ISO 27701 LI common mistakes
ISO 27701 LI · Understand the traps and how to avoid them.
Treating ISO/IEC 27701 as a standalone certifiable standard and describing the audit as a '27701 certification' of the PIMS in isolation, rather than as an extension to ISO/IEC 27001 and 27002.
Marketing shorthand and course titles say 'ISO 27701 certification', so candidates absorb the idea that the PIMS is certified independently of the ISMS. In reality 27701 is an extension to 27001/27002: the organization must already implement an ISMS, and certification is issued against the combined scope (27001 plus the 27701 extension).
What to do instead
Memorize the structural relationship: 27701 adds PIMS-specific requirements and guidance that extend 27001 (management system requirements) and 27002 (controls), and the privacy extension controls are numbered to mirror 27002 clauses. When a question asks what is audited, answer that the ISMS scope plus the privacy extension is assessed together; the PIMS cannot be certified without a conforming ISMS.
Confusing the roles of PII controller and PII processor and applying the wrong control set, e.g. citing processor obligations for a controller scenario or vice versa.
The candidate reads the scenario quickly and maps 'we hold customer data' to 'processor', or assumes both roles always apply identically. 27701 separates additional guidance for PII controllers (Clause 7 / Annex A) from PII processors (Clause 8 / Annex B), and many obligations differ.
What to do instead
For every scenario, first write down: who determines the purpose and means (controller), who processes on behalf of another (processor), and whether the organization is both (joint or dual role, requiring both Annex A and Annex B controls to be applied to the relevant processing). Then select the corresponding clause and annex before answering.
Jumping straight to writing policies and control statements without first defining PIMS scope, context, interested parties and leadership commitment in the initiation phase.
Candidates with a controls background want to 'do the Annex A checklist' immediately and skip the Clause 4/5 context and leadership steps, which feel like paperwork. Exam questions probe whether the candidate knows the sequence and inputs of initiation.
What to do instead
Learn the initiation sequence as a chain: understand the organization and its context, determine PIMS scope (including which PII processing, locations, systems, and legal jurisdictions are in scope), identify interested parties and their privacy requirements, obtain top-management commitment and assign privacy roles, then perform a gap assessment against 27701. Answer initiation questions by naming the missing upstream step rather than a downstream control.
Building the PIMS risk assessment only around information security CIA impacts and omitting PII-specific harm to individuals (privacy risk), or failing to link risk treatment to the privacy-specific controls.
Candidates carry over 27001 risk habits where asset-centric confidentiality/integrity/availability is the lens. 27701 requires the risk assessment to consider risks to PII principals, not just to the organization, and the treatment plan must map to Annex A/B controls.
What to do instead
In planning questions, insist on two dimensions: organizational risk and risk to PII principals (likelihood and severity of harm such as discrimination, reputational or financial harm, loss of anonymity). Show that the risk treatment plan selects controls from the 27701 privacy extension and records the Statement of Applicability justification for inclusions and exclusions, including jurisdiction-specific legal drivers.
Assuming the Statement of Applicability can exclude privacy controls simply because 'we don't do that', without documented justification tied to scope, legal obligations or risk.
Candidates treat the SoA as a tick-box list and either mark everything applicable or drop controls casually. 27701 requires justifications for inclusion and exclusion that reference legal/regulatory requirements and risk assessment results.
What to do instead
For any SoA question, require: the control reference, applicability decision, justification referencing risk or legal requirement, and implementation status. Note that some privacy controls are effectively mandatory where the corresponding legal obligation applies (e.g. PII principal rights, breach notification), so exclusion must be defensible and documented, not merely convenient.
Describing implementation as 'adopt the policy and train staff' without addressing operational controls: PII inventories and data-flow mapping, purpose limitation, retention and deletion, consent and preference records, PII principal rights handling, processor agreements, and privacy by design in change management.
Policy-and-training answers are easy to write and feel complete. The exam tests whether the candidate can translate Annex A/B controls into operating practice with owners, records and evidence.
What to do instead
Practice producing an implementation map: for each control family (governance, PII principal rights, privacy by design, sharing and transfers, breach handling, retention), state the process, the owner, the record produced, and the evidence an auditor would sample. Tie each to a clause of Annex A (controller) or Annex B (processor).
Treating monitoring and measurement as 'we had an internal audit and no findings', ignoring defined metrics, objectives, and evaluation of privacy performance and legal compliance over time.
Candidates conflate Clause 9 monitoring/measurement with internal audit and management review, or assume qualitative reassurance is sufficient. 27701 expects measurable privacy objectives and evidence of monitoring, including tracking of legal and regulatory changes.
What to do instead
Prepare concrete metric examples: percentage of PII records with documented lawful basis, timeliness of PII principal rights requests, breach detection-to-notification time, retention schedule adherence, percentage of processors with current agreements, training completion. Show the cycle: define what is measured, how and when, who analyses results, and how results feed management review and corrective action.
Describing corrective action as 'fix the issue and close the ticket', without root-cause analysis, evaluation of the need for action, or checks that the action was effective and did not create new risks.
Operational ticketing habits dominate, and candidates skip the Plan-Do-Check-Act loop that ISO management system clauses require. Nonconformity handling is a frequent exam theme.
What to do instead
Use the full sequence for every nonconformity: react and contain, evaluate the need for action to eliminate the cause (root cause analysis), implement, review effectiveness, update risks and the management system if needed, and retain documented information. Distinguish correction (fix the symptom) from corrective action (remove the cause).
Preparing for certification by memorizing control lists but being unable to describe the audit process: stage 1 versus stage 2, certification scope statement, auditor sampling of evidence, and how nonconformities (major/minor) affect the outcome.
Candidates focus on content knowledge and underestimate process knowledge about certification bodies, audit stages, and how findings are graded and closed.
What to do instead
Learn the audit lifecycle: application and contract, stage 1 readiness review (documentation, scope, internal audit and management review completed), stage 2 conformity and effectiveness assessment with sampling, findings graded major/minor/observation, corrective action plans with deadlines, and surveillance audits in the certification cycle. Be able to explain what evidence satisfies an auditor for a given 27701 clause.
Answering certification-readiness questions with 'we have all the policies' while the mandatory inputs are missing: no completed internal audit covering the PIMS scope, no management review, no current risk assessment, and no evidence that the SoA matches actual practice.
Candidates equate documentation volume with readiness and forget that management system clauses require performed activities and retained evidence, not just documents on a shelf.
What to do instead
Build a readiness checklist keyed to clauses: context and scope defined, leadership roles assigned, risk assessment and treatment current, SoA justified, competence and awareness records, documented information controlled, internal audit programme completed for the full scope, management review held with outputs, and nonconformities from internal audit closed. In exam scenarios, name the missing performed activity, not the missing document.