--- title: 'Management System Standards' source: 'https://academia.sh/en/courses/governance-risk-and-compliance/management-system-standards' course: 'Governance, Risk and Compliance' language: en updated: '2026-10-21T05:02:55+00:00' license: 'CC BY-SA 4.0' objectives: - 'Breaks the certifiable management system cycle into its scope statement, statement of applicability, internal audit, and external certification steps' - 'Measures the cost of narrowing scope with three numbers: control items left unapplied, risk left outside the certificate, and items counted as an external party' - 'Shows how correction capacity determines the certification decision and how scope cost produces two opposite rankings' --- # Management System Standards Running the certifiable management system model through its scope statement, statement of applicability, internal audit, and external certification cycle: in a 23-item inventory, a narrow scope leaves 25 of 100 control items unapplied, keeps 76 percent of total risk out of the certificate, and turns 15 items into an external party; a correction capacity of 20 nonconformities per round blocks certification at broad scope; and the absolute-cost order comes out the exact reverse of the cost-per-unit-of-risk order. The previous lesson reduced scattered controls to five comparable numbers, but the organization itself calculated those numbers. The organization assigned the levels, the organization took the average. To an outside observer, this is a well-organized self-declaration; a self-declaration's evidentiary value depends on the interest of the party making it. This lesson's subject is the structure that breaks that link: the **certifiable management system standard**. It defines a four-step cycle — scope statement, statement of applicability, internal audit, external certification — and at the end of the cycle a party outside the organization makes a decision. Because the decision itself is binary ("granted" or "not granted"), the cycle's real measure is not the decision; it is the **scope**. A certificate is always issued for a scope, and the organization chooses that scope itself. This lesson counts what the scope choice hides. No standard, certification body, or program name appears. ## Scope Statement and Statement of Applicability The **scope statement** is the definition that writes down which units, which locations, and which assets the management system covers. The **statement of applicability**, in turn, lists item by item which of the standard's control items are applied and on what grounds the ones left out are excluded. Read alone, the document says nothing until the two are read together: the scope gives what is audited, and the statement of applicability gives, even within the scope, **what is not audited**. - **FW7.** The inventory is the fictional **regional measurement network** from the previous topic: 23 items, seven units, four regions. Risk scores are taken from the previous topic's ranking and are **fictional**. - **FW8.** The standard's control set is 100 items, split into 12 feature groups. A group counts as **applicable** only if at least one in-scope item carries that feature. - **FW9.** Three scope statements are compared: narrow (billing unit only), medium (the non-field items of the billing, measurement, and identity units), broad (the entire inventory). - **FW10.** An item that sits outside the scope but shares a feature with an in-scope item appears in the document as an **external party**: it has an interface, but no audit. - **FW11.** The internal audit scans all applied controls; each group has a known nonconformity rate (fictional). - **FW12.** Correction capacity is 20 nonconformities per round. The external certification audit examines 40 percent of the applied controls and denies the certificate if it finds more than two nonconformities. - **FW13.** Audit duration is `⌈items/2⌉ + ⌈applied controls/15⌉` days: a fixed scope-walking load plus a per-item review load that grows with each item. ```js // system/scope.mjs — the scope statement in a certifiable management system. // MODEL: regional measurement network (fictional); items, risk scores, and control counts are fictional. export const row = (s) => s.trim().split("\n").map((l) => l.trim().split("|")); export const gen = (B) => (...h) => h.map((v, j) => (j ? String(v).padStart(B[j]) : String(v).padEnd(B[0]))).join(""); // name | unit | region | risk score (carried from the previous topic) | features export const ITEM = row(` billing-application|billing|central|8|personal-data payment-data development backup billing-database|billing|central|9|personal-data payment-data cryptography backup payment-gateway-link|billing|leased|7|payment-data vendor cryptography subscriber-portal|billing|leased|8|personal-data remote-access cloud-account billing-report-service|billing|leased|4|personal-data cloud-account collector-service|measurement|central|7|cloud-account backup development validator-service|measurement|central|6|cloud-account