CETP-AUD cheat sheet

Risk-based scoping ranks systems by likelihood × impact of privacy harm; the product determines audit depth, not the system's age or vendor brand.

A processing inventory (ROPA) is the population from which the audit sample is drawn; an incomplete ROPA is a scope limitation that must be reported, not silently accepted.

Materiality threshold = the error rate or control-failure count above which the auditor concludes the control is not operating effectively.

Inherent risk rises with special-category data, large data subject volume, automated decision-making, and cross-border transfer; residual risk subtracts control effectiveness.

Scope exclusions must be documented with rationale and approved by the audit sponsor before fieldwork begins.

Planning outputs: objectives, criteria, scope boundaries, sampling approach, resource estimate, timeline, and communication plan.

Walkthroughs test design effectiveness (is the control capable of achieving the objective); testing of a sample tests operating effectiveness.

A pre-audit scoping memo records in-scope entities, processes, locations, and the criteria (law, standard, or contract) against which conformity is judged.

Accountability requires demonstrable evidence - policies alone are design artifacts; evidence of operation is required.

Three lines model: operations owns risk, the privacy/compliance function monitors, internal audit provides independent assurance.

Policy hierarchy: charter → policy → standard → procedure → work instruction; a control gap at any layer is a finding at that layer.

A privacy governance audit tests whether roles (DPO, privacy lead, system owners) have defined authority, resourcing, and escalation paths.

Policy exception handling needs a documented approval authority, expiry date, and compensating control; open-ended exceptions are a finding.

Board or executive reporting cadence and content are testable governance controls; absence of minutes is absence of evidence.

Training effectiveness is measured by completion rate plus assessment pass rate plus role-specific content coverage, not completion alone.

Segregation of duties: the person approving a data transfer or exception should not be the person who executes or logs it.

Statutory response clock runs from receipt, not from identity verification completion; verification delays must be tracked separately and kept proportionate.

Access request fulfillment must cover all systems in the ROPA, including backups, archives, and SaaS shadow stores.

Valid consent elements: freely given, specific, informed, unambiguous, and withdrawable as easily as it was given.

Consent records must evidence who, what purpose, when, which notice version, and the collection channel.

Erasure has exceptions (legal obligation, legal claims, public interest); the auditor tests that exceptions are documented per request.

Metrics to test: request volume, median and maximum cycle time, extension rate, identity-failure rate, and denial rate with reasons.

Withdrawal must propagate to downstream processors and derived datasets; test the propagation evidence, not just the intake log.

Children's and sensitive-data consent requires a higher verification standard; test the age-assurance control separately.

Retention schedule must be tied to a legal or business justification per record class; 'indefinite' requires a documented defense.

Disposal evidence: certificate of destruction, method (crypto-erase, physical shred, overwrite standard), date, asset identifier, and approver.

Crypto-erase (destruction of the key) is valid disposal only if key management proves the key is unrecoverable.

Backup and archive copies are in scope for retention and disposal testing; the common failure is disposing of production but not backups.

Test the trigger: does the retention clock start at collection, last use, contract end, or statutory period end? Ambiguity is a finding.

Data minimization is tested by comparing fields collected against fields actually used in a documented purpose.

Legal hold suspends disposal; test that hold flags override automated deletion jobs and that release is authorized.

Sampling disposal records should be stratified by system, medium, and destruction vendor to catch localized failures.

Test encryption at rest and in transit by configuration evidence plus a sample of actual objects, not by policy statement.

Key management controls: generation, rotation interval, access list, separation of key custodian from data custodian, and revocation on exit.

Access control testing = provisioning approval + periodic recertification + timely deprovisioning after termination; test all three.

Privileged access requires MFA, session logging, and periodic review; test the review evidence for completeness against the HR roster.

Logging controls need retention period, integrity protection, and monitoring/alerting rules with evidence of triage.

Vulnerability management is tested by remediation SLA adherence, not by scan frequency alone.

Data masking and pseudonymization: verify re-identification keys are held separately and access to them is restricted and logged.

