Stage 1 That Does Not Support a Stage 2

Assessment Stage 1 exists to determine readiness for Stage 2. It must evaluate whether the documented PIMS conforms to the requirements, whether internal audit and management review have been performed, whether the client understands the ISO/IEC 27701 requirements including its role determinations, and whether there is evidence the system is operating. None of that can be credibly established for 1,400 staff across six sites in three and a half remote hours, and the file contradicts the conclusion:

• 14 unjustified privacy control exclusions - no rational basis for the Statement of Applicability.
• Records of processing for four of six sites - the core PIMS inventory is incomplete.
• Risk assessment limited to HQ - risk treatment is not organization-wide.
• A four-month-old subsidiary in scope with no operating evidence.

Options

1. Do not proceed with Stage 2 as planned. Report to the client and the CB that the readiness conclusion is not supported and that Stage 2 would be premature.
2. Schedule additional Stage 1 activity to close the specific gaps, then re-evaluate.
3. If Stage 2 were to proceed, the gaps would surface as nonconformities - likely major - which wastes the client's Stage 2 investment. Deferring is the cheaper option for them and the defensible one for the CB.

Record the reasoning: Stage 1 concerns are not nonconformities in themselves, but here they indicate the PIMS is not implemented.

Gap The team has ISO/IEC 27001 competence and freight-IT technical competence. Competence in ISO/IEC 27701, privacy principles and the applicable privacy law is missing entirely. A technical expert on logistics systems does not fill this: technical experts advise, they do not substitute for auditor competence in the standard or the subject matter, and this team could not evaluate a PIA, a consent mechanism or a controller/processor role determination.

What must be in place

• At least one team member with demonstrated ISO/IEC 27701 and privacy regulatory competence, and the sector knowledge to judge freight and e-commerce processing (customer delivery data, driver data, employee monitoring).
• A lead auditor competent to manage a combined audit and to allocate time across two standards and both PII roles.
• Documented justification for any technical expert, and confirmation that the team as a whole covers the required competence areas.
• Confirmation that the assigned team has no consultancy relationship with TerraLog in the cooling-off period.

If the CB cannot resource this, the audit is deferred. Proceeding with an incompetent team produces a report that cannot support a certification decision and exposes the CB to challenge.

Duration Nine days calculated from ISO/IEC 27001 alone is not a valid calculation for a combined audit. The PIMS adds: role determination across two roles, the Annex A/B control sets, records of processing, PIA activity, PII principal request handling and breach processes, and the interaction of PIMS and ISMS controls. It also adds remote and cross-border processing, which takes time to follow. Recalculate on the combined scope, the number of processing activities, PII principal volumes, sites and applicable jurisdictions, and document the calculation.

Sites Two sites with no records of processing cannot simply be left out of sampling. Either they process PII - in which case the inventory is incomplete and the PIMS does not cover the scope - or they genuinely do not, which needs evidence. Cover this in Stage 2 rather than assuming.

Acquired subsidiary A four-month-old acquisition inside the scope must be covered. Multi-site sampling must be risk-based and justified; a newly acquired entity with no operating evidence typically needs full coverage or, if the integration is incomplete, a decision to exclude it from scope in writing until it is operational. Leaving it in scope while never auditing it makes the certificate misleading.

Confirm all of this in the revised audit plan before fieldwork starts.