PECB ISO 28000 Lead Auditor common mistakes
PECB ISO 28000 Lead Auditor · Understand the traps and how to avoid them.
Treating ISO 28000 as a pure physical-security or guarding standard, and answering questions as if CCTV, access control and guards were the core of the system rather than one type of control within a broader management system.
The word 'security' in the title invites association with guarding and loss prevention, and many candidates come from a facility-security background where the operational controls are the whole job. They skim the management-system clauses and over-weight Annex A controls.
What to do instead
Before answering, reframe every question as 'which clause of the management system requires this?' Learn the clause architecture (context, leadership, planning, support, operation, performance evaluation, improvement) and be able to place security-specific controls as evidence under those clauses rather than as substitutes for them. Practise writing one sentence per clause describing what a supply-chain security organisation must do at that clause.
Confusing ISO 28000 with ISO 28001, ISO 28002 and the ISO 28003 audit standard, and answering as if certification of an organisation and certification of a security plan were the same thing.
The 28000 family shares a number and similar titles, and candidates memorise the family loosely. Exam items that ask what a certification body certifies under ISO 28000 are then answered with the scope of a security management plan for a specific supply chain segment.
What to do instead
Build a one-line differentiator for each: ISO 28000 specifies requirements for a security management system for organisations in the supply chain; ISO 28001 covers best practices for implementing supply-chain security assessments and plans; ISO 28002 addresses resilience; ISO 28003 covers requirements for bodies auditing and certifying security management systems. Attach the differentiator to a concrete example and test yourself by sorting ten scenario stems into the right family member.
Answering 'the auditor must verify that the organisation has identified all security threats and risks and that the risk assessment is complete and correct' instead of judging whether the organisation's process for risk identification and assessment is defined, implemented and effective.
Candidates slip into a consultant mindset and believe the auditor's value comes from validating the technical quality of the risk assessment. ISO 28000 certification is against the requirements of the standard and the organisation's own criteria, not against the auditor's view of what risks exist.
What to do instead
Use a fixed two-part formulation in practice: (1) is there a defined and documented process meeting the clause requirement; (2) is there evidence it is applied consistently and its outputs feed decisions (controls, objectives, resources). Reserve technical judgement for whether the process is capable of producing valid results, not for substituting your own risk register. Drill with stems that offer both a 'verify the content is correct' option and a 'verify the process is defined and applied' option and justify why the second is right.
Treating the security management system as a stand-alone document set and missing the requirement to integrate security into the organisation's business processes, including its management review, objectives, and the interfaces with other parties in the supply chain.
Candidates study clause by clause in isolation and never build a mental model of how context, leadership, planning and operation interlock. They therefore miss items about top-management involvement, documented objectives and the requirement to consider security across the organisation's processes.
What to do instead
Draw the system as a flow: context and interested parties feed the scope and risk assessment; leadership sets policy and assigns roles; planning produces objectives and controls; operation executes them including outsourced processes; performance evaluation and improvement close the loop. For each link, write one audit question and one piece of objective evidence you would seek. Rehearse how a single finding, for example a missed risk review, propagates into objectives and controls.
Mixing up audit criteria, audit scope and audit objectives, and writing an audit plan that lists areas to be audited without stating the criteria against which conformity will be judged.
The three terms are introduced together and sound interchangeable. In practice plans are often written as a schedule of departments, and candidates copy that habit, so the criteria (ISO 28000, the organisation's own procedures, contractual and legal requirements) are never made explicit.
What to do instead
Memorise distinct definitions with a worked example: criteria are the set of requirements used as a reference; scope is the extent and boundaries of the audit (functions, sites, processes, time period); objectives are what the audit is intended to accomplish. In every practice plan, write three labelled lines at the top, one for each. If a stem describes a plan missing one of the three, that is usually the intended answer.
Conflating nonconformity with observation, opportunity for improvement and minor versus major nonconformity, and grading a systemic breakdown as minor because 'only one site was affected'.
Candidates grade by the size of the visible incident rather than by whether the management system requirement failed. A single missing record feels small, so it is graded minor even when the underlying process is absent across the organisation.
