CETP-AUD study plan

Map each element of a risk-based audit scope (entities, systems, data categories, regulatory drivers) to a written scoping memo for a fictional organization

Draft a risk register that scores at least eight audit-relevant risks on likelihood and impact, and justify each score in one sentence

Sequence audit activities across planning, fieldwork, and reporting so that dependencies and resource needs are explicit

Identify the evidence each planned test will require before fieldwork begins

Convert the week-1 risk register into a testable audit program with objectives, procedures, and evidence sources for each high risk

Build a responsibility matrix that assigns accountability for privacy outcomes to named roles rather than departments

Evaluate whether a sample privacy policy set contains enforceable, measurable commitments or only aspirational language

Trace three policy statements to the controls that would demonstrate they operate in practice

Classify a set of processing activities by lawful basis and flag those where the stated basis is unsupported

Design a consent capture and withdrawal workflow that records timestamp, scope, version, and channel for each consent event

Evaluate whether a subject access request process meets statutory timelines under load, and identify bottlenecks

Draft test procedures that verify consent records actually reconcile to downstream processing systems

Build a data inventory for one business function spanning collection through disposal, and mark where retention clocks start

Test sample records against the retention schedule to detect over-retention and premature deletion

Select technical safeguards (encryption, access control, logging, key management) and write a test step for each that produces observable evidence

Distinguish control design deficiencies from operating effectiveness failures using two worked examples

Execute the safeguard test procedures drafted in week 4 against a mock environment and record results with evidence references

Design a vendor risk tiering model and assign at least six vendor types to tiers with rationale

Draft pre-contract due diligence questions and ongoing monitoring requirements matched to each vendor tier

Identify the contract clauses needed to preserve audit rights, breach notification timing, and subprocessor oversight

Assess a mock vendor's breach notification commitment against the organization's own incident response timelines

Construct an incident response timeline for a hypothetical breach, marking detection, containment, assessment, and notification triggers

Determine notification obligations to regulators and individuals using a decision tree keyed to data type and jurisdiction

Design monitoring metrics and log review cadences that would have detected the hypothetical incident earlier

Compare the core obligations of two regulatory frameworks and note where a single control satisfies both

Map a cross-border data transfer scenario to an appropriate transfer mechanism and document the residual risk

Build a sampling plan that states population, method, sample size rationale, and tolerable error rate

Assemble an evidence log that links each finding to a document, system extract, or interview record

Write findings in a condition-criteria-cause-effect structure and rate each by severity

Produce remediation recommendations with owners, target dates, and validation criteria

Consolidate the prior weeks' artifacts into a single audit report with a clear opinion or conclusion

Define two continuous improvement measures that would show remediation is durable rather than cosmetic