are not implemented, agencies must record and formally recognize that non‐use of any controls without due consideration may increase residual risk for the agency. This residual risk must be agreed and acknowledged by the Accreditation Authority. 8