Preparation of an ISO 18788 audit
Domain focus
This domain tests how to prepare a risk-based ISO 18788 audit: objectives, scope, criteria, document review, audit plan, sampling and logistics, including stage 1 for certification.
Core rules
Preparation starts with the audit objectives, scope and criteria, agreed with the client and auditee. Review the SOMS scope, policy, risk assessments, legal register, objectives, incident and grievance logs, training and competence records, management review outputs and previous findings. Identify high-risk operations: armed guarding, night shifts, remote sites, detention or search activities, subcontractors and new contracts. Build an audit plan that allocates time by risk, names auditors and sites, and explains sampling. For certification, stage 1 evaluates readiness, documented information, understanding of the standard and whether stage 2 can proceed; it is not a consultancy review. Consider safety, security and confidentiality before entering sites.
Sampling should cover shifts, sites, subcontractors and the full audit trail from risk assessment to operational records. Checklists should follow processes and clauses, not just the standard's headings.
Worked example
A provider has three sites and 24/7 shifts. The auditor plans only a day visit to headquarters, but the highest-risk work is night guarding at a remote site with a subcontractor. A better plan samples the remote site at night, reviews subcontractor competence and incident follow-up, and interviews the client liaison. The reasoning is risk-based: limited audit time should follow exposure, not convenience.
Traps
Do not prepare a checklist that merely copies clauses. Do not ignore subcontractors, shift patterns or off-site records. Do not treat stage 1 as a mini stage 2. Do not accept a scope that excludes a major activity without justification. Do not omit a safety or confidentiality plan.