Security operations require consistency between contract commitments, site authority, and personnel decisions. When service locations expand, temporary shifts are added, or outsourcing changes, updating only the roster may miss the need to reassess competence and risk. ISO 18788 can provide a basis for organizing operational responsibilities and oversight.
Who may need this and when
Organizations providing or commissioning private security operations can assess applicability according to activities, locations, and contract scope. Review the system when a new service or customer requirement begins, a contractor changes, or an incident or complaint reveals a management gap.
Common business challenges
- The contract defines the service, but site personnel do not know which actions exceed their authority.
- Substitute or outsourced staff arrive without synchronized checks of qualifications, training, and handover.
- An incident is closed internally, but affected people cannot raise a complaint or receive a response.
- Management reports show attendance but lack information that reflects service risks and improvement.
Approach and applicable requirements
The ISO catalogue lists ISO 18788:2015 and Amendment 1:2024 as requirements and guidance for a private security operations management system. Its scope concerns professional services, legal responsibilities, human rights, and voluntary commitments; it grants no additional law-enforcement authority to an organization.
Possible scope includes services and legal authority; human-rights and operational risks; personnel qualifications and competence; contractor oversight; site command and handovers; incident reporting and investigation; complaints and remedy; and internal review. Complaint arrangements should consider confidentiality and protection of people raising concerns; they should not exist only as internal administrative records.
Support and work stages
Confirm service commitments and authority
Organize activities, locations, and contract responsibilities, marking matters that need separate legal or regulator confirmation.
Review personnel and contractor arrangements
Compare job-specific competence, training, rostering, and outsourced-work controls; prepare a qualification and oversight gap list.
Reconstruct handoffs and incident processes
Use an existing scenario to review how the site reports an incident, obtains a decision, preserves information, and handles complaints. Check whether responses to affected people are complete.
Track corrective action and operational performance
Plan required training, internal review, and management review. Outputs may include a responsibility-interface matrix, incident-process recommendations, and an improvement tracker.
Information to prepare
Prepare service and contract summaries, site and organization responsibilities, personnel qualification and training systems, shift handovers, contractor management, and de-identified incident and complaint information. Apply separate information-protection arrangements to sensitive security layouts and personal data as needed.
Assessing schedule and fees
Effort depends on the number of sites, activity differences, legal environment, contractors, and shift patterns. Operating permits, legal opinions, field duties, and specialist technical training need separate scope and cannot be replaced by system documents.
Frequently asked questions
Can a company that commissions security services use this standard?
It can assess applicability based on its commissioning and oversight responsibilities. The key is to define the division of work with the contractor.
Can a contract expand on-site authority by itself?
Service agreements remain subject to applicable law and lawful authority. A contract or standard cannot create additional powers.
Do attendance records prove personnel competence?
Evidence relevant to the role should also cover qualifications, competence, training, and oversight.
After outsourcing, is checking the supplier’s certificate enough?
A certificate does not replace oversight of the actual service, personnel, and incident handling.
Should complaints be limited to customers?
Provide appropriate channels for people affected by the activities, with clear confidentiality, handling, and response responsibilities.
Does completing a project establish legal eligibility and certification?
Legal operating eligibility, operational responsibilities, and third-party certification must be confirmed separately; one cannot be inferred from another.
Related services and enquiries
For continuity planning, see ISO 22301. When discussing operational-system needs with Captain International, describe the service type and handoffs you want to review.