Blog
Evidently
Practical writing on ISO compliance, audits, and running a management system people don't hate.
Latest · Product
Why our AI cites clauses instead of sounding confident
Design notes on making AI findings verifiable — every verdict is tied to a clause and cites the passages it relied on, and a person decides what counts.
ISO 27001
The ISO 27001:2022 controls auditors keep raising after the transition
Three Annex A controls that are new in the 2022 revision keep turning into nonconformities — what auditors look for, and how to get them operational before your audit.
10 Jul 2026 · 5 min read
Audits
How to run an internal audit that isn't theater
Sampling that finds real problems, questions that aren't leading, and reports people read — for ISO 9001 and ISO 27001 internal audits.
2 Jul 2026 · 5 min read
ISO 9001
Clause 8.4: supplier control without a 40-tab spreadsheet
A minimal, defensible supplier evaluation process for ISO 9001 and ISO/IEC 27001 — and what auditors actually check.
24 Jun 2026 · 7 min read
ISO 27001
The Statement of Applicability is not a checkbox exercise
What clause 6.1.3 d actually requires, and how to justify inclusions and exclusions in a way that survives Stage 1 scrutiny.
3 Jun 2026 · 5 min read
Audits
Nonconformity root cause: beyond "human error"
Five whys done honestly, a worked example, and corrective actions that don't recur next cycle.
21 May 2026 · 6 min read
ISO 9001
Management review agendas that take 45 minutes, not 4 hours
Everything clause 9.3 requires, nothing it doesn't — with a sample agenda and a record that shows decisions, not just discussion.
8 May 2026 · 6 min read
No articles on this topic yet.