Fable
A certificate and a monitoring room that never stops running
Two schools simultaneously applied for the qualification of a safety education demonstration school. School A spent three months fully revising all safety policies, invited external experts to inspect for two days, and received a golden plaque hung in the entrance hall. After the inspection ended, the fire drill records stopped at that month, and the visitor registration book was never updated after one page was turned.
School B did not have that plaque, but its security office had a complete process running year-round. Every morning they checked the surveillance cameras, every quarter they updated the emergency contact list, and before every large event they conducted a separate risk assessment. These actions were printed as a duty roster posted on the wall, and the homeroom teachers and logistics supervisors each had their own checklist. When the district came for a spot check and flipped through the logbook, they could see continuous records from the start of the school year to the present.
The district education bureau organized a surprise drill: simulating a fire in the third-floor wiring of a teaching building. At School A, teachers evacuated along routes they had been trained on six months earlier, but two of the three routes were blocked by temporary renovation, and the nearest fire extinguisher was locked in an equipment room whose lock had been changed. At School B, because escape routes were inspected monthly, new evacuation maps had been drawn in advance and posted on every floor during the renovation, and the entire drill ran without a break.
The post-event evaluation report was written very restrainedly: School A's problem is that the plaque proved that on one day back then the system met the standard requirements. School B had no plaque, but its daily operating records proved that safety management is a living daily action, and inspection is just a convenient look.
Later, when the two schools merged their security assessment files, they adopted unified naming: the number on School A's plaque corresponded to ISO 27001 certification — proof that a certain audit was passed. School B's duty rosters, checklists, and drill records corresponded to the ISMS — a management system running every day.
The merged security team set a rule: a certificate only tells outsiders that you can be trusted with this system, but the system itself must continue operating independently of the certificate. The days of scrambling to add documents before an audit were banned—if something is not running in normal times, the certificate obtained is merely decoration.
Looking back three years later, School B had also obtained certification—but when the auditor came, they did not even open a new project; they directly sampled three months of data from existing operational records and completed the audit. The certificate became a natural byproduct of daily system operation, rather than an independent goal.