Introduction

While monitoring observes controls, measurement quantifies them, and analysis compares performance against objectives, it is evaluation that answers the critical question:

👉 Are we achieving our intended outcomes, and what must we do differently?

Clause 9.1 of ISO 18788:2015 requires organizations to systematically evaluate performance at operational, tactical, and strategic levels, ensuring that performance results are not only captured but also used to inform governance decisions, resource allocation, and continual improvement.

Why Evaluation Matters

1. Strategic Assurance - Provides the Board, CEO, and Executive team with a holistic view of whether the SOMS delivers on commitments (client expectations, VPSHR, ISO standards).
2. Prioritization of Resources - Ensures that investments are directed where they provide the greatest improvement to performance and risk reduction.
3. Accountability - Holds managers and staff accountable by evaluating outcomes, not just activities.
4. Improvement Decisions - Identifies where corrective or preventive actions must be applied.
5. Audit and Certification Readiness - Demonstrates to auditors and clients that performance management is not superficial but part of a closed-loop system.

The Evaluation Process

1. Consolidate Results

Gather all monitoring records, measurements (KPIs/KRIs), and analytical findings into a Performance Evaluation Report.

2. Compared to Objectives and Agreements

• Strategic Objectives: Set by Board/CEO (e.g., compliance with ISO 18788, VPSHR).
• Tactical Objectives: Set by divisional managers (e.g., reducing unauthorized entries, OHS performance).
• Operational Objectives: Daily/shift-level expectations (e.g., patrols, alarm response times).

3. Determine Performance Outcomes

• Achieved: Performance meets or exceeds objectives.
• Partially Achieved: Performance is close but not fully meeting objectives.
• Not Achieved: Objectives are missed, requiring escalation.

4. Apply Risk-Based Evaluation

• Assess the risk implications of missed objectives (e.g., reputational, financial, legal, human rights).
• Prioritize high-risk failures for urgent action.

5. Report and Recommend

• Document findings in management review reports.
• Provide recommendations for policy updates, resourcing, or corrective actions.

Example of Evaluation in Practice

Based on the Performance Analysis Dashboard:

• Strategic Objective: Ensure compliance with VPSHR and ISO 18788.
• Evaluation: Largely achieved, minor non-conformance → requires refresher training.
• Tactical Objective: Reduce unauthorized entries by 30%.
• Evaluation: Not achieved, only 15% reduction → indicates control gaps at perimeter security.
• Operational Objective: 100% patrol completion.
• Evaluation: Partially achieved, 95% completion → requires reinforcement of supervision.
• Operational Objective: Response time to alarms < 5 minutes.
• Evaluation: Not achieved (7 minutes average) → requires resource reallocation.

This evaluation feeds into management reviews and Board-level decisions, ensuring that risks and objectives are addressed in governance and resourcing.

Documentation and Audit Evidence

Auditors will expect:

• Performance Evaluation Reports: Summarizing results, outcomes, and conclusions.
• Management Review Minutes: Showing leadership involvement in evaluating results.
• Corrective Action Plans: Based on evaluation findings.
• Trend Analysis Reports: Demonstrating progress over time.
• Evidence of Stakeholder Communication: Where evaluation results impact client commitments or community trust.

Conclusion

Evaluation is the capstone of performance management under ISO 18788 Clause 9.1. It transforms monitoring, measurement, and analysis into decisions and actions.

By systematically evaluating whether objectives are achieved at all levels—strategic, tactical, and operational—organizations create a closed-loop system of continual improvement.

This ensures that ISO 18788 is not just a compliance framework but a tool for governance, resilience, and stakeholder assurance.