You Passed ISO 27001. Your Auditor Was in the Building for Two Days.
You passed ISO 27001. A certification body sent auditors to your site. They reviewed documents, interviewed staff, looked at a sample of your controls, and issued a certificate. The certificate says you have an Information Security Management System that meets the standard.
What the certificate does not say: whether any of the controls in that ISMS are actually working, whether the people operating those controls understand what they are doing, or whether the risks identified in your risk assessment are the risks that will actually hurt you.
ISO 27001 is a framework for building an ISMS. It is not a measure of security effectiveness. The certificate confirms process existence, not outcome quality. This distinction matters more than most organizations want to acknowledge when the certificate is framed and on the wall.
What the Audit Actually Looked At
A surveillance audit typically runs one to three days for a mid-sized organization. A certification audit covers more ground, but it is still sampling against an annex of 93 controls across 11 themes. The auditors review documentation, interview selected staff, and check evidence against stated procedures.
They are not running your SIEM. They are not testing whether your endpoint detection catches common attack techniques. They are not verifying whether your encryption is implemented correctly or whether your key management is sound. They are checking whether you have documented evidence that the control exists and that you follow a process for operating it.
The difference between "a policy says we patch within 30 days" and "systems are actually patched within 30 days" is measurable. ISO 27001 certification does not measure it.
The Risk Assessment Problem
The standard requires a risk assessment. Most organizations complete one, identify risks, treat them, and document the treatment. The problem is that most risk assessments are conducted to pass the audit, not to actually understand the threat landscape.
A risk assessment that lists generic threats ("unauthorized access," "data loss," "malware infection") with qualitative likelihood and impact scores, treats each with a corresponding control from Annex A, and checks the resulting residual risk as acceptable is a document that satisfies auditors. It is not a risk assessment that tells you what is actually likely to happen to your organization.
The organizations that use their risk assessment as a live operational tool - ones that revisit it when the threat landscape changes, when they change their architecture, when a new attack technique becomes prevalent - have something useful. The ones that refresh it 60 days before their surveillance audit have a document.
What Gets Missed
The areas where ISO 27001 certified organizations consistently underperform:
Supply chain security. Annex A has a control for it. Having a policy and a vendor questionnaire satisfies the audit. Having actual visibility into what third parties can access, do, and have done in your environment is a different capability that most certified organizations do not have.
Incident detection. A certified ISMS requires an incident management process. It does not require that your detection tooling is actually capable of finding the incidents you are most likely to face. Many certified organizations have incident management procedures for incidents they are told about, and no meaningful detection capability for incidents they are not.
Control testing. Certification confirms that controls exist. Many organizations do not systematically test whether their controls work. A backup procedure that has never been tested against a recovery scenario may satisfy the control documentation requirement but will not satisfy you at 2am when you need to restore from it.
The Surveillance Audit Gap
Certification requires a surveillance audit every 12 months and recertification every three years. A 12-month audit cycle means an organization can implement a control for the audit, let it atrophy for 11 months, refresh it before the next surveillance visit, and maintain certification.
This is not theoretical. Control drift happens at almost every organization between audits. The question is whether drift is caught and corrected by internal monitoring or by external pressure. Organizations that rely primarily on the external audit cycle to catch control failures are in a permanently reactive posture, and they will be surprised by a real incident in the gap between the audit and the next one.
What a Working ISMS Actually Looks Like
A genuinely functional ISMS has a few properties that distinguish it from a certification-oriented one.
Controls are tested internally, on a schedule that is not tied to audit preparation. Not all 93 controls simultaneously, but a rolling review that covers the highest-risk areas frequently enough to catch drift before it becomes a problem.
The risk assessment is a living document that the security team actually uses to prioritize work. When something changes in the environment or the threat landscape, the risk register gets updated, not because an audit is coming, but because the assessment is how work gets prioritized.
Management review is substantive. The standard requires management involvement in the ISMS. In organizations where this works, management review is where security metrics are challenged, where resource allocation decisions get made, and where the security program gets held accountable for outcomes. In organizations where it does not work, it is a meeting where slides are presented and minutes are taken.
The Certificate Is Not the Wrong Goal
ISO 27001 certification is not without value. The framework is coherent. The control set is reasonable. Having a certified ISMS signals to customers and partners that you have at minimum invested in building the documented structure of a security program.
The mistake is treating the certificate as an outcome rather than a starting point. Certification says the scaffolding exists. What the organization builds on that scaffolding is what determines whether it provides actual security - and that part is not something an auditor coming in for two days is going to tell you.