ISO 27701 LA common mistakes
ISO 27701 LA · Understand the traps and how to avoid them.
Describes ISO/IEC 27701 as a stand-alone, independently certifiable management system standard, and describes the PIMS as something an organisation builds instead of, or in parallel with, its ISMS.
Candidates study 27701 in isolation and skim the clauses that define its relationship to ISO/IEC 27001 and 27002, so they never internalise that the PIMS-specific requirements are layered onto an existing ISMS and that the additional control objectives in Annex A and the guidance in Annex B are supplementary to ISO/IEC 27002, not a replacement for it.
What to do instead
Before answering, state the relationship in one sentence: the PIMS extends the ISMS; ISO/IEC 27701 certification is issued as an extension to ISO/IEC 27001 certification; the PIMS-specific requirements and guidance add to, and rely on, the ISMS clauses and the ISO/IEC 27002 control set. Then answer the question inside that frame.
Answers a scenario with 'the organisation is certified to ISO/IEC 27701, therefore its PII processing is lawful/compliant with privacy regulation.'
The standard contains an informative mapping to a major privacy regulation, and candidates collapse conformance with the standard into legal conformity, forgetting that privacy law is jurisdiction-specific and changes independently of any standard.
What to do instead
Always separate three things in the answer: conformity with the standard, conformity with the organisation's own obligations register and contractual terms, and the certification scope. State that the certification body attests to the standard, that legal compliance stays the organisation's responsibility, and that legal requirements are auditable only to the extent they have been adopted as agreed audit criteria.
Applies PII-controller guidance and controls to an organisation acting as a PII processor, or the reverse, without first establishing the role for each processing activity.
Controller and processor obligations sit in separate parts of the standard and differ materially (who determines purposes and means, who responds to PII principal requests, who notifies whom of a breach, which contractual terms are mandatory). Most organisations act in different roles for different services, and candidates assign a single role to the whole organisation.
What to do instead
Build a role matrix before evaluating any evidence: each processing activity or service line mapped to controller, processor or joint-controller status, with the applicable clause and Annex A control set. Then test records, notices, contracts and request-handling against that mapping rather than against one assumed role.
Accepts the ISMS risk assessment as satisfying the PIMS risk requirements, or accepts a privacy risk assessment that only scores impact on the organisation and never assesses likelihood and impact of harm to PII principals.
Candidates treat 'privacy risk' as a synonym for 'information security risk'. The planning requirements extend the ISMS risk process, and the harm-to-individuals lens is exactly what distinguishes a privacy risk assessment from a security one.
What to do instead
Inspect the risk methodology for explicit PII-principal harm criteria, for one-to-one linkage with processing activities and the obligations register, and for evidence of re-assessment when processing changes. Ask for a worked example and trace one risk from identification through treatment to residual acceptance and management approval.
Describes what the auditor should 'check' or 'review' rather than what constitutes sufficient, reliable audit evidence, and treats verbal assurances given in an interview as the basis for a finding.
Audit principles such as the evidence-based approach and fair presentation are abstract in ISO 19011, so candidates memorise the definitions without converting them into sampling, corroboration and traceability behaviour when a scenario asks what the auditor does next.
What to do instead
For every proposed action, name three things: the criterion, the evidence source, and how that evidence will be corroborated (record plus interview plus observation). State the sampling basis and how it is recorded so a second auditor could re-perform the same step and reach the same conclusion.
Assigns the organisation's DPO, in-house privacy counsel, or the consultant who designed the privacy programme to the audit team, or fields a team with ISO/IEC 27001 experience only.
Candidates concentrate on audit steps and checklists and drop the impartiality and competence requirements. Auditing a PIMS needs legal/regulatory and privacy-specific knowledge that a pure information-security background does not supply, and auditors are frequently asked to audit their own prior work.
What to do instead
Screen each proposed team member against activities performed for the auditee in the current cycle and against privacy-specific competence. Document the justification, and where competence is missing, add a technical expert who advises the team but does not take over the audit conclusions.
Writes an audit plan whose scope is copied from the ISMS certification scope, whose audit criteria are stated only as 'ISO/IEC 27701', and which ignores prior findings, the PII processing register and the obligations register.
Preparation is treated as form-filling. Candidates under-use the inputs that make a 27701 audit different from a 27001 audit (processing activities, roles, applicable obligations), and do not realise that scope and criteria determine every judgement made later in the audit.
What to do instead
Write the scope as products/services plus processing activities plus locations plus roles. List criteria explicitly (ISO/IEC 27001, ISO/IEC 27701, internal policies, contractual privacy terms, obligations adopted in the register). Include prior nonconformities and risk-based focus areas with allocated audit time.
Writes findings such as 'privacy awareness could be improved' or 'the record of processing activities is incomplete' with no clause or control cited, no sample described, and no date or location.
Findings are drafted from memory of the interview, and candidates blur together nonconformity, observation and opportunity for improvement. Exam scenarios reward a precise criteria-evidence-conclusion structure that they have not practised.
What to do instead
Use a fixed template for every finding: requirement (exact clause or Annex A control), objective evidence (document identifier, sample size, what was seen, date, interviewee role), and the resulting gap or risk. Then classify explicitly as nonconformity (major where the requirement is absent or systemic), observation, or opportunity for improvement, and justify the classification.
Closes a nonconformity as soon as the auditee submits a corrective action plan, or accepts 'we will retrain the staff' as the corrective action, without verifying that the root cause was addressed and the action was effective.
Closure is treated as administration at the end of the audit. Candidates conflate correction (fixing the specific instance) with corrective action (removing the cause) and skip the requirement to review effectiveness before the finding can be closed.
What to do instead
Keep correction, root-cause analysis and corrective action distinct in the answer. Require objective evidence of implementation, then verify effectiveness by re-sampling after an agreed interval. Record the verification, reflect it in the audit conclusion, and escalate to the auditee's management where the agreed date is missed.
Describes the audit programme as the schedule of a single audit, and builds it without risk-based frequency, competence assignment, monitoring and review of programme performance, or records retention.
'Programme' and 'plan' sound interchangeable, and programme management is the least scenario-driven domain, so candidates answer with the content of an audit plan instead of the content of a programme.
What to do instead
Answer at programme level: programme objectives, risk-based frequency and scope for each planned audit, resources and competence, monitoring and review of programme performance, reporting to top management, and retention of records. State explicitly which elements belong to the programme and which belong to an individual audit plan.