PECB ISO 18788 Lead Auditor study plan

Explain how ISO 18788 structures a Security Operations Management System (SOMS) around the plan-do-check-act cycle and map each clause of the standard to the corresponding PDCA stage

Distinguish the SOMS from an ISO 9001 quality management system and an ISO 27001 information security management system, naming at least four requirements unique to security operations and human rights risk

Define the core vocabulary of the standard in your own words: security operations, client, stakeholder, human rights risk, due diligence, rules for the use of force, and incident

Describe the context-of-the-organization and interested-parties requirements and give two realistic examples of internal and external issues that shape a private security provider's SOMS

Identify the leadership, policy, and role-and-responsibility requirements and explain how top management accountability is evidenced in a SOMS

Break down the planning requirements, including risk assessment, risk treatment, human rights due diligence, and legal and other requirements, and sequence them into a logical workflow

Interpret the operational planning and control requirements for security service delivery, including screening, training, and performance of security personnel

Explain the rules for the use of force and how an organization should document, communicate, and review them

Outline the support requirements for competence, awareness, communication, and documented information, and state what evidence each would leave

Summarize the performance evaluation and improvement requirements, including monitoring, internal audit, management review, incident investigation, and corrective action

Define audit, audit criteria, audit evidence, and audit findings, and explain the difference between an audit and an inspection or a compliance review

Apply the audit principles of integrity, fair presentation, due professional care, confidentiality, independence, and an evidence-based approach to three short scenarios

Distinguish first-party, second-party, and third-party audits and describe the role of the lead auditor, the audit team, the client, and the auditee

Explain the risk-based approach to auditing and identify how audit programme risk and audit risk differ

Classify a nonconformity as major or minor and justify the classification using the impact on the management system and on security service delivery

Apply the standard's guidance on initiating an audit, including defining objectives, scope, criteria, and feasibility

Draft an audit plan that allocates time by process and by risk, includes sampling rationale, and respects site and shift constraints typical of security operations

Prepare a document review list and a set of opening questions for a SOMS covering human rights due diligence and use-of-force controls

Write an audit checklist with open questions that probe evidence rather than invite yes or no answers

Identify the resources, competences, and access arrangements a lead auditor must confirm before fieldwork begins

Conduct a simulated opening meeting that confirms scope, criteria, method, and escalation routes in under 20 minutes

Practice evidence collection through interviews, observation, and document sampling, and record the source of each piece of evidence

Interview a role-played security site manager and a role-played client representative, probing human rights due diligence and incident handling

Write findings that state the requirement, the evidence, and the consequence, and separate nonconformities from observations and opportunities for improvement

Handle a disagreement with an auditee about a finding while preserving the evidence-based approach and fair presentation

Prepare and run a closing meeting that presents findings, agrees corrective action timelines, and confirms report distribution and confidentiality

Draft an audit report that includes executive summary, scope, criteria, findings, conclusions, and a clear statement of audit limitations

Evaluate an auditee's root cause analysis and corrective action plan and identify where it addresses symptoms rather than causes

Explain the audit follow-up requirements and how verification of corrective action is planned and recorded

Complete the audit by organizing records, closing the audit file, and identifying lessons learned for the audit team

Design an audit programme for a multi-site security provider, defining objectives, cycle, scope, criteria, and resourcing across a three-year period

Apply risk-based scheduling to decide which sites and processes are audited more frequently and justify the choices

Establish programme monitoring and review measures, including finding trends, corrective action closure rates, and auditor performance

Explain the competence and evaluation requirements for auditors and identify how to maintain and improve auditor competence

Address programme-level risks such as auditor independence, resource conflicts, and changes to the organization's context

Revisit the weakest two domains identified from earlier deliverables and rewrite those deliverables to close the gaps

Produce a condensed one-page summary of each domain that you can review in the final days before the exam

Answer at least 150 practice questions across all domains, recording your score per domain and reviewing every wrong answer

Explain aloud, without notes, how an ISO 18788 audit flows from programme planning through closing and follow-up

Identify and resolve your remaining knowledge gaps by re-reading the relevant clauses of the standard