An IS auditor is reviewing an organization's implementation of ISO/IEC 27001. The security manager states that certain Annex A controls were excluded because they were not relevant to the business. Which document should the auditor examine FIRST to determine whether these exclusions are justified and properly authorized?