ISO 27701 Clause 9.2: Internal Audit

Quick Reference (60 Seconds)

If you only read one thing: Clause 9.2 is where the PIMS is independently examined, at planned intervals, by competent and impartial auditors, against the standard's requirements and the organisation's own documented arrangements, with the findings routed to corrective action under 10.2 and to top-management review under 9.3. A 9.2-conformant PIMS is one in which the organisation has commissioned an audit programme that covers the PIMS management-system clauses and the seven privacy-process families (consent, ROPA, rights, DPIA, processor management, transfer, breach); appointed auditors who are competent under ISO 19011:2018 and independent of the work they audit; conducted the audits on a planned, risk-based cadence; classified the findings and routed them to corrective action with verification and closeout; and reported the results to the management review. Not a generic checklist that says "everything is fine"; an audit programme, an annual plan, an auditor matrix and a findings register that prove it. The certification auditor will pick a recent internal audit cycle and walk the auditor's working papers; the Data Protection Board of India will, after a complaint or a breach, ask which internal audit examined the operational area, what the findings were, and what the corrective action delivered. Get 9.2 wrong, no audit programme, no independence, no findings loop, no reporting, and however strong the Clause 8 operations and the Clause 9.1 measurement are, the PIMS has no independent assurance that any of it is working, which under DPDP section 8(5) reasonable security safeguards and GDPR Article 32(1)(d) regular testing and evaluating is itself a nonconformity.

What the Standard Actually Requires

The paraphrased requirement

ISO/IEC 27701:2025 Clause 9.2 asks organizations to audit the PIMS at planned intervals. Four load-bearing ideas sit inside that paraphrase, and the certification auditor tests each separately.

The organisation must plan, establish, implement and maintain an audit programme. The audit programme is not a single audit; it is a multi-cycle, scope-driven, risk-based plan of audits covering the PIMS over time. For a PIMS, the programme covers (a) the management-system clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement); (b) the seven operational privacy processes (consent, ROPA, rights, DPIA, processor management, transfer, breach) introduced under Clause 8.1; (c) the Annex A.1 (controller), A.2 (processor) and A.3 (security) controls that the operational Statement of Applicability under Clause 8.3 documents as applicable; (d) the integrated-with-distinction interface with the ISMS (ISO/IEC 27001:2022) where both certifications are in play; and (e) for Indian Significant Data Fiduciaries, the section 10 SDF obligations (DPO, SDF DPIA, independent data audit, algorithmic-software review). The programme is the artefact that answers the question "what is the audit plan for the next one to three years, and why?".

The organisation must define the audit criteria and the scope for each audit. The audit criteria are "what 'good' looks like", the standard's requirements (the PIMS clauses and the Annex A controls), the organisation's own documented arrangements (the privacy policy, the operational procedures, the process criteria, the SoA), and the regulatory obligations (the DPDP sections, the GDPR articles where applicable, the sector-regulator rules). The audit scope is what is in and out of each audit, which processing activities, which Annex A controls, which operational processes, which business units, which time period. A 9.2-conformant audit has both documented per audit; an audit with no documented criteria or scope is a 9.2 finding waiting to be written.

The organisation must select competent auditors and conduct the audits to ensure objectivity and impartiality. This is the ISO 19011:2018 lineage made normative. Competence is the auditor's knowledge of the PIMS subject matter (privacy regulation, PIMS requirements, audit skills), evidenced through training, qualification and experience. Independence (or impartiality, in ISO 19011 terms) is the structural condition that the auditor has not run, designed or owned the work being audited. For a PIMS the load-bearing independence test is the DPO / Privacy Lead test: the person who built and runs the privacy function cannot be the auditor of that function. The PIMS-specific independence failures are described in Section 13.

The organisation must retain documented information as evidence of the audit programme and the audit results. The evidence set comprises the audit programme itself; the annual audit plan; the auditor competence and independence records; the audit working papers (the sampling, the evidence reviewed, the notes); the audit findings (each classified, conformity, observation, minor nonconformity, major nonconformity, opportunity for improvement); the audit report per cycle; the corrective-action linkage under Clause 10.2; and the management-review input under Clause 9.3. The auditor's working papers are the certification auditor's first-stop artefact in the Stage 2 examination; the absence of working papers is a 9.2 finding even when the audit report itself is present.

The audit programme, the load-bearing 9.2 artefact

The Internal Audit Programme is the artefact most organisations miss. Most growing companies have an "internal audit", a one-off annual exercise conducted the week before the surveillance audit, but no audit programme. The distinction is load-bearing. A single audit is an event; an audit programme is a managed, multi-cycle, scope-driven, risk-based system of audits that, over time, covers the PIMS completely.

The Singahi Internal Audit Programme template (toolkit doc 02) has the following fields per audit:

• Audit ID and title, the canonical label (e.g. PIMS-AUD-2026-Q1-Consent).
• Audit subject, the PIMS clause, the privacy-process family, the Annex A control set or the regulatory obligation examined.
• Audit scope, the processing activities, the business units, the systems, the time period covered.
• Audit criteria, the standard's requirements, the documented arrangements, the regulatory obligations tested.
• Audit method, documentation review, interview, observation, walk-through, sample test, end-to-end trace, sampling-based verification, control test, drill observation.
• Risk-based priority, the audit-programme risk rating that drives the cadence (high-risk or recently-changed areas audited more frequently).
• Auditor or audit team, the named competent, independent auditor(s).
• Resources and effort, the budgeted audit-days and the supporting resources.
• Cadence, the planned-interval frequency (typically annual for each major area; quarterly for high-risk areas; event-triggered for material changes).
• Reporting line, the management-review input format under Clause 9.3.
• Follow-up loop, the corrective-action linkage under Clause 10.2; the verification cycle; the closeout discipline.
• Last-cycle result, the previous cycle's findings summary, to drive the risk-based priority.

A typical Programme for an Indian growing company has twelve to twenty audits per cycle (one annual cycle covering the seven privacy processes plus the management-system clauses plus selected Annex A controls; quarterly check-ins on the highest-risk areas). For a growing firm, twenty to forty audits. For an enterprise or SDF, forty to a hundred and twenty, and the section 10 independent data audit cycle runs alongside, not inside, the 9.2 programme.

The seven privacy-process audit subjects

The Singahi seven-privacy-process audit subject catalog (toolkit doc 09 Section 4) operationalises the "what to audit" question for the PIMS operation. Every 9.2-conformant PIMS audit programme covers these seven subjects; some add others (the privacy-by-design gate, the retention and erasure operation, the algorithmic-software pipeline for SDFs), but the seven below are the load-bearing minimum.

Subject 1, Consent and notice. The audit tests whether the consent operation under DPDP section 6 and GDPR Article 7 produces consent with the seven qualities. The audit tests a sample of consent records against the seven-quality checklist; tests the notice content under DPDP section 5 and GDPR Articles 12 to 14; tests the withdrawal mechanism and the as-easy-to-withdraw latency; tests the Consent Manager integration under DPDP section 2(1)(g) where applicable. The audit criteria include the DPDP Act 2023 sections 5 and 6, the DPDP Rules 2025 consent-notice content requirements, the documented Consent Management Procedure, and the Annex A.1.2.3 / A.1.2.4 controls.

Subject 2, ROPA currency. The audit tests whether the Records of Processing Activities under Annex A.1 and GDPR Article 30 reconcile with the operational reality. The audit tests a sample of processing activities against the ROPA entries; tests the new-activity intake; tests the change-update discipline; tests the retired-activity removal; tests the periodic reconciliation against the operational evidence. The audit criteria include the documented ROPA, the Clause 8.1 process criteria, and the operational evidence.

Subject 3, Data-principal rights fulfilment. The audit tests whether the rights operation under DPDP sections 11 to 14 and GDPR Articles 15 to 22 meets the prescribed response periods and the completeness standards. The audit tests a sample of rights requests against the SLA adherence; tests the Grievance Officer response period under DPDP section 13; tests the nomination-handling workflow; tests the response-completeness rate; tests the rights-request ticketing-system integrity. The audit criteria include the DPDP Rules 2025 grievance-redressal periods, the documented Rights-Response Procedure, the Annex A.1.3 controls, and the operational SLA.

Subject 4, DPIA pipeline. The audit tests whether the DPIA pipeline under DPDP section 10 (for SDFs), GDPR Article 35 and ISO/IEC 29134:2017 operates on every trigger. The audit tests the trigger-test coverage; tests a sample of completed DPIAs against the Article 35(7) / 29134 structure; tests the prior-consultation register; tests the review-on-change discipline. The audit criteria include the DPIA Register, the documented DPIA Procedure, the Annex A.1.2.5 control, and the ISO/IEC 29134:2017 methodology.

Subject 5, Processor and sub-processor chain. The audit tests whether the processor-management operation under GDPR Article 28, Annex A.2 and DPDP section 8 governs the chain. The audit tests the due-diligence coverage; tests the DPA terms coverage; tests the sub-processor change-notification adherence; tests the infringing-instruction handling drill; tests the audit-cooperation cycle; tests the deletion-certification intake. The audit criteria include the documented Processor-Management Procedure, the Annex A.2 controls, the GDPR Article 28(3) DPA-terms list, and the DPDP section 8 obligations.

Subject 6, Cross-border transfer mechanism. The audit tests whether the transfer operation under DPDP section 16 and GDPR Chapter V is current. The audit tests the destination-screen operation (the negative-list screen under DPDP; the adequacy / safeguards / derogations analysis under GDPR); tests a sample of cross-border transfers against the documented transfer basis; tests the transfer-impact-assessment currency (post-Schrems II, CJEU C-311/18, 16 July 2020); tests the supplementary-measures implementation; tests the transfer register. The audit criteria include the documented Transfer Procedure, the Annex A.1.5.2 / A.2.5.2 controls, the GDPR Chapter V articles, and the DPDP section 16 negative list.

Subject 7, Breach detection, notification and response. The audit tests whether the breach operation under DPDP section 8(6), CERT-In Directions 20(3)/2022-CERT-In and GDPR Articles 33 to 34 meets the dual-clock and the content requirements. The audit tests the breach register's completeness; tests the dual-clock adherence (CERT-In six hours from awareness; DPDP without delay to the Board, with a detailed report within seventy-two hours via Rule 7; sector-regulator clocks where applicable); tests the breach table-top drill cadence; tests the regulator-portal-credential currency; tests the principal-notification despatch latency. The audit criteria include the documented Breach-Notification Procedure, the Annex A.3 incident-response controls, the CERT-In Directions, the DPDP Rules 2025 Rule 7, and the sector-regulator rules.

The seven subjects are not mutually exclusive. A single audit can engage several subjects, a ransomware incident at a sub-processor that exposes the controller's principals engages subjects 5, 6, 7 and 2 simultaneously. The 9.2 discipline is that each subject is audited in its own right, so that when an event engages several at once, each has a clean audit-test result.

The line between 9.2, the SDF section 10 independent data audit and the certification audit

The Indian privacy audit ecosystem has three distinct audit types that practitioners constantly conflate. The demarcation is load-bearing; getting it wrong produces duplicate audits (wasted effort) or audit gaps (a nonconformity).

9.2 is the organisation's own internal audit. The organisation commissions the audit programme, appoints the auditors (in-house or external advisory engaged for independence), owns the working papers, classifies the findings and routes them to corrective action. The audit is internal to the organisation, even when the auditor is an external advisor, the engagement is on the organisation's behalf. 9.2 is mandatory for every certified PIMS.

The SDF section 10 independent data audit is a statutory audit. DPDP Act 2023 section 10 imposes on Significant Data Fiduciaries the obligation to appoint an independent data auditor to carry out a periodic data audit. The audit is statutory, it derives from the DPDP Act, not from the PIMS standard; the auditor must be independent, though the SDF appoints it; the audit's scope and cadence are prescribed by the DPDP Rules 2025, not by the organisation's audit programme. The section 10 audit is mandatory only for SDFs; it complements 9.2 (it provides an external, statutory, independent view of the data-protection operation) but does not replace 9.2 (the organisation still owes a 9.2 internal-audit cycle to its PIMS). The SDF section 10 bridge note (toolkit doc 12) operationalises the coordination.

The certification audit is the external certification body's audit. Under ISO/IEC 27706:2025 (the PIMS certification-scheme competence standard that replaces ISO/IEC TS 27006-2:2021), an IAF-accredited certification body conducts the Stage 1 (documentary) audit and the Stage 2 (operating-effectiveness) audit, then the annual surveillance audits and the three-yearly recertification audit. The certification audit is an independent third-party attestation, not an internal audit and not a statutory audit. The certification body cannot also provide the 9.2 internal audit (the impartiality rule); many Indian growing companies engage a separate advisory firm for the 9.2 audit, distinct from the certification body.

