ISO/IEC 27701:2025 Internal Auditor Training

Opens by asking whether a privacy policy shows that personal data is protected, then has you rate your own audit knowledge. Walks through three cases: the Irish Data Protection Commission's 310 million euro fine on LinkedIn in October 2024 over consent and lawful basis, its 530 million euro fine on TikTok in May 2025 over remote access from China, and the Dutch authority's 290 million euro fine on Uber in August 2024 over driver data sent to the United States. Turns each into an audit question on lawful basis, transfers and transparency. Introduces Northlight Health, a worked example of a 380-staff telehealth company in London that is a PII controller, a processor for 40 clinics and a joint controller. Contrasts two auditors checking recording retention, one finding eighteen months of old files. Explains ISO/IEC 27701:2025, the course structure, four myths and the 30-question exam.

What you will be able to do

• Explain why an internal audit must test real processing, not only the privacy policy
• Turn regulator cases on lawful basis and transfers into practical audit questions
• Distinguish the PII controller, processor and joint controller roles at one organisation

Why it matters

Gives privacy officers and auditors a clear reason to audit what happens to PII, finding the gaps before a regulator or client does.

Practice: Practice: Welcome: why PIMS internal audit matters · 3 questions

Starts with Northlight Health's statement of applicability still using 2019 control numbers, and the auditor using Annex F to find the correspondence. Explains the full title, the difference between requirements and guidance, and the second edition of October 2025 as a stand-alone management system standard. Walks through clauses 0 to 11 as an auditor sees them. Sets out Annex A: Table A.1 with 31 controller controls, Table A.2 with 18 processor controls and Table A.3 with 29 security controls, and shows how to read A.1.2.6 privacy impact assessment with its Annex B guidance. Covers integration with an ISO/IEC 27001 ISMS and the informative mappings, including to the GDPR. Defines PII, PII principal, controller, joint controller and processor, using a Toronto payroll provider, and the three meanings of customer. Covers audit types and the wording that signals documented information. Ends with two quick questions.

What you will be able to do

• Navigate the clauses and Annex A tables of ISO/IEC 27701:2025 during an audit
• Determine whether an organisation is a PII controller or processor for each processing
• Identify the documented information each clause requires as audit evidence

Why it matters

Lets auditors find their way through the 2025 edition quickly, set the right criteria and ask for the right evidence from the first day.

Practice: Practice: The standard through an auditor's eyes · 3 questions

Begins with Northlight Health's patient requests lead auditing her own process, finding nothing, before a regulator complaint revealed postal requests never reached the tracker and 6% were late. Explains clause 9.2.1 on conformity and effectiveness, and clause 9.2.2 on the audit programme, objectivity and reporting. Shows that a processor's criteria include each clinic contract and its instructions. Introduces ISO 19011:2026, the fourth edition published in May 2026, and its remote auditing guidance. Defines audit and objective evidence, with an interview, a record and an observation on a quarterly access review. Builds the chain of criteria, evidence, finding and conclusion using 69 of 1,150 requests answered late in 2025. Contrasts a vague note with verifiable evidence. Covers audit roles, first, second and third-party audits, combined, joint and remote audits, and the seven principles, with cross-auditing for independence and a Sydney dental clinic as the small-organisation case.

What you will be able to do

• Explain what clause 9.2 of ISO/IEC 27701:2025 requires of internal audits
• Link audit criteria, evidence, findings and conclusions into one sound chain
• Apply the seven principles of auditing, especially independence, to internal audits

Why it matters

Helps internal auditors produce findings managers trust, with verifiable evidence and no one auditing their own area of work.

Practice: Practice: Clause 9.2 and the principles of auditing · 3 questions

Starts with Northlight Health's product manager claiming processor status for clinic data, until the auditor finds monthly trend reports Northlight designed for its own purposes. Explains clause 4.1: determining issues, deciding whether climate change is relevant, and determining the role as PII controller, joint controller or processor. Shows the listed issues at Northlight, from UK and EU data protection law to forty clinic contracts, and why regulator decisions such as the TikTok transfer ruling belong in the context. Treats climate change as a decision, not a register. Applies the role test to four processing activities, explains separate roles where both apply and the joint controller arrangement under A.1.2.8. Covers clinics requiring UK-only hosting and a Singapore bank whose new fraud models made it a controller. Sets out questions, expected evidence, two practice findings, a symptom checker trap and three common auditor mistakes.

