Audit Planning, Scoping, and Risk Assessment
Start with the risk question, not the checklist
A privacy audit plan is a set of decisions about what to examine, why, and how deeply. Candidates must be comfortable with the sequence: understand the entity and its data flows, identify the obligations that apply, assess inherent risk, evaluate the design of controls, then decide the nature, timing, and extent of testing. Scoping is the pivotal step. A defensible scope names the processing activities, systems, vendors, jurisdictions, and period covered, and states what was excluded and why. "The whole company" is not a scope; neither is a sample of one region chosen because it was convenient.
Risk assessment should be documented and repeatable. Common factors include volume and sensitivity of data, number of data subjects, legal exposure, reliance on third parties, automated decision-making, cross-border flows, and prior findings. A risk-ranking matrix that maps likelihood against impact lets the auditor justify depth of testing. Watch for the trap where a low-risk rating is asserted with no criteria behind it, or where the entity's own risk register is accepted without challenge.
Materiality matters too. Auditors should define a threshold below which findings are aggregated rather than reported individually, and state it up front so the report is not criticized later.
Worked example. An entity processes payroll for 40,000 staff and marketing data for 2 million prospects. A plan that scopes only payroll because "HR is the sensitive one" misses the larger population and the consent-dependent processing. A sound plan scopes both, rates marketing higher on volume and consent risk, and allocates more testing there.
Rule of thumb: if you cannot state in one sentence why an area is in or out of scope, the scope is not yet defensible.