The three operate on different cadences and answer different questions. 9.2 answers "is the PIMS operating as designed, as assessed by the organisation's own competent, independent auditors?" (continuous; annual minimum per area). The section 10 audit answers "is the SDF's data-protection operation meeting the DPDP statutory bar, as assessed by an independent data auditor?" (periodic; cadence prescribed by the DPDP Rules 2025). The certification audit answers "does the PIMS conform to ISO/IEC 27701:2025, as assessed by an IAF-accredited certification body?" (Stage 1 + Stage 2 + annual surveillance + three-yearly recertification).

What the standard does NOT require (the demarcation)

• 9.2 does not require the audit programme to cover every PIMS clause every cycle. The programme is multi-cycle and risk-based; the cadence per area is set by the risk-based priority. A typical programme covers the highest-risk areas annually and the lower-risk areas every two to three years.
• 9.2 does not require a single annual audit. A single annual audit covering all seven privacy processes and all PIMS clauses is acceptable for a small scope, but is rarely sufficient for a mid-sized or enterprise PIMS. The test is whether the programme covers the PIMS completely over the cycle.
• 9.2 does not require the auditor to be a certified lead auditor. ISO 19011:2018 competence is the bar; the auditor must be competent (knowledge, skills, experience) for the audit subject, formal certification (IRCA or equivalent) is one way to evidence competence, not the only way.
• 9.2 does not require the auditor to be internal. External advisory engagement is acceptable and often preferable for the independence dimension, especially where the in-house function is small.
• 9.2 does not require a finding. An audit that concludes "the area conforms" is a valid audit outcome; the test is whether the audit work supports the conclusion (the working papers, the sample, the evidence).
• 9.2 does not require a specific tool. A spreadsheet-based audit programme is acceptable for the first cycle; a GRC platform with an audit-management module is a maturity upgrade.
• 9.2 does not require the audit report to be public. The audit report is internal Documented Information; a summary may appear in the transparency report or the annual report (for listed entities).
• 9.2 does not require the DPO to own the audit function. In fact, the DPO owning the audit function is an independence failure when the audit examines the DPO's work. The Internal Audit Function reports independently, typically to the audit committee, the board, or the top-management sponsor.
• 9.2 does not require zero findings. A finding is the audit doing its job; a PIMS with zero findings across multiple cycles is itself a red flag, the audit is probably not deep enough.

What auditors actually check

The certification auditor's Clause 9.2 examination has seven predictable moves. First, open the audit programme, does it exist as a distinct artefact; does it cover the PIMS clauses, the seven privacy processes and the Annex A controls; is it risk-based; is it multi-cycle. Second, open the annual audit plan, for each planned audit, is the scope documented, are the criteria documented, is the method documented, is the auditor named and is the auditor competent and independent. Third, open the Auditor Competence and Independence Matrix, for each auditor, is the competence evidence on file (training, qualification, experience); is the independence test passed (the auditor has not run, designed or owned the work being audited). Fourth, pick a recent completed audit and walk the auditor's working papers, the sample, the evidence reviewed, the notes, the finding classification, the corrective-action linkage under Clause 10.2, the verification, the closeout. Fifth, test the reporting line, was the audit report presented to the management review under Clause 9.3; is there evidence that top management considered the findings and resourced the corrective action. Sixth, test the sequence, did the internal audit run after the privacy risk assessment under Clause 8.2 and after the operational treatment under Clause 8.3 (the canonical sequence test, internal audit before the risk assessment is the most common 9.2 finding on the sequence dimension). Seventh, for SDFs, test the section 10 independent-data-audit coordination, the two cycles are coordinated but not duplicated; the findings from each feed the other.

Why This Control Matters

The independent-assurance engine of the PIMS

Every other clause of ISO/IEC 27701:2025 produces a claim. The policy (5.2) commits to privacy. The objectives (6.2) are measurable. The operational processes (Clause 8) run the privacy-processing operation. The measurement (9.1) reports the privacy-performance profile. The corrective action (10.2) responds to nonconformities. But every one of those claims is a self-claim, the organisation asserting that its own privacy operation works. Clause 9.2 is the clause that converts the self-claim into an independently-tested claim. Without 9.2, the certification auditor and the Data Protection Board of India have only the organisation's word that the PIMS works; with 9.2, they have an independent audit programme, an annual plan, an auditor matrix, a findings register and a corrective-action loop that proves it.

This is not a stylistic observation. It is the operational reality the certification auditor and the Data Protection Board of India converge on. A PIMS that runs 9.2 as a one-week-before-surveillance ceremony, by the DPO auditing the DPO function, with a generic checklist and a one-page "the PIMS conforms" report, is, in auditor language, a "system without independent assurance", a structural finding that cascades into every other Clause 9 sub-clause because the assurance bridge to the management review is dark. A PIMS that runs 9.2 as a planned-interval, risk-based, independent programme is defensible end-to-end.

The Indian regulatory weight behind 9.2

In India, Clause 9.2 carries a regulatory weight that goes beyond the ISO standard because the DPDP Act 2023 and the DPDP Rules 2025 impose affirmative audit obligations that engage exactly when the organisation is a Data Fiduciary. The SDF section 10 independent data audit (mandatory for Significant Data Fiduciaries) is the marquee Indian statutory audit obligation; it complements the 9.2 internal audit but does not replace it. The Data Protection Board of India, after a complaint or a breach, will request the internal-audit findings on the affected operational area; an absence of internal audit on a area later subject to a complaint is a structural finding that engages the section 33 + Schedule penalty regime, up to two hundred and fifty crore rupees for section 8(5) failure (reasonable security safeguards, which the Board can read to include audit assurance), up to two hundred crore for sections 8(6) (breach notification) or 9 (children); one hundred and fifty crore for section 10 (SDF obligations).

The lineage is the wedge. K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 (judgment delivered 24 August 2017 by a nine-judge Bench of the Supreme Court) declared the right to privacy, including informational privacy, a fundamental right under Articles 14, 19 and 21 of the Constitution. The Aadhaar judgment (2019) 1 SCC 1 set the proportionality test. The DPDP Act was enacted 11 August 2023. The DPDP Rules 2025 were notified 13 November 2025 with phased commencement. ISO/IEC 27701:2025 was published 14 October 2025, twelve days before the DPDP Rules were notified. The internal-audit discipline is where the legal landscape enters the PIMS assurance frame: the audit criteria reflect the DPDP sections, the audit programme covers the operational processes the DPDP regulates, the audit findings drive the corrective action that closes the loop with the regulator.

The sector-regulator overlay adds audit obligations on top of the DPDP. The RBI Storage of Payment System Data directive (6 April 2018), the RBI Digital Lending Guidelines (2 September 2022), the RBI Cybersecurity Directions 2026 (31 July 2026), the SEBI Cybersecurity and Cyber Resilience Framework (20 August 2024), and the IRDAI Information and Cyber Security Guidelines 2023 (24 April 2023) each carry their own internal-audit and assurance expectations. For BFSI entities, the 9.2 audit programme must coordinate with the sector-regulator-mandated internal audit cycles (RBI / SEBI / IRDAI), a single combined audit programme covering the PIMS and the sector-regulator obligations is the integrated-with-distinction posture.

The cost of non-compliance

The cost of a Clause 9.2 failure breaks down into four bands. Direct DPDP penalty exposure for an organisation whose internal-audit programme is absent or insufficient, and where the absence is exposed after a complaint or a breach, can engage the section 33 + Schedule maxima. The Board has explicit authority under the DPDP to consider the organisation's audit and assurance posture as part of the reasonable-security-safeguards assessment. Indirect regulatory consequences are larger and slower, a 9.2 failure cascades through the management review (9.3), the corrective action (10.2), the continual improvement (10.1) and every other Clause 9 sub-clause because the assurance bridge is broken. Commercial cost is significant, the Indian privacy incidents most cited in board rooms (Juspay approximately thirty-five million records in 2021, publicly acknowledged; BigBasket approximately twenty million records alleged in 2020; Air India / SITA approximately four-and-a-half million customers affected by the SITA breach disclosed in 2021; MobiKwik contested allegations, denied by the company) all carried post-incident examinations that tested whether the internal-audit programme had examined the affected operational area, what the findings were, and what corrective action was taken. An empty findings register on a material area is the post-incident equivalent of a major nonconformity. Recoverable; entirely avoidable with a workable audit programme.

Scope and Applicability

By organisation size

Growing companies (50 to 250 staff). A compact audit programme: a single annual cycle covering the seven privacy processes (one audit per process per year), a half-yearly check on the highest-risk area, an integrated management-system-clauses audit covering clauses 4 to 10, and a sample-based audit on the Annex A controls the SoA marks applicable. The internal-audit function is typically a part-time Internal Audit Coordinator (often the Head of Quality, the Head of Risk, or an external advisor engaged for independence); the audit team is one to three auditors per audit. The first cycle is deliverable in eight to twelve weeks of internal effort plus external advisory.

Mid-sized (250 to 2,000 staff). A more granular audit programme: a multi-cycle programme with the seven privacy processes covered annually, the highest-risk areas covered semi-annually, the management-system clauses covered across a three-year rolling plan, and a sample-based audit on the Annex A controls with statistical sample sizes. The internal-audit function is typically a dedicated Internal Audit Lead with two to five auditors; for the independence dimension, a portion of the audit work is conducted by an external advisory. The first cycle typically takes twelve to twenty weeks and requires board-cycle alignment for the reporting dimension.

Multi-entity enterprise (2,000+ staff or multi-jurisdiction). A layered audit architecture: a group Internal Audit Function with entity-level audit teams, a multi-year programme covering each entity and each jurisdiction, an integrated PIMS-plus-ISMS-plus-sector-regulator audit programme where applicable, an integrated SDF section 10 independent-data-audit cycle (for SDFs), and a board-visible audit-reporting cycle. Typically six to ten months for the first cycle, with an embedded internal-audit function.

By PIMS role

PII controller (Data Fiduciary) primary. The audit programme leads with the seven privacy-process families (consent, ROPA, rights, DPIA, transfer, breach) and the Annex A.1 controls. The audit findings drive the corrective action on the controller-side operation.

PII processor (Data Processor) primary. The audit programme leads with the Annex A.2 controls, the customer-agreement audit, the infringing-instruction-handling audit, the sub-processor-chain audit, the audit-cooperation audit. The seven privacy-process families apply in the processor-modified form (the consent operation becomes the consent-handling operation on the customer's behalf; the rights operation becomes the rights-cooperation operation).

Both controller and processor. The most common shape for Indian growing companies. The audit programme covers both Annex A.1 and Annex A.2 controls; the findings drive corrective action across both surfaces and at the boundary (joint-controller arrangements, processor-acting-as-controller drift).

By sector

Sector-specific overlays are addressed in Section 21 (BFSI, Healthcare, IT-ITeS, E-commerce, Edtech, Manufacturing), along with the cross-sector patterns (the dual-regulator audit overlay, the SDF section 10 audit overlay, the integrated PIMS-plus-ISMS audit posture).

Key Definitions and Terminology

Internal audit. An independent, evidence-based, planned-interval examination of whether the PIMS, as designed and as operated, conforms to the standard's requirements and to the organisation's own documented arrangements. Distinct from the certification audit (which is a third-party attestation) and from the SDF section 10 independent data audit (which is a statutory audit by an independent data auditor).

Audit programme. The multi-cycle, scope-driven, risk-based plan of audits covering the PIMS over time. The audit programme is the load-bearing 9.2 artefact; it answers "what is the audit plan for the next one to three years, and why?". Distinct from the annual audit plan (which is one year's slice of the programme).

Audit plan. The per-audit document specifying the audit's scope, criteria, method, resources, auditors, cadence and reporting line. Sometimes called the "audit engagement plan".

Audit criteria. The set of requirements used as a reference against which audit evidence is compared. For a PIMS, the criteria include the standard's requirements (PIMS clauses + Annex A controls), the documented arrangements (the policy, the procedures, the SoA, the process criteria), and the regulatory obligations (DPDP, GDPR, sector rules).

Audit scope. The extent and boundary of an audit, the processing activities, the business units, the systems, the time period covered.

Audit evidence. The records, statements of fact or other information, related to the audit criteria, that are verifiable. The auditor gathers evidence through documentation review, interview, observation, walk-through, sample test, end-to-end trace and control test.

Audit finding. The output of the audit, the auditor's conclusion against the criteria, classified as conformity (the area meets the criteria), observation (the auditor notes a fact that does not amount to a nonconformity but warrants management attention), minor nonconformity (a single lapse against the criteria, or a systemic lapse in one part of the area), major nonconformity (a systemic lapse, the absence of a required process, or the failure of a process to achieve its intended outcome), or opportunity for improvement (a suggestion to do better, not a nonconformity).

