Many organisations spend significant time on ISO 27001 and information security, yet still face a high level of risk. This is often because the work is focused more on satisfying audits than on suppor...