Documentation

In addition to the mandatory policies, forms, assessments, and records stored in various sections of Compleye Online and within your operational environments, there are other essential documents that must be available and prepared for external audit certification. These may include, but are not limited to, the Scope, Management Review Report, the Statement of Applicability, as well as any external audit reports or actual certifications once achieved. These documents are crucial for demonstrating the effectiveness and consistency of your framework, while also supporting day-to-day business operations.  

Simply navigate to the ‘Documentation Section’ and add the required documents along with their assigned owners. This functionality also allows you to track document versioning, including a summary of changes made. Additionally, it helps monitor the annual review and approval process if required, as shown below: 

Please refer to the essential documents that may be needed for both internal and external audits, as well as day-to-day operations. These documents ensure that your organization remains compliant and prepared for audits at all times, as outlined below: 

Statement of Applicability (SOA): This document needs to be kept up to date and shared during both internal and external audits. Please note that the most recent version of the SOA should be embedded in your ISRA. Therefore, you simply need to extract the document. However, if any changes are made to the SOA, ensure that these changes are justified, tracked, and aligned with the next version of the performed ISRA. 

Scope: The scope of your framework may relate to any framework you choose to pursue, such as ISO 27001, ISO 9001, ISO 27701, or the Trust Service Criteria (TSC) for SOC 2 audits. Ensure that the most recent version of the scope is attached and approved accordingly. For ISO 27001 scope, please refer to the ISMS Mandatory Document Template available in Compleye Online Templates Section, which explicitly references the ISMS scope. 

Management Review: Attach the finalized and external document from the ‘Management Review Section’ once it has been approved and completed. 

Internal and External Audit Reports: Attach these reports to ensure they are readily available and properly documented. 

Certification Obtained: Attach the certification document once it has been received. 

Include and attach any other relevant documents that may be useful during both the internal and external audits, as well as for daily operations. This ensures that all necessary information is readily available for review and reference.