Step 5 Develop a Statement of Applicability After the risk assessment, ISO 27001 consultant will Identify controls from the Annex A control catalogue that will reduce your information security risk. And he will explain how to implement these controls within your business by defining the objective for each one and specify the extent to which each control is required for your company by creating a Statement of Applicability (SoA).