Management System Standards

The previous lesson reduced scattered controls to five comparable numbers, but the organization itself calculated those numbers. The organization assigned the levels, the organization took the average. To an outside observer, this is a well-organized self-declaration; a self-declaration’s evidentiary value depends on the interest of the party making it.

This lesson’s subject is the structure that breaks that link: the certifiable management system standard. It defines a four-step cycle — scope statement, statement of applicability, internal audit, external certification — and at the end of the cycle a party outside the organization makes a decision. Because the decision itself is binary (“granted” or “not granted”), the cycle’s real measure is not the decision; it is the scope. A certificate is always issued for a scope, and the organization chooses that scope itself. This lesson counts what the scope choice hides. No standard, certification body, or program name appears.

Scope Statement and Statement of Applicability

The scope statement is the definition that writes down which units, which locations, and which assets the management system covers. The statement of applicability, in turn, lists item by item which of the standard’s control items are applied and on what grounds the ones left out are excluded. Read alone, the document says nothing until the two are read together: the scope gives what is audited, and the statement of applicability gives, even within the scope, what is not audited.

• FW7. The inventory is the fictional regional measurement network from the previous topic: 23 items, seven units, four regions. Risk scores are taken from the previous topic’s ranking and are fictional.
• FW8. The standard’s control set is 100 items, split into 12 feature groups. A group counts as applicable only if at least one in-scope item carries that feature.
• FW9. Three scope statements are compared: narrow (billing unit only), medium (the non-field items of the billing, measurement, and identity units), broad (the entire inventory).
• FW10. An item that sits outside the scope but shares a feature with an in-scope item appears in the document as an external party: it has an interface, but no audit.
• FW11. The internal audit scans all applied controls; each group has a known nonconformity rate (fictional).
• FW12. Correction capacity is 20 nonconformities per round. The external certification audit examines 40 percent of the applied controls and denies the certificate if it finds more than two nonconformities.
• FW13. Audit duration is ⌈items/2⌉ + ⌈applied controls/15⌉ days: a fixed scope-walking load plus a per-item review load that grows with each item.

// system/scope.mjs — the scope statement in a certifiable management system.
// MODEL: regional measurement network (fictional); items, risk scores, and control counts are fictional.
export const row = (s) => s.trim().split("\n").map((l) => l.trim().split("|"));
export const gen = (B) => (...h) => h.map((v, j) =>
  (j ? String(v).padStart(B[j]) : String(v).padEnd(B[0]))).join("");

// name | unit | region | risk score (carried from the previous topic) | features
export const ITEM = row(`
  billing-application|billing|central|8|personal-data payment-data development backup
  billing-database|billing|central|9|personal-data payment-data cryptography backup
  payment-gateway-link|billing|leased|7|payment-data vendor cryptography
  subscriber-portal|billing|leased|8|personal-data remote-access cloud-account
  billing-report-service|billing|leased|4|personal-data cloud-account
  collector-service|measurement|central|7|cloud-account backup development
  validator-service|measurement|central|6|cloud-account development
  field-meter-network|measurement|field|9|field-device wireless cryptography
  field-handheld-terminal|measurement|field|6|field-device wireless remote-access
  branch-endpoint|measurement|field|5|field-device physical-facility
  identity-provider|identity|central|9|remote-access cryptography incident-response
  admin-jump-host|identity|central|8|remote-access cryptography
  directory-service|identity|central|7|personal-data remote-access
  work-order-service|field-operations|central|5|personal-data development
  field-crew-application|field-operations|field|4|personal-data remote-access field-device
  vehicle-tracking-link|field-operations|vendor|5|personal-data vendor
  data-center-space|facilities|central|6|physical-facility backup
  branch-storage|facilities|field|3|physical-facility
  log-collection-pipeline|security|central|7|incident-response cloud-account backup
  on-call-and-response|security|central|6|incident-response
  maintenance-vendor-access|procurement|vendor|8|vendor remote-access
  cloud-vendor-account|procurement|vendor|7|vendor cloud-account
  consultant-development-access|procurement|vendor|6|vendor development`)
  .map(([name, unit, region, risk, feat]) =>
    ({ name, unit, region, risk: +risk, feat: feat.split(" ") }));

