. Infrastructure management
  3. Supplier evaluation
  4. Measurement traceability

Explanation

Awareness requires that personnel understand the policy, their contribution to the effectiveness of the management system and the implications of not conforming. Unawareness of the policy is a direct awareness deficiency.

Question 47Security Operations Management Systems (SOMS)

A client requests that the security provider operate a checkpoint in a way that conflicts with local legal requirements. What is the most appropriate expectation for the management system?

  1. Follow the client instruction because the client pays for the service
  2. Ignore both the client and the law and continue as before
  3. Decline the conflicting instruction and record the legal obligation and decision Correct answer.
  4. Ask the guards to decide individually

Explanation

The organization must meet its compliance obligations, and contractual demands cannot override legal requirements. The conflict and the decision should be documented so the reasoning is traceable.

Question 48Security Operations Management Systems (SOMS)

Which activity best demonstrates that the organization has established a process for consultation and participation of workers in the security management system?

  1. Holding documented forums where guards raise security concerns and see how they are addressed Correct answer.
  2. Distributing the policy by email only
  3. Posting a notice board with no follow-up mechanism
  4. Including a clause in employment contracts requiring silence on security matters

Explanation

Consultation and participation require genuine two-way engagement where workers can raise concerns and see outcomes. One-way communication or suppression of concerns does not meet the intent.

Question 49Security Operations Management Systems (SOMS)

An auditor is assessing whether emergency preparedness arrangements are effective. Which evidence is most persuasive?

  1. A copy of an emergency plan stored in the head office
  2. An unopened box of emergency equipment
  3. A statement in the policy that emergencies will be handled
  4. Records of drills, identified weaknesses and subsequent improvements to the arrangements Correct answer.

Explanation

Effectiveness is shown by testing arrangements, learning from drills and improving them. A plan on a shelf or an unopened equipment box does not demonstrate preparedness.

Question 50Security Operations Management Systems (SOMS)

A security provider uses a client-supplied access control system to protect a site. How should the auditor treat the reliability of this control?

  1. Exclude it from the audit because it is client property
  2. Require the client to be certified to ISO 18788
  3. Assume it is reliable because the client supplied it
  4. Verify that the control's performance is monitored and that failures are reported and acted upon Correct answer.

Explanation

Controls relied upon for security must be monitored and their failures managed, regardless of ownership. Assuming reliability without verification leaves a gap in assurance.