Performance evaluation, monitoring and measurement of a SOMS based on ISO 18788
What the exam tests
This domain tests how you know the SOMS works: monitoring, measurement, analysis, evaluation, internal audit, and management review. Questions often ask what to measure and how to use the results.
Core rules and concepts
- Determine what needs monitoring, the methods, frequency, and who analyzes results.
- Use a mix of leading and lagging indicators: incidents, use-of-force events, complaints, near misses, training completion, audit findings, legal compliance, and corrective-action closure.
- Analyze and evaluate data against objectives and trends, not just report numbers.
- Internal audits must be planned, risk-based, objective, and documented; auditors should not audit their own work.
- Management review must receive relevant inputs and produce decisions and actions on improvement, resources, and risk.
Worked example
A guarding operation sets monthly indicators: patrol compliance, incident reports per 100 staff, use-of-force reviews completed, client complaints, and overdue corrective actions. After two months, patrol compliance falls while incidents rise at one site. The review links both to a new supervisor and incomplete training. Actions: retraining, supervision, and a follow-up audit. Reasoning: combining indicators reveals a likely cause; a single lagging metric would not.
Traps
Measuring only incidents. Setting indicators without targets or decision rules. Treating internal audit as a paperwork exercise. Holding management review with no decisions. Ignoring legal compliance evaluation. Reporting data without validating accuracy or privacy.