So should we just accept that, this is how it is? Or is there something, you can do to get more done and finish the project closer to the 4 month target than to the 12 month average?
Yes, there is, however it is not a silver bullet but rather a combination of a number of small things, that we have seen work (again here I assume, that you have basic requirements in place such as leadership support and ressources available):
Make it a higher priority, not just on a spreadsheet but in your mind. Think business improvement, efficiency, productivity, cost reduction etc. rather than certification when you think about the project. If you get your mind set this way, it will start to unconsciously get a higher priority.
Involve people from your team and the wider organisation and devolve the process responsibility to as many people as possible. Often we see, that it is more or less one person, who has to do it all and that person becomes a bottleneck. Delegating not only means better efficiency but typically also means better quality of the ISO 27001 management system, because these process owners have more knowledge about the process and where it could and should be improved. Hey this could even lead to higher employee engagement, because your staff are helping shape the way, they work.
Never let a week pass without doing anything on the project. Commit a number of hours, that you WILL, as a minimum, spend on the project each week. It could be something as little as 2-3 hours. You will be amazed of, how much you can get done in 3 hours and the project will not lose momentum and will keep moving forward.
Set some deadlines for yourself and the team and make small celebrations, when these deadlines are met. Yes, not rocket science.
Drop perfection. Approach the task with the notion of getting something, that is good and will work. There will be plenty of opportunity, once the ISO 27001 management system is running to measure, review and improve. In fact, the standard would expect you to do that.
Keep a checklist on your desktop and keep working this checklist as priorities change.
Always make sure you have the correct resource and have back filled the roles you’re expecting to be involved in the project. If a department can afford to loose someone for a period to be involved in the project, the chances are this isn’t the best person to be involved in the project (point added by Mike Andrews) .
Ok, so there you have it. I am sure, this list of advice could be longer, but I am conscious of number 5 plus the fact, that you are probably so busy with BAU, that reading a blog that is longer than this is highly unlikely.