Of all the documents in an ISO 27001 programme, the Statement of Applicability (SoA) has the highest scrutiny-to-size ratio. It's one table. Auditors read it first, and they test everything else against it.
What it is
The SoA lists all 93 Annex A controls and states, for each one: whether it applies to you, why (or why not), and how it's implemented. It's the bridge between your risk assessment and your actual security programme, the document that proves your control selection was reasoned rather than copied.
What auditors actually check
- Traceability: every included control should trace to a risk, a legal requirement, or a business decision. "Included because the template included it" is the classic red flag.
- Justified exclusions: excluding a control is fine; excluding it without a defensible reason is a nonconformity. A remote-first company can exclude physical-perimeter controls, with a sentence explaining why.
- Implementation truth: if the SoA says a control is implemented, the auditor will ask to see it. The table must match reality on the day, not ambition from six months ago.
- Version discipline: the SoA changes as your company changes. A stale SoA implies a stale ISMS.
The three classic failure modes
The template SoA, all 93 controls marked "applicable, implemented", copied from a consultant's boilerplate; falls apart at the first "show me". The heroic spreadsheet, hand-maintained, correct on the day it was written, decaying ever since. The orphan, an SoA disconnected from the risk register, so the justifications and the risks tell different stories.
The SoA is a mapping document: risks → controls → implementations → evidence. Mapping is what software is for.
Generate it, then own it
In Certixa, the SoA is generated from data that already exists: your risk register proposes inclusions, your connected tools witness implementations, and exclusions carry AI-drafted justifications scoped to your actual business. When a control's status changes, the SoA updates, version-controlled, always current, and ready for the auditor's first question. See how it fits the wider document set in the ISO 27001 guide.