# Standards and Regulatory References — Audit Risk Assessment

## International Standards

### ISO 19011:2018 — Guidelines for Auditing Management Systems
- **Section 5.3**: Establishing the audit programme — risk-based approach to audit planning
- **Section 5.3.2**: Determining audit programme risks and opportunities
- **Annex A**: Guidance on audit planning considerations including risk assessment

### ISO 31000:2018 — Risk Management Guidelines
- **Clause 6.3**: Risk identification methodologies
- **Clause 6.4**: Risk analysis — determining likelihood and impact
- **Clause 6.5**: Risk evaluation — comparing against risk criteria
- **Clause 6.6**: Risk treatment selection

### ISO 27005:2022 — Information Security Risk Management
- **Clause 7**: Context establishment for privacy risk assessment
- **Clause 8**: Risk identification, analysis, and evaluation
- **Annex A**: Risk assessment techniques applicable to privacy

### ISO 27701:2019 — Privacy Information Management System
- **Section 5.4.1.2**: Risk assessment specific to PII processing
- **Section 8.2**: PIMS-specific risk assessment
- Extends ISO 27001 risk framework to privacy-specific scenarios

### IIA International Standards for the Professional Practice of Internal Auditing
- **Standard 2010**: Planning — risk-based audit plan establishment
- **Standard 2010.A1**: Based on documented risk assessment updated at least annually
- **Standard 2120**: Risk Management — evaluate risk exposures relating to governance, operations, and information systems

## Data Protection Regulations

### GDPR (Regulation (EU) 2016/679)
- **Article 5(2)**: Accountability — risk assessment supports demonstration of compliance
- **Article 24(1)**: Appropriate technical and organisational measures taking into account the nature, scope, context, and purposes of processing and the risks
- **Article 32**: Security measures appropriate to the risk
- **Article 35**: DPIA for high-risk processing
- **Article 39(2)**: DPO shall have due regard to the risk associated with processing operations

### NIST Privacy Framework v1.0
- **ID.RA-P**: Risk Assessment — identify privacy risks to individuals and the organisation
- **GV.RM-P**: Risk Management Strategy — establish risk tolerance and acceptable risk

### COSO Enterprise Risk Management Framework (2017)
- **Principle 7**: Identifies risk — comprehensive inventory of risks
- **Principle 8**: Assesses severity of risk — impact and likelihood
- **Principle 9**: Prioritises risks — risk appetite and tolerance alignment

## Regulatory Guidance

### EDPB Guidelines 06/2024 on Risk-Based Approach
- Supervisory authorities expect organisations to demonstrate a risk-based approach to privacy compliance
- Risk assessment must consider risks to data subjects, not only to the organisation

### ICO Risk Assessment Guidance (UK)
- Risk assessment as a foundational element of the accountability framework
- Must be documented, periodically reviewed, and updated when processing changes

### OAIC Privacy Risk Assessment Guide (Australia)
- Step-by-step risk assessment aligned with Australian Privacy Principles
- Particular focus on cross-border transfer risk and automated decision-making