Draw a boundary that matches the service customers actually buy.
Scope and context
A governed scope statement, owners and linked context documents keep the boundary explicit.
Monday, 08:45 · One overdue action
An overdue action is rarely about the action.
It is Monday. One ISO action has been open for six weeks. When Lea asks who owns it, three people look at each other. The certification body will arrive eventually and ask a harder version of the same question. Certification itself is awarded only by an independent accredited certification body.
Monday, 08:45 · Overdue, and nobody is sure whose it is
What the session had to settle
A policy can exist and still lack the evidence an auditor needs.
Gap analysis
A structured review can connect each gap to an owner, action and source document.
Risks, controls and justifications drift when they live in separate sheets.
Risk treatment and SoA
A planned risk and SoA workspace will connect treatment decisions to controls and evidence.
Show that controls operate, not only that a policy was written.
Implementation and evidence
Versioned documents, actions, owners and linked evidence create a traceable working record.
Findings and corrective actions need visible follow-through.
Internal audit and management review
Planned audit and management-review workflows will keep findings, decisions and actions together.
The external auditor asks for precise evidence across the agreed scope.
Stage 1 and Stage 2
Lea can prepare controlled evidence packs and give scoped reviewer access.
After certification, reviews, risks and controls keep changing.
Continual improvement
Review dates, change history and actions keep the ISMS active between surveillance audits.
So she books the room and works through it once.
Scope, gaps, risks, controls, evidence, audit. Not as a checklist to admire, but as a set of decisions that need a name against each one. The flipchart gets messy. Two items get crossed out and rewritten. One question stays unresolved and is left visible rather than quietly dropped.
Available in the vault today
- Versioned, linked documents
- Roles, rules and process registers
- Actions with owners and due dates
- Cited answers and controlled exports
Build scope before first customer use
- Guided clause and Annex A gap analysis
- Risk register and treatment plan
- Structured Statement of Applicability
- Internal audit, findings and corrective actions
- Management review and surveillance reminders
The win is not a tidy wall. It is a trail.
What the room produced is a record: what was decided, who owns the next action, when it is due and which evidence the next review can inspect. When the auditor asks in four months, nobody restarts the hunt, and nobody spends the weekend before Stage 2 reconstructing a year.
iquerion can support preparation and evidence. It cannot certify an organisation or guarantee an audit result.