ISO 18788, ISO 9001, ICoCA and the Voluntary Principles: A Buyer's Guide

Four references, four different things

Security tenders often ask bidders to list their "certifications". The answers mix management system standards, association memberships and voluntary principles as if they were equivalent. They are not, and a buyer who understands the differences can ask much sharper questions.

In short: ISO 9001 and ISO 18788 are management system standards against which a provider can be certified by an independent certification body. ICoCA is an association that oversees an international code of conduct for private security providers. The Voluntary Principles are a human rights framework for companies managing security operations, usually in extractive and other high-risk sectors.

None of these references replaces site-level verification. A certificate shows that a management system existed and was audited at a point in time, within a defined scope. It does not prove that the guard on your night shift was trained, rested and properly briefed. Buyers should treat certification as evidence that supports, but does not replace, their own due diligence and audits.

ISO 9001: quality management

ISO 9001 sets requirements for a quality management system and applies to any sector. A new edition, ISO 9001:2026, was published on 16 September 2026, replacing ISO 9001:2015. ISO describes greater emphasis on leadership, a culture of quality and ethical behaviour, and clearer treatment of risks and opportunities.

Organisations certified to the 2015 edition will move to the new one over a transition period; confirm the exact arrangements and dates with the certification body concerned. For a buyer, ISO 9001 shows that processes are documented, audited and improved. It says little about security-specific issues such as use of force or human rights.

Pay attention to scope. A group can hold ISO 9001 for a head office or a single business line while its guarding operations in another country are outside the certificate. Always read the scope statement on the certificate itself.

ISO 18788: management of private security operations

ISO 18788:2015, "Management system for private security operations", is the security-specific standard. It provides a framework for establishing, running, monitoring, reviewing, maintaining and improving the management of security operations, and addresses client needs, legal compliance and respect for human rights. It was confirmed in 2021 and amended in 2024 to add climate action changes.

For buyers, it is the most directly relevant management standard for guarding and protection services. It is also one of the standards ICoCA recognises as a basis for its own certification of land-based security services.

When a provider claims ISO 18788, ask how the standard is applied in practice: how risks are assessed for each site, how rules on the use of force are set and trained, how incidents and complaints are recorded and investigated, and how lessons are fed back into procedures. These are the areas where the standard adds most value compared with a general quality certificate.

ICoCA and the Voluntary Principles

The International Code of Conduct Association (ICoCA), based in Geneva, is a multi-stakeholder initiative formed in 2013 to oversee the International Code of Conduct for Private Security Service Providers. Its members come from three pillars: governments, private security companies and civil society organisations. Its activities include certification, monitoring, capacity building and handling complaints.

ICoCA certification is not a stand-alone audit. A company must first hold external certification to a standard ICoCA recognises (PSC.1 or ISO 18788 for land-based services, ISO 28007 for maritime), issued by an accepted certification body, before applying.

The Voluntary Principles on Security and Human Rights, created in 2000, guide companies in maintaining security operations while respecting human rights. They cover risk assessment and relations with public and private security, and are promoted by a tripartite initiative of governments, companies and NGOs. A security provider does not get "certified" to the Voluntary Principles; rather, clients that have adopted them expect contractors to support their implementation.

For buyers outside the extractive sector, the Voluntary Principles are still a useful reference. Their initiative notes that they now apply across sectors such as energy, agriculture, infrastructure and manufacturing, and their focus on risk assessment and on clear rules for security providers translates well to large industrial and logistics sites.

What to ask a provider

ISO itself does not certify companies or issue certificates: certification is done by independent bodies, ideally accredited. Use the following questions to test any claim.

• Which standard and edition, which certification body, certificate number and expiry date?
• Is the certification body accredited, and by whom? (Accreditation can be checked with national accreditation bodies or IAF CertSearch.)
• What is the certificate's scope: which legal entities, countries, sites and services?
• For ICoCA: what is the company's exact status (member category or certified member)?
• For the Voluntary Principles: how does the provider support the client's implementation (training, incident reporting, use-of-force rules)?
• Can the provider share the latest audit summary and the status of corrective actions?

How IPN approaches this

IPN uses these references as a common baseline when assessing prospective national members, and expects certification claims to be documented with certificate numbers and scope. As the alliance is in its founding phase, certification status varies by member and should be checked country by country.