Find the SoA and risk register differences an auditor would raise
Your AI compares the two files. ISMS Copilot says which differences an auditor would raise and how to fix them. You fix the source files, which stay yours.
Why the two files drift
Clause 6.1.3 ties the risk treatment decisions to the Statement of Applicability, and auditors read the two documents side by side to check that the link holds. In practice the SoA lives in one file and the register in another, and they drift between review cycles: a control gets excluded from the SoA while a treatment still relies on it, an applicability decision never makes it back to the register, or a review date passes unnoticed. Finding those differences is mechanical work, and your AI does it on files it can already read. Deciding which ones an auditor would actually raise, and what the fix is, is a framework judgment. That part goes to ISMS Copilot.
Explore the ISO 27001 Copilot →How the work splits
- 01
Your AI compares the files
It reads the SoA and the register where they live, lines up controls with treatments, and lists every difference with the row it comes from.
- 02
ISMS Copilot judges the list
Your AI sends the differences. ISMS Copilot says which ones an auditor would raise under clause 6.1.3, which are cosmetic, and how to fix each one.
- 03
You fix the source files
You decide and edit the SoA or the register yourself. Before you rely on a fact ISMS Copilot states about your records, have your AI check it against the file.
Differences your AI can list
A control excluded in the SoA but still used by a risk treatment
A treatment with no applicable control behind it
An applicability decision in the SoA missing from the register
Passed review dates and statuses that disagree between the two files
Frequently Asked Questions
Does ISMS Copilot read my SoA and register directly?
No. It has no connector to your sheet, wiki or GRC platform, and over MCP your AI cannot upload files to it. Your AI reads the files and does the comparison, then sends the differences and the rows behind them, up to 100,000 characters per message.
Does it merge or edit the two files?
No. You get the list of differences that matter and the fix for each. You make the edits where the files live.
When should this run?
Before Stage 2, after any scope change, and at each review cycle. It is the same comparison every time, so surveillance audits reuse it.
Compare the two files before the auditor does
Your AI lists the differences, ISMS Copilot says which ones matter, you fix the sources.