What you will be able to do

• Assess how an organisation determines and tracks its legal, contractual and other issues
• Test the controller, joint controller or processor role for each processing of PII
• Write a clause 4.1 nonconformity only against what the requirement actually asks

Why it matters

Helps auditors catch wrong role labels early, so the right Annex A controls are applied and contractual promises reach operations.

Practice: Practice: Auditing context and roles · 3 questions

Opens with Northlight Health's register of interested parties, which lists the regulator, investors, clinics and staff but not the 450,000 patients. Explains clause 4.2 and its requirement to include PII principals, then the parties named in the notes: customers, supervisory authorities, other controllers, and processors and subcontractors. Covers the three meanings of customer and the three sources of requirements: law, contract and self-imposed objectives. Shows how complaints, requests and app reviews reveal what PII principals expect, and how a cloud host's encryption terms place requirements on Northlight. Uses a Sydney online retailer's register as good practice. Explains clause 4.3, comparing a vague scope with one naming each processing and role, and clause 4.4. Writes two findings, including backups for a UK-only clinic copied nightly to Ireland. Ends with three auditor mistakes and a staff HR data exercise.

What you will be able to do

• Check that PII principals and their requirements are determined as interested parties
• Assess whether a PIMS scope statement names the processing of PII and the roles
• Verify that requirements marked as addressed are actually delivered in operations

Why it matters

Helps auditors confirm the PIMS covers the people whose data it holds, with a scope clear enough to set real audit boundaries.

Practice: Practice: Interested parties, scope and the PIMS · 3 questions

Begins with a signed privacy policy at Northlight Health but eighteen months of board minutes with no PIMS item, and monthly reports stopping at the operations director. Lists the eight leadership duties in clause 5.1 and tests integration with the symptom checker launched in February 2026 and the privacy sign-off added in June. Uses the March 2026 incident, with summaries for 212 patients sent to the wrong clinic, to test communication. Judges resources from facts: two privacy staff and 6% of 1,150 requests late, contrasted with a Tokyo insurer cutting its team after a video message. Sets out the four contents of clause 5.2, communication and availability, and notes that the standard sets no review interval. Gives a twenty-minute top management interview method, separates policy from privacy notice, and compares two policies. Covers clause 5.3 authority and reporting, with two written findings and three common mistakes.

What you will be able to do

• Assess top management's leadership from decisions, resources and privacy built into processes
• Check a privacy policy against the four contents that clause 5.2 requires
• Verify that PIMS performance reporting actually reaches top management

Why it matters

Gives internal auditors the method and confidence to interview senior management and evidence leadership gaps in plain facts.

Practice: Practice: Leadership, policy and roles · 3 questions

Starts with Northlight Health's register rating misdirected summaries as low impact, before the March 2026 incident affecting 212 patients, some with mental health notes. Explains clause 6.1.1 risks and opportunities for the PIMS, with examples from issues and interested parties. Walks through clause 6.1.2: risk criteria with a six-point acceptance threshold on a twenty-five point scale, consistency tested by two owners rating the same risk four and sixteen, identifying privacy as well as security risks, and named risk owners. Stresses item d) 1), assessing consequences for both the organisation and PII principals, with realistic likelihoods and re-scored levels. Shows evaluation and prioritisation. Uses a Mumbai customer service BPO whose renamed security register misses privacy risks. Traces the symptom checker through the process, notes timing under clause 8.2 and who takes part. Writes the finding, lists three mistakes, and tests an owner who never saw her risk.

What you will be able to do

• Assess whether privacy risk criteria give consistent, valid and comparable results
• Check that risk analysis covers consequences for both the organisation and PII principals
• Trace one privacy risk from identification to evaluation and interview its owner

Why it matters

Helps auditors expose risk registers that ignore harm to people, so privacy risks are rated realistically and treated in time.