What to do instead
Grade by system effect, not by incident size. Ask: does the requirement fail to be met in a way that raises doubt about the system's ability to achieve its intended results, or is it an isolated lapse that the organisation's own process would catch? Practise by writing ten findings and for each stating the clause, the objective evidence, the requirement, and a one-sentence justification for the grade. Keep observations strictly separate: an observation states a risk of future nonconformity with no requirement currently breached.
Skipping a documented review of the organisation's context, interested parties, scope statement and risk methodology before drafting the audit plan, then discovering during the audit that the scope excludes a key logistics process.
Candidates want to move quickly to checklists and site schedules. Document review feels like paperwork, and the scope statement looks like boilerplate, so its boundaries and exclusions are not tested against the actual supply-chain activities.
What to do instead
Make document review a mandatory gate with a written output: a short memo listing the scope boundaries, justified exclusions, interested parties, the risk methodology, outsourced processes and previous audit results, plus a list of open questions. Cross-check the scope against the organisation's process map and contracts. Carry those open questions into the audit plan as explicit lines of enquiry, and treat an unjustified exclusion as a planned area of investigation rather than a surprise.
Building the audit plan as a tour of departments rather than a process-based plan with sampling rationale, and never documenting why particular sites, shifts or suppliers were selected.
Departmental schedules mirror the organisation chart and are easy to draft. Sampling rationale requires judgement about risk, past performance and process criticality, which candidates find harder to articulate, so it is omitted.
What to do instead
Structure the plan by process and by clause coverage, and add a sampling justification column: why this site, this shift, this logistics provider, this sample size. Tie each choice to risk significance, previous findings, volume of transactions or regulatory exposure. Verify coverage by producing a matrix of clauses against planned audit activities before finalising, and check that no clause is covered only by document review where operational evidence is needed.
Asking leading or closed questions during interviews and accepting verbal assurance ('we always do it that way') as sufficient evidence, then failing to trace the claim to records or observation.
Under time pressure candidates follow a checklist aloud, which produces yes/no answers, and a confident manager's statement feels like confirmation. The skill of probing for evidence is learned by practice and is rarely rehearsed before the exam.
What to do instead
Use open probes: 'show me', 'walk me through the last time', 'what happens if'. For each claim, name the evidence type you will seek: record, observation, interview corroboration or re-performance. In practice, take a statement such as 'all drivers are vetted' and write three follow-up questions and two evidence sources. In exam stems, prefer the option that triangulates evidence over the option that accepts assurance.
Drafting the audit report and closing the audit without verifying that corrective actions address root cause, and without checking that the audit conclusions are traceable to recorded findings and evidence.
Candidates treat report writing as summarising what was seen and corrective action as the organisation's private business. The requirement that actions address cause, and that the audit record supports the conclusion, gets lost at the end of a long audit.
What to do instead
Apply a root-cause test to every proposed action: does it change the process, or only fix the instance? Reject 'retrain the operator' as a sole action where the process lacked a control. Before closing, confirm the report's conclusions map one-to-one to findings, each finding has clause, evidence and requirement, and the audit record is complete enough for an independent reader to reach the same conclusion. Practise by taking a finding and writing a weak and a strong corrective action, then stating the test that separates them.
Designing an audit programme as a one-off certification audit and ignoring the requirement to plan the programme considering risk, previous results, and the need for surveillance and recertification cycles, plus competence of auditors and impartiality.
Candidates conflate the audit programme with a single audit. Programme-level requirements such as sequencing, resourcing, competence management and impartiality are abstract, so they are under-studied relative to the mechanics of one audit.
What to do instead
Keep the hierarchy explicit: programme (set of audits over time, owned by the programme manager) versus audit (one engagement, owned by the lead auditor). For programme questions, check four things: risk-based scheduling, use of previous audit results, auditor competence and evaluation, and impartiality including rotation and separation from consultancy. Draft a three-year programme for a logistics operator with justification for frequency and scope of each cycle, then test it against a scenario where a major nonconformity occurs.