Implementing a SOMS based on ISO 18788
What the exam tests
This domain tests operationalization: turning requirements into controls, competence, communication, and evidence. Expect questions on operational planning, human rights due diligence, use of force, incident management, client contracts, and supply chain control.
Core rules and concepts
- Operational planning and control must be implemented under specified conditions, with criteria and controls proportional to risk.
- Human rights due diligence must be ongoing: identify impacts, integrate findings, track effectiveness, and communicate appropriately.
- Rules for use of force must be documented, communicated, trained, and reviewed after incidents.
- Incident management includes reporting, classification, investigation, corrective action, and confidentiality safeguards.
- Client contracts and subcontractor agreements must reflect SOMS requirements, including human rights and use-of-force expectations.
- Competence includes training, licensing, medical fitness where relevant, and verification of performance, not only certificates.
Worked example
A company implements incident reporting across 40 sites. It defines incident categories, including near misses, use-of-force events, complaints, and human rights allegations. It provides a mobile reporting channel, trains supervisors, assigns investigators, and reviews trends monthly. Reasoning: reporting only injuries would hide the events most relevant to security operations and human rights risk. Near misses and complaints are leading indicators.
Traps
Treating incident reporting as injury reporting only. Excluding subcontractors from operational control. Recording training attendance without verifying competence. Failing to review use-of-force reports. Accepting client-imposed practices that conflict with legal or human rights requirements. Implementing controls without monitoring whether they work.