// Control set: each feature triggers a control group.
// feature | control count | rate found nonconforming in internal audit (percent)
export const GROUP = row(`
  personal-data|12|25
  payment-data|9|22
  cryptography|8|25
  remote-access|11|18
  cloud-account|10|30
  field-device|7|43
  wireless|5|40
  physical-facility|6|17
  backup|8|38
  incident-response|7|29
  development|9|33
  vendor|8|50`)
  .map(([feature, n, rate]) => ({ feature, n: +n, rate: +rate }));

export const TOTAL_CONTROL = GROUP.reduce((a, o) => a + o.n, 0);
export const TOTAL_RISK = ITEM.reduce((a, k) => a + k.risk, 0);

// Three scope statements. A scope is a predicate that selects a set of items.
export const SCOPE = [
  ["narrow", (k) => k.unit === "billing"],
  ["medium", (k) => ["billing", "measurement", "identity"].includes(k.unit) && k.region !== "field"],
  ["broad", () => true],
];

export const within = (predicate) => ITEM.filter(predicate);
export const features = (set) => new Set(set.flatMap((k) => k.feat));
export const applicable = (set) => {
  const f = features(set);
  return GROUP.filter((b) => f.has(b.feature));
};
// Boundary interface: an item outside the scope that shares a feature with an
// in-scope item appears in the document as an "external party" (model assumption).
export const externalParty = (set) => ITEM.filter((b) =>
  !set.includes(b) && b.feat.some((f) => set.some((a) => a.feat.includes(f))));

if (import.meta.url === `file://${process.argv[1]}`) {
  console.log(`model: ${ITEM.length} items, total risk ${TOTAL_RISK}, ` +
    `${GROUP.length} feature groups, ${TOTAL_CONTROL} control items`);
  const y = gen([8, 8, 10, 12, 14, 17, 15]);
  console.log("\n" + y("scope", "items", "scope %", "applied", "not applied",
    "risk outside %", "external party"));
  for (const [name, predicate] of SCOPE) {
    const set = within(predicate);
    const u = applicable(set).reduce((a, b) => a + b.n, 0);
    const risk = set.reduce((a, k) => a + k.risk, 0);
    console.log(y(name, set.length, (100 * set.length / ITEM.length).toFixed(0),
      u, TOTAL_CONTROL - u, (100 * (TOTAL_RISK - risk) / TOTAL_RISK).toFixed(1),
      externalParty(set).length));
  }
  // Groups not applicable in narrow scope, and the risk items left outside it
  const narrow = within(SCOPE[0][1]);
  const missing = GROUP.filter((b) => !features(narrow).has(b.feature));
  console.log(`\ngroups not applicable in narrow scope: ` +
    `${missing.map((b) => `${b.feature} (${b.n})`).join(", ")}`);
  const outsideRisk = ITEM.filter((k) => !narrow.includes(k)).sort((a, b) => b.risk - a.risk).slice(0, 4);
  console.log(`the four highest-risk items outside narrow scope: ` +
    `${outsideRisk.map((k) => `${k.name} (${k.risk})`).join(", ")}`);
}

model: 23 items, total risk 150, 12 feature groups, 100 control items

scope      items   scope %     applied   not applied   risk outside % external party
narrow         5        22          75            25             76.0             15
medium        10        43          82            18             51.3             11
broad         23       100         100             0              0.0              0

groups not applicable in narrow scope: field-device (7), wireless (5), physical-facility (6), incident-response (7)
the four highest-risk items outside narrow scope: field-meter-network (9), identity-provider (9), admin-jump-host (8), maintenance-vendor-access (8)

The place to read the table is between the third and fifth columns. Narrow scope takes 22 percent of the inventory and applies 75 of the 100 control items. This disproportion is the most often misread part of a scope statement: scope drops to a fifth, yet control items shrink by only a quarter, because control items scale not with the number of items but with feature diversity. The billing unit alone carries personal data, payment data, cryptography, remote access, a cloud account, development, backup, and a vendor connection; it triggers eight of the twelve groups.

For the party reading the document, the result is this: the sentence “seventy-five of one hundred items are applied” gives the impression of a broad scope, when in fact 78 percent of the inventory and 76 percent of the total risk sit outside it. What is left outside is not random either — two of the four highest-risk items are the field meter network and the identity provider, both with a risk score of 9. The four unapplied groups confirm this: field device, wireless, physical facility, and incident response. These four groups get stamped “not applicable” because the billing unit carries no field device and no facility at all; the stamp’s grounds are formally correct, and the result is still misleading.

