CETP-AUD key terms

The complete inventory of auditable entities, systems, processes, and locations within an organization's scope, used to prioritize coverage and allocate audit resources across a planning cycle.

A schedule of audit work that allocates effort in proportion to assessed risk, so that higher-exposure areas receive more frequent and deeper scrutiny than low-risk areas.

Evaluation of the likelihood and impact of a harmful event before considering any controls, typically scored on a defined scale to rank processes for audit attention.

The level of risk remaining after existing controls are applied, calculated from inherent risk and control effectiveness, and used to judge whether treatment is adequate.

The size or significance at which a finding, control gap, or data exposure becomes important enough to affect decisions and therefore must be reported to governance bodies.

The obligation on an organization to demonstrate compliance with privacy requirements, including maintaining records, policies, training evidence, and documented decisions that auditors can inspect.

A formal document assigning privacy roles, decision rights, reporting lines, and committee structures, giving auditors a baseline against which actual practice can be compared.

A governance structure separating operational management, independent risk and compliance oversight, and internal audit assurance, used to test whether privacy duties are properly segregated.

A structured analysis performed before a new process or technology is deployed, identifying personal data flows, legal basis, risks, and mitigations, whose quality and timeliness auditors often test.

The controlled process by which deviations from a privacy or security policy are requested, risk-assessed, time-limited, approved at the right level, and periodically reviewed.

The recurring requirement for staff and contractors to confirm in writing that they have read and will follow current policies, with completion records retained as compliance evidence.

Documentation capturing what an individual agreed to, when, through which interface, on what wording, and how the choice can later be withdrawn, forming proof of a valid legal basis.

The practice of separating consent requests by purpose so that agreement to one use of data is not bundled with unrelated uses, a common audit test point.

The documented path by which an individual revokes permission, including system triggers, downstream notifications, and confirmation, tested for timeliness and completeness.

The channel and logging mechanism through which access, correction, deletion, or objection requests arrive, including identity verification steps and response deadlines.

Controls confirming that a person making a privacy request is who they claim to be, balancing fraud prevention against the burden placed on legitimate requesters.

Measurement of elapsed time from a verified request to complete response, compared against statutory or policy deadlines and tracked as a performance metric.

A maintained record of personal data elements, their sources, storage locations, processing purposes, recipients, and retention periods, serving as the foundation for scoping most privacy audits.

A documented list assigning a defined retention period and disposal trigger to each category of records, with legal or business justification for the chosen period.

Evidence produced when records or media are destroyed, recording the method, date, operator, scope, and verification, used to confirm that deletion actually occurred.

Testing that data has been removed from primary stores, backups, caches, and derived copies, including sampling restored backup media to confirm erasure.

Confirmation that backup and archive cycles do not silently outlive the retention period set for the underlying data, which would defeat deletion commitments.

Procedures that gather evidence on whether a safeguard operated as designed throughout the audit period, combining inquiry with inspection, observation, or re-performance.

An evaluation of whether a control, as documented and configured, is capable of preventing or detecting the relevant risk, performed before testing whether it actually operated.

An audit technique in which the auditor independently executes the control or calculation, such as re-running an access review query, to confirm the original result.

An alternative safeguard that reduces risk when a primary control cannot be applied, such as manual review substituting for an automated block, which must itself be tested.

Classification of third parties by data sensitivity, access level, and service criticality, which determines the depth of due diligence and frequency of ongoing monitoring.

Contract language granting the customer or its appointed auditor the ability to examine a vendor's controls, often through reports, questionnaires, or on-site review.

The auditor's judgment on whether an independent attestation report covers the relevant systems, period, and control objectives well enough to reduce direct testing.

A vendor's written statement covering the gap between the end of an attestation report period and the current date, describing control changes and incidents in that interval.

Risk arising from subcontractors and downstream providers used by a direct vendor, which the primary organization may not have assessed or contractually bound.

The regulatory deadline, counted from awareness of an incident, within which regulators and affected individuals must be informed, tested against documented timestamps.

A defined scale used to rank incidents by data sensitivity, volume, and operational impact, driving escalation paths, notification decisions, and response resources.

Records from simulated incident scenarios, including participants, decisions, timings, and identified gaps, used to judge whether response plans are rehearsed and current.

A structured retrospective after an incident that identifies root causes, assigns corrective actions with owners and dates, and feeds lessons into control improvements.

The conditions under which a supervisory authority must be informed of a breach, such as risk to individuals' rights, interpreted and applied consistently in documented decisions.

The legal tool relied on to move personal data between jurisdictions, such as adequacy decisions, standard contractual clauses, or binding corporate rules.

An analysis of the laws and practices in a destination country and of supplementary safeguards, used to judge whether a chosen transfer mechanism remains effective.

A legal or contractual rule requiring certain data to be stored or processed within a specified territory, which auditors verify through configuration and hosting evidence.

The judgment that collected evidence is both enough in quantity and appropriate in relevance and reliability to support the conclusion drawn from it.

Confirmation that the full set from which a sample is drawn is accurate and unduplicated, since an incomplete population invalidates conclusions about the whole.

The possibility that conclusions drawn from a tested subset differ from what testing the entire population would have shown, managed through sample size and selection method.

The dated record of who prepared and who reviewed each piece of audit documentation, providing accountability and evidence of supervisory review before conclusions are issued.

A consistent scale applied to audit issues based on risk exposure and control impact, guiding how quickly management must respond and who must be informed.

A documented commitment describing the corrective step, the responsible owner, the target date, and the evidence that will demonstrate the issue has been resolved.

A central register of open audit issues with status, aging, ownership, and closure evidence, reviewed periodically by governance until each item is validated as fixed.

Independent confirmation that a remediation action was implemented and actually reduced the risk, performed before an issue is removed from the tracking log.

A check that data collected for one stated purpose is not used for unrelated purposes without a fresh legal basis, verified by comparing notices to actual processing.

The state in which auditors are free from operational responsibility and undue influence over the areas they examine, preserving the credibility of their conclusions.