Illustrative scenario. This is a hypothetical example designed to explain a common compliance challenge and a possible engagement approach. It does not describe a specific Kellwick client, completed project or verified outcome.
Illustrative scenario · Fintech / Payments
Lots of polished policy documents, a consultant who reviewed uploads to a shared drive, and a Head of Security who was no longer confident any of it would survive a real auditor.
The company had spent real money and produced a thick paper trail. The worry was not effort - it was whether the paper mapped to anything operating. A Mini Gap Review was the low-risk way to test that without tearing up the existing work.
Finding 01
Half the SoA asserted controls that had no operating evidence behind them.
Finding 02
Well-written policies that named no accountable owner and were not reflected in day-to-day process.
Finding 03
It existed, but leadership had never seen it, so it drove no decisions.
Finding 04
The person who wrote the controls was lined up to audit them - a finding waiting to happen.
Finding 05
The most sensitive system had the weakest evidence trail.
The engagement turns a box-ticking paper trail into evidence that could survive Stage 2. The prior consultant's usable work is kept; the gaps that would have caused nonconformities are addressed before the auditor finds them.
A consultant who reviews uploads to a shared drive produces documents, not readiness. If you cannot show the evidence behind each control, you do not have a control - you have a policy about one.
These are illustrative scenarios: hypothetical examples built from common ISO 27001 and GRC failure patterns, not accounts of Kellwick clients or completed projects. Company sizes, timelines and counts are assumptions for the example. Certification is always decided by an accredited certification body; we prepare teams for it and never guarantee the outcome.
Certification is performed by an accredited certification body through Stage 1 and Stage 2 audits. Kellwick prepares you for that process; it does not perform it and cannot guarantee its outcome.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.