PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free PECB ISO 18788 Lead Auditor Practice Questions

Prepare for the PECB Certified ISO 18788 Lead Auditor exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
Not published Pass Rate
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More PECB ISO Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

PECB ISO 14001 Lead Auditor (Environmental Management)

Practice QuestionsStudy Guide

PECB ISO 9001 Lead Auditor (Quality Management)

Practice QuestionsStudy Guide

PECB Certified ISO 31000 Risk Manager

Practice QuestionsStudy Guide

PECB ISO 45001 Lead Auditor (OH&S Management)

Practice Questions

PECB ISO 22301 Lead Implementer (Business Continuity)

Practice Questions

PECB ISO 45001 Foundation (OH&S Management)

Practice Questions
2026 Statistics

Key Facts: PECB ISO 18788 Lead Auditor Exam

12 Questions

Official Exam Format (75 points)

PECB Candidate Handbook ISO 18788 Lead Auditor (2026)

3 Hours

Exam Time Limit

PECB Training Catalog (Lead exams: 3 hours)

70%

Passing Score

PECB Candidate Handbook ISO 18788 Lead Auditor (2026)

Open Book

Exam Delivery Mode (standard + course materials + notes)

PECB Candidate Handbook ISO 18788 Lead Auditor (2026)

46.69%

Exam Points on Conducting the Audit (Domain 5)

PECB Candidate Handbook ISO 18788 Lead Auditor (2026)

300 Hours

Audit Experience for Lead Auditor Credential

PECB ISO 18788 Credential Requirements

7 Domains

Official Competency Domains

PECB Candidate Handbook ISO 18788 Lead Auditor (2026)

3 Years

Certification Validity (CPD + AMF maintenance)

PECB Certification Maintenance Policy

PECB ISO 18788 Lead Auditor certifies the competence to audit a Security Operations Management System against ISO 18788:2015. The official exam is a 12-question, open-book, 3-hour assessment with a 70% passing score across seven domains, nearly half of its points on conducting the audit. This free bank uses four-option English MCQs as an independent study adaptation of the audited knowledge, not a simulation of the official exam format.

