CETP-AUD case studies
CETP-AUD · Put your knowledge to work in context.
The Certified Expert in Trust and Privacy – Audit (CETP-AUD) is an independent professional credential for practitioners who audit privacy and trust programs. It suits internal auditors, privacy officers, compliance analysts, IT risk assessors, and consultants who test whether an organization's handling of personal data matches its policies and legal obligations. The exam spans ten domains: audit planning and risk assessment; governance and accountability; data subject rights and consent; data lifecycle and disposal; security safeguards and technical control testing; third-party and vendor risk; incident response and breach notification; regulatory frameworks and cross-border transfers; evidence, sampling, and documentation; and reporting, remediation, and continuous improvement. Expect multiple-choice and scenario-based questions that ask you to choose the best audit procedure, interpret evidence, or identify a control gap. The CETP-AUD case studies are 5 cases and about 4,946 words.
1The Consent Banner That Remembers Too Much
A subscription news site deploys a consent management platform (CMP) across its web and mobile properties. The privacy team asks you to audit consent validity before a regulator inquiry deadline.
987 words, about 5 min2Retention Schedule Meets a Litigation Hold
A regional insurer has a documented retention schedule: policy records 7 years after expiry, claims files 10 years after closure, marketing lists 24 months after last engagement, and call recordings 90 days. You are auditing disposal controls.
1,010 words, about 5 min3Cross-Border Transfer Under a New Adequacy Decision
A healthcare analytics company transfers EU patient-adjacent data to a US subsidiary for model training. The transfer relies on standard contractual clauses (SCCs) plus a transfer impact assessment (TIA) completed 14 months ago.
932 words, about 5 min4The Sampling Plan That Missed the Breach
You are auditing an access-control review for a payroll platform with 180,000 user accounts. The control owner provides evidence that a quarterly access review was performed: a spreadsheet listing 4,500 sampled accounts, each marked 'reviewed - appropriate' by managers, with a completion date.
1,010 words, about 5 min5Breach Notification Clock With an Incomplete Picture
A retail bank discovers that a misconfigured API exposed account-balance and transaction-history endpoints for an estimated 9 days. The security team detected it on a Tuesday at 14:00 and contained it by 18:00.
1,007 words, about 5 min