| A lot of startups move fast with a small team. You build something great and big corporation X wants to buy a subscription but you need to be certified. Much of this is a good checklist but some of it is very european. "Where is the risk register to track controls in your 7 person company?" Now instead of doing what your team does best, you are doing paperwork theater for frameworks designed for a 100,000 employee enterprise. You are documenting things nobody will read, making up processes that don't exist and translating the operations of a lean company into bureaucratic language. What's needed is a variant of these standards for small teams, which is proportionate and pragmatic. |
For small teams it doesn’t have to be heavyweight. A risk register can be a simple doc with a few real risks and mitigations.
That said, I agree there’s a lot of theater. For smaller companies and budgets, it often turns into rubber stamping. Auditors rely on the evidence you provide, so the report can look much cleaner than day to day reality.
Still, it has value. It forces you to formalize basic practices, and if you want those customers, you’re signing up for that level of scrutiny.