Free PECB ISO 18788 Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB ISO 18788 Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which definition describes the full scope of an asset under ISO 18788?

   1. A.Anything of tangible or intangible value to an organization.Correct answer: A
   2. B.Only physical property owned by an organization.
   3. C.Only items recorded on an organization's balance sheet.
   4. D.Only resources used directly by security personnel.

   Explanation: ISO 18788 defines an asset as "anything that has tangible or intangible value to an organization". The definition is not limited to owned physical property, accounting entries or security personnel.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.1

2. 2What does a security operations policy express in an ISO 18788 SOMS?

   1. A.The security incidents recorded during a defined period.
   2. B.The risk levels estimated for particular security threats.
   3. C.The measurable targets selected for individual functions.
   4. D.The organization's overall security operations intentions and direction.Correct answer: D

   Explanation: ISO 18788 describes the policy as the "overall intentions and direction of an organization (3.34) related to security operations" formally expressed by top management. Individual targets and estimates are not the policy definition.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.66

3. 3How does ISO 18788 define competence in security operations management?

   1. A.The assignment of responsibility for a security operation.
   2. B.The authority to approve a security operations policy.
   3. C.The ability to apply knowledge and skills to achieve intended results.Correct answer: C
   4. D.The possession of documented qualifications regardless of results.

   Explanation: ISO 18788 defines competence as the "ability to apply knowledge and skills to achieve intended results". Qualifications and assigned authority are not the definition.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.5

4. 4Which organizational role formally expresses the security operations policy under ISO 18788?

   1. A.The organization's top management.Correct answer: A
   2. B.The organization's internal audit team.
   3. C.The organization's risk assessment team.
   4. D.The organization's incident response team.

   Explanation: ISO 18788 defines the security operations policy as the organization's intentions and direction "as formally expressed by top management". Audit, risk assessment and incident response are different functions.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.66

5. 5In security operations risk management, what is consultation intended to provide before a decision?

   1. A.An informed two-way dialogue that can influence the decision.Correct answer: A
   2. B.A binding vote by every external stakeholder.
   3. C.A joint decision that replaces management accountability.
   4. D.A one-way announcement of an already approved decision.

   Explanation: ISO describes consultation as a "two-way process of informed communication" before a decision. It influences decision making without being joint decision making.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.6, Note 2 to entry

6. 6How do security operations objectives generally relate to the security operations policy?

   1. A.They apply only after the policy has been withdrawn.
   2. B.They are generally based on the policy.Correct answer: B
   3. C.They must be independent of the policy.
   4. D.They replace the policy after implementation.

   Explanation: The standard states that the security operations policy "provides a framework for the setting of security operations objectives". The objectives are generally based on the policy, rather than replacing it.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.66 Note 1 to entry

7. 7Which statement describes continual improvement in ISO 18788?

   1. A.A single review conducted after certification.
   2. B.A one-time action to approve security objectives.
   3. C.A recurring activity to replace all performance measures.
   4. D.A recurring activity to enhance performance.Correct answer: D

   Explanation: Continual improvement is a "recurring activity to enhance performance". It is not a single review or a requirement to replace all measures.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.9

8. 8What does planning focus on within an ISO 18788 security operations system?

   1. A.Reviewing the system's suitability and effectiveness against objectives.
   2. B.Evaluating whether risk levels meet established risk criteria.
   3. C.Setting objectives and the processes and resources needed to achieve them.Correct answer: C
   4. D.Measuring results achieved against existing performance targets.

   Explanation: ISO 18788 describes planning as "part of management focused on setting security operations objectives (3.65) and specifying necessary operational processes (3.43) and related resources" to fulfil those objectives.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.37

9. 9Which statement about a risk consequence is consistent with ISO 18788?

   1. A.A consequence must always be a financial loss.
   2. B.A consequence can have a positive or negative effect on objectives.Correct answer: B
   3. C.A consequence must be known with certainty before an event.
   4. D.A consequence can only be described using numerical values.

   Explanation: The definition notes that a consequence "can have positive or negative effects on objectives". It can also be uncertain and expressed qualitatively or quantitatively.

   Reference: ISO 18788:2015 Management system for private security operations — Clause 3.10, Note 2 to entry

10. 10A team fixes a detected failure to meet a documented requirement. How is that immediate action classified?

    1. A.Action to eliminate the cause and prevent recurrence.
    2. B.Action to eliminate a potential cause before occurrence.
    3. C.Action to document the detected nonconformity.
    4. D.Action to eliminate the detected nonconformity.Correct answer: D

    Explanation: ISO 18788 defines correction as "action to eliminate a detected nonconformity". The question describes the immediate fix, not action on its cause.

    Reference: ISO 18788:2015 Management system for private security operations — Clause 3.11