Preparing an ISO/IEC 27701 Audit
Programme, then plan
Preparation starts from the audit programme (the set of audits over a cycle) and narrows to the individual audit: objectives, scope, criteria and feasibility. Scope must state the organizational units, locations, technologies and PII processing activities covered, and whether the client acts as controller, processor or both - this decides whether Annex A, Annex B or both are in play.
Document review
Typical inputs: PIMS scope and privacy policy, risk assessment and treatment, Statement of Applicability, records of PII processing, PIA/DPIA outputs, processor agreements and transfer mechanisms, consent records, breach and incident logs, competence and training records, internal audit results, management review minutes and prior findings.
Two-stage initial certification
Stage 1 assesses readiness: documentation, scope, understanding of the requirements, whether internal audit and management review have been performed, and whether Stage 2 is feasible. Stage 2 evaluates implementation and effectiveness. Stage 1 is neither a documentation-only formality nor a miniature Stage 2.
Team, plan and work documents
Assign competent auditors with privacy, legal, sector and technology knowledge; define roles and any technical experts. Build a sampling plan across sites, shifts, processes, systems and third parties. The audit plan lists dates, activities, auditees, methods and deliverables, and is communicated and agreed with the client.
Traps
Accepting a scope that excludes the processing activities that carry the most privacy risk. Failing to establish the client's role. Reusing another client's checklist. Assuming the auditee can veto team members - objections are considered, but the auditor controls the plan.
Rule of thumb: settle scope, role and criteria before designing any sampling plan; everything downstream depends on them.