Sample PECB ISO 18788 Lead Auditor Practice Questions

Try these sample questions to test your PECB ISO 18788 Lead Auditor exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1An auditor begins an ISO 18788 audit engagement. Which statement about the standard's intended application should frame the audit?
A.It provides a business and risk management framework for organizations conducting or contracting security operations, particularly where governance may be weak or the rule of law undermined, demonstrating accountability to law and respect for human rights
B.It is a code of practice offering recommended good practice for private security companies, which the auditor assesses for reasonable adoption rather than for auditable conformity
C.It applies to organizations providing armed security services in armed conflict, with unarmed guarding and consultancy activities falling outside the certifiable scope
D.It certifies that an organization holds the legal authority required to guard, transport and question persons detained by law enforcement in its country of operations
Explanation: ISO 18788 provides a business and risk management framework for organizations conducting or contracting security operations, aimed at circumstances where governance may be weak or the rule of law undermined, demonstrating professional conduct, accountability to law, respect for human rights and consistency with voluntary commitments.
2During an ISO 18788 audit, which documents serve as the normative foundation that the audited SOMS must demonstrably implement?
A.The Montreux Document, the ICoC and the UN Guiding Principles on Business and Human Rights, together with ISO Guide 73 vocabulary
B.The Geneva Conventions, the Hague Conventions and the ICRC Interpretive Guidance on Direct Participation in Hostilities, which Clause 2 lists as normative references
C.ISO 19011 and ISO/IEC 17021-1, which the standard adopts normatively so that the SOMS and its audit follow a single methodology
D.The UN Global Compact Ten Principles and the Universal Declaration of Human Rights, adopted as the standard's normative human rights baseline
Explanation: ISO 18788's Clause 2 normative references are ISO Guide 73:2009, the Montreux Document (2008), the ICoC (2010) and the UN Guiding Principles on Business and Human Rights (2011). Clause 4.4 requires the SOMS to implement the principles and commitments of the ICoC.
3ISO 18788 Clause 3.2 defines an audit as:
A.A systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled
B.A systematic and documented process for obtaining evidence of conformity, conducted by a party independent of the organization being assessed
C.A systematic, independent and documented process for verifying that an organization's controls are effective and that its stated objectives have been achieved
D.A systematic, independent and documented process for identifying nonconformities and determining the corrective actions the organization must implement
Explanation: Clause 3.2 adopts the ISO 19011 definition: a systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Audits can be internal (first party) or external (second or third party), and can be combined.
4Why does an ISO 18788 auditor need to understand the Montreux Document even though it is addressed to states?
A.Because ISO 18788 notes that although specifically addressed to states and armed conflict, the Montreux Document is also instructive in similar conditions and for other entities, and the standard provides a means to implement its legal obligations and good practices
B.Because Clause 8.3.1 requires an organization operating without authorized rules for the use of force to base its procedures on the Montreux Document alone, without reference to other international guidance
C.Because the Montreux Document sets the binding treaty obligations that private security companies assume directly on signing the International Code of Conduct
D.Because the Montreux Document supersedes the ICoC where an organization operates in a country experiencing armed conflict rather than general weak governance
Explanation: The Introduction notes the Montreux Document, though addressed to states and armed conflict, is instructive in similar conditions and for other entities, and ISO 18788 provides organizations a means to implement its legal obligations and recommended good practices. Auditors therefore assess how the SOMS operationalizes those obligations.
5Which ISO 18788 definition should an auditor apply when evaluating whether an organization has properly identified events requiring incident procedures?
A.An incident is an event with consequences that has the capacity to cause loss of life, harm to assets, or negatively impact human rights and fundamental freedoms of internal or external stakeholders
B.An incident is an occurrence or change that interrupts planned activities, operations or functions, whether anticipated or unanticipated
C.An incident is an occurrence or change with the potential to cause loss of life, harm to assets or negative human rights impacts, whether or not consequences follow
D.An incident is an event with consequences that results in loss of life or physical injury to the organization's personnel or to persons under its protection
Explanation: Definition 3.21 ties 'incident' to an event with consequences capable of causing loss of life, asset harm, or negative human rights impacts on stakeholders. Auditors test whether the organization's incident management procedures (8.8) capture this full range, not only weapon events or complaints.
6An auditee claims its SOMS conforms because it follows 'the PDCA cycle'. Which mapping of ISO 18788 clauses to PDCA is correct for audit purposes?
A.Plan — Clauses 4, 5, 6 and 7; Do — Clause 8; Check — Clause 9; Act — Clause 10
B.Plan — Clauses 4, 5 and 6; Do — Clauses 7 and 8; Check — Clause 9; Act — Clause 10
C.Plan — Clauses 4 and 5; Do — Clauses 6, 7 and 8; Check — Clauses 9 and 10; Act — the management review outputs
D.Plan — Clauses 4 to 7; Do — Clauses 8 and 9; Check — Clause 10; Act — the corrective action process
Explanation: ISO 18788 is built on the Plan-Do-Check-Act model: context, leadership, planning and support (Clauses 4-7) map to Plan; operation (Clause 8) to Do; performance evaluation (Clause 9) to Check; and improvement (Clause 10) to Act.
7While reviewing a risk assessment, an auditor looks for the human rights risk analysis (HRRA). Which characteristic confirms a conforming HRRA under ISO 18788?
A.It is a documented process to identify, analyse, evaluate and document human rights-related risks and impacts, undertaken at regular intervals and involving meaningful engagement with stakeholders whose rights may be at risk
B.It is a documented analysis of the human rights risks the organization's personnel face in the country of operations, refreshed whenever the security situation deteriorates materially
C.It is a documented screening process establishing that no person working on the organization's behalf has a recorded history of human rights violations, repeated at each contract renewal
D.It is a documented analysis of the severity of human rights impacts, completed once during SOMS implementation and reviewed by the certification body at each surveillance audit
Explanation: Definition 3.20 and its notes require the HRRA to identify, analyse, evaluate and document human rights risks and impacts, to consider the operational context, draw on human rights expertise, involve direct meaningful engagement with at-risk stakeholders, and be undertaken at regular intervals because human rights risks change over time.
8An auditor verifies the auditee's Statement of Conformance. Which combination of evidence demonstrates conformity with Clause 5.1.2?
A.A documented, maintained and implemented statement committing to the ICoC, Montreux Document, UN Guiding Principles and other applicable commitments; publicly available; communicated internally and externally; visibly endorsed by top management
B.A documented statement committing to the named human rights instruments, signed by the compliance director and issued to all personnel and subcontractors with the Code of Ethics
C.A documented statement published on the organization's website committing to national law and the client's contractual human rights clauses, endorsed by top management
D.A documented and publicly available statement committing to the ICoC and the Montreux Document, reviewed annually by the board and communicated internally to all personnel
Explanation: Clause 5.1.2 requires the Statement of Conformance to commit to the named international instruments, be documented, maintained and implemented, publicly available, communicated internally and externally to all relevant stakeholders, and visibly endorsed by top management, and to stipulate human rights expectations of stakeholders linked to operations.
9An auditee's Statement of Applicability excludes all Annex A guidance on use of force even though its guards carry firearms. Under Clause 4.3, how should an auditor treat this?
A.As a likely nonconformity: where the risk assessment and human rights analysis identify Annex A clauses as relevant to scope, legal obligations and operating environment, they shall be addressed and implemented, and exclusions must be justified and documented
B.As acceptable, because Annex A is informative guidance and Clause 4.3 leaves the choice of applicable Annex A clauses to the organization's own judgement
C.As acceptable, provided the organization's use of force procedures under Clause 8.3 are documented, since Annex A guidance duplicates those operational requirements
D.As an observation rather than a nonconformity, to be raised as an opportunity for improvement and verified at the first surveillance audit
Explanation: Clause 4.3 requires the Statement of Applicability to define relevant Annex A clauses based on the risk assessment and human rights impact analysis; identified relevant clauses shall be addressed and implemented, and specific exclusions with justifications documented. An armed operation excluding use-of-force guidance lacks credible justification.
10While auditing legal and other requirements (Clause 6.1.2), an auditor should expect the organization to have considered the laws of:
A.The country of the organization, the countries of its personnel, the country of operations and the country of the client
B.The country of operations and the country of the client, with the personnel's home jurisdictions covered by their individual employment contracts
C.The country of the organization and the country of operations, since the client's jurisdiction reaches the organization only through contractual rather than legal requirements
D.The country of operations and any jurisdiction whose law the contract nominates as governing the engagement between the organization and its client
Explanation: The note to Clause 6.1.2 states national laws can include those of the country of the organization, the countries of its personnel, the country of operations and the country of the client. An audit of 6.1.2 tests whether all these jurisdictions were identified and how requirements apply to subcontractors and joint ventures.

