You are an experienced audit team leader conducting a third-party surveillance audit of an organisation...

A Statement of Applicability must be produced by organisations seeking ISO/IEC 27001 conformity

Justification is only required for any controls that the organisations choses to exclude

Justification for both the inclusion and exclusion of Annex A controls in the Statement of Applicability is required

The Statement of Applicability is owned and amended by the organisation's top management

Additional controls not included in Appendix A may be added to the Statement of Applicability if the organisation choses to do so

The Statement of Applicability must include Organisational, Physical, People and Technological controls that are necessary