What bugs me is so much of our (Australia's) government's policies over time have increasingly deferred to some ISO standard or another. These days most agencies / departments are stipulating some form of ISO27k compliance from vendors, a standard that can only be purchased from ISO.

Given we pay our taxes to the government, and I would have thought defining policy standards was one of the services we pay tax to have (what better thing for governments to do than what they're naturally geared towards - bureaucracy?), at the very least they would be able to directly and in detail outline the standards they expect and not simply handball the entire definition and auditing off to an international organisation and myriad consultancies with the stroke of a single bullet point requirement in the RFx.

The quagmire of ISO consultancies are often charging exorbitant rates to deliver essentially a set of Excel templates, when the hard work of adopting a standard really is all in-house and any company with a copy of the standards and the templates can pretty much get it all done internally then get certified.

And ultimately when it comes down to it, the standard doesn't really do much to improve quality outcomes, especially for an organisation that doesn't give a fig. A well intentioned company that's on the ball will already be following best practices, a shady company that plays cowboy will do the bare minimum to get the badge.

Anyway, just an axe I tend to grind. Standards definitely are needed and have their place but holy hell is it a mess ATM. There needs to be an independent open source standards body, ISO is a farce IMHO - the standards as they are written are actually decent but their business model and hands-off approach to auditing and verifying standard adherence is a big issue across multiple sectors I think.