Auditor competence. The auditor's knowledge of the PIMS subject matter (privacy regulation, PIMS requirements, audit skills), evidenced through training, qualification and experience per ISO 19011:2018. The competence evidence is on file per auditor and per audit subject.

Auditor independence (impartiality). The structural condition that the auditor has not run, designed or owned the work being audited. For a PIMS, the load-bearing independence test is the DPO / Privacy Lead test, the person who built and runs the privacy function cannot be the auditor of that function. ISO 19011:2018 calls this "impartiality", the freedom from bias or conflict of interest.

Audit subject. The PIMS clause, privacy-process family, Annex A control set or regulatory obligation examined in a given audit. The seven canonical privacy-process audit subjects are consent, ROPA, rights, DPIA, processor management, transfer and breach.

Findings and Corrective-Action Register. The Documented Information artefact recording each finding, the classification, the root cause, the corrective-action plan under Clause 10.2, the verification, the closeout, and the management-review cross-reference.

Internal Audit Charter. The board-approved document authorising the internal-audit function, its independence, its access rights (to people, to records, to systems) and its reporting line. The Charter is the authority foundation that makes the audit programme enforceable inside the organisation.

Risk-based audit programme. The discipline that the audit programme allocates audit attention based on risk, high-risk or recently-changed areas audited more frequently; low-risk stable areas audited less frequently. The risk-based priority is set at the programme-design stage and refreshed each cycle.

Integrated-with-distinction posture. For organisations running both the PIMS and the ISMS, the posture of a single combined internal-audit programme with sub-sections for the PIMS-specific audit subjects and the ISMS-specific audit subjects, sharing the Annex A.3 / ISO/IEC 27002:2022 control evidence. Avoids duplicate audits while preserving the distinct audit criteria.

SDF section 10 independent data audit. The statutory audit, mandatory only for Significant Data Fiduciaries under DPDP Act 2023 section 10, conducted by an independent data auditor the SDF appoints. Complements the 9.2 internal audit but does not replace it.

Certification audit. The external third-party attestation audit conducted by an IAF-accredited certification body under ISO/IEC 27706:2025. Distinct from the 9.2 internal audit and the SDF section 10 audit.

Stage 1 audit. The documentary / context audit that opens the certification process, confirms the PIMS scope, context, interested parties, risk assessment and documented arrangements are in place; produces a Stage 1 readiness report.

Stage 2 audit. The operating-effectiveness audit that follows Stage 1, tests that the documented PIMS is actually operating; produces the certification recommendation. The 9.2 internal-audit cycle must be complete (with findings and corrective-action linkage) before Stage 2.

Common nonconformity (the canonical sequence failure). The pattern, flagged in tier-1 cert-body practitioner commentary, of an internal audit that runs before the privacy risk assessment under Clause 8.2 and before the operational treatment under Clause 8.3, the audit has no basis to test against. The most common 9.2 sequence finding in the Indian growing-company segment.

Relationship to Other Clauses and Frameworks

Inside ISO/IEC 27701:2025

9.2 derives its audit criteria from the policy (5.2), the planning artefacts (6.1.3 RTP, 6.1.3 SoA, 6.2 objectives), the operational processes (Clause 8.1's seven privacy-process families, 8.2 risk register, 8.3 SoA and residual-risk register), and the measurement discipline (9.1 Privacy Monitoring Plan and Dashboard). 9.2 feeds 9.3 (the management review uses the audit report as a first-class input), 10.2 (corrective action on the findings) and 10.1 (continual improvement from the recurring-finding patterns). The Annex A.1 / A.2 / A.3 controls are the audit subjects on the control-surface dimension.

ISO/IEC 27001:2022 Clause 9.2

Structurally identical on the infosec side. For organisations running both certifications, the combined 9.2 discipline has a shared audit-programme spine (the management-system clauses 4 to 10 are audited once; the operational controls are audited per discipline) with clearly labelled sub-sections for the PIMS-specific audit subjects (the seven privacy processes, the Annex A.1 / A.2 controls) and the ISMS-specific audit subjects (the access-control operation, the vulnerability-management operation, the security-operations throughput, the ISO/IEC 27002:2022 Annex A controls). The DPO and the CISO jointly own the integrated audit-programme reconciliation.

ISO 19011:2018, the auditing principles lineage

ISO 19011:2018 (Guidelines for auditing management systems) is the auditing-methodology standard that 27701:2022 Clause 9.2 implicitly invokes through the words "objectivity and impartiality" and "competence". The seven principles, integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach, are the load-bearing lineage. The 19011 audit-process model (initiating the audit, preparing the audit activities, conducting the audit activities, preparing and distributing the audit report, completing the audit, conducting the audit follow-up) is the structural pattern the 9.2 audit programme operationalises. ISO 19011:2018 Section 4 (principles), Section 5 (managing an audit programme) and Section 6 (performing an audit) are the three structural references the internal-audit function works from.

GDPR

Article 32(1)(d) "regular testing, assessing and evaluating the effectiveness of technical and organisational measures" is the explicit statutory anchor for the regular-testing dimension of 9.2. Article 28(3)(h) processor audit-cooperation (the processor makes available all information necessary to demonstrate compliance) is the anchor for the processor-chain audit dimension. Article 35(11) DPIA review (the DPIA is reviewed where there has been a change in the risk represented by the processing operations) is the anchor for the DPIA-pipeline audit dimension. Articles 33 to 34 breach notification is the anchor for the breach-operation audit dimension. The EDPB Guidelines 9/2022 on personal data breach notification operationalise the breach-audit test.

DPDP Act 2023 + DPDP Rules 2025

Section 8(5) reasonable security safeguards (the internal audit tests whether the safeguards are operating). Section 8(6) + DPDP Rules 2025 Rule 7 (breach intimation without delay, the seventy-two-hour detailed report, the breach-operation audit tests the dual-clock adherence). Sections 11 to 13 rights turnaround (the rights-operation audit tests the SLA adherence). Section 13 Grievance Officer response period (the rights-operation audit tests the section 13 SLA). Section 10 SDF obligations (the audit tests the SDF-obligations operating model; the section 10 independent data audit is the statutory complement). Section 2(1)(g) Consent Manager integrity (the consent-operation audit tests the Consent Manager integration). Section 16 cross-border negative-list screening (the transfer-operation audit tests the destination-screen operation). Section 18 Data Protection Board of India (the audit tests the regulatory-engagement record). Section 33 + Schedule penalty maxima (the audit tests the penalty-exposure tracking).

NIST Privacy Framework v1.0

Communicate-P (Data Review, Reporting, Training, Authorization, Transparency) and Govern-P (Risk Management Strategy, Monitoring and Review) are the closest functional analogues of the 9.2 audit discipline. The Internal Audit Function is a Govern-P capability; the audit findings are a Communicate-P output. The NIST Privacy Framework's risk-based approach aligns with the 9.2 risk-based audit programme.

SOC 2 Privacy TSC + Common Criteria

P8.0 (Monitoring for Compliance) is the privacy-monitoring criterion that maps to the 9.2 audit discipline. CC4.1 / CC4.2 (Monitoring) are the common-criteria monitoring anchors, CC4.1 covers ongoing / separate evaluations; CC4.2 covers evaluator competence and the evaluation cadence. CC5 (Control Activities) is the operational-controls dimension. The Points of Focus 2022 update operationalises the monitoring and evaluation expectations. A combined PIMS + SOC 2 audit discipline is common in the Indian SaaS / ITeS segment, the internal-audit programme covers both the PIMS audit subjects and the SOC 2 monitoring expectations.

ISO/IEC 27002:2022

Only 5.34 (Privacy and protection of PII) is PII-specific. The 5.35 (Independent review of information security) lineage is the structural ISMS analogue of the 9.2 audit on the security dimension, the 5.35 control expects the organisation to review the management of information security at planned intervals, independently. The 9.2 audit covers 5.35 from the PIMS dimension; the ISMS Clause 9.2 audit covers 5.35 from the security dimension. The two are coordinated under the integrated-with-distinction posture.

Other ISO siblings

ISO/IEC 29134:2017 (DPIA guidelines), the audit criteria for the DPIA-pipeline audit. ISO/IEC 27018:2019 (cloud PII processor), the audit criteria for the processor-chain audit on cloud processors. ISO 31000:2018 (risk management), the Clause 6 Monitoring and Review function is the structural analogue of 9.2 for the risk-management discipline. ISO/IEC 42001:2023 (AI Management System), Clause 9.2 alignment for AI-driven processing audit overlap; the algorithmic-software review for SDFs under DPDP section 10 is a 9.2 audit subject when AI is in use. ISO/IEC 27706:2025 (PIMS certification-scheme competence), the standard that governs the certification-body's competence for the certification audit (the external audit; not the 9.2 internal audit).

Inside the harmonized structure, what 9.2 inherits

The harmonized structure (HS, formerly Annex SL) means 9.2 is structurally aligned with the ISMS Clause 9.2, the AI-Management-System Clause 9.2, the BCMS Clause 9.2 and the QMS Clause 9.2. An organisation running an integrated 27001 + 27701 + 42001 programme can run a single combined internal-audit programme with sub-sections for each discipline, a single annual audit plan covering all three control surfaces, a single findings register, a single management-review input.

Detailed Implementation Guidance, The Seven Internal-Audit Moves

Figure · Process

What Clause 9.2 asks you to do

Move 1, Establish or confirm the Internal Audit Function

The first move is to establish (or, where one exists, confirm the authority of) the Internal Audit Function. For most Indian growing companies, the function starts as a part-time Internal Audit Coordinator (often the Head of Quality, the Head of Risk, or an external advisor engaged for independence) and matures into a dedicated function as the PIMS matures. The function is established through a board-approved Internal Audit Charter (toolkit doc 01 Section 6) that authorises: the function's independence; its access rights (to people, to records, to systems); its reporting line (typically to the audit committee, the board, or the top-management sponsor); its authority to classify findings and route them to corrective action; and its authority to escalate unresolved findings.

The Charter is the authority foundation. Without it, the Internal Audit Function's requests for evidence and time are contested by the business units; with it, the function's authority is unambiguous. The Charter is signed by top management and reviewed annually at the management review (Clause 9.3).

The independence dimension is the PIMS-specific load. The DPO and the Privacy Lead cannot own the Internal Audit Function when the function audits the DPO's work, the most common independence failure in the Indian growing-company segment. The cleanest pattern for a growing firm is an Internal Audit Function reporting to the Audit Committee or the board, with the DPO and the Privacy Lead as subject-matter consultees (the auditor asks them for evidence and explanation; the auditor does not report to them). For a small growing company where a separate function is not feasible, an external advisor engaged for independence is the workable pattern.

Move 2, Build the Internal Audit Programme

The Internal Audit Programme (toolkit doc 02) is the load-bearing 9.2 artefact. The Programme is multi-cycle, it covers the PIMS over a one- to three-year horizon, not a single year. The Programme is risk-based, the audit attention is allocated based on the risk-based priority, not equally across all areas. The Programme is scope-driven, each audit has a defined subject, scope and criteria.

The Programme design starts with the PIMS scope map: the management-system clauses 4 to 10 (audited across the cycle); the seven privacy-process families (audited annually for the highest-risk, biennially for the medium-risk, triennially for the lowest-risk); the Annex A.1 / A.2 / A.3 controls (audited on a sample basis with statistical sample sizes); and the integrated-with-distinction interface with the ISMS (audited jointly where both certifications are in play).

The Programme design then assigns the risk-based priority. Higher-risk areas, those with recent material change, those with previous audit findings, those handling sensitive data (children, health, financial), those with high-volume processing, those handling cross-border transfers, get higher priority and more frequent audit attention. Lower-risk areas get less.

The Programme design then assigns the cadence. Typical cadences: annual for the highest-risk privacy processes (consent, breach, processor management for most consumer-facing firms); biennial for the medium-risk processes; triennial for the lower-risk processes. The management-system clauses are audited across a three-year rolling plan, three to four clauses per year, covering the full set across the cycle.

The Programme design then assigns the auditor. Each audit has a named competent, independent auditor (see Move 4). The Auditor Competence and Independence Matrix is the cross-reference artefact.

The Programme design then assigns the reporting line. Each audit's findings are routed to the management-review input under Clause 9.3 (the summary view) and to the corrective-action loop under Clause 10.2 (the per-finding view). The Internal Audit Report per cycle (toolkit doc 11) is the artefact that bridges the two.

The Programme is reviewed annually at the management review (Clause 9.3). The review considers: the previous cycle's findings; the recurring-finding patterns; the risk-based priority (have the risks shifted?); the regulatory-change log; the operational-change log; the auditor performance. The output is the refreshed Programme for the next cycle.

