We built compliance
systems the hard way.
So you don’t have to.

01

Building the SoA — wiring controls to risks by hand

ISO 27001 requires a Statement of Applicability: every Annex A control mapped to a documented risk, with inclusions and exclusions justified in writing. Straightforward in theory. In practice, we’ve built that structure from scratch multiple times — inside platforms that simply weren’t designed for it.

One engagement meant weeks of customising a risk management system just to hold the SoA framework, then building a separate layer to link each control to the risk it addressed. Every connection had to be traceable. Every exclusion had to stand up to auditor scrutiny. None of it was automatic. All of it was manual.

Those projects taught us exactly where compliance tools break down — and exactly what a proper SoA workflow needs to look like when it’s built right from day one.

“The platform handled risks just fine. It had no real concept of the relationship between a risk and the control embedded in the SoA that addressed it.”

02

Making SharePoint behave like a compliance system

SharePoint is already in most organisations. It’s familiar, it’s paid for, and when a company needs to stand up an ISMS it’s usually the first tool they reach for. We’ve been there — building document libraries, version workflows, and permission structures inside SharePoint to serve as a compliance backbone.

It works well enough until an auditor asks the question SharePoint can’t reliably answer: “Can you prove this incident information has not been edited?” SharePoint wasn’t designed to produce immutable records. Data can be edited without a clear audit trail. Version history gets cleared. What looks like a clean evidence trail turns into a manual investigation through metadata.

We’ve seen it derail audit preparation. We’ve fixed it — expensively, under pressure, and after the fact. It’s a solvable problem, but only if you design around it from the start.

“We spent more time proving the evidence was trustworthy than we spent creating it in the first place.”

03

Automating compliance with tools that weren’t built for it

When clients need compliance and can’t justify a $30k–$100k enterprise GRC platform, you improvise. We’ve used workflow automation tools, spreadsheet logic, form builders, and notification systems — strung together to simulate what purpose-built software should do natively.

It can work. We’ve made it work. But the time cost is brutal. Weeks of configuration to produce what the right system delivers in hours. And when a team member leaves, or a tool changes its pricing, everything built on that scaffolding becomes fragile overnight.

The deeper pattern we kept seeing: even companies that invested in a specialist tool found it gave them a container for compliance data — not the processes, structure, or guidance needed to actually run a complete ISMS. The gap between “we bought the tool” and “we are compliant” was enormous. And expensive to close.

“By the time we had everything working, we could have built the right system from scratch and finished sooner.”