Start with treatment decisions, not template defaults
Under ISO/IEC 27001:2022 clause 6.1.3, determine the controls necessary for your chosen risk treatment options, then compare them with Annex A to check for omissions. Necessary controls can come from other sources or be designed for your organisation's circumstances.
The SoA records necessary controls, reasons for inclusion, whether they are implemented and justification for excluding Annex A controls. It is more than an Annex A conformance table. A pre-filled template saying every control is applicable can conceal the absence of any real treatment reasoning.
Write reasons that explain your environment
Replace phrases such as 'required for compliance' with a specific rationale. Explain the information, obligation or risk that makes the control necessary. Access reviews might support protection of client records and contractual access restrictions across named business systems.
Treat exclusions with equal care. 'We use the cloud' does not establish that physical security or supplier controls are irrelevant. Identify which activities are outsourced, which responsibilities remain yours and how supplier assurance supports the decision. Avoid excluding a control merely because implementation is inconvenient.
Separate applicability from implementation
A necessary control remains applicable when it has not yet been implemented. Record the gap honestly and connect it to a treatment action. Where implementation is partial, explain the boundary: one department's completed access review does not demonstrate organisation-wide operation.
Add operational fields such as owner, evidence reference, review date and related risks where useful. These help maintain the SoA but should not obscure its required content. Link to controlled procedures and records instead of duplicating detailed instructions that will become inconsistent.
Maintain it through operational change
Review control decisions when scope, suppliers, technology, obligations or assessed risks change. Check whether implementation claims still match evidence. A control can remain necessary while its delivery changes, such as moving from locally managed infrastructure to a shared-responsibility cloud service.
Use the existing implementation support where control design needs work. Horizon control management supports traceability between risks, controls, owners and evidence. It does not choose exclusions, accept risk or certify the organisation.