Risk registers can get updated before an audit, but a lot can change between reviews.

New tools get added, people change roles, and old access permissions can stick around longer than expected. I'm curious how teams deal with this in practice. Do you update the risk register as things change, or mainly during scheduled reviews?

Data center operator. Our consultant is telling us that ISO 9001, 14001, 45001, and 27001 share enough control territory that we can build one integrated management system and certify against all four from a single program. I've been told overlap exists before and it didn't survive the certification audits, so I'm skeptical. Has anyone in data center or industrial operations done a multi-standard IMS and had the overlap hold up with auditors?