Risk Professionals

14/10/2026

13/10/2026

Full ISO implementation is a different proposition from writing a few policies and running a workshop.

It is scoping and context, interested parties, risk and opportunity analysis. It is the policy set, the procedures, the controls, and the full Statement of Applicability. It is the internal audit, the management review, the corrective actions, and the certification body liaison through Stage 1 and Stage 2. It is the work it actually takes to get a management system from an idea on a page to a running operation that passes an external audit.

Risk Professionals runs end-to-end implementation for ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, and ISO/IEC 42001. Each engagement is shaped to the client’s scope, maturity, and timeline, so what we build is what fits, not a generic kit.

Our senior consultants have taken multiple organisations through successful first-time certification. The methodology is proven. The documentation is audit-ready. The handover is complete, so you own the system we build with you.

Book a scoping call within 48 hours at [email protected].

12/10/2026

Most organisations approaching ISO certification for the first time want the same thing from a gap assessment. A clear picture of where they stand against the standard, and a plan to close the distance.

What they do not want is a 200-page report that reads like a thesis and leaves them no better placed to act.

Our gap assessment is clause-by-clause, structured against the standard itself, and designed to produce a working output. Each clause is assessed, each gap is scored by effort and impact, and the result is a prioritised remediation plan with a realistic timeline to audit readiness. Boards can read it. Project teams can execute from it.

We cover gap assessments for ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, and ISO/IEC 42001. For organisations already certified, the same approach works as a surveillance-readiness check or as the baseline for a transition to a new edition of the standard.

The best time to find a gap is before the certification body does. The second best is before your next surveillance audit.

Book a scoping call within 48 hours at [email protected].

08/10/2026

ISO/TS 31050 focuses on emerging risks that are developing under conditions of uncertainty, change, and limited information.

Identify: Weak signals, emerging issues, uncertainty, and changing conditions that may indicate future risks.

Assess: Evaluate emerging and evolving risks by considering uncertainty, context, potential impact, and organisational exposure.

Treat: Develop fit-for-purpose strategies that can adapt as emerging risks change.

Monitor: Continuously observe changing contexts, signals, trends, and the effectiveness of risk responses.

Communicate: Build risk intelligence and communicate emerging risk information to support decision-making and organisational resilience.

The approach goes beyond traditional risk assessment. Emerging risks may not have established data, predictable patterns, or clearly defined impacts. Organisations therefore need to detect signals early, understand uncertainty, and continuously adapt their response.

The PECB Certified ISO/TS 31050 Emerging Risks Manager course covers the practical application of emerging risk management, including identifying weak signals, assessing uncertainty, developing treatment strategies, monitoring changing contexts, and strengthening risk intelligence.

The self-study course includes 300+ pages of material, practical examples, exercises and quizzes, 2 exam attempts, and 21 CPD credits.

Course fee: US$299.

Risk Professionals is a PECB Platinum Partner, providing ISO and risk management training, implementation, internal audit, and certification readiness support globally.

[email protected]
riskprofs.com

07/10/2026

A strong management system needs more than certification. It needs independent internal auditing to identify gaps, strengthen controls, and prepare your organisation for the certification audit.

Risk Professionals provides PECB-qualified, independent internal audits across:

ISO 9001 Quality Management
ISO 14001 Environmental Management
ISO 45001 Occupational Health & Safety
ISO/IEC 27001 Information Security
ISO/IEC 42001 AI Management

Our audits provide clear, evidence-based findings and practical insights to help your organisation improve before the external audit.

One audit team. Every standard. Greater certification confidence.

Book an internal audit with Risk Professionals.

06/10/2026

ISO 9001:2026 introduces important updates to Quality Management Systems, with stronger emphasis on quality culture, ethical behaviour, climate change, risks and opportunities, and organisational resilience.

As organisations prepare for the transition to the updated standard, understanding what has changed and how those changes affect your Quality Management System is essential.

Risk Professionals offers four PECB-certified ISO 9001:2026 training pathways designed for different stages of professional development:

Foundation: Build a strong understanding of ISO 9001:2026 principles, requirements, and key changes.

Lead Implementer: Learn how to plan, implement, maintain, and continually improve an effective Quality Management System aligned with ISO 9001:2026.

Lead Auditor: Develop the skills to plan, conduct, report, and follow up on ISO 9001:2026 audits.

Transition: Understand the key changes from ISO 9001:2015 and prepare your organisation for a smooth transition to ISO 9001:2026.

Whether you are starting your ISO journey, implementing a QMS, auditing organisations, or preparing for the transition, the right training can help you build practical knowledge and confidence.

