This begs the question "why" is your organization ISO 9001 certified? What is top management hoping to achieve with the ISO 9001 certification? Is the certification simply to "fly the flag" or is there benefit intended to be gained (as there should indeed be).
1 - the ISO standard helped us achieve reduction in costs and lessen our risks in several areas. We saw it important to organize the company as it grew based on some outdate and disorganized practices. That is the benefit to be gained.
2 - Fly the flag... we do it only for pride. Again, it's completely irrelevant to our customers, because we work 99.9% with government biddings, where you can´t even use ISO as an "advantage". It's usually lowest price + certificates of non debt, certificates that X and Y service in Z and W quantities were already performed by the company, etc.
3 - Over 10 years ago, a brazilian standard for Housing (specially highrises) Quality Construction was created in Brazil. PBQP-H. Having it became a necessity or a helper to get credit lines from a State Bank usually involved with development projects.
The standard was based on ISO 9001 with some extra stuff added in. The standard was later extended to Civil Infrastructure, and there were federal projects to allow Governments (federal, state or municipal level) to require or accept (as extra factors) a PBQP-H certificate in public biddings.
So having an ISO and then getting our PBQP-H certificate was also eyeing that possibility, which would increase our chances in public biddings.
However, due to lobbying and judicial decisions based on Public Biddings Law, PBQP-H was NEVER accepted for public biddings. There are zero public biddings we have ever participated that require it. So without that real use, it ended up being only number 1 and 2.
What does "top management" say about the risk of having the certification pulled? Is top management not horrified and intent on ensuring the resources necessary to correct the problem?
They like the certification for reasons 1 and 2. The risk of having the certification pulled is more about the financial cost of re-doing it again from step 1.
Which will mean that if Top Management think the cost of stopping some departments to do the external audits amid a crucial time (election year, our income is through the roof and nobody has time to spare) is worse than the cost of re-doing the certification, they would opt for re-doing the certification. Plus the pandemic problem and the fact we can´t do online audits at job sites, because they are often remote and with poor internet connection.