Preparing for a SOMS certification audit
What the exam tests
This domain tests certification readiness: certification body selection, scope, evidence, audit stages, nonconformity handling, and surveillance. It asks how to demonstrate that the SOMS is implemented and effective.
Core rules and concepts
- Select an accredited certification body with competence in security operations and ISO 18788; agree the audit scope and criteria.
- Complete internal audit and management review before the certification audit; these are readiness requirements, not optional extras.
- Prepare evidence: policies, risk assessments, legal register, training records, incident records, client contracts, audit reports, and management review minutes.
- Stage 1 reviews readiness and documentation; Stage 2 evaluates implementation and effectiveness.
- Handle findings openly: correct, analyze cause, act, and provide evidence. Do not hide nonconformities.
- After certification, surveillance audits and recertification maintain the certificate; the scope must reflect actual operations.
Worked example
Eight weeks before Stage 2, a provider runs a readiness review. It samples five contracts, checks use-of-force training records, traces three incidents to corrective actions, and interviews guards and supervisors. It finds one subcontractor without a signed SOMS clause. The contract is amended and the supply-chain risk assessment updated before the audit. Reasoning: auditors test evidence across clauses, not just the existence of a manual.
Traps
Treating the certification body as a consultant. Defining a scope broader than the evidence supports. Skipping management review. Presenting documents without operational evidence. Arguing about findings instead of correcting them. Assuming the certificate removes the need for surveillance and continual improvement.