Move 3, Build the Annual Audit Plan

The Annual Audit Plan (toolkit doc 03) is one year's slice of the Programme. For each planned audit in the year, the Plan documents: the audit ID and title; the audit subject; the audit scope; the audit criteria; the audit method; the auditor or audit team; the resources and effort (audit-days); the scheduled timing (which quarter); the reporting line (the management-review input format); the follow-up loop (the corrective-action linkage under Clause 10.2).

The Annual Audit Plan is approved by top management (or the Audit Committee) at the start of the year. The Plan is a living document, audits may be added during the year in response to material changes (the event-trigger dimension; e.g. a breach, a new processing activity, a regulator engagement may trigger an ad-hoc audit on top of the planned cadence).

A typical Annual Audit Plan for an Indian growing company has twelve to twenty audits per year. The Plan is the artefact the certification auditor opens first in the Stage 2 examination of 9.2, it answers "what is the audit plan for the year, and is it being executed?".

Move 4, Build the Auditor Competence and Independence Matrix

The Auditor Competence and Independence Matrix (toolkit doc 10) is the artefact that operationalises the "select competent auditors and conduct the audits to ensure objectivity and impartiality" requirement. The Matrix has two dimensions per auditor:

• Competence, the auditor's knowledge of the PIMS subject matter (privacy regulation, PIMS requirements, audit skills), evidenced through training (formal ISO 19011:2018 or equivalent audit-training), qualification (privacy-specific credentials, ISO/IEC 27701 Lead Auditor or equivalent) and experience (audits conducted, sectors covered, complexity handled). The competence evidence is on file per auditor and per audit subject, an auditor competent on the consent operation may not be competent on the cross-border transfer operation.
• Independence (impartiality), the structural condition that the auditor has not run, designed or owned the work being audited. For a PIMS, the load-bearing independence tests are: the DPO / Privacy Lead test (cannot audit their own function); the Privacy Operations Lead test (cannot audit their own operation); the CISO test (cannot audit their own security operation when the audit examines the Annex A.3 controls); the business-process owner test (cannot audit their own process).

The Matrix is reviewed annually. For each audit in the Annual Audit Plan, the Matrix confirms: the named auditor; the competence evidence; the independence test result (pass / fail); the mitigation where the independence test fails (typically: engage an external advisor for the audit; or reassign to another in-house auditor who passes the test).

For most Indian growing companies, the independence dimension requires at least one of: an external advisory engagement for some audits; an in-house auditor pool large enough that any given audit subject has at least one auditor who passes the independence test; or a parent-company / group-internal-audit arrangement where auditors from one entity audit another.

Move 5, Build the Privacy-Process Audit Checklist

The Privacy-Process Audit Checklist (toolkit doc 09) turns each of the seven privacy-process families into a structured audit-test instrument. For each family, the Checklist provides: the audit-test questions (10 to 25 per family); the expected evidence per question; the sample size (where sampling applies); the pass / fail criteria; the regulatory anchor (the DPDP section, the GDPR article, the sector rule); the 27701 clause and Annex A control tested.

The seven-family Checklist structure (with the question counts in a typical mid-sized implementation):

• Consent and notice (15 questions), the seven-quality test on a sample of consent records; the notice-content test under DPDP section 5; the withdrawal-mechanism test; the as-easy-to-withdraw latency test; the Consent Manager integration integrity test.
• ROPA currency (12 questions), the reconciliation test on a sample of processing activities; the new-activity intake test; the change-update discipline test; the retired-activity removal test; the periodic-reconciliation test.
• Rights fulfilment (15 questions), the SLA adherence test on a sample of rights requests; the Grievance Officer response-period test under DPDP section 13; the nomination-handling test; the response-completeness test; the ticketing-system integrity test.
• DPIA pipeline (12 questions), the trigger-test coverage test; the DPIA-quality test on a sample of completed DPIAs (against the Article 35(7) / 29134 structure); the prior-consultation register test; the review-on-change discipline test.
• Processor and sub-processor chain (18 questions), the due-diligence coverage test; the DPA-terms coverage test against the Article 28(3) / Annex A.2 list; the sub-processor change-notification adherence test; the infringing-instruction handling test; the audit-cooperation test; the deletion-certification intake test.
• Cross-border transfer (12 questions), the destination-screen operation test; the transfer-basis documentation test on a sample of cross-border transfers; the TIA currency test (post-Schrems II); the supplementary-measures implementation test; the transfer-register completeness test.
• Breach detection and notification (15 questions), the breach-register completeness test; the dual-clock adherence test (CERT-In six hours + DPDP without delay plus a seventy-two-hour detailed report on a sample of breaches and drills); the table-top drill cadence test; the regulator-portal-credential currency test; the principal-notification despatch latency test.

The Checklist is the audit-day instrument. The auditor works through the questions, records the evidence reviewed, the sample drawn, the finding per question (conformity / observation / minor NC / major NC / opportunity for improvement), and the working-paper cross-reference. The completed Checklist becomes part of the audit working papers, the certification auditor's first-stop artefact in the Stage 2 examination of audit depth.

Move 6, Conduct the audit and write the findings

The audit itself runs to the ISO 19011:2018 process model: opening meeting; documentation review; interview; observation; walk-through; sample test; end-to-end trace; control test; closing meeting. The audit-day evidence is recorded in the working papers, the notes, the documents reviewed, the screenshots, the system exports, the interview records.

The findings are written per the finding-classification taxonomy:

• Conformity, the area meets the criteria. The audit records the evidence on which the conformity conclusion rests.
• Observation, a fact that does not amount to a nonconformity but warrants management attention. Often a leading indicator of a future nonconformity.
• Minor nonconformity, a single lapse against the criteria, or a systemic lapse in one part of the area. Does not by itself compromise the PIMS but warrants corrective action.
• Major nonconformity, a systemic lapse, the absence of a required process, or the failure of a process to achieve its intended outcome. Compromises the PIMS in the area audited.
• Opportunity for improvement, a suggestion to do better, not a nonconformity.

Each finding is recorded in the Findings and Corrective-Action Register (toolkit doc 11) with: the finding ID; the audit ID; the audit subject; the classification; the description (the fact, the criteria against which it is a finding, the evidence); the root cause; the corrective-action plan under Clause 10.2 (the action, the owner, the target date); the verification (the method, the verifier, the date); the closeout (the date, the outcome, the sign-off); the management-review cross-reference.

The corrective-action loop under Clause 10.2 is the operational expression of the finding. A finding without a corrective-action linkage is an open loop, the canonical 9.2 finding-on-a-finding. The verification cycle confirms the corrective action actually delivered the intended outcome; the closeout records the auditor's sign-off.

Move 7, Write the Internal Audit Report and wire it into the management review

The Internal Audit Report per cycle (toolkit doc 11 Section 6) is the management-facing artefact. The Report includes: the audit ID and the audit subject; the scope, criteria, method, auditor; the audit period; the findings summary (the count per classification, the headline findings); the recurring-finding patterns (where a finding has appeared in multiple cycles, the systemic-improvement signal); the corrective-action status (open, in progress, verified, closed out); the management-review input (the headline verdict for 9.3).

The Report is wired into the management review under Clause 9.3. The DPO presents (or, for the independence dimension, the Internal Audit Function Lead presents) the audit-cycle summary to top management. The management review considers: the audit findings; the recurring-finding patterns; the corrective-action status; the resources needed for the corrective action; the implications for the PIMS (suitability, adequacy, effectiveness). The output is the management-review decisions, including the resources for the corrective action and the implications for the next cycle's audit programme.

The reporting line is the load-bearing 9.2-to-9.3 link. An audit report that is filed but never presented to the management review is the canonical reporting failure, the audit work is done but the top-management decision loop is not engaged. The certification auditor tests the reporting line by asking for the management-review minutes that reference the audit-cycle summary; the absence of such a reference is a 9.2 finding on the reporting dimension.

Worked example, Arya Hospitals builds a privacy-programme audit

To make the seven moves concrete, consider Arya Hospitals (a fictional Bengaluru-based secondary-care network with two thousand one hundred staff; the facts are composite from publicly reported sector patterns and should not be attributed to any real organisation). Arya's 9.2 build:

• Move 1, established the Internal Audit Function under a board-approved Charter. The function reports to the Audit Committee; the DPO is a subject-matter consultee; the CISO is a consultee on the Annex A.3 audit subjects; the Head of Internal Audit (a qualified IRCA-registered auditor with healthcare experience) leads the function.
• Move 2, built the Internal Audit Programme covering the seven privacy processes (each annually, given the high-risk patient-data profile), the management-system clauses (across a three-year rolling plan, four clauses per year), the Annex A controls (sample-based with statistical sample sizes), and the integrated-with-distinction interface with the ISMS (joint audits on the Annex A.3 / ISO/IEC 27002:2022 controls).
• Move 3, built the Annual Audit Plan with sixteen audits in the year (seven privacy-process audits, four management-system-clause audits, three Annex A sample audits, one integrated audit, one event-trigger reserve).
• Move 4, built the Auditor Competence and Independence Matrix with five in-house auditors plus an external advisory engagement for the consent, rights and DPIA audits (the DPO function is the consultee; the external advisor is the auditor). The Matrix confirms competence (training, qualification, experience per auditor per subject) and independence (the DPO test passed via the external advisor).
• Move 5, built the Privacy-Process Audit Checklist with 109 audit-test questions across the seven families (15 consent + 12 ROPA + 15 rights + 12 DPIA + 18 processor + 12 transfer + 15 breach + 10 integrated-with-distinction questions).
• Move 6, ran the first audit cycle (sixteen audits over the year) producing forty-seven findings (eight major NC, nineteen minor NC, fourteen observations, six opportunities for improvement). Each finding routed to the Findings and Corrective-Action Register; each corrective action tracked to verification and closeout.
• Move 7, wrote the Internal Audit Report per cycle, presented to the Audit Committee quarterly and to the full management review (Clause 9.3) annually. The recurring-finding pattern (consent-record quality drift on the telemedicine platform's consent UX) drove a re-design of the consent flow under the continual-improvement programme (10.1).

The first-cycle effort: forty-two weeks of internal time plus external advisory; the resulting audit programme and findings register passed the 27701:2025 transition surveillance audit at first attempt; the privacy-programme-audit discipline positioned Arya for the SDF designation analysis and the section 10 independent-data-audit cycle when the SDF designation arrives.

Tools, Technologies, and Solutions

The tool categories

Audit-management GRC platforms. Modules that record the audit programme, the annual plan, the auditor matrix, the working papers, the findings register, the corrective-action linkage and the management-review input.

Audit-automation tools. Specialised platforms that automate the audit-day work, the Checklist automation, the sample-drawing, the evidence-collection, the finding-drafting. Often a feature of the GRC platform rather than a standalone tool.

Evidence-collection tools. Tools that gather the audit evidence, the consent-record exports, the ROPA extracts, the rights-request ticketing exports, the breach-register extracts, the DPIA-register extracts, the processor-inventory extracts. Often built into the operational platforms (the consent platform, the ticketing system, the breach register) rather than a separate audit tool.

Sampling tools. Statistical sampling tools that draw the audit sample with documented sample sizes, confidence levels and selection methods. Often a feature of the audit-management GRC platform; sometimes a standalone tool.

Working-papers tools. Platforms that structure the auditor's working papers, the notes, the documents reviewed, the screenshots, the interview records. Often a feature of the audit-management GRC platform; sometimes a standalone tool.

Findings and corrective-action workflow tools. Modules that route the findings to the corrective-action owner, capture the corrective-action plan, track the verification, file the closeout. Often a feature of the GRC platform.

SDF section 10 independent-data-audit coordination tools. For SDFs, tools that coordinate the 9.2 cycle with the section 10 cycle, shared evidence library, non-overlapping scope allocation, joint reporting where appropriate. Often a feature of the GRC platform.

Selection criteria

Select on: India-DPDP coverage (most global platforms are GDPR-heavy and DPDP-thin); audit-programme support (the audit programme, the annual plan and the auditor matrix as first-class artefacts); working-papers depth (the audit-day evidence structurally captured); findings-and-corrective-action workflow (the closed loop with verification and closeout); management-review integration (the audit-cycle summary as a first-class 9.3 input); integrated-with-distinction support (the PIMS-plus-ISMS audit reconciliation); SDF section 10 coordination (where applicable); and cost-to-value for the Indian growing-company segment.

Build vs buy

Most growing companies should buy the GRC platform with the audit-management module and build the audit programme methodology in-house with external advisory for the first cycle. The methodology is too organisation-specific to outsource end-to-end; the tooling is too time-intensive to build internally. The Privacy-Process Audit Checklist is the build item, it must be customised to the organisation's processing activities, business units and systems; the generic Checklist is a starting point, not a finished instrument.

