CETP-AUD study guide
CETP-AUD · Work through your exam, one topic at a time.
The Certified Expert in Trust and Privacy – Audit (CETP-AUD) is an independent professional credential for practitioners who audit privacy and trust programs. It suits internal auditors, privacy officers, compliance analysts, IT risk assessors, and consultants who test whether an organization's handling of personal data matches its policies and legal obligations. The CETP-AUD study guide has 10 sections and about 3,231 words.
01Audit Planning, Scoping, and Risk Assessment
A privacy audit plan is a set of decisions about what to examine, why, and how deeply. Candidates must be comfortable with the sequence: understand the entity and its data flows, identify the obligations that apply, assess inherent risk, evaluate the design of controls, then decide the nature, timing, and extent of testing.
337 words, about 2 min02Privacy and Trust Governance, Policies, and Accountability
This domain tests whether the organization can demonstrate that privacy is governed, not merely described. Candidates should know the components of a governance framework: a designated accountable executive or privacy officer with defined authority, a committee or reporting line that reaches senior leadership, a policy hierarchy (policy, standards, procedures, guidelines), training and awareness, performance metrics, and a mechanism for escalating issues.
330 words, about 2 min03Data Subject Rights and Consent Management
Candidates must understand the lifecycle of a data subject request: intake through any channel, identity verification proportionate to sensitivity, logging, search across systems including backups and processors, response within the statutory deadline, and records of the outcome. Common rights include access, correction, deletion, restriction, objection, portability, and withdrawal of consent.
334 words, about 2 min04Data Lifecycle, Retention, and Disposal Controls
This domain covers classification, minimization, retention scheduling, and disposal. The auditor needs a working knowledge of the lifecycle: collection, use, sharing, storage, archival, and destruction, with controls at each stage.
335 words, about 2 min05Security Safeguards and Technical Control Testing
Privacy auditors do not need to be penetration testers, but they must evaluate whether technical safeguards operate as intended. Core areas include access control and least privilege, authentication strength including multi-factor, encryption in transit and at rest with key management, logging and monitoring, segmentation, secure configuration, and vulnerability management.
306 words, about 2 min06Third-Party and Vendor Risk Auditing
Vendors extend the organization's processing footprint and its obligations. Candidates should understand the vendor lifecycle: risk-tiering at onboarding, due diligence proportionate to tier, contractual terms, ongoing monitoring, and offboarding with data return or deletion.
304 words, about 2 min07Incident Response, Breach Notification, and Monitoring
This domain tests whether the organization can detect, assess, contain, notify, and learn from incidents. Candidates should know the phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident review.
312 words, about 2 min08Regulatory Frameworks and Cross-Border Data Transfers
Candidates should be able to compare frameworks at a conceptual level: comprehensive privacy laws with principles and rights, sector-specific rules, and security-oriented frameworks. For any engagement, the auditor identifies the applicable regimes from the entity's processing, locations, and data subjects, then maps requirements to controls.
336 words, about 2 min09Audit Evidence, Sampling, and Documentation
This domain covers how the auditor builds a defensible file. Evidence should be relevant to the control tested, reliable given its source, and sufficient in quantity.
311 words, about 2 min10Reporting, Remediation, and Continuous Improvement
A well-formed finding states the criteria (what should be), the condition (what is), the cause, the effect or risk, and a recommendation. Candidates should be able to distinguish severity levels and justify them with reference to likelihood, impact, and exposure.
326 words, about 2 min