Orchid Foods, a food manufacturer, connected plant-floor systems to the enterprise network for predictive maintenance. During the ISO/IEC 27001 lead auditor engagement, the team is reviewing stage 1 readiness. For an initial certification audit, policies exist but no internal audit or management review has occurred. Which conclusion or next audit action is most appropriate?
