ISO 27001 certification: what auditors actually focus on versus what most teams spend time preparing

I've spent the past several years working in GRC, involved in multiple ISO 27001 certification audits across technology companies of different sizes and I see the same gaps come up every time. Figured it might be useful to share. The thing that catches most teams off guard isn't the technical contr