A Statement of Applicability is a document in which an organisation lists all the controls from the standard's annex and decides, for each one, whether it is implementing it. If so, it states how it is implemented; if not, it must justify the exclusion. For an auditor it is the system's main map – they use it to select what to verify on the ground and to compare what is declared against the actual state. There are two most common problems. The first is excluding a control without a defensible reason, typically because the company simply didn't want to implement it. The second is the opposite: signing up to everything, which loads the company with obligations it cannot demonstrate with records. The document is kept alive and updated with every change in scope, every new system, and after every audit.
See also: Pre-certification gap analysis, AI management system, Register of AI systems.
