Theory
The audit passed and the network was flat
Certification scope is negotiated. A clean report describes the environment that was examined against the controls that were selected, at the time of the examination.
Three ordinary reasons a clean report coexists with weakness
Claim: observation
Scope: the systems that matter most operationally may sit outside the boundary that was assessed.
Design versus operation: a control can be well designed and tested on a small sample, which says little about the other eleven months.
Requirement level: many framework requirements ask whether a process exists, not whether it works, so an organisation can satisfy them completely without changing any attack outcome.
How to use certification
Claim: recommendation
Certification is often a condition of doing business and a reasonable source of requirements. Treat it as an input to the program and keep a separate, smaller set of outcome measures for the question of whether the organisation would survive.