Practice: Practice: Risks, opportunities and privacy risk assessment · 3 questions

Opens with control A.1.3.11, automated decision making, excluded as not applicable in a 2023 statement of applicability, although Northlight Health's symptom checker has sorted patients automatically since February 2026. Walks through clause 6.1.3 items a) to h): treatment options, determining necessary controls, documenting the information security programme and its listed areas, and comparing with Annex A, which is not exhaustive. Explains the four contents of the statement of applicability and what makes an exclusion justified: the risk assessment or legal requirements. Shows when excluding Table A.2 is valid and why Northlight's 2023 exclusion was not. Audits four statement lines and traces the misdirected summaries risk to A.2.4.4 and an extra routing test. Covers risk owner approval, considering Annex B guidance and keeping the statement current, with a Hong Kong hospital group's plan lacking owners and dates. Writes the finding and tests an A.3.22 exclusion.

What you will be able to do

• Assess whether each statement of applicability exclusion is justified by risk or law
• Trace one privacy risk from treatment option to controls, statement and plan
• Verify that risk owners approved the treatment plan and accepted residual risk

Why it matters

Helps auditors test the statement of applicability properly, catching unjustified exclusions and claims of implementation without evidence.

Practice: Practice: Risk treatment and the statement of applicability · 3 questions

Starts with Northlight Health's single 2026 objective, be fully compliant, which nobody measures or monitors. Sets out the seven tests in clause 6.2 and the five planning points, then shows measurable objectives, such as 98% of requests answered within one month. Follows the requests objective rising from 91% to 98%, and a Frankfurt logistics firm cutting stored driver data by 40%. Explains clause 6.3 planned changes using a weekend hosting move, and clause 7.1 resources judged from results. Covers clause 7.2 competence for requests staff, developers, call handlers and contract GPs, and evaluating effectiveness through call sampling that cut identity check errors from six to one. Tests clause 7.3 awareness by asking two call handlers what privacy means in their job, and checks clause 7.4 communications. Writes findings on the objective and on four of ten contract GPs lacking evidence of competence.

What you will be able to do

• Assess whether privacy objectives are measurable, monitored and linked to real risks
• Evaluate competence evidence for staff and contractors, beyond training attendance
• Test privacy awareness by interviewing the people who actually do the work

Why it matters

Helps auditors turn vague privacy goals into auditable objectives and confirm that staff and contractors can do their privacy duties.

Practice: Practice: Objectives, changes and support · 3 questions

Begins with Northlight Health's patient requests tracker, a spreadsheet sixty people can edit, where three late reply dates were changed with no version history. Defines documented information under clause 3.10 and lists what clauses 4 to 10 require, plus Annex A records such as consent under A.1.2.5 and transfer and disclosure records under A.1.5.4 and A.1.5.5. Explains clause 7.5.2 identification, format and approval, and clause 7.5.3 availability and protection. Covers distribution and access, storage and legibility, with consent records locked in a database retired in 2023, control of changes, and retention linked to A.1.4.8. Applies A.3.14 protection of records to the tracker. Checks external documents such as clinic contracts, and a Toronto payroll provider using a printed old deletion procedure. Discusses how much documentation is enough and what makes approval real. Writes the finding and tests an incident procedure kept on one laptop.

What you will be able to do

• Identify the documented information ISO/IEC 27701:2025 requires and what the organisation adds
• Check access, version control and retention for records that contain PII
• Verify that people use the current approved version of a document at the point of use

Why it matters

Helps auditors protect the integrity of PIMS evidence and the PII inside it, rather than hunting for typos in a document register.

Practice: Practice: Auditing documented information · 3 questions

Begins with a May 2026 update from Northlight Health's video supplier that switched on cloud recording by default, so every consultation was recorded for three weeks until a GP noticed. Explains clause 8.1: process criteria, enough documented information for confidence, controlled planned changes, reviewing unintended changes and controlling externally provided services. Uses the patient requests process to show testable criteria, and the planned move to Irish hosting, keeping three UK-only clinics in place, as a controlled change. Shows how each supplier is controlled, contrasted with a Paris online retailer whose marketing agency kept customer lists. Covers clause 8.2 assessments at planned intervals and when changes are proposed, with a reassessment overdue since May 2026 and only one of four changes assessed in time. Audits clause 8.3 by sampling treatment actions and testing identity checks on twenty requests. Writes the findings and ends with a university research project exercise.

