ISO/IEC 27701 Lead Auditor — Lesson 2: Audit Planning, Controller-Processor Boundaries, Process Mapping, Sampling, Interviews, Records, and Evidence

Learning Objectives

• Trace audit Planning, Controller-Processor Boundaries, Process Mapping, Sampling, Interviews, Records, and Evidence from business need through implementation evidence in an audit team evaluating a privacy information management system spanning customer, employee, digital, and outsourced processing.
• Create privacy audit plan and working papers that another practitioner can independently review.
• Diagnose sampling ignores high-risk processing identified by DPIAs, test a reversible response, and confirm no residual failure remains.

Detailed Topics

• Audit Planning
• Controller-Processor Boundaries
• Process Mapping
• Sampling
• Interviews
• Records
• Evidence
• Decision ownership, prerequisites, and acceptance evidence for audit Planning, Controller-Processor Boundaries, Process Mapping, Sampling, Interviews, Records, and Evidence
• Security, compliance, resilience, documentation, and support implications for privacy systems audit

Instructor Demonstration

Using an audit team evaluating a privacy information management system spanning customer, employee, digital, and outsourced processing, the instructor performs audit Planning, Controller-Processor Boundaries, Process Mapping, Sampling, Interviews, Records, and Evidence, preserves privacy audit plan and working papers, and tests the result against the realistic failure condition where sampling ignores high-risk processing identified by DPIAs.

Hands-On Exercise

Execute a scenario-based task covering audit Planning, Controller-Processor Boundaries, Process Mapping, Sampling, Interviews, Records, and Evidence. Record assumptions and controls in privacy audit plan and working papers, troubleshoot the case where sampling ignores high-risk processing identified by DPIAs, and obtain a result another reviewer can reproduce.

1. Confirm the requirement, stakeholders, environment, assumptions, inputs, and expected result.
2. Perform the privacy systems audit workflow and capture evidence before and after each material decision.
3. Test normal, boundary, failure, security, compliance, recovery, and operational conditions where relevant.
4. Document the root cause, correction, rollback, owner, support action, and next improvement priority.

Scenario Analysis

• Identify the business or assurance decision required within an audit team evaluating a privacy information management system spanning customer, employee, digital, and outsourced processing.
• Compare control strength, evidence quality, operational impact, cost, resilience, and stakeholder trade-offs.
• Define escalation, communication, recovery, acceptance, and follow-up requirements for privacy audit plan and working papers.

Troubleshooting Guidance

If sampling ignores high-risk processing identified by DPIAs, pause unsupported conclusions. Recheck criteria, roles, records, interfaces, and exceptions; use privacy audit plan and working papers to prove the root cause and the effectiveness of the selected correction.

Validation Checklist

• privacy audit plan and working papers identifies the approved baseline, accountable owner, inputs, and expected result.
• Evidence confirms audit Planning, Controller-Processor Boundaries, Process Mapping, Sampling, Interviews, Records, and Evidence under normal and relevant exception conditions.
• The response to “sampling ignores high-risk processing identified by DPIAs” is reversible, tested, and supported by before-and-after records.
• Residual privacy systems audit risk, support ownership, deadlines, and the next action are recorded.

Lesson Outcome

Learners can apply Audit Planning, Controller-Processor Boundaries, Process Mapping, Sampling, Interviews, Records, and Evidence, explain the choices made, and defend the result using privacy audit plan and working papers.