Conduct an (additional) internal audit. This should include at least the adjusted risk analysis and the corresponding treatment plan and the new and amended (merged) control measures from Appendix A.