Where: /app/aims/soa — server-rendered, so you see the full control set

Check every one of these:

• Every control carries an applicability determination.
• Every "not applicable" carries a justification. Count them. An unjustified exclusion is a nonconformity and the product should not permit one.
• Every applicable control traces onward to a control implementation, evidence, or an open action.

The SoA also exports to CSV, so you can take the full determination set away and reconcile it against Annex A yourself rather than trusting the screen.

What would be a finding

An unjustified exclusion, an applicable control tracing to nothing, or an applicability decision that changed with no version history behind it.