Keep the audit focused on the management system
ISO 18788 concerns management arrangements for private security operations. An auditor evaluates the system and evidence against agreed criteria; the role is different from commanding a security operation or issuing legal authority. PECB's auditor credential concerns individual competence under its certification scheme, while an organisation's certification is a separate assessment.
This work needs an understanding of context, operational risks and the consequences of misconduct. A written security policy is only a starting point. The auditor needs evidence that responsibilities, competence, reporting and oversight influence what personnel actually do during an assignment.
Establish the operational context
Before sampling, understand the contract, locations, stakeholders, subcontractors and decision authority. Identify how applicable obligations and client requirements are translated into operational instructions. Clarify which parts of the assignment are included in scope and where interfaces require further evidence. Avoid assuming that one site represents every operation.
Illustrative exercise: a provider adds a subcontracted team at a new facility. Review how it checks competence, communicates instructions, supervises work and receives concerns. The provider may outsource an activity without removing the need to manage the associated responsibilities and risks.
Trace decisions rather than collecting policies
Select an operational event and follow the chain from authorisation through execution, reporting and review. Ask how staff know the boundaries of their authority and when to escalate. Compare training records, duty instructions and incident records with interviews. Look for consistent evidence rather than relying on the most confident explanation.
For example, examine a complaint about inappropriate conduct during an access-control interaction. Establish how the complaint was received, protected from interference, investigated and resolved by authorised people. An absence of complaints is not automatically evidence of good performance if the reporting route is inaccessible.
Evaluate accountability and improvement
Assess whether management receives meaningful information about incidents, grievances, competence gaps and subcontractor performance. Review how findings result in action. A closed action should show what changed and how effectiveness was evaluated, not only that a reminder email was sent.
Practise writing an evidence-based finding where a subcontractor has not received the current instructions. Identify the criterion, sample and gap precisely. Do not make allegations beyond the evidence or substitute legal advice for the organisation's authorised legal process. Protect sensitive personnel and operational information in working papers.
Build the professional route responsibly
PECB publishes auditor levels with different examination, professional and audit-experience requirements. Confirm the current table for the exact designation and retain verifiable activity records. A security-management background can be valuable, but operational experience is not automatically equivalent to eligible audit experience.
Study with cases covering audit planning, evidence evaluation, findings and follow-up. Confirm the booked exam format and permitted materials. The strategic contribution of this learning is better oversight of security operations, not a promise of employment or legal authority. Choose assignments within your competence and develop sector knowledge alongside auditing skill.
Official references
Certification requirements and programme terms can change. Use the issuer’s current page and your account to confirm details before applying or paying.