PECB ISO 18788 Lead Implementer common mistakes
PECB ISO 18788 Lead Implementer · Understand the traps and how to avoid them.
Treating ISO 18788 as a generic ISO management-system standard and answering questions about 'the organization's security policy' without distinguishing the client organization from the security services contractor that operates the SOMS.
Candidates often study 18788 alongside ISO 9001 or 27001 and carry over a single-organization mental model, missing that 18788 is written for organizations that provide security operations services under contract, often in complex or high-risk environments, and must reconcile client requirements with their own management system.
What to do instead
Before answering any scenario question, explicitly identify the actors: the security services provider (the certified organization), its client, affected communities, and personnel. Map each requirement to the provider's responsibility, and note where the provider must flow down or align with client obligations. Practice rewriting each clause as 'the provider shall...' to lock in the perspective.
Confusing ISO 18788 with ISO 28007 or PSC.1 and attributing certification, audit, or conformance requirements from those schemes to 18788.
The three documents are frequently mentioned together in the private security company sector, so candidates blend their scopes and misattribute requirements such as specific audit durations or third-party certification rules to 18788 itself.
What to do instead
Build a one-page comparison table listing each document's title, scope, intended user, and whether it contains certifiable requirements. Memorize that 18788 specifies requirements for a security operations management system and that certification is a separate conformity-assessment decision, not a clause of the standard.
Listing policy documents, risk registers, and training records as the SOMS itself rather than as outputs of the management system.
Candidates memorize clause headings and document names and then answer 'what is a SOMS' with a list of artifacts, missing the process-and-interaction view that the standard requires.
What to do instead
Define the SOMS as the set of interrelated processes, responsibilities, and resources used to direct and control security operations, then give documents as evidence that those processes operate. When asked to describe or evaluate a SOMS, structure answers as processes, inputs, outputs, controls, and performance feedback rather than as a document list.
Performing a context-of-the-organization analysis that lists only the provider's internal strengths and weaknesses, omitting the client's operating environment, the threat landscape, legal jurisdictions, human rights considerations, and affected stakeholders.
Candidates reuse a SWOT habit from general management courses and treat context as an internal exercise, whereas 18788 requires understanding external and internal issues relevant to the purpose and strategic direction of the SOMS, which for a security provider is dominated by external factors.
What to do instead
Use a structured PESTLE-plus template with explicit rows for client contractual environment, host-country legal and regulatory regimes, conflict or criminal threat profile, human rights and community sensitivities, and interested parties with their needs and expectations. Show how each issue is then carried into the risk assessment and into the scope statement.
Defining the SOMS scope as 'all security services provided by the organization' without stating boundaries, interfaces, locations, or the activities of subcontractors and joint-venture partners.
Candidates write a broad aspirational scope because it feels safer for certification, but broad scopes create unmanageable audit surfaces and leave outsourced functions unaddressed, which is exactly what assessors probe.
What to do instead
Draft scope statements that name the sites, service lines, client segments, and legal entities covered, and explicitly state how subcontracted guarding, logistics, or intelligence functions are controlled. Test the scope by asking whether every named activity has an owner, a risk assessment, and a monitoring method.
Producing a risk assessment that scores threats only by likelihood and impact on the provider's business, with no treatment options linked to human rights, use-of-force, or client-operations consequences.
Candidates default to a corporate risk matrix and forget that 18788's risk thinking is inseparable from responsible security operations, including avoiding complicity and respecting human rights in the delivery of services.
What to do instead
Add explicit risk categories for human rights impact, excessive or unlawful use of force, detention and arrest activities, discrimination, and community disruption, and require every treatment to name the control, the owner, and the residual risk accepted by an accountable manager. Practice writing treatments that combine preventive, detective, and corrective controls.
Designing controls as a policy statement alone, without the operational planning, resourcing, competency, communication, and documented information needed to make the control function.
Candidates treat 'implement' as 'write a procedure' and under-budget the enabling elements such as training, equipment maintenance, supervision, and records that auditors sample to test effectiveness.
What to do instead
For each planned control, produce a mini implementation plan covering who performs it, what competence and equipment are required, what record proves it happened, how often it is supervised, and what happens when it fails. Use a control-to-evidence matrix so each clause of the implementation plan maps to a verifiable artifact.
Treating competence and awareness as a single training-event requirement and answering questions with 'conduct annual training' only.
Candidates collapse the distinct requirements for determining necessary competence, ensuring persons are competent, and making personnel aware of the policy and their contribution to the SOMS, so they miss the evaluation-of-effectiveness step that auditors focus on.
What to do instead
Separate the answer into three parts: competence criteria per role (including use-of-force, human rights, and rules-of-engagement knowledge), evidence of qualification before independent duty, and evaluation of whether training changed field behavior, using supervision reports, incident trends, or post-training assessments.
Defining monitoring and measurement in terms of activity counts such as number of patrols or training hours, with no indicators tied to the effectiveness of controls or to client and community outcomes.
Counts are easy to collect and candidates equate measurability with volume, but performance evaluation under 18788 requires judging whether the SOMS achieves intended results, which needs outcome and compliance indicators.
What to do instead
Build an indicator set split into leading, lagging, and compliance measures, for example incident severity trends, complaints and grievances resolved within target, use-of-force reviews completed, audit findings closed on time, and client satisfaction. For each indicator state the method, frequency, responsible person, target, and the decision it triggers.
Describing management review and internal audit as annual paperwork events, and failing to show how their outputs feed corrective action, risk reassessment, and changes to the SOMS.
Candidates memorize clause headings and reproduce inputs and outputs as lists without the feedback loop, so they cannot answer scenario questions that ask what should happen after a nonconformity or a rising incident trend.
What to do instead
Draw the loop explicitly: monitoring data and audit findings feed management review, review decisions produce actions and resource changes, actions are tracked to closure, and residual risk and objectives are updated. Practice a worked scenario where a repeat nonconformity triggers root-cause analysis, a change to a control, and a follow-up audit.
Approaching certification as a document-submission exercise and preparing only a policy and procedure pack, with no internal audit completed, no management review held, and no evidence of corrective action before the stage 1 audit.
Candidates confuse the certification audit with a documentation check and underestimate the requirement for the SOMS to be operating and internally evaluated before the certification body assesses it.
What to do instead
Plan a readiness sequence: gap analysis, implementation of controls, a full internal audit cycle covering all clauses and scope, management review with recorded decisions, closure of nonconformities, then stage 1 and stage 2 preparation. Prepare an evidence index that maps each clause to records an auditor would sample, and rehearse interviews with process owners.