“I rarely see a certified organisation go beyond considering the controls described in Annex A” - Andrew Robinson takes you through his comments regarding ISO27001