Agreement on organizations, locations, processes, technologies, risk types, etc are in scope for the risk assessment.