Conducting an ISO/IEC 27701 Audit
Open, then gather
Begin with the opening meeting: confirm scope, criteria, plan, methods, communication channels, confidentiality and how findings will be reported. Then collect evidence by interview, observation, document and record review, and system walkthrough.
Triangulate
For each control tested, check three layers: what the policy says, what people actually do, and what the records show. Discrepancies between the three are where most findings live.
What to test in a PIMS
Follow the PII lifecycle from collection to disposal: lawful basis and consent capture, purpose specification and notice, minimization, accuracy, retention and deletion, PII principal access and other rights requests with response times, disclosure and transfer controls, processor selection, due diligence and agreements, breach detection, notification and logging, privacy by design in change projects, and privacy training and awareness. Confirm that privacy risks are identified and that impact assessments happen before processing begins, not after.
Technique
Ask open questions, then corroborate with records. Sample individual records and trace them back to authorisation, or forward to deletion. Record evidence precisely: document identifier, date, interviewee role. Hold team meetings to compare findings across auditors, and keep the auditee informed - escalating any major nonconformity without delay.
Traps
Auditing documents only and never observing practice. Relying on a single interview. Elevating guidance ('should') from ISO/IEC 27002 into a hard requirement. Missing the ISMS-PIMS interface, such as a single risk register or Statement of Applicability that omits privacy controls.
Rule of thumb: for every control you test, say 'show me' - evidence is a record, not a promise.