The letters ISMS stand for information security management system, and the word doing the most work in that phrase is the last one. A management system is meant to be a standing mechanism for making and reviewing decisions — risk treatment, resourcing, scope. What a lot of certified organizations actually operate is a binder: a set of policy documents produced once, updated before each surveillance audit, and otherwise untouched.How a System Becomes a BinderIt happens gradually, and usually for a reasonable-sounding reason each time: the risk register gets updated only when the auditor is coming, the internal audit becomes a document review rather than a test of whether anyone follows the document, and management review becomes a meeting where a slide deck confirms nothing changed. Each shortcut is individually defensible under time pressure. Together they produce a system that exists on paper and nowhere else.What the System Is Actually Meant to DoA risk register that changes between audits: because the business changed, not because the audit is approaching — new systems, new vendors, new regulatory obligations all belong in it as they arrive.Internal audit that tests behaviour, not just documentation: whether the access review actually happened this quarter, not whether a procedure describing it exists.Management review that can change direction: resourcing, scope or priority genuinely up for revision based on what the review surfaces, not a status update dressed as governance.Nonconformities that produce a different outcome, not just a closed ticket: a recurring finding should change the control, not just get remediated the same way each time it resurfaces.“A certificate proves the binder was complete on audit day. It does not prove the system inside it was ever switched on.”Why This Distinction Is Worth Making Out LoudThe gap between a working management system and a well-maintained binder does not usually show up in a surveillance audit — it shows up during an actual incident, when the risk register, the escalation path and the ownership the ISMS was supposed to establish either function under pressure or turn out to have only ever existed as a description of how things were meant to work.Share this articleX (Twitter)LinkedInFacebookCopy Link
ISMSJun 5, 2026The Management Review Meeting Nobody Prepares ForISO 27001's management review clause asks leadership to actually govern the ISMS. In practice it is often a status update nobody expects to change anything.
ComplianceJun 19, 2026Why Framework Mapping Beats Framework ChasingTreating each new regulatory framework as its own project produces duplicated evidence, duplicated policies and a compliance team that never catches up.
TPRMAug 14, 2026The Vendor Questionnaire Nobody Reads TwiceA security questionnaire completed once at onboarding and never revisited tells you what a vendor's environment looked like on one day — usually not the day that matters.
