Independent Audit

ISO 27701 Internal Audit Services

An independent ISO 27701 internal audit of your privacy information management system (PIMS) that meets Clause 9.2, run by auditors from outside your team. Most audits take two to four weeks and end in a formal report with every finding rated.

  • A Clause 9.2 report with every finding rated major, minor or observation
  • Controls tested against Annex A Tables A.1, A.2 and A.3 for your controller and processor roles
  • Led by a senior CISSP in the US or Canada

For most SMBs, a standalone ISO 27701 internal audit costs USD $5,000 to $15,000.

Talk to an ISO 27701 auditor

Share your scope and certification date, and an auditor will follow up to book a call.

What does an ISO 27701 internal audit cover?

A risk-based audit of your PIMS against ISO/IEC 27701:2025, from planning to the final report.

Frame (8)

Assess: Audit Planning

  • What We Do

    We review your PIMS scope, your controller and processor roles, the privacy risk assessment, the Statement of Applicability and prior audit findings. We build an audit plan weighted by privacy risk and schedule interviews with process owners.

  • What You Get

  • Audit Plan:
    Scope, criteria and method, weighted by the processing activities that carry the most privacy risk.

  • Interview Roster:
    The process owners we interview, with topics and the evidence we ask each one to show.

Frame (9)

Assess: Document Review

  • What We Do

    We review the privacy policy, procedures, privacy risk assessment, records of processing, privacy impact assessments and management review minutes against ISO/IEC 27701:2025 Clauses 4 to 10.

  • What You Get

  • Document Review Findings:
    Each document checked for coverage, currency and approval, and for whether it matches how your team works.

Frame (10)

Assess: Annex A Control Testing

  • What We Do

    We test the controls in your Statement of Applicability: Table A.1 for controllers, Table A.2 for processors and Table A.3 for both. We sample evidence such as data subject request records, processor agreements and breach notification records.

  • What You Get

  • Control Testing Workpapers:
    For each control, the test performed, the evidence reviewed and the conclusion.

Frame (11)

Assess: Interviews and Process Verification

  • What We Do

    We interview the people who handle personal data to confirm they know their responsibilities and can show them, from consent and retention to data subject requests.

  • What You Get

  • Interview Notes:
    What was asked, what was shown, and where practice differs from the documented procedure.

Frame (12)

Report: Audit Report and Nonconformity Register

  • What We Do

    We write a formal internal audit report that meets Clause 9.2, with nonconformities, observations and recommended corrective actions ordered by certification risk.

  • What You Get

  • Internal Audit Report:
    Every finding classified, tied to a clause or Annex A control, and backed by evidence.

  • Nonconformity Register:
    Major and minor nonconformities with clause references, evidence and a recommended corrective action.

Frame (13)

Report: Findings Walkthrough and Management Review Input

  • What We Do

    We walk your team through every finding, help you order the fixes, and format the results for your Clause 9.3 management review. Follow-up verification of corrective actions is optional.

  • What You Get

  • Remediation Plan:
    Fixes ordered by certification risk, each with an owner and a target date.

  • Management Review Input:
    Audit results, privacy risk changes and recommended actions for leadership sign-off.

What do you get from an ISO 27701 internal audit?

Four things you hold at the end, ready for the certification auditor.

A Clause 9.2 audit report

A formal report your certification body can review, with scope, criteria, method and every finding tied to a clause or Annex A control.

A rated nonconformity register

Every finding rated major, minor or observation, with the evidence behind it and a recommended corrective action.

A dated remediation plan

Fixes ordered by certification risk, each with an owner and a target date, timed to close before Stage 2.

Management review input

Results formatted for your Clause 9.3 management review, so leadership signs off on what was found and what changes.

When is an outside ISO 27701 auditor the right call?

For many companies, the trigger is a certification date on the calendar and no one on staff who can audit the PIMS without auditing their own work.

Right call when

  • No one on staff is both trained in ISO auditing and independent of the privacy controls

  • Your Stage 1 or Stage 2 audit is booked and the internal audit is still open

  • The people who built the PIMS are the people who operate it

  • You want ISO 27001 and ISO 27701 audited together in one engagement

Wrong call when

  • You need the lowest possible price. Our pricing is competitive, but every audit is run by experienced auditors, goes through several rounds of QA and ends in a detailed report, so we are rarely the cheapest option

What do clients say about Truvo's ISO work?

"Truvo Cyber conducted our ISO 27001 and ISO 27701 internal audit. They were easy to work with, communicated clearly throughout the project, and delivered a thorough, professional report on time. I would recommend them to any organization working through similar compliance requirements."

