ISO 27701 internal audit: how to plan, conduct and report a PIMS audit that stands up at certification

What does ISO 27701 require of an internal audit?

ISO/IEC 27701:2025 places internal audit in clause 9, performance evaluation, alongside monitoring and management review. Following the structure shared by ISO management system standards, it asks for audits at planned intervals that show whether the PIMS conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained.

Those audits sit inside a programme. The programme sets frequency, methods, responsibilities, planning and reporting, weighted by each process's importance and earlier results. Every audit in it has:

• Defined criteria and scope for each audit, written down before it starts.
• Objective, impartial auditors, which in practice means nobody audits a process they run.
• Results reported to the relevant managers, and carried into the management review.
• Documented information kept as evidence that the programme ran and what it found.

Nonconformities then pass to clause 10 for correction and corrective action.

What do you audit against?

A PIMS audit has more layers of criteria than most, and each audit plan should name them.

• The clauses. Context, leadership, planning, support, operation, performance evaluation and improvement apply to every organisation in scope, whatever its role.
• The Annex A controls for your role. A.1 applies where you act as PII controller, A.2 where you act as PII processor, and A.3, the information security set, applies in both cases. An organisation that is both audits both sets, guided by the treatment decisions from clause 6.
• Your own commitments. The privacy policy, published notices, the retention schedule, and the data processing agreements you have signed with clients and sub-processors.
• The obligations in your register. The privacy laws, regulator expectations and client requirements recorded under clause 4.

On the last layer, the auditor checks that the PIMS operates the obligations you identified, such as answering requests inside the deadline your register records, and gives no legal opinion. How the PIMS evidences accountability under data protection law has its own guide in this series.

A one-year programme for a controller and processor

Take a software company of around 120 people: a controller for its staff and marketing data, a processor for its clients. Three or four trained auditors from different functions can cover the whole PIMS in a year.

Before initial certification, compress the cycle so that every clause and applicable control has been audited, and the findings acted on, before the certification body's Stage 2. Add an unplanned audit after a personal data breach or a major new sub-processor.

How to conduct a PIMS audit: trace the data

Start from the records of processing

Pick a processing activity from the records of processing and follow it through its life. Is the stated purpose what the team does? Is the lawful basis recorded, and can the consent record be found where consent is relied on? Which notice version applied? Who can reach the data, which sub-processors touch it, and does it leave the country? When retention ends, is there a deletion record? One activity traced end to end beats twenty questions asked at a desk.

Sample the things that happen

Choose the samples yourself: requests from individuals across the year, checked for dates and identity verification; recent new processing, checked for an impact assessment before go-live; sub-processors, checked against a signed agreement and the client's authorisation; and breach register entries, checked for assessment and notification decisions.

Handle the personal data carefully

The audit itself processes PII. View records where they sit, note references rather than names, and keep customer data out of the report.

Write the finding: requirement, evidence, gap

• Requirement: the retention schedule sets deletion of former customers' account data twelve months after contract end.
• Evidence: of ten accounts closed more than a year ago, sampled from the billing system, four still hold full profile data and no deletion record exists for them.
• Gap: retention periods are not applied to closed customer accounts, so the schedule is not operated.

Close by confirming the facts with the process owner and a date for the action plan.

Reporting findings and closing them before Stage 2

ISO/IEC 27701 does not prescribe a grading scheme, so set one in your audit procedure using the certification body's terms. A major nonconformity affects the ability of the PIMS to achieve its intended results; a minor one does not; an opportunity for improvement records a better way where the requirement is met.

The report states the scope, criteria, auditors, what was sampled, each finding with its evidence and a conclusion on whether the area conforms and is effective. It reaches the process owner and top management within days and feeds the management review.

Closure means the process owner has recorded the correction, the root cause and the corrective action, and the auditor has seen evidence the action worked. For the retention finding above, a revised schedule proves nothing; a deletion run with its log, and a re-sample showing no overdue accounts, does. The certification body's Stage 1 readiness review checks that internal audits are planned and performed; Stage 2 and surveillance audits examine them, closed findings included.

Running the programme in Effivity

Schedules, audit plans, findings and corrective actions sit in Effivity, with reminders when actions run late. Effivity, used in 50+ countries, is included with the engagement, at no additional cost.

Who should audit the PIMS: competence and independence

ISO/IEC 27701 names no qualification for internal auditors. They come under the competence requirements of clause 7: competence determined for the role, gained through education, training or experience, and shown by documented information. A privacy auditor must tell a controller from a processor, read a data processing agreement and follow records of processing.

Independence is the harder part in privacy. The privacy lead or data protection officer usually designed the PIMS, so a colleague or an external auditor should cover their processes and the programme itself; likewise, the people who run the security controls should not be the only ones auditing them.

ISO 19011:2026, the current edition of the guidelines for auditing management systems, gives the method: audit principles, managing the programme, conducting audits and evaluating auditor competence. It is guidance, not a certifiable standard. Internal auditor training for your audit team is part of a Sterling engagement, as applicable to your standard, and Sterling Academy access covers awareness for the wider team.

Where PIMS internal audits go wrong

• Auditing the policy, not the processing. A notice and a policy reviewed at a desk say nothing about whether requests are answered or data deleted.
• Skipping the processor controls. Organisations that think of themselves as controllers forget the client data they hold as processors, which is often where contracts and sub-processors are weakest.
• One audit the week before Stage 2. Nothing it finds can be corrected and shown to work in time.

ISO 27701 internal audit: questions buyers ask