What you will be able to do

• Test PIMS process criteria by sampling real cases, not only reading procedures
• Assess how the organisation detects and controls changes made by its suppliers
• Check that privacy risk assessments were done when significant changes were proposed

Why it matters

Helps auditors find where supplier changes and late risk assessments leave PII exposed, and confirm that planned treatment really happened.

Practice: Practice: Auditing operation · 3 questions

Opens with the March 2026 misdirected summaries nonconformity closed as human error, while the same routing still serves e-prescriptions unchecked. Explains clause 9.1: what is monitored, methods that give valid results, when results are analysed, and evaluating PIMS effectiveness. Shows a 2025 on-time requests figure of 99% that excluded postal requests, with the true figure about 94%. Covers clause 9.3 management review by top management at planned intervals, the five inputs in clause 9.3.2 and the decisions required by clause 9.3.3, checked against Northlight's October 2026 review. Contrasts this with a Chicago hotel group whose minutes said only noted. Sets out clause 10.1 continual improvement and the five steps of clause 10.2, applied to the March incident and to a Dubai clinic group whose retraining did not stop repeated errors. Writes findings on cause analysis and measurement method, then tests a missing new-law input.

What you will be able to do

• Check that monitoring methods cover the whole population and give valid results
• Assess whether management review covers every required input and records decisions
• Evaluate corrective action for root cause, similar cases and a review of effectiveness

Why it matters

Helps auditors stop false closures and unreliable figures, so management reviews rest on valid data and fixes actually prevent recurrence.

Practice: Practice: Evaluation and improvement · 3 questions

Starts with Northlight Health's symptom checker, live since February 2026, collecting health data with no documented purpose, an assumed lawful basis and a privacy impact assessment begun a month late. Explains the A.1.2 objective and its eight controls. Covers A.1.2.2 specific purposes checked against real uses, and A.1.2.3 lawful basis, using the LinkedIn decision to show why the basis must be demonstrable, and how special categories such as health information are classified. Explains A.1.2.4 and A.1.2.5 consent processes and records, with a Toronto online retailer's bundled consent and bare yes flag. Sets out A.1.2.6 privacy impact assessment criteria and contents, A.1.2.7 processor contracts read against Table A.2, A.1.2.8 joint controllers and A.1.2.9 records of processing, with four checks on one entry. Traces the symptom checker through the group to one root cause, writes the finding and tests a new triage tool plan.

What you will be able to do

• Check that specific purposes and a demonstrable lawful basis exist for each processing
• Test whether consent records show if, when and how consent was obtained
• Assess whether a privacy impact assessment was done before new processing began

Why it matters

Prepares auditors to check that a controller decided purposes, lawful basis and impact before processing, the gaps regulators often find.

Practice: Practice: Controllers: conditions for processing · 3 questions

Opens with Northlight Health's one-tap research consent in the app that patients can withdraw only by letter with an identity document, managed by eleven patients in 2025. Covers A.1.3.2 obligations and a contact point that matches how data is collected, and A.1.3.3 the information to give, its timing and the source of PII, using referral letters from other GP practices. Explains A.1.3.4 clear and accessible information, tested by counting taps, and compares a 2024 notice with the US video supplier now in use, recalling the TikTok transparency finding. Shows how to test the contact point with an agreed request. Covers A.1.3.5 withdrawal consistent with how consent was given, and A.1.3.6 objection, with a Hong Kong bank whose phone objections never reached its marketing engine. Sets the sample, writes the finding and tests a notice missing from the app.

What you will be able to do

• Compare privacy notices with the processing actually observed during the audit
• Test a consent withdrawal end to end, from the request to processing stopping
• Check that objections are recorded and acted on across every channel and system

Why it matters

Helps auditors test notices and consent choices from the user's side, so people are told the truth and can change their minds easily.

Practice: Practice: Controllers: obligations to PII principals, 1 · 3 questions

Starts with a copy request answered on time by Northlight Health but missing the patient's video recordings, GP chats and symptom checker answers. Covers A.1.3.7 response times and a route for disputed corrections, using a patient contesting a diagnosis. Explains A.1.3.8 informing third parties such as the pharmacy chain, with acknowledgement of receipt. Sets out A.1.3.9 copies in a usable format that relate only to the person, and shows how to test completeness against a map of four systems. Covers A.1.3.10 request procedures and response times defined in the privacy policy, and how to trace five requests from arrival to reply. Explains A.1.3.11 obligations from decisions based solely on automated processing, applied to the symptom checker's routine bookings, with a Mumbai digital lender's appeals as good practice. Defines a defensible sample, writes the finding on incomplete copies and tests an erasure the pharmacy never heard about.