development field-meter-network|measurement|field|9|field-device wireless cryptography field-handheld-terminal|measurement|field|6|field-device wireless remote-access branch-endpoint|measurement|field|5|field-device physical-facility identity-provider|identity|central|9|remote-access cryptography incident-response admin-jump-host|identity|central|8|remote-access cryptography directory-service|identity|central|7|personal-data remote-access work-order-service|field-operations|central|5|personal-data development field-crew-application|field-operations|field|4|personal-data remote-access field-device vehicle-tracking-link|field-operations|vendor|5|personal-data vendor data-center-space|facilities|central|6|physical-facility backup branch-storage|facilities|field|3|physical-facility log-collection-pipeline|security|central|7|incident-response cloud-account backup on-call-and-response|security|central|6|incident-response maintenance-vendor-access|procurement|vendor|8|vendor remote-access cloud-vendor-account|procurement|vendor|7|vendor cloud-account consultant-development-access|procurement|vendor|6|vendor development`) .map(([name, unit, region, risk, feat]) => ({ name, unit, region, risk: +risk, feat: feat.split(" ") })); // Control set: each feature triggers a control group. // feature | control count | rate found nonconforming in internal audit (percent) export const GROUP = row(` personal-data|12|25 payment-data|9|22 cryptography|8|25 remote-access|11|18 cloud-account|10|30 field-device|7|43 wireless|5|40 physical-facility|6|17 backup|8|38 incident-response|7|29 development|9|33 vendor|8|50`) .map(([feature, n, rate]) => ({ feature, n: +n, rate: +rate })); export const TOTAL_CONTROL = GROUP.reduce((a, o) => a + o.n, 0); export const TOTAL_RISK = ITEM.reduce((a, k) => a + k.risk, 0); // Three scope statements. A scope is a predicate that selects a set of items. export const SCOPE = [ ["narrow", (k) => k.unit === "billing"], ["medium", (k) => ["billing", "measurement", "identity"].includes(k.unit) && k.region !== "field"], ["broad", () => true], ]; export const within = (predicate) => ITEM.filter(predicate); export const features = (set) => new Set(set.flatMap((k) => k.feat)); export const applicable = (set) => { const f = features(set); return GROUP.filter((b) => f.has(b.feature)); }; // Boundary interface: an item outside the scope that shares a feature with an // in-scope item appears in the document as an "external party" (model assumption). export const externalParty = (set) => ITEM.filter((b) => !set.includes(b) && b.feat.some((f) => set.some((a) => a.feat.includes(f)))); if (import.meta.url === `file://${process.argv[1]}`) { console.log(`model: ${ITEM.length} items, total risk ${TOTAL_RISK}, ` + `${GROUP.length} feature groups, ${TOTAL_CONTROL} control items`); const y = gen([8, 8, 10, 12, 14, 17, 15]); console.log("\n" + y("scope", "items", "scope %", "applied", "not applied", "risk outside %", "external party")); for (const [name, predicate] of SCOPE) { const set = within(predicate); const u = applicable(set).reduce((a, b) => a + b.n, 0); const risk = set.reduce((a, k) => a + k.risk, 0); console.log(y(name, set.length, (100 * set.length / ITEM.length).toFixed(0), u, TOTAL_CONTROL - u, (100 * (TOTAL_RISK - risk) / TOTAL_RISK).toFixed(1), externalParty(set).length)); } // Groups not applicable in narrow scope, and the risk items left outside it const narrow = within(SCOPE[0][1]); const missing = GROUP.filter((b) => !features(narrow).has(b.feature)); console.log(`\ngroups not applicable in narrow scope: ` + `${missing.map((b) => `${b.feature} (${b.n})`).join(", ")}`); const outsideRisk = ITEM.filter((k) => !narrow.includes(k)).sort((a, b) => b.risk - a.risk).slice(0, 4); console.log(`the four highest-risk items outside narrow scope: ` + `${outsideRisk.map((k) => `${k.name} (${k.risk})`).join(", ")}`); } ``` ``` model: 23 items, total risk 150, 12 feature groups, 100 control items scope items scope % applied not applied risk outside % external party narrow 5 22 75 25 76.0 15 medium 10 43 82 18 51.3 11 broad 23 100 100 0 0.0 0 groups not applicable in narrow scope: field-device (7), wireless (5), physical-facility (6), incident-response (7) the four highest-risk items outside narrow scope: field-meter-network (9), identity-provider (9), admin-jump-host (8), maintenance-vendor-access (8) ``` The place to read the table is between the third and fifth columns. Narrow scope takes 22 percent of the inventory and applies **75** of the 100 control items. This disproportion is the most often misread part of a scope statement: scope drops to a fifth, yet control items shrink by only a quarter, because control items scale not with the number of items but with **feature diversity**. The billing unit alone carries personal data, payment data, cryptography, remote access, a cloud account, development, backup, and a vendor connection; it triggers eight of the twelve groups. For the party reading the document, the result is this: the sentence "seventy-five of