In many organisations, the Chief Information Security Officer (CISO) checks whether security safeguards have been implemented. In this context, the examination of the actual ISMS can often be forgotten because the CISO is part of the ISMS, and thus not impartial. Consequently, the processes of an ISMS may have been inefficiently or inappropriately implemented, resulting in an unintentionally low level of security for the organisation.