The Statement of Applicability, generated from what you did
The SoA is a view over your controls and records, not a spreadsheet you fill. Every Annex A control is listed; an exclusion needs a justification sentence.
The Statement of Applicability is the document both ISO management-system standards require under their clause 6.1.3: every Annex A control, whether it applies, how it is implemented, and — for a control you exclude — why.
A view, not a form
In Veritome the ISO/IEC 42001 SoA is generated from the programme. Each of the 38 Annex A controls reads its state from the steps and controls that address it:
- Implemented — an approved step (or one done by overlap) satisfies it, or a control you linked by hand carries verified evidence.
- Assigned — a control is linked but its evidence is not yet verified.
- Residue — nothing addresses it yet: justify an exclusion, or schedule a control with an owner and a date.
The SoA step opens pre-filled from that state — labelled "Pre-filled from your programme" — on its empty fields only; the first edit is yours. What the tooling cannot write is the justification sentence for anything you exclude. The standard requires that sentence and the auditor will read it, so approval refuses an exclusion that names an Annex A control with fewer than six words of reason, or a control key that is not in Annex A at all.
The ISO/IEC 27001 programme has its own risk-treatment and SoA step in its Plan phase, produced from the four theme records over the 93 controls; its statement is written in that record rather than generated as a view.
Controls that are yours
Controls lists only the controls your organisation actually runs: the ones approved steps produced, plus any you created by hand. The catalogue rows — the Annex A items themselves — are requirements, not controls; they appear in the SoA and the Coverage matrix, never as empty rows waiting to be ticked. The header reads Produced by your programmes with the count of controls, requirements covered and Annex A items still in residue, and Decide the residue takes you to the SoA step.
Exporting
The sealed SoA PDF is issued from Documents (Statement of Applicability, an organisation-wide document) and minted as evidence with its hash. Frameworks → Coverage exports the requirement matrix as CSV for an auditor who wants the whole map.