> It seems like you've never tried to get it

I have. What I wrote was based on personal experience working for an ISO 27001 certified company and being very involved in the (successful) audit and recertification.

> You will not pass the independent audit if you're bad at security.

Incorrect. You will pass if you have all required processes documented and have documentation that show you follow those processes. Whether you actually do follow the processes is irrelevant, the auditor just needs to think you do.

Also, you can be incredibly bad at security and still be ISO 27001 certified. For example:

Process: Describes that employees use an encrypted password vault for secret management. Keys in the vault are rotated each year and when employees leave.

Reality: Keepass database is sent through email, the password is "CompanyNameVault2023!", which is shared in the same email. Keys are never rotated because it's annoying.

This will 100% get you ISO certified, in my experience at least.