Meridian Maritime: Does a Quality Certificate Answer the ISO 18788 Question?
Meridian Maritime Protection provides armed embarked security teams on commercial vessels transiting the Gulf of Guinea. It is 11 years old, employs 180 armed guards and 40 shore staff, and holds ISO 9001 and ISO 45001 certificates. Growth has been rapid: revenue tripled in three years, and the company now works for four shipowners and two insurers. During a pre-contract evaluation, a European shipowner's compliance team asks Meridian to demonstrate that it manages security operations the way ISO 18788 intends. Meridian's managing director responds that the company already has a quality system, an incident register and a legal adviser who reviews contracts. The compliance team notes that the quality manual treats human rights as a matter for the client, that the risk register is built only from insurer loss data, and that guards receive weapons training but no human rights or use-of-force training. The managing director wants a plain explanation of what a security operations management system adds, and whether the company can claim to be operating in line with ISO 18788's principles without being certified.
1. Explain how a Security Operations Management System differs in purpose and scope from the quality and OH&S systems Meridian already holds, and why human rights due diligence cannot be delegated to the client.
Read the worked answer
Start from the object of the system, not the certificate list
- ISO 9001 asks whether Meridian consistently meets customer and applicable requirements. ISO 45001 asks whether it controls work-related injury and ill health to workers. Neither takes as its object the effect of the security operation on the people it touches.
- ISO 18788 is written specifically for organisations that deliver or contract security services. Its subject is the security operation and its consequences: the use of force, detention or restraint, weapons handling, interaction with communities, treatment of persons encountered, and the conduct of personnel and subcontractors.
Why human rights sits at the centre rather than in the legal folder
Human rights due diligence is itself a risk process: what could our operations do to people, how severe would that be, and what do we do about it. A guard who uses excessive force against a fisherman creates the same liability whether or not the contract assigns responsibility elsewhere. The standard is built around operating consistently with human rights law and with reference frameworks such as the UN Guiding Principles on Business and Human Rights, the Voluntary Principles on Security and Human Rights, the Montreux Document and the International Code of Conduct. Saying 'human rights is the client's matter' removes the only party that can actually control guard behaviour from the process.
Certification versus conformity
Owning a document set is not conformity. Conformity is demonstrated by implemented processes and the evidence they generate: risk assessments covering affected people, use-of-force rules, competence records, incident and grievance handling, monitoring. Certification is third-party confirmation of that, not its definition. Meridian can align its operations with ISO 18788 without certifying, but any public claim must be measured against the evidence it can actually produce - and on the facts described, the insurer loss register and weapons-only training would not support a claim of alignment.
2. Identify the interested parties Meridian's SOMS must account for, and explain why the insurer and the affected coastal communities are not interchangeable stakeholders.
Read the worked answer
Who the system must consider
Relevant interested parties include: the shipowners (clients); hull and P&I insurers; flag states and coastal state authorities; the embarked guards and their families; vessel crews; fishing communities and other sea users in the operating area; the company's own shore staff; industry bodies and the code-of-conduct regime it subscribes to; and, where contracts require it, humanitarian or NGO counterparties.
The test is relevance, not a long list
Each party must be assessed for two things: what requirements it imposes that become compliance obligations (contractual, statutory, licensing), and how it is affected by Meridian's operations. Only then do you decide which requirements the SOMS must address, and which risks are unacceptable.
Why the insurer is not a proxy for the community
- The insurer's requirements are contractual and financial: loss history, incident notification, perhaps exclusions for certain areas. Its data is backward-looking and tuned to insured loss, not to harm to people. A patrol that intimidates fishermen without a claim being filed generates no insurer signal.
- Affected people hold claims that do not depend on a contract existing. Severity for them is measured in injury, livelihood and dignity, and those risks can be high even where the insured loss is zero.
- If Meridian builds its risk picture only from insurer loss data, the risk assessment will systematically miss the low-financial-impact, high-severity events that most damage a security provider: excessive force, unlawful detention, sexual exploitation, or community reprisals.
A defensible SOMS therefore keeps two linked but separate feeds: contractual and legal obligations, and a human rights risk assessment driven by who is affected and how badly.