Medium scope is not a midpoint but a different choice: it doubles the item count and moves the applied item count only from 75 to 82. The seven added items come from the incident-response group, because the identity provider is the first in-scope item to carry that feature. The control-side cost of widening the scope depends on whether the added items bring a new feature; adding an item that carries features already present changes the statement of applicability not at all.

The last column names this fallacy. In narrow scope, 15 items count as an external party: they have an interface with the system, but no audit. A document gathers the interfaces at the scope boundary under the heading “external party” and expects that party to prove its own controls. If the organization’s own items show up as an external party in its own document, the scope boundary has split the organization in two. This is why the statement of applicability is required alongside the certificate: only that document lists the 25 items left outside and the grounds for it.

Cycle and Correction Capacity

Once the scope is chosen, the rest of the cycle runs: the internal audit scans the applied controls, what is found gets corrected, the external certification audit takes a sample, and a decision is made.

// system/cycle.mjs — the internal audit and external certification cycle run on the same three scopes.
import { ITEM, SCOPE, TOTAL_CONTROL, TOTAL_RISK, within, applicable, externalParty, gen }
  from "./scope.mjs";

const CORRECTION = 20;   // number of nonconformities correctable in one round (fictional capacity)
const SAMPLE = 0.4;      // external certification audit examines 40% of the applied controls
const THRESHOLD = 2;     // certificate is denied if external audit finds more than 2 nonconformities
const dayCalc = (items, controls) => Math.ceil(items / 2) + Math.ceil(controls / 15);

const y = gen([8, 11, 18, 12, 11, 17, 11, 13]);
console.log(`${TOTAL_CONTROL} control items, ${ITEM.length} items, total risk ` +
  `${TOTAL_RISK}; correction capacity ${CORRECTION} nonconformities/round (fictional)`);
console.log("\n" + y("scope", "applied", "internal finding", "corrected", "remaining",
  "external sample", "caught", "certificate"));
const results = [];
for (const [name, predicate] of SCOPE) {
  const set = within(predicate), groups = applicable(set);
  const applied = groups.reduce((a, b) => a + b.n, 0);
  const findings = groups.reduce((a, b) => a + Math.round(b.n * b.rate / 100), 0);
  const remaining = Math.max(0, findings - CORRECTION);
  const sample = Math.round(applied * SAMPLE);
  const caught = Math.round(remaining * SAMPLE);
  const risk = set.reduce((a, k) => a + k.risk, 0);
  const days = dayCalc(set.length, applied);
  results.push({ name, set, applied, findings, remaining, caught, risk, days });
  console.log(y(name, applied, findings, Math.min(findings, CORRECTION), remaining, sample, caught,
    caught > THRESHOLD ? "not issued" : "issued"));
}

const z = gen([8, 11, 11, 9, 12, 15, 16]);
console.log("\n" + z("scope", "covered", "outside", "days", "days / risk", "items outside",
  "external party"));
for (const s of results) {
  console.log(z(s.name, s.risk, TOTAL_RISK - s.risk, s.days, (s.days / s.risk).toFixed(3),
    ITEM.length - s.set.length, externalParty(s.set).length));
}
const cheapest = [...results].sort((a, b) => a.days - b.days).map((s) => s.name);
const efficient = [...results].sort((a, b) => a.days / a.risk - b.days / b.risk).map((s) => s.name);
console.log(`\nabsolute cost order      : ${cheapest.join(" < ")}`);
console.log(`cost per unit of risk order: ${efficient.join(" < ")}`);

const [narrow, , broad] = results;
console.log(`\nnarrow scope saves ${broad.days - narrow.days} audit days and ` +
  `${broad.findings - narrow.findings} internal findings; in exchange, ` +
  `${TOTAL_RISK - narrow.risk} risk points and ${TOTAL_CONTROL - narrow.applied} control items ` +
  `stay outside the certificate`);
const external = externalParty(narrow.set).filter((k) => k.risk >= 7);
console.log(`of the ${externalParty(narrow.set).length} items counted as an external party ` +
  `in narrow scope, ${external.length} carry a risk score of 7 or higher: ` +
  `${external.map((k) => k.name).join(", ")}`);
console.log(`remaining nonconformities in broad scope ${broad.remaining}; for the certificate ` +
  `to be issued, correction capacity would have had to be ` +
  `${Math.ceil(broad.findings - THRESHOLD / SAMPLE)} (currently ${CORRECTION})`);

