/ Privacy internal audit
ISO 27701 internal audit
Aegentra reviews your privacy information management system against agreed ISO 27701 criteria. Connect processing responsibilities, control decisions and sampled evidence in a report your team can act on.
Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.
/ At a glance
- Service
- Organisational PIMS internal audit
- Fee
- Scoped quote; no published starting fee
- Criteria
- Agreed edition, scope and applicable requirements
- Outputs
- Audit plan, evidence-linked findings, report and agreed follow-up
- Independence
- Competence and impartiality checked before assignment
- Excluded
- Certification, legal opinion and unagreed remediation
Scope and fee, agreed before fieldwork
Request a scoped quote for an ISO 27701 internal audit. We confirm the PIMS boundary, standard edition, processing roles, evidence access and required report before agreeing the fee and schedule.
- Included when agreed: audit planning, evidence requests, interviews and risk-based sampling, findings and a report of conclusions and limitations.
- Separately scoped: remediation, legal advice, certification-body fees, travel and corrective-action effectiveness review.
- Bring a description of the services you supply and the assurance your customer actually needs—not confidential personal records.
Trace responsibility through the information lifecycle
A privacy policy is a starting point, not evidence that every process operates. We follow selected processing activities through the people, systems and suppliers that handle personal information.
- Confirm controller and processor roles for each selected activity, including interfaces with customers and suppliers.
- Review how privacy risks, applicable requirements and control decisions connect to actual procedures.
- Sample records for collection, use, access, correction, retention and disposal where included in the criteria.
- Examine management review, previous findings, changes and corrective actions within the agreed audit programme.
A closed request is not the whole evidence trail
Original fictional example—not a client result or a complete audit checklist. A SaaS provider's approved deletion procedure requires confirmation from an in-scope processor before the request can be marked complete.
- Criterion and sample: select three closed deletion requests against that approved procedure; record how and why the sample was chosen.
- Evidence: one request has an application deletion log but no required processor confirmation. Check interviews and other records before concluding that the evidence is missing.
- Finding: describe the sampled failure to demonstrate the required confirmation. Do not infer that every record remains stored or declare a legal breach without evidence.
- Follow-up: management addresses the request, investigates why closure was possible without confirmation, and provides evidence of an effective correction to the process.
- Boundary: agreed backup retention, legal holds and processor dependencies must be considered; deletion does not automatically mean immediate erasure from every backup.
Competence and impartiality are assignment decisions
We confirm the auditor's privacy-management knowledge, audit competence, sector context and prior involvement before accepting the work. Relevant qualification evidence and responsibilities are agreed for the assignment; a generic security credential alone does not establish ISO 27701 audit competence.
- No independent audit of the auditor's own implementation or remediation work.
- Documented conflict assessment and reporting arrangements, with another provider where a conflict cannot be managed.
- Secure, proportionate evidence access: redacted samples or supervised viewing where appropriate; retention and deletion arrangements agreed upfront.
Keep privacy assurance and certification distinct
ISO/IEC 27701:2025 addresses a PIMS for organisations acting as PII controllers, processors or both. It can stand alone or be integrated with an ISMS. An internal audit evaluates the agreed management-system criteria; it does not issue a certificate or replace legal advice.
- For Australian organisations, identify the applicable Privacy Act and Australian Privacy Principles obligations separately from the ISO audit criteria.
- Map customer and supplier requirements to the actual processing activity. Do not assume a certificate covers every service or transfer.
- The report states what was sampled, the supported findings, scope limitations and the agreed follow-up—not an unconditional assurance of compliance.
/ FAQ
Questions, answered.
It is an evidence-based assessment of your privacy information management system against agreed criteria. The engagement defines the standard edition, processing activities, organisational roles and sample before fieldwork. You receive findings and limitations, not an organisational certificate or a blanket opinion that every privacy law has been met.
ISO/IEC 27701:2025 is a standalone management-system standard, so ISO 27001 certification is not a prerequisite for auditing a PIMS against that edition. An integrated audit can examine shared processes where appropriate, but the plan and findings must identify which privacy and information-security criteria were actually evaluated.
We agree the edition explicitly before accepting the engagement. ISO/IEC 27701:2025 is the current edition; the earlier 2019 edition was an extension to information-security standards. If your programme or certificate still references 2019, clarify the relevant certification-body arrangements and any transition scope rather than silently mixing requirements.
The person who designed or implemented the work must not independently audit that same work. Where Aegentra provides both services, we assess prior involvement, conflicts, reporting arrangements and competence, then assign an appropriately impartial auditor. A different name alone is insufficient; if the conflict cannot be managed, use a separate provider.
Start with the PIMS scope, processing activities, controller and processor responsibilities, privacy risks, applicable requirements and control decisions. The agreed sample can then trace notices, requests, retention, supplier instructions and operational records. We agree minimised evidence access first; do not send raw personal records or passwords through the enquiry form.
This service is quote-only. Processing complexity, entities, systems, controller and processor roles, locations, available evidence and the depth of follow-up affect the fee. The written proposal separates planning, fieldwork and reporting from implementation, legal advice, travel, certification-body charges and any additional corrective-action review. No standard starting price is advertised.
The schedule and delivery method follow the agreed scope, evidence access and interview availability, not a promised universal number of days. Remote review can use controlled document access or supervised screen-sharing. Any onsite work, sample limitations, reporting deadline and follow-up effort are confirmed in the proposal before fieldwork begins.
Neither. This is an organisational internal-audit service with an agreed scope and report. A certification body separately decides whether to issue an ISO certificate. A PECB Lead Auditor course develops an individual's knowledge and has its own exam and credential conditions. Training, implementation and certification fees are not included automatically.
Related services and learning
- ISO 27701 implementation
- ISO 27701 guide and practical resources
- ISO 27001 internal audit
- ISO 27701 Lead Auditor course and exam
Training, implementation, internal audit and independent certification have separate scopes and fees.
Ready to make Privacy internal audit evidence-backed?
A practitioner reviews the scope, evidence and responsibilities, then provides a written plan and fixed price for the agreed work.
Discuss your privacy audit