# Internal Privacy Audit Workflows

## Workflow 1: Annual Audit Plan Development

1. **Audit Universe Update** (November): Review all auditable privacy areas; add new systems, regulations, and processing activities
2. **Risk Scoring** (November-December): Apply risk matrix to each auditable area; calculate weighted risk scores
3. **Resource Planning** (December): Determine available audit hours; account for holidays, training, and contingency
4. **Plan Drafting** (December): Schedule audits by quarter; balance risk priority with resource constraints
5. **Management Consultation** (December): Share draft plan with CPO and CISO for input on priorities
6. **Audit Committee Approval** (December): Present final plan to Audit Committee for formal approval
7. **Communication** (January): Communicate approved plan to all stakeholders

## Workflow 2: Individual Audit Execution

### Phase 1: Planning (1-2 Weeks)
1. Review audit charter and confirm authority
2. Conduct preliminary research (prior audits, incidents, regulatory changes)
3. Define scope, objectives, period, and criteria
4. Develop detailed audit program (test procedures per control objective)
5. Issue engagement letter to audit client
6. Schedule opening meeting and interviews

### Phase 2: Fieldwork (2-4 Weeks)
1. Conduct opening meeting
2. Execute audit program using evidence gathering techniques
3. Select and test samples per sampling methodology
4. Document findings in working papers with full evidence chain
5. Conduct daily debriefs within audit team
6. Hold interim meetings with audit client for preliminary findings

### Phase 3: Reporting (1-2 Weeks)
1. Classify findings by severity (Critical/High/Medium/Low/Advisory)
2. Draft findings using Condition-Criteria-Cause-Consequence-Recommendation format
3. Obtain management responses for each finding
4. Draft audit report with executive summary and overall rating
5. Conduct closing meeting with audit client
6. Issue final report to stakeholders

### Phase 4: Follow-Up (Ongoing)
1. Register findings in tracking system
2. Monitor remediation progress per deadlines
3. Conduct verification testing when remediation reported complete
4. Report remediation status quarterly
5. Escalate overdue findings per protocol

## Workflow 3: Sampling Methodology

1. **Define Population**: Identify the complete set of items to be tested
2. **Determine Sampling Approach**: Attribute sampling (compliance) or judgmental (risk-focused)
3. **Calculate Sample Size**: Based on population size, confidence level, and expected error rate
4. **Select Sample Items**: Random selection for attribute sampling; purposive selection for judgmental
5. **Execute Testing**: Test each sample item against audit criteria
6. **Evaluate Results**: Determine error rate; project to population; conclude on control effectiveness
7. **Document**: Record population, sample, methodology, results, and conclusion in working papers