Managing an ISO/IEC 27701 Audit Program
Programme versus plan
An audit programme is the set of audits planned over a period, with defined objectives, managed by a competent programme manager. An audit plan covers one audit. Confusing the two is a common examination trap.
Design the programme on risk
Frequency, duration and depth should reflect the size and complexity of the organization, the volume, sensitivity and cross-border nature of PII processing, the controller or processor role, changes to systems or law, incident and complaint history, and previous audit results. Fixed annual cycles applied regardless of risk are poor practice.
Certification cycle
For third-party certification, a typical cycle is three years: initial certification (Stage 1 and Stage 2), surveillance audits at least once a year, and recertification before expiry. Requirements for bodies auditing and certifying PIMS come from ISO/IEC 17021-1 together with ISO/IEC 27006 and the PIMS-specific ISO/IEC 27706. Scope extensions, transfers and special audits are managed as programme changes.
Resources and oversight
Plan auditor competence and development, allocate teams, decide on combined or integrated audits, justify remote auditing, monitor auditor performance, and define programme performance indicators such as timeliness of corrective action closure and complaint rates. Review the programme periodically and adjust it.
Traps
Presenting the programme as a single audit plan. Running an integrated ISO/IEC 27001 and ISO/IEC 27701 audit without covering their interfaces. Assigning auditors without privacy legal competence. Ignoring the impartiality threats created by repeat assignments or prior consulting.
Rule of thumb: the programme answers what, when and by whom over time; the plan answers what happens on these dates.