# Standards and Regulatory References — Audit Report Writing

## International Standards

### ISO 19011:2018 — Guidelines for Auditing Management Systems
- **Section 6.6**: Preparing and distributing the audit report
- **Section 6.6.1**: Report content requirements (objectives, scope, findings, conclusions)
- **Section 6.6.2**: Report approval and distribution
- Defines the audit report as the formal record of the audit and its outcomes

### ISO 27701:2019 — Privacy Information Management System (PIMS)
- **Section 5.2**: PIMS-specific audit requirements
- **Section 8.2.2**: Internal audit programme for privacy management
- Extends ISO 27001 audit requirements to privacy-specific controls

### ISO 27001:2022 — Information Security Management Systems
- **Clause 9.2**: Internal audit requirements
- **Clause 9.3**: Management review (audit reports as input)
- **Clause 10.1**: Nonconformity and corrective action documentation

### IIA International Standards for the Professional Practice of Internal Auditing
- **Standard 2400**: Communicating Results — auditors must communicate engagement results
- **Standard 2410**: Criteria for Communicating — must include objectives, scope, results, conclusions
- **Standard 2420**: Quality of Communications — accurate, objective, clear, concise, constructive, complete, timely
- **Standard 2440**: Disseminating Results — appropriate distribution to intended recipients

## Data Protection Regulations

### GDPR (Regulation (EU) 2016/679)
- **Article 5(2)**: Accountability principle — audit reports serve as evidence of compliance monitoring
- **Article 24**: Obligation to implement appropriate measures and demonstrate compliance
- **Article 28(3)(h)**: Processor must allow for and contribute to audits by the controller
- **Article 39(1)(b)**: DPO monitoring compliance including audits
- **Article 47(2)(j)**: BCR audit mechanisms
- **Recital 77**: Risk-based approach documentation

### UK GDPR and Data Protection Act 2018
- **Section 69(1)**: DPO tasks include monitoring compliance
- ICO Accountability Framework — audit trail requirements

### NIST Privacy Framework v1.0
- **GV.MT-P5**: Compliance monitoring and audit reporting
- **CT.PO-P3**: Privacy audit trail management

## Enforcement Guidance

### EDPB Guidelines 01/2022 on Data Subject Rights
- Auditors must verify DSAR process compliance and document findings

### ICO Accountability Framework (2020)
- Organisations must maintain records of compliance activities including audit reports
- Audit reports are key evidence in regulatory investigations

### CNIL Audit Methodology (France)
- Structured finding documentation with condition-criteria-cause-effect format
- Graduated severity classification aligned with regulatory enforcement