Illustrative scenario. This is a hypothetical example designed to explain a common compliance challenge and a possible engagement approach. It does not describe a specific Kellwick client, completed project or verified outcome.
Illustrative scenario · SaaS (certified)
Certified 14 months ago, then attention moved on. With surveillance 90 days out, the risk register was stale, the internal audit had slipped, and a repeat nonconformity looked likely.
ISO 27001 does not stop at the certificate. The moment attention moves on, the risk register goes stale, evidence scatters and the internal audit slips. Surveillance auditors specifically look for this drift. The work was to close it quickly and then keep it closed without a full-time hire.
Finding 01
Scores had not moved in over a year - a clear signal to a surveillance auditor that the system is not operating.
Finding 02
The annual internal audit had lapsed entirely - a likely nonconformity on its own.
Finding 03
The review cadence stopped once the certificate was in hand.
Finding 04
Records were spread across Drive, Slack and spreadsheets, with no current index.
Finding 05
The last management review was the one done for certification.
The company would go into its surveillance visit with the drift addressed and the mandatory activities genuinely done - instead of hoping the auditor would not look. It could then run the ISMS on a light retainer rather than a fire drill every year.
The certificate is the start of the work, not the end. Surveillance auditors are trained to spot the ISMS that went quiet - the fix is a steady rhythm, not a scramble the quarter before the visit.
These are illustrative scenarios: hypothetical examples built from common ISO 27001 and GRC failure patterns, not accounts of Kellwick clients or completed projects. Company sizes, timelines and counts are assumptions for the example. Certification is always decided by an accredited certification body; we prepare teams for it and never guarantee the outcome.
Certification is performed by an accredited certification body through Stage 1 and Stage 2 audits. Kellwick prepares you for that process; it does not perform it and cannot guarantee its outcome.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.