ISO 27701 audit prep: the evidence file and how to survive questions

To survive an ISO 27701 audit, organise evidence around the privacy information management system (PIMS) itself: scope, privacy risk work, controls for controllers or processors, records, internal audit and management review. Auditors sample records and interview staff, so rehearse both. The standard is paywalled, so confirm clause level detail with your certification body.

What is the auditor actually checking?

ISO/IEC 27701 is the international standard for a PIMS. Its October 2025 revision made it a stand-alone standard, aligned with the 2022 structures of ISO/IEC 27001 and 27002, with its own management system clauses 4 to 10 and annexes of privacy controls for PII controllers and PII processors. That summary comes from a public reference page, not the paywalled text, so treat the details as a map and check the purchased standard.

Whatever the exact clause numbers, an assessment asks three things:

• Is the system defined and led? Scope, policy, roles, objectives.
• Does it work? Records show controls operating on real personal data.
• Does it improve? Internal audit, management review and corrective actions.

Certification is done by an accredited certification body, which is independent of you. Nobody can promise the outcome.

How should you build the evidence file?

Create one folder per area, and in each one a short index listing what the item is, who owns it and the date. Start with these.

Governance

• PIMS scope statement naming the processing activities, locations and whether you act as controller, processor or both.
• Privacy policy for the management system and the privacy objectives.
• Role assignments: privacy lead, management representative, system owners.

Privacy risk

• A method for assessing risk to individuals, not just to the business.
• The current risk register and treatment decisions.
• Applicability statement listing which privacy controls apply and why, with implementation status.

Processing records

• Record of processing activities with purposes, categories of data, recipients, retention and transfers.
• Impact assessments for higher risk processing.
• Data flow diagrams for the main systems.

Operational controls

• Data subject request log with dates and outcomes.
• Processor and sub-processor contracts and review notes. For processors, the customer instructions you follow.
• Retention and deletion proof: job logs, deletion tickets.
• Breach register and the last incident exercise.
• Training records and the dates people read the policy.

Assurance

• Internal audit plan, report and corrective actions.
• Management review minutes with decisions and resources assigned.

What questions will staff get?

Auditors interview people doing the work, not just the privacy lead. Prepare the following.

• Engineers: where does personal data live, and how do you find and delete one person's data?
• Support: what do you do when a customer asks for their data?
• Procurement: how do you check a new supplier before it touches personal data?
• Managers: what did the last management review decide?
• Everyone: where is the privacy policy and what do you do if you suspect a breach?

Run a mock interview with a colleague playing the auditor. Anyone who answers "I would ask someone" needs a one page cheat sheet and a named contact.

Which findings come up most?

• Scope statement does not match reality, for example a product team using personal data that is not in the record.
• Applicability statement says "implemented" with no evidence behind it.
• Internal audit done by the person who built the system.
• Management review held once, minutes thin.
• Retention periods defined but no deletion evidence.
• Processor list stale.

Findings are normal. The test is whether your corrective action process works, so keep a register with cause, fix, owner and closure date.

What to do

1. Confirm the current edition and the certification body's audit rules, and buy the standard.
2. Freeze the scope in writing and check it against your processing record.
3. Build the evidence folders above and add owners and dates to each index.
4. Pull a sample from each control as the auditor would: five rights requests, five deletions, three supplier reviews. Fix gaps found.
5. Run the internal audit with someone independent of the area audited.
6. Hold management review and record decisions.
7. Run mock interviews, then close findings before the certification audit.
8. After certification, keep the evidence flowing, because surveillance visits will test the same system again.

Quick check

How Safeguard helps automate this

Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring keeps running between audits. For a privacy audit, the technical share of the evidence file comes from your real code and dependencies: scans, SBOMs and reachability. If you want it, Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and at which approval level. Safeguard helps prepare and keep evidence ready. The certification body assesses you, not us.

Open the framework mapping demo or book a call.

Sources

• ISO/IEC 27701 overview, Wikipedia. The ISO pages and the standard text were blocked or paywalled when fetched, so claims are kept general.

Last reviewed: 18 October 2026.