A net-zero pledge, a line about "responsible AI," a diversity statement in the annual report. None of it means much until it's attached to a system someone can actually audit. That’s the gap ISO management system standards exist to close. Not by writing better policy language. By forcing an organisation to assign owners, set measurable objectives, document how decisions get made, and submit to an independent audit that can revoke a certificate if the organisation stops doing