About the PECB ISO 18788 Lead Auditor Exam

Lead-level certification validating the expertise to plan, conduct, close and manage audits of Security Operations Management Systems against ISO 18788:2015, applying ISO 19011 audit principles and the ISO/IEC 17021-1 certification process to the standard's distinctive requirements: human rights risk analysis, use of force rules, personnel vetting, weapons management, grievance mechanisms and incident management in environments of weak governance.

Assessment

Seven competency domains with official handbook weights (% of exam points): Domain 1 SOMS fundamental principles 6.67%; Domain 2 SOMS and ISO 18788 requirements 6.67%; Domain 3 fundamental audit concepts and principles 20.01%; Domain 4 preparing an ISO 18788 audit 6.67%; Domain 5 conducting an ISO 18788 audit 46.69%; Domain 6 closing an ISO 18788 audit 6.67%; Domain 7 managing an ISO 18788 audit programme 6.67%.

Time Limit

180 minutes

Passing Score

70%

Exam Fee

Included with PECB training course (first attempt, one free retake, certification application fee and first-year AMF included in course price). Standalone: US$1,000 Lead exam plus US$500 certification application fee (PECB)

PECB ISO 18788 Lead Auditor Exam Content Outline

6.67% of exam points

Domain 1: Fundamental principles and concepts of a SOMS

SOMS purpose, PDCA, Montreux Document, ICoC, UN Guiding Principles, and key ISO 18788 definitions framing audit criteria

6.67% of exam points

Domain 2: SOMS and ISO 18788 requirements

ISO 18788:2015 Clauses 4-10 as audit criteria, from context and risk criteria through use of force, vetting, incidents and improvement

20.01% of exam points

Domain 3: Fundamental audit concepts and principles

Seven ISO 19011 principles, audit definitions and types, sampling, and the ISO/IEC 17021-1 certification process

6.67% of exam points

Domain 4: Preparing an ISO 18788 audit

Initiation, feasibility, document review, audit plans, team selection, and work documents including test plans

46.69% of exam points

Domain 5: Conducting an ISO 18788 audit

Opening meetings, evidence collection, applying ISO 18788 clauses in operational scenarios, findings and nonconformity grading, and handling obstacles

6.67% of exam points

Domain 6: Closing an ISO 18788 audit

Closing meetings, conclusions, report content, corrective action evaluation, follow-up verification and the certification decision

6.67% of exam points

Domain 7: Managing an ISO 18788 audit programme

Programme objectives, risks and opportunities, auditor competence, records, monitoring, review and improvement

