Applicable does not mean implemented

Applicability answers one question; implementation answers another

A control is applicable when the organisation has determined that it is relevant to its risk treatment or other obligations. Implementation status describes whether the control has actually been put into operation. Conflating these concepts can make an SoA look complete while significant work remains outstanding.

For example, secure authentication may clearly be applicable from the beginning of an implementation. That does not mean every system already uses the intended authentication controls. The gap should be visible and managed rather than hidden by a single yes/no field.

Use status to drive work and assurance

A practical control lifecycle may include states such as planned, in progress, implemented, partially implemented and not applicable, supported by ownership and target dates. The exact labels should fit the organisation, but they should make unfinished work visible.

Implementation should also be supported by evidence. A control owner saying “done” is useful operational information; an auditor will normally expect objective evidence that demonstrates the activity or technical configuration exists and is being maintained.

Review control effectiveness, not only presence

Even a fully implemented control can be ineffective. A backup process may exist but fail regularly, or an access review may take place but not remove inappropriate access. Internal audit, monitoring, incidents and metrics should feed back into the organisation’s view of control effectiveness.

This is why connected assurance matters: control status, evidence quality, exceptions and related risk should be visible together rather than represented by an isolated green tick.