# Privacy Audit Risk Assessment Record

## Assessment Details

| Field | Value |
|-------|-------|
| Organisation | Zenith Global Enterprises |
| Assessment Period | FY 2026 |
| Assessment Date | 14 March 2026 |
| Prepared By | Maria Chen, Chief Audit Executive |
| Approved By | Board Audit Committee |
| Next Review | September 2026 (mid-year update) |

## Risk Universe Summary

| Risk Domain | Auditable Entities | Highest Residual Risk |
|-------------|-------------------|-----------------------|
| Data Subject Rights | 4 | High |
| Data Processing | 3 | Medium |
| Data Transfers | 2 | Critical |
| Data Security | 3 | High |
| Breach Management | 2 | High |
| Vendor Management | 3 | High |
| Privacy Governance | 2 | Low |
| Special Categories | 2 | Critical |
| **Total** | **21** | |

## Detailed Risk Scores

| Auditable Entity | Data Vol | Sensitivity | Reg Exposure | Complexity | Ext Sharing | Inherent Risk | Control Eff. | Residual Risk | Rating |
|-----------------|----------|------------|-------------|-----------|------------|--------------|-------------|--------------|--------|
| DSAR Processing | 4 | 3 | 4 | 3 | 2 | 3.35 | Partially Effective (2) | High | Annual |
| Consent Management | 3 | 3 | 4 | 4 | 3 | 3.40 | Effective (1) | Medium | Biennial |
| International Transfers (EU-US) | 4 | 5 | 5 | 4 | 5 | 4.70 | Partially Effective (2) | Critical | Semi-annual |
| Biometric Access Control | 2 | 5 | 4 | 3 | 1 | 3.40 | Ineffective (3) | Critical | Semi-annual |
| Vendor DPA Management | 3 | 4 | 4 | 2 | 5 | 3.75 | Partially Effective (2) | High | Annual |
| Employee Data Processing | 4 | 3 | 3 | 2 | 2 | 2.90 | Effective (1) | Low | Triennial |
| Marketing Analytics | 5 | 2 | 4 | 4 | 3 | 3.55 | Partially Effective (2) | High | Annual |
| Breach Response | 3 | 4 | 5 | 3 | 2 | 3.60 | Partially Effective (2) | High | Annual |

## Risk Heat Map Summary

| Rating | Count | Entities |
|--------|-------|---------|
| Critical | 2 | International Transfers (EU-US), Biometric Access Control |
| High | 4 | DSAR Processing, Vendor DPA Management, Marketing Analytics, Breach Response |
| Medium | 1 | Consent Management |
| Low | 1 | Employee Data Processing |

## Annual Audit Plan (FY 2026)

| Priority | Entity | Audit Type | Planned Quarter | Estimated Days | Lead Auditor |
|----------|--------|-----------|----------------|---------------|-------------|
| 1 | International Transfers (EU-US) | Full compliance audit | Q1 2026 | 15 | Maria Chen |
| 2 | Biometric Access Control | DPIA review + controls | Q1 2026 | 12 | James Okoro |
| 3 | DSAR Processing | Process effectiveness | Q2 2026 | 10 | Priya Sharma |
| 4 | Vendor DPA Management | Contract review + monitoring | Q2 2026 | 10 | Maria Chen |
| 5 | Marketing Analytics | Purpose limitation review | Q3 2026 | 8 | James Okoro |
| 6 | Breach Response | Tabletop exercise + review | Q3 2026 | 8 | Priya Sharma |
| 7 | Consent Management | Follow-up on 2025 findings | Q4 2026 | 7 | Maria Chen |
| | **Total Planned Days** | | | **70** | |

## Risk Appetite Exceptions

| Entity | Residual Risk | Appetite Threshold | Exception Approved By | Rationale |
|--------|-------------|-------------------|----------------------|-----------|
| International Transfers (EU-US) | Critical | Very Low | Board Audit Committee | Business-critical transfers; enhanced monitoring in place pending SCC update |
| Biometric Access Control | Critical | Very Low | CPO | DPIA in progress; interim manual controls deployed; completion target Q2 2026 |