I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked.
Does that make any sense? Can hackers be aware that some particular company is certified? To my mind, if the company does not state it publicly, no one would ever know... Also, since this is a bank, it already inherently possesses some level of risk.