Policy and Procedure Templates

Internal Audit Policy (sample of our own drafting)

The organisation maintains an internal-audit discipline that independently, at planned intervals, examines the PIMS, the management-system clauses, the seven operational privacy processes, the Annex A controls and the regulatory obligations, to determine whether the PIMS, as designed and as operated, conforms to the standard's requirements and to the organisation's own documented arrangements. The Internal Audit Function is established under a board-approved Charter; the function is independent of the privacy function it audits; the function has the access rights and the authority necessary to conduct the audits. The Internal Audit Programme is risk-based and multi-cycle; the Annual Audit Plan is approved by top management; the auditors are competent under ISO 19011:2018 and independent of the work they audit. The findings are classified per the finding-classification taxonomy and routed to corrective action under Clause 10.2 with verification and closeout. The Internal Audit Report per cycle is a first-class management-review input under Clause 9.3. For Indian Significant Data Fiduciaries, the section 10 independent data audit cycle is coordinated with the 9.2 cycle but does not replace it.

Internal Audit Procedure (sample of our own drafting, summarised)

1. Scope and inputs, every audit subject in the Internal Audit Programme. The inputs are the PIMS clauses, the documented arrangements, the operational evidence, the regulatory obligations, the previous-cycle findings.
2. Audit programme maintenance, the Programme is maintained per the Move 2 rules; the risk-based priority is refreshed each cycle; the annual plan is approved at the start of the year.
3. Auditor competence and independence, the Matrix is maintained per auditor per subject; the independence test is enforced; the mitigation is engaged where the test fails.
4. Audit conduct, the audit runs to the ISO 19011:2018 process model; the working papers are recorded per audit; the Checklist is the audit-day instrument.
5. Finding classification and the corrective-action loop, the findings are classified per the taxonomy; each finding is routed to the Findings and Corrective-Action Register; the corrective-action plan is recorded under Clause 10.2; the verification is conducted; the closeout is signed off.
6. Reporting, the Internal Audit Report per cycle is written; the Report is presented to the management review under Clause 9.3; the recurring-finding patterns are reported; the implications for the next cycle's audit programme are recorded.
7. SDF section 10 coordination (for SDFs), the 9.2 cycle and the section 10 cycle are coordinated; the scope allocation is non-overlapping; the evidence library is shared where appropriate; the reporting is joint where appropriate.
8. Roles and responsibilities, the Internal Audit Function Lead, the auditors, the DPO (consultee), the CISO (consultee on Annex A.3), the business-process owners (auditees), top management (recipient of the Report).
9. Documented Information control, the Programme, the annual plan, the Matrix, the working papers, the Register, the Report, all retained as Documented Information per Clause 7.5.

Sample Internal Audit Charter clauses

The Internal Audit Function is established by top management as the independent assurance function for the PIMS.

The Function reports to the Audit Committee (or, where no Audit Committee exists, to top management); the DPO and the Privacy Lead do not supervise the Function.

The Function has the authority to access any record, system, premises or person within the scope of the PIMS; the auditees cooperate with the Function's requests within five business days.

The Function has the authority to classify findings per the finding-classification taxonomy; the Function has the authority to escalate unresolved findings to the Audit Committee.

The Function has the authority to engage external advisors for independence where the in-house auditor pool fails the independence test.

The Function is resourced with the audit-days and the supporting resources necessary to execute the Annual Audit Plan.

Audit-Programme Risk Assessment and Treatment

The audit programme itself carries risk, the risk that the audit work is too shallow to detect a nonconformity, the risk that the independence dimension is compromised, the risk that the reporting line is broken, the risk that the corrective-action loop is open. The audit-programme risk treatment is the discipline that addresses these risks.

The audit-programme risk register

The Internal Audit Function maintains an audit-programme risk register (often a section of the Findings and Corrective-Action Register or a separate artefact). The register records: the audit-programme risk (e.g. "the consent audit is conducted by an external advisor who has been engaged for three consecutive years and may have lost independence"); the risk rating; the treatment (e.g. "rotate the external advisor every three years; engage a different advisor for the next cycle"); the treatment owner; the review date.

The recurring-finding risk

The recurring-finding pattern is the highest-signal audit-programme risk. A finding that appears in multiple cycles on the same operational area signals either: (a) the corrective action under Clause 10.2 was ineffective, the root cause was not addressed; (b) the operational area has a structural problem that the corrective-action discipline cannot resolve, the area needs a Clause 6.3 planned change or a Clause 10.1 continual-improvement programme; or (c) the audit is repeatedly testing the wrong thing, the audit criteria or the method are not the right ones for the area. The Internal Audit Function flags the recurring-finding pattern in the audit report and recommends the structural treatment.

The auditor-drift risk

Auditor drift is the risk that an auditor who has been engaged for many cycles gradually adopts the auditee's perspective and loses the independent edge. The treatment is auditor rotation, typically every three to five cycles per audit subject. The rotation can be in-house (a different in-house auditor takes over) or external (a different external advisor takes over). The rotation is documented in the Auditor Competence and Independence Matrix.

The audit-depth risk

The audit-depth risk is the risk that the audit work is too shallow to detect a nonconformity. The treatment is the sample-size discipline (statistical sample sizes documented per audit), the walk-through discipline (at least one end-to-end operational-event trace per audit), and the evidence-on-file discipline (the working papers support every conformity conclusion with the underlying evidence).

The audit-programme effectiveness evaluation

The Internal Audit Function evaluates the effectiveness of the audit programme annually. The evaluation considers: the findings yield per audit (an audit with zero findings across multiple cycles is itself a red flag, the audit is probably not deep enough); the recurring-finding pattern; the corrective-action effectiveness (the rate at which corrective actions delivered the intended outcome); the certification-audit findings on the operational areas the internal audit examined (any divergence is a signal that the internal audit missed something); the regulator-engagement findings on the operational areas (any post-incident finding on an area the internal audit examined is a signal). The evaluation output is the refreshed audit programme for the next cycle.

Audit and Compliance Checklist

The 26 questions below cover the audit-evidence surface for Clause 9.2. Expected evidence and red flags noted. Most can be answered from the toolkit doc 04 audit-evidence checklist.

1. Is there an Internal Audit Function (or an appointed Internal Audit Coordinator)? Expected: a board-approved Charter (toolkit doc 01 Section 6). Red flag: missing.
2. Is the Function independent of the privacy function it audits? Expected: the reporting line is to the Audit Committee or top management, not to the DPO. Red flag: the Function reports to the DPO.
3. Is the Function's authority documented (access to people, records, systems; escalation authority)? Expected: the Charter. Red flag: missing or partial.
4. Is there an Internal Audit Programme as a distinct artefact? Expected: dated, version-controlled, approved by top management. Red flag: missing; or the "programme" exists only inside the audit report.
5. Does the Programme cover the PIMS clauses 4 to 10? Expected: a clause-by-clause coverage map.
6. Does the Programme cover the seven privacy-process families (consent, ROPA, rights, DPIA, processor management, transfer, breach)? Expected: a family-by-family coverage map.
7. Does the Programme cover the Annex A.1 / A.2 / A.3 controls (on a sample basis with documented sample sizes)?
8. Is the Programme risk-based (higher-risk or recently-changed areas audited more frequently)? Expected: the risk-based priority documented per audit subject.
9. Is there an Annual Audit Plan as a distinct artefact? Expected: the Plan, approved by top management at the start of the year.
10. For each planned audit in the Plan, is the scope documented? The criteria documented? The method documented? The auditor named?
11. Is there an Auditor Competence and Independence Matrix? Expected: per auditor, the competence evidence (training, qualification, experience); the independence test result.
12. For each audit, does the named auditor pass the independence test? Red flag: the DPO auditing the consent process; the Privacy Lead auditing the rights process; the CISO auditing the breach process.
13. Where the independence test fails, is the mitigation engaged (external advisor; alternative in-house auditor)?
14. Is there a Privacy-Process Audit Checklist per family? Expected: the seven-family Checklist with audit-test questions, expected evidence, sample sizes, regulatory anchors.
15. For each completed audit, are the working papers on file? Expected: the notes, the documents reviewed, the screenshots, the interview records. Red flag: only the audit report; no working papers.
16. For each completed audit, was the audit conducted per the ISO 19011:2018 process model (opening meeting; documentation review; interview; observation; closing meeting)?
17. Is there a Findings and Corrective-Action Register? Expected: per finding, the classification, the root cause, the corrective-action plan under Clause 10.2, the verification, the closeout.
18. Are the findings classified per the taxonomy (conformity / observation / minor NC / major NC / opportunity for improvement)?
19. For each finding, is the corrective action linked to Clause 10.2? Expected: the corrective-action record on file. Red flag: open loop.
20. For each corrective action, is the verification conducted and the closeout signed off? Red flag: corrective action without verification.
21. Is there an Internal Audit Report per cycle? Expected: the Report, including the findings summary, the recurring-finding patterns, the corrective-action status, the management-review input.
22. Is the Report presented to the management review under Clause 9.3? Expected: the management-review minutes reference the Report. Red flag: the Report filed but never presented.
23. Did the internal audit run after the privacy risk assessment under Clause 8.2 and after the operational treatment under Clause 8.3? Expected: the audit's criteria reference the 8.2 register and the 8.3 SoA. Red flag: the audit ran before the risk assessment (the canonical sequence failure).
24. For SDFs, is the section 10 independent-data-audit cycle coordinated with the 9.2 cycle? Expected: the bridge note (toolkit doc 12). Red flag: duplicate audits; or audit gaps.
25. Is the audit programme integrated with the ISMS internal audit where both certifications are in play? Expected: the integrated-with-distinction posture.
26. Is the audit programme evaluated annually for effectiveness (the findings yield; the recurring-finding pattern; the corrective-action effectiveness; the certification-audit divergence)?

Evidence the auditor will physically request

• The dated and signed Internal Audit Charter.
• The Internal Audit Programme (multi-cycle; risk-based).
• The Annual Audit Plan (this year's slice).
• The Auditor Competence and Independence Matrix.
• The Privacy-Process Audit Checklist per family.
• The working papers for a sampled recent audit (the notes, the documents reviewed, the screenshots, the interview records).
• The Findings and Corrective-Action Register.
• The corrective-action records under Clause 10.2 (the linkage test).
• The verification and closeout records.
• The Internal Audit Report per cycle.
• The management-review minutes referencing the Report.
• For SDFs: the section 10 independent-data-audit report and the bridge note.
• The integrated-with-distinction evidence: the PIMS audit programme and the ISMS audit programme reconciled on the Annex A.3 / ISO/IEC 27002:2022 controls.

Common Stage-1 nonconformities the auditor will write up

• NC 1: Internal Audit Programme does not exist; only a one-off annual audit report. Major NC. Remediation: build the Programme, four to eight weeks.
• NC 2: Auditor independence failure, the DPO audited the DPO function. Major NC. Remediation: re-audit with an independent auditor, four to twelve weeks.
• NC 3: Sequence failure, the internal audit ran before the privacy risk assessment. Major NC (and frequently a cascading NC on 8.2). Remediation: re-run the audit after the risk assessment, eight to twelve weeks.
• NC 4: No findings, every audit concludes "the area conforms" with no working papers. Minor or major NC. Remediation: re-audit with depth, six to twelve weeks.
• NC 5: Findings without corrective-action linkage under Clause 10.2. Minor or major NC. Remediation: route the findings to 10.2, two to six weeks.
• NC 6: Report not presented to the management review under 9.3. Minor or major NC. Remediation: present at the next review, four to twelve weeks (next review cycle).
• NC 7: No working papers, only the audit report. Minor NC. Remediation: stand up the working-papers discipline, four to eight weeks.
• NC 8: Programme not risk-based, every area audited annually regardless of risk. Minor NC. Remediation: introduce the risk-based priority, four to eight weeks.

Metrics and KPIs

1. Audit programme coverage, percentage of the PIMS scope (clauses + privacy processes + Annex A controls) covered by the audit programme over the cycle. Target: 100% across the multi-cycle Programme.
2. Annual audit plan execution, percentage of the planned audits in the Annual Audit Plan completed in the year. Target: 95%+ (a small reserve for reprioritisation is acceptable).
3. Auditor independence test pass rate, percentage of audits where the named auditor passes the independence test. Target: 100%.
4. Auditor competence coverage, percentage of audits where the named auditor's competence evidence is on file for the audit subject. Target: 100%.
5. Findings yield per audit, the count of findings (any classification) per audit. Target: organisation-specific (a healthy audit programme produces findings; a zero-finding programme is a red flag).
6. Major-NC count per cycle, the count of major nonconformities per audit cycle. Target: downward trend; spikes investigated at the management review.
7. Recurring-finding rate, the count of findings that have appeared in multiple cycles on the same operational area. Target: downward trend; recurring findings trigger structural treatment (6.3 / 10.1).
8. Corrective-action closeout rate, percentage of findings with corrective action verified and closed out within the target period. Target: 90%+ within ninety days; 100% within one hundred and eighty days.
9. Corrective-action effectiveness rate, percentage of corrective actions that delivered the intended outcome (verified by the next-cycle audit). Target: 85%+.
10. Audit-report-to-management-review latency, the time from the audit-report issue to the management-review presentation. Target: under thirty days.
11. Working-paper completeness, percentage of audits with complete working papers (the notes, the documents reviewed, the screenshots, the interview records). Target: 100%.
12. Sequence adherence, percentage of audits that ran after the privacy risk assessment under 8.2 and after the operational treatment under 8.3. Target: 100%.
13. Integrated-with-distinction reconciliation, percentage of Annex A.3 / ISO/IEC 27002:2022 controls audited jointly with the ISMS audit (where both certifications are in play). Target: 100% on the shared controls.
14. SDF section 10 coordination (for SDFs), percentage of the 9.2 audit subjects coordinated with the section 10 cycle (non-overlapping scope allocation; shared evidence library). Target: 100%.
15. Audit-programme effectiveness evaluation, the annual evaluation completed and the refreshed Programme issued. Target: annual completion.

