Plan, conduct and report an internal audit of privacy and records controls

What is going on

The first audit in Meridian's annual program is privacy and records management, scheduled for the week of 12 October. In August a client personnel file was emailed to the wrong client contact, and an earlier audit found that closed client folders older than seven years had not been destroyed under the retention schedule. Both are open in the risk and compliance register. The Quality, Risk and Compliance Manager wants the audit planned and conducted under the Internal Audit Procedure with criteria drawn from the Privacy and Information Security Policy, the Australian Privacy Principles and the retention schedule, findings classified and recorded, and a report issued within ten business days. The auditee is the finance and administration team with people services in scope for the email incident.

Your brief

Plan the audit with a clear scope, criteria, checklist and sampling plan, conduct it from the evidence supplied, classify and record the findings with objective evidence, report in the standard format and set up corrective action follow up.

Work through it

You do not need to do it all. Doing a few of these will show you what the work is like. Your ticks and notes stay on this device.

• Read the Internal Audit Procedure and the Privacy and Information Security Policy and write the audit plan: objective, scope, criteria, auditee, method, schedule and auditor independence.
• Interpret the compliance requirements: list the specific obligations from the Australian Privacy Principles and the retention schedule that the checklist will test, in your own words.
• Prepare the audit checklist and a sampling plan for client folders, access permissions, email handling practices and destruction records.
• Using the interview notes, records and system extracts supplied by your assessor, record each checklist item as conforming or not with the objective evidence.
• Classify each finding as major, minor or opportunity for improvement with reasons, and enter each non-conformance in the Risk and Compliance Register with an owner.
• Evaluate the treatment of the August email incident RC-26-018 and the retention finding RC-26-024 and state whether the corrective actions are effective.
• Write the audit report in the standard format and prepare the closing meeting minutes using the Meeting Agenda and Minutes Template.
• Recommend one improvement to the privacy program that addresses the root cause of the findings rather than the symptoms.

What someone in this role would produce

• Audit plan
• Compliance requirements list and checklist with sampling plan
• Completed checklist with evidence
• Classified findings and register entries
• Audit report and closing meeting minutes