Explore PECB-certified ISO 9001:2026 training with Risk Professionals.

05/10/2026

ISO 14001:2026 updates the Environmental Management System framework with stronger expectations around climate change, biodiversity, resource efficiency, and life-cycle thinking.

For organisations preparing for ISO 14001:2026 certification, Risk Professionals offers four PECB-certified training pathways:

Foundation: 2 days covering EMS fundamentals, Plan-Do-Check-Act, and key ISO 14001:2026 changes.

Lead Implementer: 5 days focused on designing, implementing, maintaining, and improving an ISO 14001:2026 Environmental Management System.

Lead Auditor: 5 days covering first-, second-, and third-party auditing using ISO 19011 methodology.

Transition: 2 days for organisations already certified to ISO 14001:2015, focusing on the key changes, impact assessment, and migration planning.

These ISO 14001:2026 training courses help sustainability professionals, environmental managers, consultants, auditors, and organisations prepare for the updated environmental management requirements.

Risk Professionals delivers PECB-certified ISO 14001:2026 training with live online learning, examination, and certification pathways.

Enrol or enquire: [email protected]
riskprofs.com

01/10/2026

Five days of structured learning on AI Risk Management, covering how to identify, assess, treat, and monitor risks across AI systems.

The PECB AI Risk Manager training uses the NIST AI Risk Management Framework (AI RMF) as its core methodology, explores key obligations under the EU AI Act, and uses the MIT AI Risk Repository as a reference taxonomy for AI-related risks and harms.

Designed for professionals responsible for AI governance and risk in practice, including risk managers, governance and compliance leads, information security professionals, and those developing AI risk assessments and AI governance frameworks.

31 CPD credits, 450+ pages of course material, and the PECB certification exam with two attempts.

From US$599. Self-paced.

Enrol at riskprofs.com/pecb-trainings.

30/09/2026

ISO/IEC 27001:2022 organises its Annex A controls into four themes rather than the fourteen domains of the 2013 edition.

Organizational (A.5): 37 controls covering policies, roles, information classification, supplier relationships, and incident management.

People (A.6): 8 controls covering screening, terms of employment, awareness, remote working, and the disciplinary process.

Physical (A.7): 14 controls covering secure areas, equipment, cabling, media handling, and clear desk.

Technological (A.8): 34 controls covering access, cryptography, logging, secure coding, data masking, and network segmentation.

That is 93 controls in total, down from 114 in the previous edition.

The restructure was more than cosmetic. Consolidating the domains gave the standard room to add 11 new controls that reflect how security actually works today: threat intelligence, information security for the use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding all appeared for the first time in the 2022 edition.

Every one of these controls needs to be considered in the Statement of Applicability. Every one needs a justification for inclusion or exclusion that reflects the reason the standard requires.

For organizations still working from the 2013 edition, the transition deadline has passed (31 October 2025). Any current ISO 27001 certification is now against the 2022 edition of the standard.

Risk Professionals supports organizations with ISO 27001 implementation, gap assessments, internal audits, and certification readiness across the globe. Get in touch at [email protected].

29/09/2026

Every certified organisation has one. It is mandatory under Clause 6.1.3(d) of ISO/IEC 27001:2022. It lists every Annex A control (93 in the current edition), records whether each applies to the organisation, and gives the reason.
Simple in structure. Endlessly muddled in practice.

The field that trips people up is the justification. The standard is clear about what belongs there: a reason for including or excluding the control. Everything else that ends up in that column, whether descriptions of what has been built, restatements of the applicability decision, or explanations that the project is still in flight, is off-brief.

A well-written justification for an included control might read: "Personal data is processed as part of core operations; access control is required to protect confidentiality." Anyone reading against the standard can see immediately why the control is in scope.

A poorly written one might read: "Applicable. Access control policy has been drafted and is currently being reviewed by IT before rollout." That reads like an implementation status update, not a reason for the control being in scope.

Why any of this matters:

The SoA is usually the first document an auditor looks at. It tells them how the organisation thinks about its control environment before they have opened a single policy or interviewed a single person. A tight, well-reasoned SoA sets the tone for the audit. A loose one signals that the rest of the ISMS may be similarly thin.

For anyone cleaning up an SoA ahead of a certification or surveillance audit, the fix is usually the same. Take out anything describing implementation or restating the applicability field. Leave the reason.

Risk Professionals supports organisations with ISO 27001 implementation, gap assessments, internal audits, and certification readiness across the globe. Get in touch at [email protected].