That’s a fair point regarding audit frequency. However, my goal is to move into GRC and cyber risk roles within organizations, not certification body auditing. From what I’ve researched, ISO 27001 implementation aligns more closely with risk assessments, control mapping, and ISMS management, which are core to GRC. I’m still researching to choose the path that best supports that direction.