PECB ISO 18788 Lead Implementer cheat sheet

ISO 18788 applies to organizations that conduct or contract security operations; it is a management system standard built on the ISO High-Level Structure (HLS), so clause structure mirrors ISO 9001 and ISO 14001 (context, leadership, planning, support, operation, performance evaluation, improvement).

A SOMS is the set of interrelated policies, objectives, processes and resources used to direct and control security operations so that they protect human rights, comply with law, and meet client and community expectations.

Core principles: primacy of human rights, rule of law and compliance, risk-based thinking, due diligence, continual improvement, stakeholder engagement, transparency and accountability.

ISO 18788 requires respect for human rights consistent with the UN Guiding Principles on Business and Human Rights (protect, respect, remedy) and the Voluntary Principles on Security and Human Rights.

Use of force principle: force is a last resort, must be necessary, proportionate and lawful, and must be documented and reported; firearms use is restricted to imminent threat to life.

Risk-based approach: security risk assessment plus human rights risk assessment are both required inputs; the standard addresses risk to the organization, to stakeholders and to affected communities.

The standard uses the process approach and PDCA (Plan-Do-Check-Act) as the improvement cycle; each clause maps to a PDCA phase.

Applicability is scalable: the scope statement defines boundaries (sites, services, contracts) and exclusions must be justified and must not affect the organization's ability to ensure conformity.

Documented information replaces the older terms 'documented procedures' and 'records'; the organization determines what documented information is needed for effectiveness.

Mandatory documented information includes: scope of the SOMS, security operations policy, objectives, risk assessment results, legal and other requirements, competence evidence, operational control records, monitoring results, audit results, management review outputs, incident and investigation records, and nonconformity/corrective action records.

The security operations policy must include commitment to satisfy applicable requirements, respect human rights, comply with law, and continual improvement; it must be communicated, available to interested parties, and reviewed for continuing suitability.

Roles and responsibilities must be assigned and communicated at all levels, including a management representative or top-management accountability for the SOMS; top management remains accountable and cannot delegate accountability.

Operational planning and control covers: risk assessment, contractual and legal review, screening and vetting of personnel, training and competence, deployment, use-of-force rules, equipment control, incident management, investigations, and client/community liaison.

Incident management requires documented procedures for reporting, recording, escalating, investigating and responding; incidents involving use of force or human rights allegations require special handling and reporting to relevant parties.

Grievance and complaint mechanisms must be accessible to affected communities and workers, with impartial investigation and remedy provisions consistent with the UN Guiding Principles effectiveness criteria (accessible, predictable, equitable, transparent, rights-compatible, continuous learning).

Contractor and subcontractor control: the organization must apply equivalent human rights and use-of-force requirements to subcontracted security providers and verify conformity.

Emergency preparedness and response must be planned and tested, covering security incidents, medical emergencies, natural hazards and escalated threats, with periodic review and post-exercise evaluation.

Outsourcing does not transfer responsibility: outsourced processes must be controlled and the nature and extent of control defined in the SOMS.

Implementation sequence: obtain top-management mandate, define scope and boundaries, perform gap analysis against ISO 18788 clauses, build a project plan with owners, resources and milestones, then execute clause-by-clause.

Context of the organization (Clause 4): identify internal and external issues, interested parties and their requirements, and determine the SOMS scope; outputs feed risk and opportunity planning.

Risk assessment methodology must address likelihood and consequence, security threats, human rights risks, legal/regulatory exposure, and stakeholder/community impact; define risk criteria and acceptance thresholds before assessment.

Legal and other requirements register must capture applicable national law, international human rights law, client contract requirements, voluntary commitments (e.g., Voluntary Principles, Montreux Document) and industry codes.

Objectives must be SMART, measurable, monitored, communicated and consistent with the policy; plan what will be done, resources, responsible person, timeframe and evaluation method.

Gap analysis output should be a prioritized action register distinguishing quick wins, structural changes and resource-dependent items; use it to build the implementation roadmap and budget.

Stakeholder mapping should identify clients, employees, local communities, authorities, NGOs, indigenous groups and contractors; engagement frequency and channels should be planned.

Competence planning: identify required competencies per role (use of force, human rights, investigation, first aid, reporting) and plan training, licensing and vetting before deployment.

Implementation planning should define the document architecture (manual/policy, procedures, work instructions, forms/records) and avoid over-documentation that does not add control value.

Leadership implementation: top management must demonstrate commitment through resource allocation, policy issuance, integration into business processes, and active participation in management review.

Competence and awareness: personnel must be trained on the policy, their contribution to SOMS effectiveness, human rights obligations, use-of-force rules, incident reporting and the consequences of nonconformity.

