Not blog posts in the SEO sense. Working notes from real audits, real implementations and the craft of running a management system that people actually use.
Featured
ISO/IEC 27001:2022
March 2026 · 9 min read
The 2022 revision moved secure coding out of ISO 27002 guidance and into a listed Annex A control. In practice, auditors haven't reinvented the assessment — they've formalised what they were probing anyway. Here's the pattern.
Read the noteThe desk
Notes are drafted between engagements — at the same desk we prepare audit files, review evidence and mark up standard revisions.
More from the journal
Auditors want evidence a decision was made and a process is running. Whether that lives in Confluence, Notion or a MS Word template is not the point — and hasn't been since 2015.
February 2026
42001 isn't a governance checklist bolted onto an ML pipeline. It's a management system in the ISO family sense — with the same clause structure and the same expectations of leadership.
January 2026
Distributed teams pass audits every day. The trick is deciding — before the auditor arrives — which time zone owns which clause, and getting that call in writing.
December 2025
Two standards can share one internal audit programme, one management review and one document control system. Here's how we structure it in engagements.
November 2025
There are competent QMS platforms. None of them behaved the way we, as consultants, needed a client workspace to behave — so we built one.
October 2025
Scope, standard and pressure. Get those three right and the engagement writes itself; get them wrong and everyone ends up unhappy at stage-2.
September 2025
The Practice Note
A short letter from the practice — one live audit pattern, one standard update, one thing we changed our mind about. Reply and a consultant reads it.
