Where it began
FreshWave was chasing public sector work, and public sector buyers demand proof: certifications, audits, claims that survive independent checking. The danger in any assurance push is well known: an estate groomed for inspection day that drifts the moment attention moves on, then fails in front of exactly the audience it was built to convince.
The approach
A senior CyPro practitioner ran the engagement with the second inspection in mind, not the first. Controls were selected because the business could realistically operate them, engineering fixes were delivered rather than recommended, and evidence generation was folded into routines the company already ran. Certification was treated as a consequence of being secure rather than the goal.
Why it matters for AI governance
An AI management system faces the same trap with sharper teeth, because AI estates change faster than infrastructure ever did. A register compiled for one board meeting, or a policy written for one questionnaire, decays in weeks. The FreshWave discipline, controls the business can actually run and evidence produced by normal operation, is what we build into every ISO 42001 readiness programme and what the AI Responsible Officer retainer exists to sustain.
