Organizations will demonstrate that they have considered clauses 4.1 and 4.2 with their risk tool, which can be covered in one document. Some organizations may add “risk” to their Statement of Applicability (SoA) found within Annex A, which includes four categories of 93 risk controls.