Communication plan must define what, when, with whom and how to communicate internally and externally, including escalation to clients, authorities and affected communities after serious incidents.

Operational control hierarchy: eliminate or avoid the risk, substitute, apply engineering or procedural controls, then administrative and PPE controls; controls must be documented and verified in the field.

Personnel vetting and screening must respect privacy and non-discrimination law; records of screening, training and licensing must be retained as documented information.

Weapons and equipment control: authorization, issue, storage, inventory, maintenance and loss reporting must be procedurally controlled and auditable.

Incident and investigation process: secure the scene, preserve evidence, record statements, avoid conflicts of interest in investigators, and produce a report with findings and corrective actions.

Change management: changes to scope, contracts, sites, laws or personnel must be assessed for SOMS impact and reflected in risk assessments, procedures and training before implementation.

Supplier and subcontractor implementation: pre-qualification, contractual flow-down of human rights and use-of-force clauses, performance monitoring and documented evaluation.

Monitoring and measurement must define what is monitored, methods, when, who analyzes results, and criteria for evaluating performance; results must be retained as documented information.

Typical KPIs: incident rate per 1,000 deployment hours, use-of-force incidents, human rights complaints and resolution time, training completion, vetting completion, audit findings closure rate, client satisfaction, grievance response time.

Internal audit programme must be risk-based, planned by frequency and scope, use competent and impartial auditors (not auditing own work), and report results to management.

Audit findings categories: conformity, nonconformity (major/minor), observation/opportunity for improvement; each nonconformity requires root cause analysis and corrective action with verification of effectiveness.

Management review inputs must include audit results, incident and investigation data, complaints and grievances, legal compliance status, risk assessment updates, objectives status, resource adequacy and interested party feedback.

Management review outputs must include decisions on improvement opportunities, resource needs, and changes to the SOMS, and must be retained as documented information.

Compliance evaluation: the organization must evaluate compliance with legal and other requirements at planned intervals and maintain evidence of the evaluation and any follow-up actions.

Data analysis should trend incidents by site, shift, client, service type and control type to identify systemic weaknesses rather than isolated events.

Performance evaluation feeds continual improvement; monitoring results that show objectives are not met trigger corrective action, not just reporting.

Nonconformity handling: react (contain/correct), evaluate need for action to eliminate cause, implement action, review effectiveness, and update risks if needed; retain documented information of the nonconformity, actions and results.

Root cause analysis methods: 5 Whys, fishbone (Ishikawa), fault tree; choose based on complexity and record the rationale.

Corrective action must be proportionate to the effect of the nonconformity and must not introduce new risks; verify effectiveness before closing.

Continual improvement sources: audit findings, incidents and investigations, grievances, management review outputs, performance data trends, stakeholder feedback, changes in law and technology.

Improvement projects should have defined objectives, owners, timelines, success measures and be tracked in an improvement register.

Lessons learned from incidents and near-misses should be disseminated through training updates, procedure revisions and communication to clients and subcontractors.

Maturity progression: from reactive (incident-driven) to proactive (risk-based, preventive) to resilient (integrated, learning organization); improvement plans should target the next maturity level.

Human rights remedy: where the organization caused or contributed to adverse human rights impacts, it should provide for or cooperate in remediation through legitimate processes.

Documented information must be updated when improvements change processes, and obsolete documents controlled to prevent unintended use.

Certification audit stages: Stage 1 (documentation and readiness review, scope confirmation, audit planning) and Stage 2 (implementation effectiveness, evidence of conformity, operational control verification).

Certification body selection: verify accreditation (e.g., IAF member, national accreditation body), auditor competence in security operations and human rights, and sector experience.

Stage 1 readiness criteria: scope defined, policy approved, risk assessments completed, internal audit and management review conducted at least once, nonconformities from internal audit closed or planned.

Evidence pack preparation: scope statement, policy, objectives, risk registers, legal register, training records, incident and investigation files, internal audit reports, management review minutes, corrective action records, subcontractor evaluations.

Audit logistics: site sampling may include multiple sites and night shifts; ensure access to records, personnel for interviews and operational sites; plan for confidentiality and safety briefings.

Common Stage 2 nonconformities: objectives not measurable, risk assessment not covering human rights, no evidence of use-of-force training, internal audit lacking impartiality, management review missing required inputs, no subcontractor control.

Auditor interviews may cover top management, site supervisors, guards, HR, legal and client liaison; personnel must be able to explain the policy and their role.

Post-certification: surveillance audits at least annually (typical 3-year certification cycle), recertification audit before expiry, and notification of significant changes to the certification body.

Corrective action for audit findings must be submitted within the certification body's timeframe with root cause, action and effectiveness evidence; major nonconformities may require follow-up audit.