In many organisations, the Chief Information Security Officer checks whether security safeguards have been implemented. However, the auditing of the ISMS itself is often forgotten, particularly because this should be done by an independent third party. As a consequence, the processes of an ISMS might be implemented inefficiently or inappropriately. The level of security of the respective organisation may thus be impaired.