Description
The lead auditor of the Stage 1 audit read the Statement of Applicability and found that three controls are marked as included without a reason that a reader can follow. The text names the control and the Risk, but not why the control is needed in this organisation. Stage 2 will test the Statement against the Risk treatment, so the reasons must be complete by then.