Part II · Chapter 2 · The Boundary · lesson 10
One boundary, written twice for two different readers
12 min
Builds on Two answers to the same question, written for different readers
Part II · Chapter 2 · The Boundary · lesson 10
12 min
Builds on Two answers to the same question, written for different readers
You made one decision: 31 systems, 39 people, three named exclusions. One afternoon, one argument, one line.
Now write it down twice. On one side it becomes a short scope sentence plus an enumerated decision for every control in an annex, each with a justification beside it. On the other it becomes a narrative description of how your service works, which somebody then forms an opinion on, plus a set of subject areas you either opted into or did not.
Same line. Two documents that barely resemble each other.
Predict
The two documents are different objects, and almost every difference follows from one fact.
One is a management system: a thing that is supposed to keep running, examine itself and improve. So it carries obligations about its own upkeep — auditing yourself, leadership sitting down with the whole picture, version control over its own documents, a register of the obligations you are subject to. The boundary is a scope sentence, and applicability is decided control by control in writing.
The other is an opinion about a period, addressed to the customers of a service. So it carries devices for telling a reader what the opinion does and does not cover: a written description of the system, subject areas you opt into, a mechanism for bounding a supplier out, and your own promises used as the yardstick.
Where they diverge tells you what each is for.
Only on one side
Almost all of this is structural rather than an oversight. One document is a management system and the other is an opinion about a period, and that single difference generates most of the list.
Auditing yourself before anybody external does
9.2
A management system is expected to check itself on a cycle, which means an internal audit function with findings of its own that the external auditor then reads. The criteria side has monitoring language but nothing that makes the organisation commission an examination of itself, so a company can be entirely dependent on the annual external pass to learn anything.
Leadership sitting down with the whole picture on a schedule
9.3
A scheduled review by the people who control the budget, with a defined set of inputs, is part of the management system itself. Governance criteria on the other side are about the control environment generally and do not produce a recurring meeting with an agenda and minutes that an auditor can ask to see.
An enumerated applicability decision for every annex control
6.1.3
The artefact that lists every control in the annex with a decision and a justification beside it has no counterpart. The criteria side never makes anybody write down what they decided not to do, which removes both the discipline and the paper trail of exclusion.
Keeping a register of the legal and contractual requirements you are subject to
A.5.31
Identifying applicable obligations is a control, so the register is a thing that exists and can be found out of date. On the criteria side obligations enter only through the organisation's own description of its commitments, so an unlisted regulatory requirement is invisible rather than overdue.
Version control over the management system's own documents
7.5
The documents that describe the system are themselves subject to control, which is why a policy with no version and no approval date is a finding. Nothing equivalent exists on the other side: a policy is evidence of design there, and its own provenance is rarely the subject.
Three of those bear directly on a boundary, and they are the three that surprise people holding the other document.
The enumerated applicability decision. The identifier to look up is 6.1.3. What it gives you is a table with every annex control in it, a decision, and a reason — and what it forces is the discipline of having had the argument for all of them rather than for the ones somebody asked about. There is no equivalent on the criteria side, so a company with a clean report has never been made to write down a single thing it decided not to do.
The register of obligations you are subject to. The identifier is A.5.31. It means the legal and contractual requirements that reach you are a thing that exists, can be found, and can be found out of date. On the criteria side obligations enter only through your own description of your commitments, so an obligation you never listed is invisible rather than overdue — which is a meaningfully worse failure mode, because nothing points at it.
Auditing yourself before anybody external does. The identifier is 9.2. Findings of your own, on a cycle, which the external auditor then reads. Its absence on the other side is why companies on that path learn everything they know about their controls once a year from a stranger.
Now the other direction.
Only on one side
Almost all of this is structural rather than an oversight. One document is a management system and the other is an opinion about a period, and that single difference generates most of the list.
The written description of the service that the opinion attaches to
structural — no single identifier
The organisation writes a narrative of how the system works and the auditor opines on whether it is fairly presented. A certificate has a scope statement, which is a sentence, not a description, and nobody forms an opinion on its accuracy in the same way. This is the single largest structural difference between the two documents.
Your own commitments to customers used as the measuring stick
structural — no single identifier
What the organisation promised becomes part of what is tested, so a stronger promise makes the examination harder. Certification measures against the standard, which is the same standard for everybody, so a company cannot make its own audit harder by promising more and cannot make it easier by promising less.
Controls the customer has to operate for yours to work
structural — no single identifier
The report formally names things the reader has to do at their end, which is a mechanism for saying out loud that a control is only half yours. There is no device for this on the certification side, so a shared responsibility either lives inside your controls or lives nowhere.
Choosing whether whole subject areas are examined at all
structural — no single identifier
Availability, confidentiality, processing integrity and privacy are categories an organisation opts into, so a report can be silent on backups or on data handling by design rather than by omission. Dropping a whole domain on the certification side takes a written applicability decision per control, which is a different kind of silence.
Carving a supplier out of the examination
structural — no single identifier
A subservice organisation can be excluded, which bounds the opinion and hands the reader a second report to chase. The certification side has no carve-out at all, so the supplier stays inside your controls and the only lever is the scope statement.
Whether processing is complete, accurate and timely
PI1.1
An entire category concerns whether the system processes what it was given correctly, which is a quality question rather than a security one. The management-system standard for information security has no processing-accuracy domain; that subject belongs to a different standard entirely, so there is nothing to map it to.
An opinion about a period rather than a point in time
structural — no single identifier
Operating effectiveness over a window means each control has a population and a missed instance is a deficiency. Certification samples around a point in time inside a multi-year cycle with surveillance visits, so the same control can be evidenced by its design plus a recent example rather than by every instance in a window.
The one at the top of that list is the one that matters most to a boundary, and it is worth saying plainly: a description of the service is a different object from a scope sentence. A scope sentence says what is inside. A description says how the thing works — the components, the flows, the people, what you promised — and somebody forms an opinion on whether it is fairly presented. You can write a scope sentence in an afternoon. You cannot write a description of a system you have not mapped, which is why that document is the one that finds the system nobody knew was in the path.
Then two more that change what a boundary can do.
Opting out of whole subject areas. Availability, confidentiality, processing integrity, privacy: a report can be silent on backups by design rather than by omission. On the certification side, dropping an equivalent domain means an applicability decision per control with a reason each — which is a different kind of silence and a much noisier one.
Bounding a supplier out. One side has the device; the other does not, so the supplier stays inside your controls and your only lever is the scope sentence.
Check
It is tempting to write one line and paste it into both, and the reason it does not work is structural rather than stylistic.
The certification side's boundary is a scope for a management system: it says which parts of the organisation the system governs. The subject is the organisation.
The criteria side's boundary is a scope for a service: it says which service the opinion is about, and the description that follows is about how that service operates. The subject is the product.
Those two are not the same cut. A company whose management system covers the whole engineering organisation may be describing one of three products, and a company describing its whole product may be running a management system scoped to one business unit. The sensible approach is one decision and two renderings, with a note somewhere of how they differ — which is itself the thing most often missing when a company holds both.