Blog
Evidently
Practical writing on ISO compliance, audits, and running a management system people don't hate.
Featured · ISO 27001
The 2022 transition gaps auditors are actually raising, one year in
Three Annex A controls that are new in the 2022 revision keep turning into nonconformities — and what to do about them before your audit.
Major nonconformities by control
Audits
How to run an internal audit that isn't theater
Sampling that finds real problems, questions that aren't leading, and reports people read.
Jul 1, 2026
ISO 9001
Clause 8.4: supplier control without a 40-tab spreadsheet
A minimal, defensible supplier evaluation process — and what auditors actually check.
Jun 23, 2026
Product
Why our AI cites clauses instead of sounding confident
Design notes on making AI findings verifiable — every claim links to the control and the evidence.
Jun 11, 2026
ISO 27001
The Statement of Applicability is not a checkbox exercise
How to justify exclusions in a way that survives Stage 1 scrutiny.
Jun 2, 2026
Audits
Nonconformity root cause: beyond "human error"
Five whys done honestly, and corrective actions that don't recur next cycle.
May 20, 2026
ISO 9001
Management review agendas that take 45 minutes, not 4 hours
Everything clause 9.3 requires, nothing it doesn't.
May 7, 2026