What you will be able to do

• Test whether copies of PII are complete by comparing replies with a system map
• Trace a request from arrival to reply, including identity checks and third parties
• Establish the facts on automated decisions and check that obligations were identified

Why it matters

Helps auditors look beyond on-time replies to complete, accurate answers, which is where individual rights handling most often fails.

Practice: Practice: Controllers: obligations to PII principals, 2 · 3 questions

Begins with a test account in Northlight Health's app showing location sharing and personalised health tips switched on by default. States the group's objective and its nine controls. Covers A.1.4.2 limiting collection, including web and system logs, with optional processing off by default, and A.1.4.3 limiting processing, with support agents able to open full consultation notes. Explains A.1.4.4 accuracy as a safety matter in telehealth, A.1.4.5 minimisation objectives and A.1.4.6 de-identification or deletion. Covers A.1.4.7 temporary files such as downloaded extracts, A.1.4.8 retention schedules checked against stored data, A.1.4.9 disposal for each media type and A.1.4.10 transmission controls. Uses a Singapore fitness app collecting contacts just in case. Follows video consultations through their life, tests small counts in de-identified trend reports, and writes the finding from a test account of 14 October 2026. Ends on developers testing with real patient records.

What you will be able to do

• Check that optional collection and processing are switched off by default for new users
• Compare the retention schedule with the actual dates of stored PII
• Assess whether de-identified data still allows a person to be identified

Why it matters

Helps auditors gather hard evidence from settings and stored files, exposing over-collection and data kept long after its purpose.

Practice: Practice: Controllers: privacy by design and by default · 3 questions

Opens with Northlight Health's country list naming only the UK and Ireland, while its US video supplier's staff can access recordings and a transcription sub-processor sits in a third country. Covers A.1.5.2, a documented basis for each route, revisiting the TikTok case to show that remote access is a route, and the Uber case to show a basis that lapsed while transfers continued. Explains A.1.5.3 and how to build the chain of processors and sub-processors, then check access logs showing twelve approved US support sessions. Covers A.1.5.4 transfer records, including a ninety-day e-prescription log, and A.1.5.5 disclosure records, with a police request answered by a GP and never recorded. Applies the group to the planned Irish hosting move and shows a Boston university hospital's records as good practice. Writes the finding and tests a new text message supplier.

What you will be able to do

• Build the chain of processors and sub-processors to test a controller's country list
• Check that each transfer route has a documented basis that is reviewed when things change
• Verify that one-off disclosures, such as police requests, are recorded centrally

Why it matters

Helps auditors find hidden transfer routes through suppliers and remote access, the issue behind some of the largest privacy fines.

Practice: Practice: Controllers: sharing, transfer, disclosure · 3 questions

Begins at Northlight Connect, where the marketing team imported about 60,000 clinic patients' e-mail addresses into Northlight's own newsletter without asking the clinics. Explains which eleven Table A.2 controls the module covers and that the customer is the clinic. Covers A.2.2.2 contracts addressing assistance, A.2.2.3 processing only on documented instructions, and A.2.2.4 no marketing use without prior consent, never as a condition of service. Shows A.2.2.5 in action with a privacy manager's letter querying a keep-forever instruction. Covers A.2.2.6 and A.2.2.7 information and records for customers, A.2.3.2 the clinic portal for patients' requests, A.2.4.2 three-year-old report extracts, A.2.4.3 return and disposal including backups, and A.2.4.4 transmission, linked to the March 2026 misdirected summaries. Uses a Dubai payroll bureau selling a salary benchmark report. Sets the sample, writes the finding and tests an instruction to send notes to an insurer.

What you will be able to do

• Compare every use of customer data with the controller's documented instructions
• Check that a processor never uses customer PII for marketing without prior consent
• Verify return and deletion of a departed customer's data, including backups

Why it matters

Prepares auditors of SaaS, cloud and BPO processors to catch uses of client data that breach instructions and put contracts at risk.

