Part I · Chapter 1 · The Ask · lesson 3
Two answers to the same question, written for different readers
13 min
Part I · Chapter 1 · The Ask · lesson 3
13 min
Two companies down the road from each other do roughly the same work. Both get asked the same question by the same kind of buyer. One of them ends up with a certificate — a single page, with a scope sentence on it and a registration number. The other ends up with a sixty-page report and no certificate at all.
They did not do different work. They bought different documents, and the documents are for different readers.
Predict
The certificate says a management system exists and is being run: a scope, a method for deciding what applies, written decisions about what was left out, internal audits of itself, and a scheduled meeting where leadership looks at the whole picture. An auditor visits on a cycle and a registration lapses if the visits stop.
The report says an independent practitioner formed a view about described controls across two dates. There is no certificate, no registration and nothing to lapse. There is a boundary, a period, a description the organisation wrote, and a list of exceptions.
The work underneath overlaps heavily — the same access reviews, the same change approvals, the same backups. The paperwork barely overlaps at all, and that is where the cost of holding both actually lives.
Not the same thing
A standing arrangement for deciding what applies, doing it, checking yourself, and reviewing the whole thing on a schedule.
An independent view on whether described controls were built to do the job and ran that way between two dates.
Both sides accept
Both want the same underlying things done: somebody re-approving access, changes reviewed by a second person, backups actually read back. The disagreement is entirely about what has to exist on paper and whether an absence is visible.
Which is which? Put each one on a side.
An enumerated decision, with a reason, for every control in the annex
A written description of the service that somebody forms an opinion about
Auditing yourself, on a cycle, with findings the external auditor then reads
Your own promises to customers becoming part of what is tested
Excluding a supplier from the exercise, and handing the reader their report instead
A scheduled meeting where leadership looks at the whole picture, with minutes
A crosswalk sold as an equivalence table is the least interesting object in this field. Nobody is confused about the topics; they are confused about what changes when the auditor changes. So here is the negative space from both directions — the things that exist on one side with nothing to map them to.
Only on one side
Almost all of this is structural rather than an oversight. One document is a management system and the other is an opinion about a period, and that single difference generates most of the list.
Auditing yourself before anybody external does
9.2
A management system is expected to check itself on a cycle, which means an internal audit function with findings of its own that the external auditor then reads. The criteria side has monitoring language but nothing that makes the organisation commission an examination of itself, so a company can be entirely dependent on the annual external pass to learn anything.
Leadership sitting down with the whole picture on a schedule
9.3
A scheduled review by the people who control the budget, with a defined set of inputs, is part of the management system itself. Governance criteria on the other side are about the control environment generally and do not produce a recurring meeting with an agenda and minutes that an auditor can ask to see.
An enumerated applicability decision for every annex control
6.1.3
The artefact that lists every control in the annex with a decision and a justification beside it has no counterpart. The criteria side never makes anybody write down what they decided not to do, which removes both the discipline and the paper trail of exclusion.
Keeping a register of the legal and contractual requirements you are subject to
A.5.31
Identifying applicable obligations is a control, so the register is a thing that exists and can be found out of date. On the criteria side obligations enter only through the organisation's own description of its commitments, so an unlisted regulatory requirement is invisible rather than overdue.
Version control over the management system's own documents
7.5
The documents that describe the system are themselves subject to control, which is why a policy with no version and no approval date is a finding. Nothing equivalent exists on the other side: a policy is evidence of design there, and its own provenance is rarely the subject.
Only on one side
Almost all of this is structural rather than an oversight. One document is a management system and the other is an opinion about a period, and that single difference generates most of the list.
The written description of the service that the opinion attaches to
structural — no single identifier
The organisation writes a narrative of how the system works and the auditor opines on whether it is fairly presented. A certificate has a scope statement, which is a sentence, not a description, and nobody forms an opinion on its accuracy in the same way. This is the single largest structural difference between the two documents.
Your own commitments to customers used as the measuring stick
structural — no single identifier
What the organisation promised becomes part of what is tested, so a stronger promise makes the examination harder. Certification measures against the standard, which is the same standard for everybody, so a company cannot make its own audit harder by promising more and cannot make it easier by promising less.
Controls the customer has to operate for yours to work
structural — no single identifier
The report formally names things the reader has to do at their end, which is a mechanism for saying out loud that a control is only half yours. There is no device for this on the certification side, so a shared responsibility either lives inside your controls or lives nowhere.
Choosing whether whole subject areas are examined at all
structural — no single identifier
Availability, confidentiality, processing integrity and privacy are categories an organisation opts into, so a report can be silent on backups or on data handling by design rather than by omission. Dropping a whole domain on the certification side takes a written applicability decision per control, which is a different kind of silence.
Carving a supplier out of the examination
structural — no single identifier
A subservice organisation can be excluded, which bounds the opinion and hands the reader a second report to chase. The certification side has no carve-out at all, so the supplier stays inside your controls and the only lever is the scope statement.
Whether processing is complete, accurate and timely
PI1.1
An entire category concerns whether the system processes what it was given correctly, which is a quality question rather than a security one. The management-system standard for information security has no processing-accuracy domain; that subject belongs to a different standard entirely, so there is nothing to map it to.
An opinion about a period rather than a point in time
structural — no single identifier
Operating effectiveness over a window means each control has a population and a missed instance is a deficiency. Certification samples around a point in time inside a multi-year cycle with surveillance visits, so the same control can be evidenced by its design plus a recent example rather than by every instance in a window.
Read those two lists together and the pattern is one difference wearing a dozen costumes. One document describes a system that is supposed to keep running, so everything about its own upkeep lives there: auditing yourself, reviewing yourself, keeping your documents under version control, keeping a register of what the law obliges you to do. The other is an opinion addressed to a service's customers, so everything about telling a reader what is and is not covered lives there: the description, the carve-out, the optional categories, the controls the customer has to run at their end.
Check