Use this six to ten weeks before an external audit, and at each internal audit of the management system. You get two files in a new folder, ./soa-status-reconciliation/: a spreadsheet you can open in Excel comparing, control by control, the status the company claims with what its records actually show, and the status they support (status-reconciliation.csv), and a to-do list per owner of the proof that is missing and how long it takes to produce (evidence-gaps.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The reconciliation proposes statuses; the control owner and the approver of the statement decide them.

Inputs to gather

Read: the statement of applicability, the treatment plan, the evidence index or compliance platform export, policies and procedures, and the records the agent can reach (ticket exports, review records, logs exported by the reader, training records, supplier assessments). Ask the reader for the audit period the next audit will cover and which systems are the source of truth for people, assets and changes. Write the period's start and end dates in the gap list; a record outside them supports nothing.

Step 1: list the claims

For each control marked implemented or partially implemented, add a row to the reconciliation spreadsheet (status-reconciliation.csv): the control id, the claimed status, the owner, and the evidence the statement or index points to. Note controls with no evidence pointer at all; they go straight to the gap list (evidence-gaps.md).

Step 2: classify what the control is

The type sets what evidence proves it:

Recurring: runs on a schedule (access review, backup test, vulnerability scan review). Proof is a record per run in the period.
Event-driven: runs on a trigger (leaver, new supplier, change, incident). Proof is the record for a sample of triggers.
Configured: a technical setting (disk encryption, multi-factor sign-in, logging). Proof is a current configuration export plus the process that keeps it true.
Documented: a policy or plan that must exist and be approved. Proof is the approved version, communicated to the people it applies to.