# When Security Work Exists -But Security Confidence Doesn’t  > The article explains why many information security management systems (ISMS) fail to show that security work was done over time. It describes four things an ISMS should enable. Swiss GRC publishes it for security and compliance teams. - URL: https://swissgrc.com/en/when-security-work-exists-but-security-confidence-doesnt/ - Publisher: SwissGRC® - Published: 2026-05-05 - Last updated: 2026-09-17 ## Key facts - Swiss GRC argues that many ISMS fail in practice because of the gap between performing security and demonstrating it. - According to the article, the core problem is missing continuity rather than missing controls, because security is continuous while documentation is periodic. - The article names four requirements for an ISMS: security follows the asset, evidence is a by-product of work, the system reflects cross-functional responsibility, and monitoring matters more than documentation. - The article states that information security is not only an IT responsibility: HR triggers identity lifecycle events, procurement introduces vendor risks, business units classify data and legal defines obligations. - Swiss GRC says the difference between security as documentation and security as a system shows up during audits, incidents, customer due diligence and regulatory reviews. - The article states that an effective ISMS does not make a company more secure overnight, but makes security observable and therefore manageable. Most organizations today already *do* information security. They maintain asset lists. They run vulnerability scans. They review access rights. They write policies. Yet the uncomfortable moment still happens: “Can we prove this was controlled last quarter?” Silence. Not because the work wasn’t done – but because the work lives in different places. Security emails sit in inboxes. Risk registers sit in spreadsheets. Controls sit in documents. Ownership sits in people’s heads. So, when an audit, incident, or customer questionnaire arrives, teams don’t check security -they **reconstruct it.** That gap between performing security and demonstrating it is where many Information Security Management Systems (ISMS) fail in practice. The Real Problem Isn’t Missing Controls It’s Missing Continuity In theory, an ISMS is simple: identify assets, assess risks, apply controls, review regularly. Security is continuous while documentation is periodic. Teams assess risks when projects start, but not when environments change. Assets are listed during onboarding, but not during shadow IT growth. Controls are defined, but their operation isn’t visible over time. So, the organization becomes compliant at points -not secure over time. An ISMS software helps only if it changes how security work happens daily, not only during audits. What an ISMS Should Actually Enable **1. Security should follow the asset -not the spreadsheet** When a vulnerability appears, the key questions are always operational: - What system is affected? - Who owns it? - What data does it handle? - What risk does it create? If answers require three meetings and two exports, the ISMS is documentation, not management. A practical ISMS connects assets, risks, controls, and ownership so the impact is visible immediately -not compiled later. **2. Evidence should be a by-product of work** Security teams often spend more time proving actions than performing them. A mature ISMS approach means: You don’t prepare evidence. Evidence accumulates automatically as work happens. Reviews, approvals, risk assessments, and control checks leave a trail without someone consciously “creating audit proof.” **3. Security is cross-functional -the system should reflect that** Information security isn’t only IT’s responsibility: - HR trigger’s identity lifecycle events - Procurement introduces vendor risks - Business units classify data - Legal defines obligations If security depends on one department collecting updates from others, it becomes periodic. If each team works within a shared structure, it becomes continuous. **4. Monitoring matters more than documentation** Many organizations have perfectly written policies and still face incidents. Because the real question is not: “Was the control designed?” But: “Was the control working last Tuesday?” Continuous visibility -not policy completeness -defines operational security maturity. Where Tools Like Swiss GRC Fit In When security exists only as documentation, confidence depends on memory. When security exists as a system, confidence depends on records. That difference shows up during: - audits - incidents - customer due diligence - regulatory reviews Organizations don’t struggle because they lack security work. They struggle because they cannot see it over time. An [effective ISMS](https://swissgrc.com/en/information-security-management-isms-software/) doesn’t make a company “more secure” overnight. It makes security observable -and once something is observable, it becomes manageable. And that’s usually the point where security stops feeling like a yearly project and starts functioning like an everyday operation. The Practical Outcome When security exists only as documentation, confidence depends on memory. When security exists as a system, confidence depends on records. That difference shows up during: - audits - incidents - customer due diligence - regulatory reviews Organizations don’t struggle because they lack security work. They struggle because they cannot see it over time. An effective ISMS doesn’t make a company “more secure” overnight. It makes security observable -and once something is observable, it becomes manageable. And that’s usually the point where security stops feeling like a yearly project and starts functioning like an everyday operation. ## Frequently asked questions ### Why do ISMS fail in practice? According to Swiss GRC, many ISMS fail because of the gap between performing security and demonstrating it. The work exists, but it sits in inboxes, spreadsheets, documents and people's heads, so teams have to reconstruct it when an audit, incident or questionnaire arrives. ### What should an ISMS enable? The article names four points: security follows the asset instead of the spreadsheet, evidence accumulates as a by-product of work, the system reflects the cross-functional nature of security, and monitoring takes priority over documentation. ### What does it mean that evidence should be a by-product of work? Teams do not prepare evidence separately. Reviews, approvals, risk assessments and control checks leave a trail as work happens, without someone consciously creating audit proof. ### Why is monitoring more important than documentation in information security? Organizations can have well written policies and still face incidents. The article says the relevant question is whether a control was working last Tuesday, not whether it was designed, and that continuous visibility defines operational security maturity. ### When does the difference between documented and systematic security become visible? The article lists audits, incidents, customer due diligence and regulatory reviews. When security exists only as documentation, confidence depends on memory. When it exists as a system, confidence depends on records.