Where: /app/home

Read the declared AIMS scope and any carve-outs before you look at a single control. Scope carve-outs are found here, not discovered halfway through sampling.

What to establish

• The scope is declared, not implied.
• Every exclusion carries a justification.
• You can tell what sits outside the management system.

What would be a finding

Scope that has to be inferred from the estate; an exclusion with no stated reason; or a boundary that cannot be reconciled with the AI systems on the register in the next lesson.

Clause 4.3 requires the scope to be available as documented information. If you cannot point at it, neither can the organisation.