SaaS (certified)
Certified 14 months ago, then attention moved on. With surveillance 90 days out, the risk register was stale, the internal audit had slipped, and a repeat nonconformity looked likely.
ISO 27001 does not stop at the certificate. The moment attention moves on, the risk register goes stale, evidence scatters and the internal audit slips. Surveillance auditors specifically look for this drift. The work was to close it quickly and then keep it closed without a full-time hire.
Finding 01
Scores had not moved in over a year - a clear signal to a surveillance auditor that the system is not operating.
Finding 02
The annual internal audit had lapsed entirely - a likely nonconformity on its own.
Finding 03
The review cadence stopped once the certificate was in hand.
Finding 04
Records were spread across Drive, Slack and spreadsheets, with no current index.
Finding 05
The last management review was the one done for certification.
The company went into its surveillance visit with the drift closed and the mandatory activities genuinely done - instead of hoping the auditor would not look. It now runs the ISMS on a light retainer rather than a fire drill every year.
The certificate is the start of the work, not the end. Surveillance auditors are trained to spot the ISMS that went quiet - the fix is a steady rhythm, not a scramble the quarter before the visit.
These are representative engagements - detailed, realistic walkthroughs built from the ISO 27001 failure patterns we see most often, not accounts of specific named clients. Certification is always decided by an accredited certification body; we prepare teams for it and never guarantee the outcome.
Certification is performed by an accredited certification body through Stage 1 and Stage 2 audits. Kellwick prepares you for that process; it does not perform it and cannot guarantee its outcome.
Kellwick is an independent advisory practice. We are not a certification body and do not issue ISO certifications. Certification decisions are made only by accredited certification bodies.