Common Pitfalls and Audit Failures

Pitfall 1, The DPO-audits-the-DPO-function independence failure. The DPO (or the Privacy Lead) audits the privacy function they built and run. The single most common 9.2 finding in the Indian growing-company segment. Treatment: Move 1 independence, the Internal Audit Function reports independently; the DPO is a consultee; an external advisor or a different in-house auditor conducts the audit.

Pitfall 2, The one-week-before-surveillance timing failure. The internal audit is conducted in the thirty days before the certification surveillance audit, with the explicit purpose of "preparing for the surveillance". The audit is not a 9.2 audit, it is a pre-surveillance dry run. Treatment: stand up the audit programme with the planned-interval cadence independent of the certification cycle.

Pitfall 3, The sequence failure (the canonical tier-1-cert-body-flagged common NC). The internal audit runs before the privacy risk assessment under Clause 8.2 and before the operational treatment under Clause 8.3, the audit has no criteria to test against. The single most common 9.2 sequence finding in the Indian growing-company segment. Treatment: the audit programme's criteria reference the 8.2 register and the 8.3 SoA; the audit cycle is sequenced after the 8.2 / 8.3 cycle.

Pitfall 4, The programme-as-it-exists-only-in-the-report failure. The Internal Audit Programme does not exist as a distinct artefact; the only evidence of a programme is the annual audit report. The certification auditor asks for the Programme and the answer is "the report". Treatment: Move 2, build the Programme as a distinct artefact.

Pitfall 5, The zero-finding failure. Every audit concludes "the area conforms" with no findings. The audit is not deep enough to detect nonconformities. Treatment: Move 5, build the Privacy-Process Audit Checklist with audit-test questions, sample sizes, evidence requirements; train the auditors on the audit depth.

Pitfall 6, The findings-without-corrective-action-loop failure. The findings are written but never routed to corrective action under Clause 10.2. The audit is an open loop. Treatment: Move 6, wire the Findings and Corrective-Action Register to Clause 10.2 with verification and closeout.

Pitfall 7, The report-not-presented-to-management-review failure. The audit report is filed but never presented to the management review under Clause 9.3. The top-management decision loop is not engaged. Treatment: Move 7, wire the Report to the 9.3 input pack; record the presentation in the management-review minutes.

Pitfall 8, The documentation-only failure. The audit tests documentation only (the policy, the procedure, the SoA) and never walks an operational event end-to-end (the consent record; the rights request; the breach drill; the processor change notice; the cross-border transfer). The audit work does not test operating effectiveness. Treatment: the walk-through discipline, at least one end-to-end operational-event trace per audit.

Pitfall 9, The generic-checklist failure. The audit Checklist is a generic ISO-management-system checklist with no PIMS-specific content. The audit does not test the seven privacy processes. Treatment: Move 5, build the Privacy-Process Audit Checklist.

Pitfall 10, The annual-only failure. The audit programme has a single annual audit covering everything; no risk-based priority; no multi-cycle plan; no event-trigger dimension. Treatment: Move 2, build the risk-based, multi-cycle Programme.

Pitfall 11, The no-working-papers failure. Only the audit report exists; no working papers (the notes, the documents reviewed, the screenshots, the interview records). The certification auditor cannot verify the audit work. Treatment: the working-papers discipline, record per audit the evidence reviewed.

Pitfall 12, The recurring-finding-without-structural-treatment failure. A finding appears in multiple cycles on the same operational area; the corrective action under Clause 10.2 is repeated; the root cause is not addressed. Treatment: flag the recurring-finding pattern; route to Clause 6.3 (planned change) or Clause 10.1 (continual improvement) for structural treatment.

Pitfall 13, The SDF-section-10-conflation failure. The SDF conflates the 9.2 internal audit with the section 10 independent data audit, assuming the section 10 audit replaces the 9.2 audit (it does not), or assuming the 9.2 audit replaces the section 10 audit (it does not). Treatment: the bridge note (toolkit doc 12), coordinate the two cycles.

Pitfall 14, The auditor-drift failure. The external advisor has been engaged for five consecutive cycles and has gradually adopted the auditee's perspective. Treatment: auditor rotation, rotate every three to five cycles.

Pitfall 15, The integrated-with-distinction failure. Where both the PIMS and the ISMS are in play, the two audit programmes are run separately, duplicate audits on the Annex A.3 / ISO/IEC 27002:2022 controls, audit gaps elsewhere. Treatment: the integrated-with-distinction posture, a single combined audit programme with shared evidence on the shared controls.

Pitfall 16, The certification-body-as-internal-auditor failure. The same firm that conducts the certification audit also conducts the 9.2 internal audit. This is an impartiality failure under the certification scheme (ISO/IEC 27706:2025). Treatment: engage a different firm for the 9.2 internal audit.

Pitfall 17, The single-auditor-pool failure. The internal-audit function has one in-house auditor; that auditor cannot pass the independence test on every audit subject (they cannot audit their own work, and at small scale they have touched everything). Treatment: build a pool of three to five in-house auditors; engage an external advisor for the independence gap; rotate auditors across cycles.

Pitfall 18, The board-invisible failure. The audit programme and the findings are not visible to the board / Audit Committee. The Audit Committee does not receive the Report; the management review (9.3) is the only forum. Treatment: the Audit Committee reporting line, the Report goes to the Audit Committee (for listed entities and SDFs, this is mandatory); the management review is the operational forum.

Illustrative Scenario 1: Failure, Camlin Travel and the Back-to-Front Audit Cycle (Illustrative)

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome. It is set after 13 May 2027, when the DPDP Act's duties and the Board's inquiry and penalty powers take effect.

Illustrative scenario. Camlin Travel in this scenario is a fictional Mumbai-based online travel aggregator with three hundred and eighty staff, an in-house DPO (the Head of Legal doubling up), and approximately one-point-four million customer accounts; the name is descriptive only and the facts are composite from publicly reported sector patterns. Nothing here should be attributed to any real organisation.

Camlin Travel built its PIMS in 2024 ahead of an ISO/IEC 27701:2019 certification push. The internal audit was a single annual exercise conducted in the thirty days before the surveillance audit, by the DPO (the Head of Legal), the independence failure. The Checklist was a generic ISO-management-system template downloaded from the internet; the privacy-specific content was a single line ("verify that the consent forms work"). The audit's criteria did not reference the privacy risk assessment under Clause 8.2 (which had not yet been completed) or the operational Statement of Applicability under Clause 8.3 (which was a draft). The audit ran in March 2028, ahead of the surveillance audit in April 2028; the 8.2 risk assessment was completed in June 2028, the canonical sequence failure. The audit report was one page; the conclusion was "the PIMS conforms". The findings register was empty. The audit report was filed in the DPO's drive; no presentation to the management review.

In July 2028 a published investigation alleged that Camlin's loyalty programme had been sharing customer travel-history data with a third-party marketing analytics vendor based in a jurisdiction not on the DPDP section 16 negative list but with no documented transfer-impact assessment and no supplementary measures, the cross-border transfer mechanism under Annex A.1.5.2 was not operating as documented in the SoA. The Data Protection Board of India preliminary inquiry under section 18 requested the internal-audit findings on the cross-border transfer operation. The answer was "the internal audit did not cover the cross-border transfer operation in detail; the audit was generic". The DPBI's working hypothesis became that the absence of a substantive internal audit on the cross-border transfer operation was itself a section 8(5) reasonable-security-safeguards failure, the organisation could not demonstrate that it had independently tested the operation.

The certification body issued a major nonconformity on Clause 9.2 at the next surveillance audit, cascading into nonconformities on 8.2 (the risk assessment had not covered the cross-border transfer operation in depth), 8.3 (the SoA marked A.1.5.2 applicable but the implementation was future-state), 9.3 (the management review had not considered the audit findings because there were none), 10.2 (no corrective action because no findings), and Annex A.1.5.2 (the transfer mechanism was not operating). The certificate was suspended pending remediation.

The remediation re-engineered the internal-audit discipline (the board-approved Charter; the audit programme with the seven privacy-process families; the external advisor engagement for the consent, rights and transfer audits to address the independence dimension; the Privacy-Process Audit Checklist with the cross-border transfer section added; the Findings and Corrective-Action Register; the management-review wiring; the sequence discipline, the audit cycle runs after the 8.2 / 8.3 cycle).

The lessons: the DPO-audits-the-DPO-function pattern is a structural failure that produces zero findings on the DPO function; the sequence failure (audit before the risk assessment) means the audit has no criteria to test against; the generic-checklist failure means the seven privacy processes are not actually audited; the report-not-presented failure means the top-management loop is dark; the absence of an internal audit on a operational area is itself a section 8(5) exposure after a complaint or a breach.

Illustrative Scenario 2: Success, Arya Hospitals Builds a Privacy-Programme Audit (Illustrative)

Illustrative scenario. Arya Hospitals is a fictional Bengaluru-based secondary-care network with two thousand one hundred staff, an IRDAI-regulated health-insurance affiliate, and approximately eight hundred thousand patient records; the facts are composite from publicly reported sector patterns and should not be attributed to any real organisation.

Arya ran an integrated ISO/IEC 27001:2022 + ISO/IEC 27701:2019 programme with a single Internal Audit Function reporting to the Audit Committee. The existing 9.2 audit programme had three audits per year (the ISMS audit, the PIMS audit, the integrated audit), each conducted by a rotating pool of two in-house auditors. The findings yield was low (typically two to three findings per cycle); the recurring-finding pattern on the patient-data access control had been flagged for three consecutive cycles without structural treatment; the audit-programme effectiveness evaluation was a tick-box exercise.

In Q4 2025 the Head of Internal Audit commissioned a 9.2 refresh ahead of the 27701:2025 transition. The workshop surfaced six material shifts (worked example in Section 7.8 details the operational shape): the Charter refreshed with the explicit independence-from-the-DPO rule; the Programme rebuilt with the seven privacy-process families (each annually, given the high-risk patient-data profile), the management-system clauses across a three-year rolling plan, the Annex A sample audits, and the integrated-with-distinction reconciliation with the ISMS audit; the Annual Audit Plan with sixteen audits in the year; the Auditor Competence and Independence Matrix with five in-house auditors plus an external advisory engagement for the consent, rights and DPIA audits; the Privacy-Process Audit Checklist with 109 audit-test questions; the Findings and Corrective-Action Register wired to Clause 10.2 with verification and closeout.

The first cycle produced forty-seven findings (eight major NC, nineteen minor NC, fourteen observations, six opportunities for improvement). The recurring-finding pattern on the patient-data access control was escalated to the continual-improvement programme under Clause 10.1, the structural treatment was a re-design of the access-control workflow under Clause 6.3 planned change, not another corrective-action cycle. The consent-record quality drift on the telemedicine platform's consent UX was caught early through the consent audit's sample test, the corrective action was a UX refresh delivered before the drift became a regulator-visible failure. The SDF section 10 bridge note was prepared in advance of the expected SDF designation, the 9.2 cycle and the section 10 cycle were designed for non-overlapping scope allocation.

The outcome: the integrated-with-distinction posture cut parallel-audit overhead; the recurring-finding escalation (structural treatment under 6.3 / 10.1 instead of repeated corrective-action cycles under 10.2) cut corrective-action-cycle cost; the consent-record quality drift caught early avoided DPDP section 8(5) penalty exposure and reputational damage on the telemedicine platform; the SDF section 10 bridge note positioned Arya for the SDF designation without an additional remediation cycle.

The lessons: the privacy-programme audit (the seven-family Checklist) is the highest-use 9.2 decision for most Indian growing companies; the independence dimension is non-negotiable (engage an external advisor where the in-house pool fails the test); the recurring-finding pattern is the structural-improvement signal (route to 6.3 / 10.1, not 10.2); the audit-cycle sequence (after 8.2 / 8.3) is the discipline most organisations miss; the SDF section 10 bridge note is the 2026 / 2027 maturity dimension as the SDF designations arrive.