How to Pass the PECB ISO 18788 Lead Auditor Exam

What You Need to Know

  • Passing score: 70%
  • Assessment: Seven competency domains with official handbook weights (% of exam points): Domain 1 SOMS fundamental principles 6.67%; Domain 2 SOMS and ISO 18788 requirements 6.67%; Domain 3 fundamental audit concepts and principles 20.01%; Domain 4 preparing an ISO 18788 audit 6.67%; Domain 5 conducting an ISO 18788 audit 46.69%; Domain 6 closing an ISO 18788 audit 6.67%; Domain 7 managing an ISO 18788 audit programme 6.67%.
  • Time limit: 180 minutes
  • Exam fee: Included with PECB training course (first attempt, one free retake, certification application fee and first-year AMF included in course price). Standalone: US$1,000 Lead exam plus US$500 certification application fee

Keys to Passing

  • Complete 500+ practice questions
  • Score 80%+ consistently before scheduling
  • Focus on highest-weighted sections
  • Use our AI tutor for tough concepts

PECB ISO 18788 Lead Auditor Study Tips from Top Performers

1Learn the official domain weights and invest accordingly: conducting the audit (Domain 5) is 46.69% of points and audit concepts (Domain 3) another 20.01%
2Master the seven ISO 19011 principles word-perfectly — integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach — and recognize scenario violations of each
3Know the certification cycle: stage 1 (documentation and readiness), stage 2 (implementation and effectiveness), surveillance at least annually, recertification on a three-year cycle, with certification decisions made independently of the audit team
4Be able to apply ISO 18788 clauses as audit criteria: what objective evidence demonstrates conformity, and what a well-formed nonconformity statement (criteria + evidence + extent) looks like
5Drill the distinctive SOMS audit targets: Statement of Conformance, Statement of Applicability, HRRA, RUF-based use of force procedures, weapon-specific written authorizations, seven-year record retention, 12-month use-of-force training, annual exercises
6Practice corrective action evaluation: a conforming plan addresses the root cause, is specific and implementable, and can be verified for effectiveness during follow-up

Frequently Asked Questions

What is the PECB ISO 18788 Lead Auditor exam format?

The official exam is a 12-question, 75-point open-book exam completed in 3 hours with a 70% passing score, delivered online via PECB Exams or paper-based through partners. Permitted references include the ISO 18788 standard, training materials, personal notes and a hard-copy dictionary. The PECB candidate handbook (Version 3.2) states this exam comprises essay-type questions and notes that PECB will progressively transition its exams to open-book, scenario-based multiple choice; candidates should confirm the format for their sitting via the List of PECB Exams.

How is the exam weighted across domains?

Per the official candidate handbook: Domain 5, conducting an ISO 18788 audit, carries 46.69% of points; Domain 3, fundamental audit concepts and principles, carries 20.01%; and Domains 1, 2, 4, 6 and 7 each carry 6.67%. The exam also splits between comprehension/application/analysis questions (5 of 12) and evaluation-level questions (7 of 12).

What credential tiers exist for PECB ISO 18788 auditors?

Four tiers, all requiring the Lead Auditor exam (or accepted equivalent) and signing the PECB Code of Ethics: Provisional Auditor (no experience), Auditor (2 years professional experience including 1 year in security operations management and 200 audit hours), Lead Auditor (5 years including 2 in the field and 300 audit hours), and Senior Lead Auditor (10 years including 7 in the field and 1,000 audit hours).

What does an ISO 18788 audit cover that generic audits do not?

SOMS audits test the standard's distinctive human-rights-critical controls: the Statement of Conformance and Statement of Applicability, the documented risk assessment with human rights risk analysis, use of force procedures and the force continuum, weapons authorization and accountability, personnel vetting (including the eighteen-year minimum for armed duties), grievance and whistle-blower mechanisms, and incident reporting and investigation — all in contexts where governance may be weak.

How much does the PECB ISO 18788 Lead Auditor exam cost?

With a PECB partner training course, the fee bundles the first exam attempt, one free retake, the certification application fee and the first-year Annual Maintenance Fee, completed within 12 months. Standalone, PECB publishes a US$1,000 Lead exam fee plus a US$500 certification application fee.

Is this practice test the official PECB exam?

No. OpenExamPrep provides free English multiple-choice practice questions as an independent study aid. It is not affiliated with PECB and does not replace official training or the live exam. The official assessment is a 12-question open-book exam; this bank uses 100 four-option questions with no time limit to build the underlying knowledge and judgment, not to simulate the official format.