An organization pursuing ISO/IEC 27001 for the first time usually budgets for a gap assessment, a remediation push, some consultancy and the certification body's fee. That budget is broadly right for year one. What it rarely includes is the management system itself, which is the part the standard is actually about and the part that runs forever.
The Standard Is a Management System, Not a Control List
Most of the attention in a first certification goes to the controls, because controls are concrete and can be implemented. But the requirements that cause the trouble later are the management ones: risk assessment on a defined basis, internal audit, management review, corrective action, continual improvement. These are not implemented. They are performed, repeatedly, and evidenced each time.
An organization can hold a valid certificate and still have a management system that only functions in the weeks before a surveillance visit. Nothing about the certificate reveals that, which is exactly why sophisticated customers have started asking questions the certificate does not answer.
The Annual Load Nobody Scopes
Risk assessment maintenance: the register has to reflect the organization as it currently is, which means revisiting it when the business changes, not annually by ritual.
Internal audit: a real programme covering the scope over a cycle, performed by someone sufficiently independent of what they are auditing.
Management review: a documented review with the required inputs, at which decisions are actually taken and recorded.
Corrective action: findings tracked to closure with root cause addressed, rather than closed by restating the control.
Scope and applicability upkeep: new systems, new locations and new suppliers move the boundary, and a stale statement of applicability is a common finding.
“The certificate proves you built a management system. Only the operating record proves you have been running one.”
Deciding Deliberately
None of this is an argument against certification, which is often commercially necessary and usually improves the organization. It is an argument for scoping the second year honestly at the point the first year is approved — either by resourcing the management system internally, or by placing it with someone whose continuing job it is. What does not work is assuming that the effort ends when the certificate arrives.