Practice: Practice: Processors: conditions, obligations, design · 3 questions

Starts with Northlight Connect replacing its appointment reminder supplier in April 2026 under a general written authorisation, without telling the forty clinics first. Groups the eight controls into transfers, disclosures and subcontractors. Covers A.2.5.2 informing customers of transfer bases and changes in time to object, applied to the Irish hosting move, and A.2.5.3 and A.2.5.4 with the chain test. Explains A.2.5.5 notifying legally binding requests and A.2.5.6 rejecting requests that are not legally binding, with a support agent sending a patient's notes to a health insurer in June 2026. Covers A.2.5.7 disclosing subcontractors, A.2.5.8 authorisation and flow-down of Table A.2 terms, shown by a cloud host contract silent on disclosure requests, and A.2.5.9 advance notice of changes. Uses a Manila customer service BPO's thirty-day notices as good practice. Shows that an empty disclosure log needs testing, writes the finding and handles a court order with a gagging requirement.

What you will be able to do

• Check that customers were told of subcontractor changes before the change took effect
• Test how front-line staff handle disclosure requests that are not legally binding
• Read a subcontract to confirm Table A.2 controls are flowed down to it

Why it matters

Helps auditors confirm a processor keeps its clients informed and in control, catching late notices and disclosures made by mistake.

Practice: Practice: Processors: sharing and subcontractors · 3 questions

Opens with control A.3.31 marked implemented, while Northlight Health's test environment holds a full copy of identifiable patient records open to twenty-five developers, two of them contractors. Groups the controls, A.3.3 to A.3.31, into governance, access and incidents, and places, devices and systems. Shows how to choose a sample from the privacy risk assessment, incidents and changes, and rotate the rest across the programme. Tests A.3.9 access rights by comparing the leavers list with active accounts, A.3.11 and A.3.12 incident handling for the March incident, A.3.25 logging by asking who opened a record last week, and A.3.26 cryptography and key ownership. Covers A.3.10 supplier security terms, and a Toronto credit union with unencrypted laptops and loan files left on desks. Reads the A.3.17 course content, writes the finding from a live demonstration on 15 October 2026, and ends with an untested backup under A.3.24.

What you will be able to do

• Select a risk-based sample of Table A.3 controls and record the reasons for it
• Test access rights by comparing the leavers list with active system accounts
• Verify test environments, logs and encryption settings directly, not from procedures

Why it matters

Helps auditors test PII security controls in practice, so a statement of applicability saying implemented is backed by real evidence.

Practice: Practice: Security of PII: Table A.3 · 3 questions

Begins with last year's one-line plan at Northlight Health that started with the policy and never reached a patient record. Places planning in the ISO 19011:2026 audit flow and recaps clause 9.2.2. Shows how to give priority to higher risk and weaker performance, with a programme auditing Northlight Connect and patients' requests twice and staff HR data once, and a review after the Irish hosting move was confirmed. Defines objectives, scope and criteria for one audit, naming controls such as A.2.2.3, A.2.4.4 and A.2.5.9, with a New York health app company's consent audit as a second example. Builds an hour-by-hour plan with the highest risk first and methods matched to evidence. Explains preparing from four sources and four checklist types, including one built around processing activities, and contrasts weak and strong questions. Covers keeping programme records and four common planning mistakes.

What you will be able to do

• Build a risk-based audit programme that gives most effort to high-risk processing
• Write clear audit objectives, scope and criteria naming each clause and control
• Prepare a checklist built around one processing of PII with evidence-based questions

Why it matters

Helps auditors plan audits that reach real records and contracts, so the highest privacy risks are tested first, not left for a complaint.

Practice: Practice: Planning the audit programme, plan, checklist · 3 questions

Starts with an auditor who skips the opening meeting at Northlight Health and has a junior agent run a live data export, sending a patient her full records for a request she never made. Explains the three purposes of the opening meeting in clause 6.4.3 of ISO 19011 and its eight points, scaled from a full meeting to two minutes for a small audit, with a ten-minute agenda for the Connect audit. Contrasts a weak opening with one that confirms people and access. Sets out on-site conduct: follow site rules, keep hands off live systems, ask before photos, and stop guides answering for auditees. Explains remote methods from Table A.1 of the guidance and four rules, with a remote requests review from Sydney using a plan B and hidden names. Describes seventeen qualities of a good auditor and five traits of a bad one.