Multi-Framework Mapping

The densest cross-framework mappings are at the audit-programme row (GDPR Article 32(1)(d); DPDP section 8(5); NIST PF Govern-P; ISO/IEC 27001:2022 Clause 9.2; ISO 19011:2018), the auditor-independence row (GDPR Article 32(1)(d); DPDP section 8(5); ISO 19011:2018 impartiality principle), and the findings-to-corrective-action row (GDPR Article 5(2); DPDP section 8(5); ISO/IEC 27001:2022 Clause 10.2). The unique-to-India rows are the SDF section 10 independent-data-audit coordination (DPDP section 10) and the dual-clock breach-operation audit (DPDP section 8(6) + CERT-In six hours), no direct GDPR analogue exists at the SDF designation level.

Implementation Roadmap

30 days

• Decide the Internal Audit Function's authority and reporting line. Issue or refresh the Internal Audit Charter (Move 1). Get it board-approved.
• Identify the independence dimension, does the DPO currently audit the DPO function? If yes, plan the mitigation (external advisor engagement; alternative in-house auditor).
• Run the audit-programme framing workshop (Move 2). Use the Singahi Internal Audit Programme template (toolkit doc 02) on a whiteboard. Walk the seven privacy-process families; for each, decide the cadence (annual, biennial, triennial).

90 days

• Complete the Internal Audit Programme build (Move 2). The Programme covers the PIMS clauses, the seven privacy processes, the Annex A controls, the integrated-with-distinction interface.
• Complete the Annual Audit Plan for the current year (Move 3). Each planned audit has a scope, criteria, method, auditor and timing.
• Build the Auditor Competence and Independence Matrix (Move 4). The Matrix is enforced; the mitigation is engaged where the independence test fails.
• Build the Privacy-Process Audit Checklist per family (Move 5). Start with one family (consent is typically the highest-use start) and complete the others across the year.
• Run the first audit on the first family. Document the working papers. Write the findings. Route to Clause 10.2 corrective action.

180 days

• Run the audits on the next three privacy-process families (rights, DPIA, breach are typically the next priorities for Indian consumer-facing firms).
• Build the Findings and Corrective-Action Register (Move 6). The Register is the artefact that operationalises the corrective-action loop under 10.2.
• Write the Internal Audit Report per cycle (Move 7). Present the Report to the management review under Clause 9.3.
• For SDFs, prepare the section 10 bridge note (toolkit doc 12). Coordinate the 9.2 cycle with the section 10 cycle.
• Update the awareness programme to reference the audit programme (Clause 7.3) and the training programme on the Privacy-Process Audit Checklist (Clause 7.2).

12 months

• Run the full audit cycle (all seven privacy processes, the management-system clauses for the year, the Annex A sample audits).
• Run the audit-programme effectiveness evaluation (Section 10.5).
• Refresh the Programme for the next cycle. Apply the recurring-finding patterns; the regulatory-change log; the operational-change log.
• Run an internal-audit-of-the-internal-audit (the audit-programme effectiveness evaluation is the meta-audit). The certification auditor will test this in the next surveillance.
• For SDFs, complete the first SDF section 10 independent data audit cycle and integrate the findings.

FAQ

Q1. Our DPO is the most knowledgeable person on the PIMS. Why can't the DPO be the internal auditor?

Because the auditor must be independent of the work being audited. The DPO built and runs the privacy function; the DPO auditing the DPO function is the canonical independence failure. The independence dimension is not about competence (the DPO is competent); it is about impartiality (the DPO is not impartial about their own work). The mitigation is to engage a different in-house auditor or an external advisor for the privacy-function audits; the DPO is a subject-matter consultee.

Q2. Can we use the same firm for the 9.2 internal audit and the certification audit?

No. The certification body cannot also provide the 9.2 internal audit, the impartiality rule under ISO/IEC 27706:2025 (and the broader ISO/IEC 17021-1:2015 certification-scheme rules) prohibits the conflict. Engage a different firm for the 9.2 internal audit.

Q3. How often should the internal audit run?

At planned intervals. The interval is risk-based, the highest-risk privacy processes are typically audited annually (consent, breach, processor management for most consumer-facing firms); the medium-risk processes biennially; the lower-risk processes triennially. The management-system clauses are audited across a three-year rolling plan. A single annual audit covering everything is rarely sufficient for a mid-sized or enterprise PIMS.

Q4. Do we have to wait for the privacy risk assessment under 8.2 to be done before we run the internal audit?

Yes, the canonical sequence discipline. The internal audit's criteria reference the 8.2 register and the 8.3 SoA; an audit that runs before the risk assessment has no criteria to test against. The internal audit must also run before the Stage 2 certification audit and before the management review under 9.3. The sequence: 8.2 (assess) → 8.3 (treat) → 9.1 (monitor) → 9.2 (audit) → 9.3 (review) → 10.2 / 10.1 (act / improve).

Q5. What does an internal-audit finding look like?

A finding has: the finding ID; the audit ID; the audit subject; the classification (conformity / observation / minor NC / major NC / opportunity for improvement); the description (the fact, the criteria against which it is a finding, the evidence reviewed); the root cause; the corrective-action plan under Clause 10.2 (the action, the owner, the target date); the verification (the method, the verifier, the date); the closeout (the date, the outcome, the sign-off); the management-review cross-reference. The Findings and Corrective-Action Register (toolkit doc 11) operationalises the structure.

Q6. We have completed our first internal-audit cycle with zero findings. Is that good?

It is a red flag. A zero-finding audit programme across multiple cycles signals that the audit work is too shallow to detect nonconformities. A healthy audit programme produces findings; the recurring-finding pattern is the structural-improvement signal. Re-examine the Privacy-Process Audit Checklist depth; the sample sizes; the walk-through discipline.

Q7. Our internal audit was conducted but the report was not presented to the management review. Is that a problem?

Yes, the reporting failure. The internal audit report is a first-class management-review input under Clause 9.3. An audit report filed but never presented engages the top-management decision loop dark. The certification auditor tests the reporting line by asking for the management-review minutes that reference the report; the absence of such a reference is a 9.2 finding on the reporting dimension.

Q8. We are an SDF. Does the section 10 independent data audit replace the 9.2 internal audit?

No. The section 10 audit is a statutory audit by an independent data auditor; the 9.2 audit is the organisation's own internal audit. The two are distinct and not substitutable. Coordinate them through the SDF section 10 bridge note (toolkit doc 12), non-overlapping scope allocation, shared evidence library, joint reporting where appropriate.

Q9. What is the difference between the 9.2 internal audit, the SDF section 10 audit and the certification audit?

The 9.2 internal audit is the organisation's own internal audit (mandatory for every certified PIMS). The SDF section 10 audit is a statutory audit by an independent data auditor (mandatory only for SDFs; complements 9.2). The certification audit is the external third-party attestation by an IAF-accredited certification body under ISO/IEC 27706:2025. The three answer different questions and are not substitutable.

Q10. How do we run the integrated-with-distinction audit programme with the ISMS?

A single combined internal-audit programme with sub-sections for the PIMS-specific audit subjects (the seven privacy processes, the Annex A.1 / A.2 controls) and the ISMS-specific audit subjects (the access-control operation, the vulnerability-management operation, the security-operations throughput, the ISO/IEC 27002:2022 Annex A controls). The Annex A.3 / ISO/IEC 27002:2022 controls are the bridge, audited jointly. The DPO and the CISO jointly own the reconciliation.

Q11. Do we need to use a GRC platform for the internal audit?

No. A spreadsheet-based audit programme is acceptable for the first cycle. The test is whether the Programme, the Matrix, the working papers, the Findings Register and the Report exist and are current, not the medium. A GRC platform with an audit-management module is a maturity upgrade for the mid-sized and enterprise segment.

Q12. Can we outsource the entire 9.2 internal audit to an external advisor?

You can outsource the audit-day work; you cannot outsource the audit-programme ownership. The organisation owns the Programme; the external advisor is engaged for the audit-day work (and often for the independence dimension). The Report is the organisation's Report; the Findings Register is the organisation's Register.

Q13. How do we test the auditor competence?

Through the Auditor Competence and Independence Matrix (toolkit doc 10). For each auditor, the competence evidence is on file: training (formal ISO 19011:2018 or equivalent audit-training), qualification (privacy-specific credentials, ISO/IEC 27701 Lead Auditor or equivalent), experience (audits conducted, sectors covered, complexity handled). The competence evidence is per audit subject, an auditor competent on the consent operation may not be competent on the cross-border transfer operation.

Q14. What should the Internal Audit Report say to the management review?

The Report's management-review input includes: the audit-cycle summary (the audits conducted; the subjects covered); the findings summary (the count per classification; the headline findings); the recurring-finding patterns (where a finding has appeared in multiple cycles, the structural-improvement signal); the corrective-action status (open, in progress, verified, closed out); the resources needed for the corrective action; the implications for the PIMS (suitability, adequacy, effectiveness). The headline verdict is the management-review input.

Q15. How do we handle a major nonconformity our own internal audit has identified?

The finding is classified as a major NC; the corrective action under Clause 10.2 follows the standard root-cause-analysis and corrective-action discipline; the verification cycle confirms the corrective action delivered the intended outcome; the closeout is signed off by the auditor; the finding is reported to the management review under 9.3. The major NC identified internally is a 9.2 success, the audit programme working. The same major NC identified first by the certification auditor or by the Data Protection Board of India is a 9.2 failure.

Industry-Specific Requirements

BFSI

Banks, NBFCs, payment aggregators, payment gateways, insurers. The BFSI internal-audit programme carries the heaviest regulatory load: the DPDP section 8(5) safeguards audit, the section 8(6) dual-clock breach-notification audit (CERT-In six hours + DPDP without delay plus a seventy-two-hour detailed report + RBI six hours + SEBI six hours + IRDAI twenty-four to seventy-two hours), the section 10 SDF audit overlay (most large BFSI players are likely SDFs), the RBI Storage of Payment System Data audit (6 April 2018, data-locality), the RBI Digital Lending audit (2 September 2022, borrower-consent, device-data minimisation), the RBI Cybersecurity Directions 2026 IS audit (31 July 2026), the SEBI CSCRF audit (20 August 2024), the IRDAI Information and Cyber Security Guidelines audit (24 April 2023). The BFSI internal-audit programme is typically integrated with the sector-regulator-mandated internal-audit cycles (RBI / SEBI / IRDAI), the integrated-with-distinction posture applied to multiple regulatory regimes. The algorithmic-software review audit is critical for credit-scoring, fraud-detection and collections engines. The board / Risk Management Committee reporting line is mandatory.

Healthcare

Hospitals, telemedicine platforms, healthtech, insurers processing health data. The internal-audit programme must surface the heightened sensitivity of health data (the DPDP section 9 analog for vulnerable data subjects; the SPDI Rules' explicit inclusion of health data; clinical-data-confidentiality expectations; the IRDAI framework where insurance is involved). The DPIA-pipeline audit is critical, most material processing activities require DPIA treatment under 8.2; the audit tests whether the DPIA pipeline fires on every trigger. The consent-operation audit must test the patient-consent flow including the verifiable-consent dimension where the patient is a minor or a person with disability (DPDP section 9). The cross-border-transfer audit must test the cross-border affiliate flows (clinical second-opinion services; teleradiology; pharmacovigilance reporting). The rights-operation audit must test the patient-rights workflow (access to medical records; correction of clinical data; the sensitive erasure-vs-retention balance against clinical-record-retention rules). The role declaration is complex, hospitals are controllers for patient data, processors for some insurance-claim data, joint controllers with referring physicians in some cases.

IT-ITeS and SaaS

IT services firms, BPOs, SaaS providers, cloud processors. The internal-audit programme is almost always "both", the Annex A.1 controls for the organisation's own employees, marketing-lead contacts and beta-test users (controller-side); the Annex A.2 controls for the customer's principals reached through the organisation's processing (processor-side). The processor-chain audit (the infringing-instruction handling; the sub-processor controls; the audit-cooperation cycle) is the marquee processor-side audit subject. The standalone-PIMS scoping decision lets SaaS firms scope a PIMS to the customer-data plane only, separate from the ISMS-scoped engineering plane, the internal-audit programme reflects this scoping. The cross-border transfer audit is central, most ITeS firms process data of overseas principals under GDPR / CCPA jurisdiction; the transfer-impact-assessment audit and the SCC-currency audit are dense. The customer's own audit cooperation is itself audited, the audit-cooperation audit tests whether the organisation responds to customer audits within the contractual clock.

