Why does passing a certification not mean your governance actually works?

Passing a certification does not mean your governance actually works. A certification confirms that your organisation met a defined set of requirements at a specific point in time. It says nothing about whether those structures hold up in day-to-day operations, whether roles are genuinely followed, or whether the system adapts as your organisation changes. If you want to know more about how we approach this, feel free to get in touch with us. The sections below unpack the most important questions around this gap, from what certifications actually measure to how organisations can maintain real governance long after the audit is over.

What does a certification actually measure?

A certification measures conformance to a standard at the moment of assessment. Auditors verify that documented policies exist, that controls are in place, and that evidence of implementation can be produced. What they cannot verify is whether those controls operate consistently outside the audit window, or whether the people responsible for them understand their purpose.

Standards like ISO 27001, ISO 42001, and frameworks tied to NIS2 or DORA are built around a defined scope and a structured set of requirements. Meeting those requirements earns the certificate. But the assessment is inherently a snapshot. An auditor reviews samples, interviews key personnel, and checks documentation over a limited period. Organisations that prepare intensively for that window can pass without having embedded the underlying practices into their daily operations.

This is not a flaw in the standards themselves. It is a structural limitation of any point-in-time assessment. The standard defines what good governance looks like. The certification confirms you demonstrated it. Whether you live it is a different question entirely.

Why do certified organisations still experience governance failures?

Certified organisations experience governance failures because certification creates a false sense of completion. Once the certificate is issued, attention shifts elsewhere. Controls that were carefully documented for the audit are not maintained with the same rigour. Responsibilities that were clearly assigned on paper become blurred in practice as teams grow, roles change, and priorities compete.

Several patterns appear repeatedly in organisations that pass audits but still face incidents or regulatory scrutiny:

Audit-mode behaviour: Teams operate differently during an assessment period than they do the rest of the year. Governance becomes a project that gets activated before a renewal, not a permanent operating mode.
Key-person dependency: Governance knowledge concentrates in one or two individuals. When those people leave or change roles, the system quietly degrades.
Documentation without ownership: Policies exist but no one is accountable for keeping them current or ensuring they reflect actual practice.
Fragmented domains: Security, privacy, quality, and AI governance are managed in separate silos. Gaps form at the boundaries where no single team takes responsibility.

The result is what practitioners sometimes call governance drift: a gradual divergence between what the documentation says and what the organisation actually does. Drift is invisible until something goes wrong.

What is the difference between compliance and governance?

Compliance is the act of meeting a defined external requirement. Governance is the system that ensures your organisation makes sound decisions, manages risk continuously, and operates with accountability over time. Compliance is an outcome you achieve at a point in time. Governance is the capability that produces and sustains that outcome.

A useful way to think about this distinction is to ask what happens when no one is watching. A compliant organisation can demonstrate it met the standard when assessed. A well-governed organisation operates consistently whether or not an audit is approaching, because the structures, roles, and processes are embedded in how work actually gets done.

Compliance without governance is fragile. It depends on preparation cycles, external pressure, and the availability of specific individuals. Governance without compliance is incomplete, because it lacks the external validation that confirms the system is calibrated against recognised benchmarks. The two are not opposites, but they are not the same thing, and treating certification as the destination rather than as a waypoint is where many organisations go wrong.

How can you tell if your governance actually works?

You can tell your governance actually works when it operates without being triggered by an upcoming audit. The clearest indicators are behavioural and structural: accountability is exercised by the people assigned to it, incidents are identified and escalated through established channels, and governance documentation reflects current practice rather than aspirational policy.

Concrete signals that governance is functioning include:

Management actively reviews governance outputs, not just signs off on them
Roles and responsibilities are understood by the people who hold them, not just recorded in a RACI matrix
Changes to the organisation, such as new systems, new suppliers, or new processing activities, trigger a governance review as a matter of course
Findings from internal reviews lead to documented actions that are actually followed up
The governance system covers security, privacy, quality, and AI in an integrated way, so gaps at domain boundaries are visible

If your governance only becomes active in the months before a certification renewal, that is a reliable signal that the system is built for audits rather than for operations. Real governance is always on.

What happens to governance between certification cycles?

Between certification cycles, governance typically degrades. Without the external pressure of an approaching audit, the activities that maintain the system, such as risk reviews, policy updates, training, and internal audits, tend to slip down the priority list. Organisations that treat certification as a project rather than a continuous capability are especially vulnerable to this pattern.

The gap between a certification date and its renewal is often two to three years. In that period, organisations change significantly. Teams grow or restructure. New technologies are adopted. Suppliers change. Regulatory requirements evolve, as they have consistently across the EU, with NIS2, DORA, and the AI Act all coming into force in recent years. Each of these changes creates potential misalignment between the certified state and the current state.

By the time the next audit approaches, the gap has often grown large enough that organisations find themselves in a scramble to rebuild documentation, reassign responsibilities, and close controls that have quietly lapsed. This is governance drift in its most visible form, and it is almost entirely preventable with a different operating model.

