I ask what the customer actually asked for
Then I read the clause. Most of what a company fears is required is not.
About
Bram HirschCompliance lead, founder
I have been audited. Most advisers have only audited.
I am Bram Hirsch. I spent twenty years running operations across more than 25 countries: shared services, process architecture, transitions and complex IT implementations, most recently as COO of a software company.
As COO I led an ISO 27001 certification with a full Statement of Applicability. I implemented SOC 2 alongside a financial-services supplier qualification. I led the company AI policy and aligned it to the EU AI Act. Earlier in my career I built an operating model ready for ISAE 3402 and ISO 27001.
I was nominated for a Gartner award for business process management. I treat compliance as a process someone owns, not a document someone produces. That is why I review everything that leaves this practice.
- ISO 27001Led certification as COO, full Statement of Applicability
- ISO 42001Led a company AI policy, aligned to the EU AI Act
- SOC 2Implemented, with a financial-services supplier qualification
- ISAE 3402Built an operating model ready for it
- 25+Countries of operations experience over twenty years
How I work
Three habits
I write the one-page version
A risk register the board reads beats sixty pages nobody opens.
I stay for the surveillance audit
A certificate is checked every year. The work that keeps it is quieter than the work that got it. It is the work that matters.