100 control items, 23 items, total risk 150; correction capacity 20 nonconformities/round (fictional)

scope       applied  internal finding   corrected  remaining  external sample     caught  certificate
narrow           75                22          20          2               30          1       issued
medium           82                24          20          4               33          2       issued
broad           100                30          20         10               40          4   not issued

scope       covered    outside     days days / risk  items outside  external party
narrow           36        114        8       0.222             18              15
medium           73         77       11       0.151             13              11
broad           150          0       19       0.127              0               0

absolute cost order      : narrow < medium < broad
cost per unit of risk order: broad < medium < narrow

narrow scope saves 11 audit days and 8 internal findings; in exchange, 114 risk points and 25 control items stay outside the certificate
of the 15 items counted as an external party in narrow scope, 8 carry a risk score of 7 or higher: collector-service, field-meter-network, identity-provider, admin-jump-host, directory-service, log-collection-pipeline, maintenance-vendor-access, cloud-vendor-account
remaining nonconformities in broad scope 10; for the certificate to be issued, correction capacity would have had to be 25 (currently 20)

The first table gives the cycle’s harshest result: widening the scope loses the certificate. In narrow and medium scope, correction capacity swallows the internal findings, leaving two and four nonconformities behind; the external audit’s sample sees one and two of these, the threshold is not crossed, and the certificate is granted. In broad scope, internal findings rise to 30, capacity stays at 20, 10 remain, the sample turns up four nonconformities, and the certificate is not granted. The last line converts this into capacity: for broad scope to get the certificate, correction capacity would have had to be 25, not 20.

This explains the most widely misunderstood part of compliance work. Narrowing the scope is not a trick; where capacity falls short, it is the only way to obtain the certificate — when the organization chooses to audit more items with the same capacity, the nonconformity count grows and the decision flips. The certificate measures not the level of security but the ratio between scope and correction capacity. The same organization, without changing a single control, becomes certified merely by shortening its scope statement.

The second table ties the course’s ranking axis to this decision. The absolute-cost order is narrow, medium, broad — narrow scope takes 8 days, broad scope 19. The cost-per-unit-of-risk order is exactly the reverse: narrow scope spends 0.222 days per risk point it covers, broad scope 0.127. The reason lies in the audit’s fixed load; as the scope shrinks, the fixed load is divided across less risk. The cheapest certificate is the most expensive certificate per unit of risk it covers. The same data yields two rankings, and both are correct; which one to use depends on whether the question is “what does this certificate cost” or “how much risk does this money bring under audit.”

Summary

• A certifiable management system is a four-step cycle — scope statement, statement of applicability, internal audit, external certification — and a party outside the organization makes the decision; but the organization chooses the scope.
• Control items scale with feature diversity, not item count: narrow scope takes 22 percent of the inventory but applies 75 of the 100 items. The sentence “seventy-five of one hundred items” gives the impression of a broad scope.
• Narrow scope’s cost is three numbers: 25 control items not applied, 76 percent of total risk outside the certificate, and 15 items counted as an external party — eight of which carry a risk score of 7 or higher.
• The ratio between scope and correction capacity determines the certificate decision: with a capacity of 20 nonconformities per round, narrow and medium scope get the certificate and broad scope does not; getting it would have required a capacity of 25.
• The absolute-cost order (narrow, medium, broad) and the cost-per-unit-of-risk order (broad, medium, narrow) are exact reverses of each other: the cheapest certificate is the most expensive certificate per unit of risk it covers.

Next Step

Two lessons have set up two measures: the maturity level says how institutionalized a control is, the scope statement says how far the audit reaches. Both are about the control itself. The question asked by the party reading the certificate or the maturity report is a different one: my requirement is this — which control satisfies it, and where is the item that shows it does.

This question is not a one-to-one mapping. One control can satisfy more than one requirement, one requirement can call for more than one control, and some requirements are tied to no control at all. The next lesson is the topic’s most important part: it runs the matrix between control and requirement, separates the requirement satisfied by no control from the requirement that looks satisfied but has no evidence, and counts how many items it takes to prove a single control.