Reconcile the HR termination list against active directory and application accounts to detect orphaned accounts.

Tier vendors by data sensitivity, volume, and system access; tier drives due-diligence depth and reassessment frequency.

Contract clauses to verify: purpose limitation, subprocessor approval, breach notification window, audit rights, deletion on termination, and liability.

Independent assurance reports (SOC 2, ISO certification) cover a period and a scope; test the scope, the period, and the exceptions section.

Bridge letters cover the gap between report period end and the current date; absence of a bridge letter is a control gap.

Fourth-party (subprocessor) risk must be inventoried and flowed down contractually; the primary vendor remains accountable.

Offboarding evidence: data return or destruction certificate, access revocation, and confirmation of no retained copies.

Concentration risk: multiple critical functions on one vendor or one cloud region is a resilience finding.

Vendor questionnaire answers are assertions; corroborate high-risk answers with independent evidence such as a report or a site assessment.

Breach notification clocks are jurisdiction-specific and run from awareness; the auditor tests the timestamp of awareness, not of resolution.

Notification content typically requires nature of breach, categories and approximate numbers affected, consequences, and mitigation measures.

Incident severity classification must map to escalation paths and to the regulatory notification decision tree.

Test the playbook by evidence of a real incident or a tabletop exercise with documented decisions and timing.

Processor-to-controller notification obligations are usually shorter than controller-to-regulator deadlines; test the flow-down.

Monitoring controls: alert coverage of sensitive data stores, triage SLA, false-positive review, and escalation to privacy when personal data is involved.

Evidence of breach register completeness: reconcile incident tickets flagged as data-related against the breach log.

Post-incident review must produce root cause, corrective actions, owners, and due dates; verify closure evidence.

Transfer mechanisms include adequacy decision, standard contractual clauses, binding corporate rules, and derogations; each has distinct documentation.

A transfer impact assessment evaluates the destination legal regime and supplements the chosen mechanism; it must be dated and refreshed.

Onward transfers require the same or equivalent protection; test subprocessor chain documentation end to end.

Data localization requirements restrict storage or processing location; test by verifying actual hosting regions against the legal requirement.

Local representative or DPO registration obligations vary by jurisdiction and are testable as a discrete control.

Sectoral regimes (health, financial, telecom) can impose stricter rules than general privacy law; scope must include applicable sector rules.

Framework mapping (e.g., GDPR to ISO 27701) is an aid, not evidence of conformity; test against the actual legal criterion.

Cross-border access by foreign authorities is a transfer risk even without physical data movement; document the assessment.

Evidence hierarchy: system-generated direct evidence > independently observed > client-produced document > management assertion.

Sufficiency relates to quantity; appropriateness relates to relevance and reliability; both are required.

Attribute sampling for control testing: define the population, the attribute, the tolerable deviation rate, and the sample size before testing.

A deviation found in a sample is projected to the population; the auditor concludes on the population, not on the sample alone.

Workpapers must let an independent reviewer reach the same conclusion: criteria, test performed, evidence reference, result, conclusion.

Evidence retention period should meet or exceed the longest applicable statutory or professional record-keeping requirement.

Screenshots should carry source system, date, and the identity of the person who captured them; undated screenshots are weak evidence.

Document any reliance on the work of others (internal audit, specialist) with an assessment of their competence and objectivity.

Finding structure: condition, criteria, cause, effect (risk), and recommendation; a finding without criteria is an opinion.

Severity rating should combine likelihood and impact and be defined in a rubric applied consistently across findings.

Management response must include a named owner, a committed date, and the accepted-risk decision if remediation is declined.

Overdue remediation escalates per a defined path; the auditor verifies closure evidence rather than accepting a status field.

Root-cause analysis distinguishes symptom fixes from control redesign; repeat findings indicate the former.

Continuous monitoring includes key risk indicators, control self-assessments, and periodic re-testing of high-risk controls.

Report distribution and confidentiality controls protect the report itself, which often contains sensitive vulnerability detail.

Track remediation metrics: closure rate, average days to close, repeat-finding rate, and accepted-risk inventory.