What changed in the documents?
A returned internal-audit note asked about document replacements in an earlier delivery batch. The preserved working record identified 21 replaced PDFs, but replacing a file did not mean its policy requirements had changed.
The useful answer was a comparison of the source bodies selected for that batch. A current policy or the complete history of the merged PR would answer a different question.
Explain the six changes, using their actual versions.
The historical source revisions were recovered and compared in six before-and-after pairs. Fifteen other replacements were recorded as rendering corrections with their source text retained. The output explained each of the six text changes and its limits.
| Document | Change explained |
|---|---|
| Document master list | Added corpus entries and linked the relevant registers. |
| ISMS roles | Linked the existing ownership register; responsibilities stayed the same. |
| Document control | Linked the publication register; approval requirements stayed the same. |
| Statement of Applicability | Replaced generic placeholders with control-specific review proposals. |
| Legal and contractual requirements | Clarified procedure approval and the separate applicability decisions. |
| Security roles policy | Linked the ownership register; authority and independence stayed the same. |
Three amendments added usable register links and version-history entries. Treating them as new responsibilities would have overstated their effect. Later policy revisions were identified separately from the original six-change explanation.
Return a review explanation, with its remaining gap.
The selected repository bodies supported the explanation. The original delivery reconciliation and PDF files were unavailable in the inspected checkout, so the source comparison did not independently verify the bytes delivered to the auditor.
The handoff did not amend the shared audit workpaper or Vanta. Its value was a specific account of what changed, what stayed the same and which delivery facts still needed their own evidence.