Our governance services are built specifically around this 36-month certification cycle, maintaining the system continuously so that renewal is a confirmation rather than a reconstruction.

How should organisations maintain governance after passing a certification?

Organisations should maintain governance after passing a certification by treating the certificate as the beginning of an operational cycle, not the end of a project. This means assigning clear ownership for each governance domain, scheduling recurring activities that keep the system current, and ensuring that management reviews governance outputs regularly rather than only at renewal time.

Practically, continuous governance requires several things to be in place:

Permanent role assignment: Governance responsibilities must be held by named individuals with the authority and capacity to act on them, not delegated to a project team that disbands after the audit.
Scheduled review cadence: Risk assessments, policy reviews, and internal audits should run on a defined calendar that is independent of certification timelines.
Change management integration: When the organisation changes, governance must respond. New systems, new processing activities, and new regulatory requirements should trigger structured reviews.
Cross-domain visibility: Security, privacy, quality, and AI governance should be managed within a unified system so that interdependencies are visible and gaps at domain boundaries are caught early.
Management ownership: Governance cannot be delegated entirely to a compliance function. Senior management must own the outcomes, not just receive the reports.

The organisations that maintain effective governance between certification cycles are those that have moved from treating governance as a periodic exercise to treating it as a permanent organisational capability. That shift requires both the right structure and the right expertise to sustain it over time. If you are ready to make that shift, contact us to discuss how we can help your organisation build governance that works every day, not just on audit day.

Frequently Asked Questions

How do we know which certification standard is right for our organisation — ISO 27001, ISO 42001, NIS2, or something else?

The right standard depends on your organisation's industry, size, regulatory obligations, and the nature of the risks you need to manage. ISO 27001 is the most broadly applicable for information security, while ISO 42001 is specifically designed for organisations developing or deploying AI systems. NIS2 and DORA are regulatory requirements rather than voluntary standards, so if your organisation falls within their scope, compliance is mandatory regardless of which other certifications you hold. A governance assessment can help you map your obligations and identify the most strategic starting point.

What is governance drift, and how quickly can it set in after a successful audit?

Governance drift is the gradual divergence between what your documented policies and controls say and what your organisation actually does in practice. It can begin almost immediately after an audit closes, particularly if governance responsibilities were concentrated in a project team that disbands once the certificate is issued. Within six to twelve months, undocumented organisational changes, staff turnover, and shifting priorities can create meaningful gaps — and because drift is invisible until something goes wrong, it often goes undetected until the next renewal cycle forces a reckoning.

How much internal resource does it take to maintain governance continuously between certification cycles?

The resource requirement depends on your organisation's size, the number of domains covered, and how embedded governance already is in your operations. For most small to mid-sized organisations, continuous governance does not require a dedicated full-time team, but it does require clearly assigned part-time ownership across roles, a structured review calendar, and management time for oversight. Many organisations find it more efficient to work with an external governance partner who maintains the system on their behalf, reducing the internal burden while ensuring nothing lapses between cycles.

What are the most common mistakes organisations make when trying to build governance that lasts beyond the audit?

The most common mistake is treating governance as a documentation exercise rather than an operational one — producing policies that satisfy auditors but are never used to guide real decisions. A closely related mistake is concentrating governance knowledge in a single person or team, which creates a fragile system that degrades when key individuals leave. Organisations also frequently underestimate the importance of integrating governance with change management, meaning that new systems, suppliers, or regulatory requirements are adopted without triggering any structured governance review.

Can we use the same governance framework to cover security, privacy, AI, and quality, or do we need separate systems for each?

You can and should use an integrated governance system that covers all relevant domains. Separate silos for security, privacy, quality, and AI governance are one of the most common sources of gaps, because no single team takes responsibility for the boundaries between domains. An integrated approach uses a shared structure for risk management, policy ownership, internal audit, and management review, while allowing domain-specific requirements to be addressed within that common framework. This also makes cross-domain interdependencies visible — for example, where an AI system introduces both security and privacy risks simultaneously.

How should we handle governance when our organisation goes through significant changes, such as a merger, a new product launch, or a major technology adoption?

Significant organisational changes should automatically trigger a structured governance review rather than being absorbed informally. This means assessing how the change affects your risk landscape, whether existing controls remain adequate, whether documented policies need to be updated, and whether any new regulatory obligations apply. The key is to have a change management process that is explicitly connected to your governance system, so that business decisions and governance responses happen in parallel rather than governance catching up after the fact.

If we are starting from scratch with no existing governance structure, where should we begin?

Start by establishing clarity on three things: what your regulatory and contractual obligations actually are, who in your organisation will own governance responsibilities on a permanent basis, and what your most significant risks are. From that foundation, you can select the appropriate standard or framework, scope it correctly, and build documentation and controls that reflect how your organisation genuinely operates rather than how you wish it did. Engaging an experienced governance partner at this stage can accelerate the process significantly and help you avoid the common mistake of building a system designed for audit performance rather than operational effectiveness.

Navigation