# Internal Privacy Audit Standards Reference

## Primary Standards

### IIA International Standards for the Professional Practice of Internal Auditing
- **Publisher**: Institute of Internal Auditors (IIA)
- **Current Version**: Global Internal Audit Standards (effective January 2025)
- **Scope**: Defines the mandatory requirements for internal audit practice
- **Key Standards**: Standard 9 (Performing the Work), Standard 10 (Communicating Results), Standard 11 (Monitoring)
- **Application to Privacy**: Internal privacy audits must conform to IIA standards for methodology, independence, competence, and reporting

### ISACA IT Audit Framework (ITAF)
- **Publisher**: ISACA
- **Scope**: Framework for IT audit and assurance professionals
- **Application**: Technical privacy audit procedures (system configuration, access controls, encryption verification)

### GDPR Audit Requirements
- **Art. 5(2)**: Accountability principle — controller shall demonstrate compliance
- **Art. 24(1)**: Controller shall implement appropriate measures and demonstrate compliance
- **Art. 28(3)(h)**: Processor shall make available information necessary and allow for audits by controller
- **Art. 39(1)(b)**: DPO task to monitor compliance
- **Art. 47(2)(j)**: BCRs must include audit mechanisms
- **Art. 58(1)(b)**: Supervisory authority power to carry out data protection audits

## Supporting Frameworks

### NIST Privacy Framework v1.0
- **Publisher**: National Institute of Standards and Technology
- **Published**: January 2020
- **Application**: Provides audit criteria for privacy risk management and control assessment

### ISO 19011:2018
- **Title**: Guidelines for auditing management systems
- **Application**: Provides audit methodology guidance applicable to privacy management system audits
- **Key Sections**: Audit principles, managing an audit programme, conducting an audit, competence of auditors

### AICPA Generally Accepted Privacy Principles (GAPP)
- **Application**: Provides privacy audit criteria organized by ten management principles

## Professional Certifications for Privacy Auditors

| Certification | Issuing Body | Focus |
|--------------|-------------|-------|
| CIPP/E | IAPP | European data protection law |
| CIPM | IAPP | Privacy program management |
| CIPT | IAPP | Privacy technology |
| CISA | ISACA | Information systems auditing |
| CIA | IIA | Internal auditing |
| ISO 27701 Lead Auditor | Multiple (BSI, PECB, etc.) | PIMS auditing |
| CDPSE | ISACA | Data privacy solutions engineering |