Privacy and Trust Governance, Policies, and Accountability
Accountability is evidenced, not declared
This domain tests whether the organization can demonstrate that privacy is governed, not merely described. Candidates should know the components of a governance framework: a designated accountable executive or privacy officer with defined authority, a committee or reporting line that reaches senior leadership, a policy hierarchy (policy, standards, procedures, guidelines), training and awareness, performance metrics, and a mechanism for escalating issues.
Auditors examine whether policies exist, are approved, are current, are communicated, and are actually followed. The frequent trap is treating a signed policy as evidence of operation. A policy that prohibits personal email for customer data is design evidence only; operating evidence is mailbox configuration, monitoring reports, or exception logs. Another trap is the policy that has not been reviewed since a major regulatory change, or one that conflicts with a regional addendum.
Accountability also includes records: processing inventories, decision logs for privacy impact assessments, approval records for exceptions, and minutes showing that leadership received and acted on privacy reporting. Where an exception to policy is granted, the auditor should see who approved it, on what basis, for how long, and how it is monitored.
Worked example. An entity claims a privacy steering committee provides oversight. The auditor requests the last four sets of minutes. Two meetings were cancelled, one had no quorum, and only one shows a decision recorded. The conclusion is not "no governance" but "governance design exists; operating effectiveness is not demonstrated for the period." That distinction should appear in the finding.
Rule of thumb: for every policy statement, ask what artifact would prove it is happening, then ask whether you have seen that artifact.