What you will be able to do

• Run an opening meeting that confirms the plan, the team, access and sampling
• Apply on-site rules that keep auditors' hands off live systems and patient accounts
• Choose remote or on-site methods to fit the evidence while protecting PII

Why it matters

Helps internal auditors run audits that people trust and talk openly in, without disturbing operations or exposing patients' data.

Practice: Practice: Conducting the audit part 1 · 3 questions

Opens with a quarterly report claiming every patient request was answered on time, until the post room log shows five of fourteen letters never reached the tracker. Explains investigating to the depth necessary and when to stop. Walks through Figure 2 in clause 6.4.7 of ISO 19011, from sources of information to conclusions, and the four verification checks: complete, correct, consistent and current. Uses a Tokyo hospital's green access review dashboard, where no access was ever removed and four leavers stayed active. Compares judgement-based and statistical sampling and the risk that samples are not representative. Covers open, closed, leading and appreciative questions, tell me and show me, whom to ask at Northlight Health, and note taking without collecting personal data. Follows the symptom checker from clause 4.1 through A.1.2.6, A.1.3.3, A.1.4.8 and A.3.25 to clause 10.2, then gives topic advice and a defensible requests sample.

What you will be able to do

• Verify that information is complete, correct, consistent and current before using it as evidence
• Choose and record a fair sample sized to the risk of the processing
• Follow one processing of PII end to end, from its role to corrective action

Why it matters

Helps auditors turn reports and claims into verified evidence, so findings stand up and real gaps behind green dashboards are found.

Practice: Practice: Conducting the audit part 2 · 3 questions

Starts with the head of marketing disputing the newsletter finding but agreeing about 60,000 clinic patients were added without consent, showing that the 2026 guidance asks for acknowledged facts, not acceptance. Explains clause 6.4.8 reviews and generating findings. Covers grading criteria and Sterling's grading of major and minor nonconformities, applied to four Northlight Health findings, noting these terms are not in ISO/IEC 27701 or ISO 19011. Separates opportunities for improvement and good practice, using an online insurer in Singapore. Sets out the four parts of a statement, with full examples against A.2.2.4 and A.2.5.9, and rewrites weak statements. Covers the closing meeting in clause 6.4.10, the report contents in clause 6.5.1 and reporting under clause 9.2.2. Explains follow-up under clause 10.2, weak and strong responses to the newsletter import, four ways findings die, and an online pharmacy in Manchester blaming agent error.

What you will be able to do

• Write a nonconformity in four parts: criteria, evidence, statement and grade
• Distinguish nonconformities from opportunities for improvement and good practices
• Assess a corrective action response for root cause and verify its effectiveness

Why it matters

Helps auditors write findings management acts on, avoid findings that will not stand, and close actions only when evidence shows they work.

Practice: Practice: Findings, report and follow-up · 3 questions

Sets out an effective internal audit in six steps: start from the standard and included controls, understand the context and role, test documents against the work, check objectives, competence and awareness, sample controls and records, and close properly with follow-up. Runs a practice audit of Northlight Health's patient requests team for July to September 2026 against A.1.3.7 to A.1.3.10, clauses 7.2 and 7.3 and the requests procedure, led by an independent finance analyst. She samples fifteen requests and five agents and writes two minor nonconformities: two replies missing GP messages under A.1.3.9, and a temporary agent without competence evidence under clause 7.2. Records an opportunity for improvement and a good practice, then verifies the fixes after sixty days. Reviews where audits go wrong and runs quick checks on exclusions and Annex D. Explains the 30-question exam, the 60% pass mark and one retake.

What you will be able to do

• Apply the six-step method to plan and carry out a PIMS internal audit
• Name the correct clause or Annex A control for a given audit situation
• Plan a first internal audit in an area outside your own responsibility

Why it matters

Leaves auditors ready to audit a privacy information management system in their own organisation, with findings that lead to working fixes.

Practice: Practice: A practice audit and the exam · 3 questions