Ellipse (1) (1)
Aimee Halbert

UserTesting

"Truvo is an instrumental and integrated part of our team...
They don’t just provide recommendations; they ensure we meet our stringent ISO 27001 and SWIFT compliance goals. We trust them with projects of national importance, and they deliver."

Mask Group-1
Matt Charette

CISO, Payments Canada

Ready to plan your ISO 27701 internal audit?

Book a strategy call. We review your PIMS scope and certification date, and give you a clear picture of the timeline and investment.

Book Your Free ISO Strategy Session

What do companies ask about ISO 27701 internal audits?

For most SMBs, a standalone ISO 27701 internal audit costs USD $5,000 to $15,000. The price depends on the PIMS scope, whether you act as a PII controller, a PII processor or both, and the number of Annex A controls in your Statement of Applicability. Auditing ISO 27001 in the same engagement raises the scope. No prior Truvo engagement is required.

Clause 9.2 of ISO/IEC 27701:2025 requires internal audits at planned intervals. Many organizations audit once a year, and a risk-based plan can add audits after significant changes to how you process personal data.

Anyone competent and impartial. Clause 9.2 asks you to select auditors so the audit stays objective and impartial, so the person who designed or operates a privacy control should audit a different area. Many small and mid-sized companies have no one who meets both tests, which is why they bring in an outside auditor.

Yes. When both standards share one management system, we audit them in one engagement, with one plan, one evidence request and one report that references the clauses and Annex A controls of each standard.

A gap assessment comes before the PIMS is built and lists the work to do. An internal audit tests a PIMS that is already operating and reports what works and what needs a fix.

You commission the internal audit to find problems early. An accredited certification body performs the certification audit and decides on certification. The certification auditor reviews your internal audit report as evidence that Clause 9.2 is working.

Two to four weeks for most small and mid-sized organizations, from planning to final report. Finish the audit six to eight weeks before the Stage 2 audit, so there is time to fix findings and show the fixes work.

Yes, as a separate engagement with a different team, so the auditor stays independent of the PIMS. See our ISO 27701 certification consulting page.

Client data, documentation and sensitive materials are stored in secure North American cloud environments. Every engagement is led by a senior CISSP in the US or Canada with 10+ years in security, and every consultant on the engagement is an experienced, vetted professional.

How is a Truvo ISO 27701 internal audit different?

Our auditors build and operate management systems, so findings come with fixes your team can carry out.

The Internal DIY Approach

  • Document-Only Audits:
    Many internal audits confirm that privacy policies exist. The certification auditor tests whether your team follows them.

  • Independence Gap:
    A team member who built the privacy controls is often the only person who knows them, and Clause 9.2 asks for an impartial auditor.

  • Generic Findings:
    "Consider improving documentation" gives your team no clear fix before Stage 2.

The Truvo Approach

  • Practitioner-Led Audit:
    Our auditors build and operate management systems, and every engagement is led by a senior CISSP in the US or Canada.

  • Annex A Control Testing:
    We test the controls in your Statement of Applicability across Tables A.1, A.2 and A.3, and record the evidence and conclusion for each.

  • Certification-Focused Findings:
    Every finding is rated major, minor or observation, with a clause reference and a recommended fix ordered by certification risk.

Ready to audit your privacy program?

Independent ISO 27701 internal audits by practitioners who build and operate management systems.

Book a Strategy Call

From the blog: privacy and data protection

Laptop showing a padlock and world map, for PIPEDA privacy compliance

PIPEDA Compliance for SaaS: 10 Principles as Controls

PIPEDA (the Personal Information Protection and Electronic Documents Act) is Canada's federal privacy law for private-sector organizations that ...

Learn More
Vector infographic: A man with glasses points to Quebec on a globe, where a teal radius connects to global servers. Side panels read "No Revenue Threshold" and "Partial Overlap." A bottom banner titled "Where the Privacy Gap Sits" displays five privacy compliance icons.

Quebec Law 25 Compliance: The Privacy Law Every SaaS Company Should Know About (But Probably Doesn't)

Quebec Law 25 is the province's modernized private-sector privacy law: a set of amendments (adopted in 2021 as Bill 64) to the Act respecting the ...

Learn More
An infographic titled 'LAW 25 COMPLIANCE CHECKLIST' for Quebec security teams. It links 'LEGAL REQUIREMENT' and 'SECURITY OVERLAP' (SOC 2, ISO 27001) as a man checks a large clipboard list. The bottom outlines 'THE 8-POINT CHECKLIST' with 8 key icons, such as privacy officer, PIA, and safeguards.

Law 25 Compliance Checklist: What Security Teams Actually Need to Do

Quebec's Law 25 has been fully in force since September 2024, and the penalties are no longer theoretical. Under the Act respecting the protection of ...

Learn More