The SoA Is a Control Story, Not a Checkbox List
Explain what a Statement of Applicability must prove and how to make it useful to control owners.
Two weeks before stage one, Leo exports a spreadsheet with 93 Annex A rows and a column that says "implemented" everywhere. The auditor will not fail the color green; they will fail the missing rationale behind it. > The SoA is the trace from risk to control to evidence. What the SoA proves The Statement of Applicability shows which Annex A controls are relevant, why they were selected or excluded, whether they are implemented, and where evidence lives. Why checkboxes fail A checkbox does not show risk-based selection. It does not tell a control owner what to operate or tell…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in