one hundred items are applied" gives the impression of a broad scope, when in fact 78 percent of the inventory and 76 percent of the total risk sit outside it. What is left outside is not random either — two of the four highest-risk items are the field meter network and the identity provider, both with a risk score of 9. The four unapplied groups confirm this: field device, wireless, physical facility, and incident response. These four groups get stamped "not applicable" because the billing unit carries no field device and no facility at all; the stamp's grounds are formally correct, and the result is still misleading. Medium scope is not a midpoint but a different choice: it doubles the item count and moves the applied item count only from 75 to 82. The seven added items come from the incident-response group, because the identity provider is the first in-scope item to carry that feature. The control-side cost of widening the scope depends on whether the added items **bring a new feature**; adding an item that carries features already present changes the statement of applicability not at all. The last column names this fallacy. In narrow scope, **15 items count as an external party**: they have an interface with the system, but no audit. A document gathers the interfaces at the scope boundary under the heading "external party" and expects that party to prove its own controls. If the organization's own items show up as an external party in its own document, the scope boundary has split the organization in two. This is why the statement of applicability is required alongside the certificate: only that document lists the 25 items left outside and the grounds for it. ## Cycle and Correction Capacity Once the scope is chosen, the rest of the cycle runs: the internal audit scans the applied controls, what is found gets corrected, the external certification audit takes a sample, and a decision is made. ```js // system/cycle.mjs — the internal audit and external certification cycle run on the same three scopes. import { ITEM, SCOPE, TOTAL_CONTROL, TOTAL_RISK, within, applicable, externalParty, gen } from "./scope.mjs"; const CORRECTION = 20; // number of nonconformities correctable in one round (fictional capacity) const SAMPLE = 0.4; // external certification audit examines 40% of the applied controls const THRESHOLD = 2; // certificate is denied if external audit finds more than 2 nonconformities const dayCalc = (items, controls) => Math.ceil(items / 2) + Math.ceil(controls / 15); const y = gen([8, 11, 18, 12, 11, 17, 11, 13]); console.log(`${TOTAL_CONTROL} control items, ${ITEM.length} items, total risk ` + `${TOTAL_RISK}; correction capacity ${CORRECTION} nonconformities/round (fictional)`); console.log("\n" + y("scope", "applied", "internal finding", "corrected", "remaining", "external sample", "caught", "certificate")); const results = []; for (const [name, predicate] of SCOPE) { const set = within(predicate), groups = applicable(set); const applied = groups.reduce((a, b) => a + b.n, 0); const findings = groups.reduce((a, b) => a + Math.round(b.n * b.rate / 100), 0); const remaining = Math.max(0, findings - CORRECTION); const sample = Math.round(applied * SAMPLE); const caught = Math.round(remaining * SAMPLE); const risk = set.reduce((a, k) => a + k.risk, 0); const days = dayCalc(set.length, applied); results.push({ name, set, applied, findings, remaining, caught, risk, days }); console.log(y(name, applied, findings, Math.min(findings, CORRECTION), remaining, sample, caught, caught > THRESHOLD ? "not issued" : "issued")); } const z = gen([8, 11, 11, 9, 12, 15, 16]); console.log("\n" + z("scope", "covered", "outside", "days", "days / risk", "items outside", "external party")); for (const s of results) { console.log(z(s.name, s.risk, TOTAL_RISK - s.risk, s.days, (s.days / s.risk).toFixed(3), ITEM.length - s.set.length, externalParty(s.set).length)); } const cheapest = [...results].sort((a, b) => a.days - b.days).map((s) => s.name); const efficient = [...results].sort((a, b) => a.days / a.risk - b.days / b.risk).map((s) => s.name); console.log(`\nabsolute cost order : ${cheapest.join(" < ")}`); console.log(`cost per unit of risk order: ${efficient.join(" < ")}`); const [narrow, , broad] = results; console.log(`\nnarrow scope saves ${broad.days - narrow.days} audit days and ` + `${broad.findings - narrow.findings} internal findings; in exchange, ` + `${TOTAL_RISK - narrow.risk} risk points and ${TOTAL_CONTROL - narrow.applied} control items ` + `stay outside the certificate`); const external = externalParty(narrow.set).filter((k) => k.risk >= 7); console.log(`of the ${externalParty(narrow.set).length} items counted as an external party ` + `in narrow scope, ${external.length} carry a risk score of 7 or higher: ` + `${external.map((k) => k.name).join(", ")}`); console.log(`remaining nonconformities in broad scope ${broad.remaining}; for the certificate ` + `to be issued, correction capacity would have had to be ` + `${Math.ceil(broad.findings - THRESHOLD / SAMPLE)} (currently ${CORRECTION})`); ``` ``` 100 control items, 23 items, total risk 150; correction capacity 20 nonconformities/round (fictional) scope applied internal finding corrected remaining external sample caught certificate narrow 75 22 20 2 30 1 issued medium 82 24 20 4 33 2 issued broad 100 30 20 10 40 4 not issued scope covered outside days days / risk items outside external party narrow 36 114 8 0.222 18 15 medium 73 77 11 0.151 13 11 broad 150 0 19 0.127 0 0 absolute cost order : narrow < medium < broad cost per unit of risk order: broad < medium < narrow narrow scope saves 11 audit days and 8 internal findings; in exchange, 114 risk points and 25 control items stay outside the certificate of the 15 items counted as an external party in narrow scope, 8 carry a risk score of 7 or higher: collector-service, field-meter-network, identity-provider, admin-jump-host, directory-service, log-collection-pipeline, maintenance-vendor-access, cloud-vendor-account remaining nonconformities in broad scope 10; for the certificate to be issued, correction capacity would have had to be 25 (currently 20) ``` The first table gives the cycle's harshest result: **widening the scope loses the certificate.** In narrow and medium scope, correction capacity swallows the internal findings, leaving two and four nonconformities behind; the external audit's sample sees one and two of these, the threshold is not crossed, and the certificate is granted. In broad scope, internal findings rise to 30, capacity stays at 20, 10 remain, the sample turns up four nonconformities, and the certificate is not granted. The last line converts this into capacity: for broad scope to get the certificate, correction capacity would have had to be 25, not 20. This explains the most widely misunderstood part of compliance work. Narrowing the scope is not a trick; where capacity falls short, it is **the only way to obtain the certificate** — when the organization chooses to audit more items with the same capacity, the nonconformity count grows and the decision flips. The certificate measures not the level of security but **the ratio between scope and correction capacity**. The same organization, without changing a single control, becomes certified merely by shortening its scope statement. The second table ties the course's ranking axis to this decision. The absolute-cost order is narrow, medium, broad — narrow scope takes 8 days, broad scope 19. The cost-per-unit-of-risk order is exactly the reverse: narrow scope spends 0.222 days per risk point it covers, broad scope 0.127. The reason lies in the audit's fixed load; as the scope shrinks, the fixed load is divided across less risk. **The cheapest certificate is the most expensive certificate per unit of risk it covers.** The same data yields two rankings, and both are correct; which one to use depends on whether the question is "what does this certificate cost" or "how much risk does this money bring under audit." ## Summary - A certifiable management system is a four-step cycle — scope statement, statement of applicability, internal audit, external certification — and a party outside the organization makes the decision; but the organization chooses the scope. - Control items scale with feature diversity, not item count: narrow scope takes 22 percent of the inventory but applies 75 of the 100 items. The sentence "seventy-five of one hundred items" gives the impression of a broad scope. - Narrow scope's cost is three numbers: 25 control items not applied, 76 percent of total risk outside the certificate, and 15 items counted as an external party — eight of which carry a risk score of 7 or higher. - The ratio between scope and correction capacity determines the certificate decision: with a capacity of 20 nonconformities per round, narrow and medium scope get the certificate and broad scope does not; getting it would have required a capacity of 25. - The absolute-cost order (narrow, medium, broad) and the cost-per-unit-of-risk order (broad, medium, narrow) are exact reverses of each other: the cheapest certificate is the most expensive certificate per unit of risk it covers. ## Next Step Two lessons have set up two measures: the maturity level says how institutionalized a control is, the scope statement says how far the audit reaches. Both are about the control **itself**. The question asked by the party reading the certificate or the maturity report is a different one: my requirement is this — which control satisfies it, and where is the item that shows it does. This question is not a one-to-one mapping. One control can satisfy more than one requirement, one requirement can call for more than one control, and some requirements are tied to no control at all. The next lesson is the topic's most important part: it runs the matrix between control and requirement, separates the requirement satisfied by no control from the requirement that looks satisfied but has no evidence, and counts how many items it takes to prove a single control.