E-commerce and Retail

D2C brands, marketplaces, e-commerce platforms, omni-channel retailers. The internal-audit programme must address consumer-privacy expectations at scale, the children's-data regime where minors are in the user base (DPDP section 9, the children's-data audit tests the verifiable-parental-consent flow and the no-behavioural-monitoring / no-targeted-advertising controls), the marketing-lead consent regime (the consent audit tests the lead-capture forms against the seven-quality checklist), the supplier-ecosystem processor chains (the processor-management audit tests the supplier DPA terms and the sub-processor change-notification clock), the payment-data overlays (RBI Tokenisation, the Payment Aggregator obligations). The loyalty programme is typically a joint-controller arrangement under A.1.2.8, the audit tests the joint-controller agreement. The Consent Manager integration (DPDP section 2(1)(g)) is particularly relevant for consumer-facing firms, the consent audit tests the Consent Manager integrity controls.

Edtech

K-12 platforms, higher-edtech, skilling platforms, test-prep. The children's-data regime (DPDP section 9) is the central internal-audit subject, the principal is a minor, the consent dynamic is parental, and the section 9 verifiable-parental-consent + no-behavioural-monitoring-or-targeted-advertising regime is load-bearing. The children's-data audit is the densest single audit subject in the edtech internal-audit programme, it tests the age-assurance operation, the verifiable-parental-consent flow, the no-behavioural-monitoring control, the no-targeted-advertising control. The DPIA threshold is low, most material processing activities require DPIA treatment under 8.2; the DPIA-pipeline audit is dense. The rights-operation audit must test the parental-rights workflow (parental access; parental correction; parental erasure). The cross-border-transfer audit must test the cross-border affiliate flows (overseas tutors; overseas content providers; cross-border exam delivery).

Manufacturing

Discrete and process manufacturing, automotive, chemicals, pharma manufacturing. The internal-audit programme must address the OT-IT convergence (operational technology systems increasingly connected, with PII exposure in HR, contractor and visitor data), the supply-chain processor ecosystem, the geopolitical context for cross-border manufacturing data flows. The principal set includes employees, contractors, visitors, customers (where the manufacturer operates a direct-to-customer channel), and patients (for pharma manufacturing with patient-level pharmacovigilance data). The employee-monitoring audit is typically the marquee audit subject, the audit tests the surveillance tools against the legitimate-purpose and proportionality tests. The contractor-management audit tests the contractor-onboarding flow and the contractor-data-handling disciplines. The pharmacovigilance audit (for pharma) tests the safety-reporting workflow and the regulator-reporting disciplines. The internal-audit programme is often lighter on the Annex A.1 / A.2 controls and heavier on the Annex A.3 security controls (the OT-IT convergence dimension).

Cross-sector patterns

Three patterns recur across sectors and are worth flagging in any 9.2 internal-audit programme regardless of industry.

The dual-regulator audit-overlay pattern. BFSI and listed entities carry dual-regulator exposure, DPDP via the Data Protection Board plus the sector regulator (RBI, SEBI, IRDAI). The internal-audit programme covers both regulatory streams; the dual-clock pattern (CERT-In six hours, DPDP without delay plus a seventy-two-hour detailed report, sector six hours) is the audit-test on the breach operation; the sector-regulator audit cycles (RBI / SEBI / IRDAI) are coordinated with the 9.2 cycle to avoid duplication.

The SDF section 10 audit-overlay pattern. SDFs carry a statutory independent-data-audit obligation under DPDP section 10 on top of the 9.2 internal-audit obligation. The two cycles are coordinated through the bridge note; the scope allocation is non-overlapping; the evidence library is shared where appropriate.

The AI-driven processing audit pattern. AI-driven processing activities (credit-scoring, marketing-lead scoring, recommendation engines, fraud detection, adaptive learning, algorithmic hiring) require the algorithmic-software review as a 9.2 audit subject. The audit tests whether the review is operating as a release gate; whether the review's findings are routed to corrective action; whether the MLOps pipeline integration is operating. For SDFs, the audit tests the Rule 13(3) algorithmic-software dimension specifically.

Maturity Model

Emerging Trends

The SDF section 10 audit-cycle emergence. The Central Government is expected to designate the first wave of SDFs through 2026 and 2027 as the DPDP Rules 2025 phased commencement completes. Designated SDFs must operationalise the section 10 independent-data-audit cycle. The 9.2 internal-audit discipline is the natural single framework that coordinates with the section 10 cycle; the bridge note (toolkit doc 12) operationalises the coordination. The first section 10 audits will set the practice patterns every other SDF will follow.

The Data Protection Board's emergence and the post-incident audit examination. The DPBI, constituted under DPDP section 18, is emerging through 2026 and 2027. Its early orders, its interpretation of the Schedule penalty maxima, and its precedent on the audit-cooperation dimension will reshape the 9.2 internal-audit landscape for every Indian Data Fiduciary. After a complaint or a breach, the DPBI is expected to request the internal-audit findings on the affected operational area, the absence of an audit on a material area is itself a section 8(5) exposure.

The AI-driven processing audit dimension. The Rule 13(3) algorithmic-software review, the 2025 edition's callout of AI-driven profiling and automated decision-making, and the parallel development of ISO/IEC 42001:2023 (AI Management System) are reshaping the 9.2 audit landscape. For organisations using AI / ML on personal data, the algorithmic-software review is the highest-use 9.2 audit subject; the audit tests whether the review is operating as a release gate and whether the review's findings are routed to corrective action.

The integrated PIMS-plus-ISMS-plus-AI-Management-System audit. The harmonized structure enables integrated 27001 + 27701 + 42001 governance. The internal-audit discipline is the natural point of integration, a single combined audit programme covering all three management systems with clearly labelled sub-sections per discipline. The integrated-with-distinction posture matures into the integrated-multi-system posture.

The generative-AI-in-the-audit-function dimension. The use of generative AI inside the internal-audit function (for Checklist automation, working-papers drafting, findings drafting) is a 9.2 trend in its own right. The opportunity is efficiency (the auditor's manual work reduced); the risk is over-reliance (the auditor accepts the generative-AI output without verification). The discipline is to use generative AI as an audit assistant, not an audit replacement, the working papers still need the auditor's evidence-review and the finding still needs the auditor's classification judgement.

The sector-regulator convergence. RBI, SEBI and IRDAI are each tightening their audit-and-assurance expectations (the RBI Cybersecurity Directions 2026; the SEBI CSCRF; the IRDAI ICS 2023). The DPDP Act sits as a horizontal layer above these sectoral instruments; the internal-audit programme must monitor both the horizontal and the sectoral streams because they can diverge in their specific obligations even when they share the underlying privacy principle.

The certification-scheme maturation under ISO/IEC 27706:2025. The new PIMS certification-scheme standard (replacing ISO/IEC TS 27006-2:2021) is maturing through 2026 and 2027. The certification-body competence expectations, the impartiality rules, and the audit-team composition expectations are settling into practice. The 9.2 internal-audit programme benefits indirectly, the higher the certification-audit quality, the more the 9.2 audit programme is held to the same bar.

Climate-related privacy risks and the audit dimension. The 2025 edition's climate-change amendment (to Clauses 4.1 and 4.2) intersects with 9.2, climate-driven disruption of PII processing is an emerging audit subject for climate-exposed sectors (data centres in flood-prone areas; supply-chain failures affecting processors; climate-driven migration affecting principal populations).

References and Further Reading

Primary instruments (India). Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, enacted 11 August 2023), MeitY, in particular sections 8(5), 8(6), 9, 10 (SDF, DPO, SDF DPIA, periodic independent data audit, algorithmic-software review), 11 to 14, 16, 18, 33 + Schedule (penalty maxima up to two hundred and fifty crore rupees for section 8(5) failure; two hundred crore for sections 8(6) and 9; one hundred and fifty crore for section 10). Digital Personal Data Protection Rules, 2025 (notified 13 November 2025), MeitY, Rule 7 (breach intimation without delay, the seventy-two-hour detailed report and format); SDF thresholds and the independent-data-audit cadence; Consent Manager registration conditions. Information Technology Act, 2000, sections 43A, 72A, 70B. IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (notified 11 April 2011). CERT-In Directions 20(3)/2022-CERT-In (28 April 2022), the six-hour clock. RBI Storage of Payment System Data (6 April 2018); RBI Digital Lending Guidelines (2 September 2022); RBI Tokenisation (22 September 2021); RBI Cybersecurity Directions 2026 (31 July 2026). SEBI Cybersecurity and Cyber Resilience Framework (20 August 2024). IRDAI Information and Cyber Security Guidelines 2023 (24 April 2023). Companies Act 2013, sections 134(3)(n), 177; SEBI LODR Regulation 21 (the Audit Committee dimension).

Primary jurisprudence (India). K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 (nine-judge Bench, 24 August 2017). Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar), (2019) 1 SCC 1 (five-judge Bench, 26 September 2018).

Primary instruments (global). Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016, p. 1; application from 25 May 2018, Articles 5(2), 24(1) (ongoing basis controller responsibility), 24(2) (DPO reports to highest management level), 28(3)(h) (processor audit-cooperation), 32(1)(d) (regular testing, assessing and evaluating), 33 to 34 (breach notification), 35(11) (DPIA review), 38 (DPO position). NIST Privacy Framework v1.0, NIST.CSWP.01162020, 16 January 2020, the Govern-P function (Monitoring and Review; Risk Management Strategy) and the Communicate-P function (Data Review; Reporting). AICPA, 2017 Trust Services Criteria (with 2022 Points of Focus update), CC4.1, CC4.2 (Monitoring), P8.0 (Monitoring for Compliance). Brazil LGPD, Lei nº 13.709/2018. China PIPL, Article 55 (mandatory PIA).

ISO/IEC standards. ISO/IEC 27701:2025 (2nd ed., published 14 October 2025), Clause 9.2 (internal audit); Clause 9.1 (monitoring, the audit's input); Clause 9.3 (management review, the audit's reporting destination); Clause 10.2 (corrective action, the findings' treatment); Annex A.1 / A.2 / A.3 (the audit subjects); Annex B (normative in 2025, the implementation guidance the audit tests). ISO/IEC 27701:2019 (1st ed., for transition reference). ISO/IEC 27001:2022 Clause 9.2 (infosec internal audit, the integrated-with-distinction partner). ISO 19011:2018 (Guidelines for auditing management systems, the auditing-methodology lineage; the seven principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach; the audit-process model). ISO/IEC 27002:2022, only 5.34 is PII-specific; 5.35 (independent review) is the structural ISMS analogue of 9.2 on the security dimension. ISO/IEC 29134:2017 (DPIA guidelines, the audit criteria for the DPIA-pipeline audit). ISO/IEC 27018:2019 (cloud PII processor, the audit criteria for the processor-chain audit on cloud processors); ISO/IEC 27017:2015 (cloud security); ISO/IEC 29151 (PII protection code). ISO/IEC 42001:2023 (AI Management System, internal-audit alignment for the AI-driven processing dimension). ISO/IEC 27706:2025 (PIMS certification-scheme competence, the standard governing the certification-body's competence for the certification audit). ISO/IEC 17021-1:2015 (universal management-system certification rule-set, the impartiality rules that prohibit the certification body from also providing the internal audit). ISO/IEC 27006 (current ed.; ISMS certification-body requirements, the partner scheme to 27706). ISO 31000:2018 (risk management, Clause 6 Monitoring and Review function is the structural analogue). ISO 9001:2015 Clause 9.2 (quality-management-system internal audit, the harmonized-structure alignment).

Edition-transition sources (practitioner commentary used as research input). ANAB Heads Up #550 (transition timeline). The 2025 edition's structure, the harmonized-structure alignment of Clause 9.2, the integrated-with-distinction posture, the audit-programme discipline, the auditor-independence and competence requirements, and the SDF section 10 independent-data-audit coordination are confirmed from the official 2025 PDF (OCR) and corroborated by tier-1 practitioner commentary. The common-nonconformity patterns (the DPO-audits-the-DPO-function independence failure; the one-week-before-surveillance timing failure; the sequence failure, audit before the risk assessment; the no-programme failure; the zero-finding failure; the findings-without-corrective-action failure; the report-not-presented failure; the documentation-only failure; the SDF-section-10-conflation failure) are drawn from tier-1 cert-body practitioner commentary on the canonical "common problems in 27701 certification" catalogue and from the broader ISO-management-system audit-experience base. The seven privacy-process audit subjects (consent, ROPA, rights, DPIA, processor management, transfer, breach) derive from the Clause 8.1 operational-process taxonomy and the Annex A control themes. All clause text in this guide is paraphrased; the official text is copyrighted by ISO/IEC and has not been reproduced.

This guide is published by Singahi. The ISO/IEC 27701:2025 clause text is copyrighted by ISO/IEC and has not been reproduced; all requirements are paraphrased. Brand names of competitors, cert bodies, and reference books are intentionally omitted. Scenarios are illustrative and should not be attributed to any real organisation.