Who it is for
A proportionate engagement with clear boundaries.
Organisations acting as PII controllers, processors or both that need an objective internal audit against agreed PIMS criteria.
Independent assurance
ISO/IEC 27701 PIMS internal audit
An evidence-led internal audit of the defined privacy information management system against ISO/IEC 27701:2025 and agreed organisation-specific criteria.
How we assess your ISMSCheck what happens. Explain the result.
AgreeConfirm the scope and requirements to check
ReviewUnderstand your processes and supporting records
SelectChoose records and activities based on risk
TestCheck whether controls work in practice
ReportExplain what works and where requirements are not met
Acceptance and competence boundary
Acceptance is subject to a documented review of privacy-management competence, capacity, processing context, relevant jurisdictions and any need for legal or specialist input. Mang Morgan does not provide legal advice; an engagement may require an approved specialist or be declined if the required competence or independence cannot be demonstrated.
What is included
- PIMS scope, roles and criteria confirmation
- Privacy-context and evidence request
- Document review, interviews and process walkthroughs
- Risk-based sampling across selected PII processing activities
- Finding validation and closing meeting
- Independent quality review and controlled report
Typical outputs
- PIMS audit plan
- Traceable privacy-audit workpapers
- Findings register
- Detailed internal-audit report
What we need from you
- PIMS scope and processing-role definition
- PII inventories, data flows and privacy-risk records
- Applicable internal, contractual and regulatory criteria
- Privacy policies, procedures and operating evidence
Timing
Confirmed after the PIMS boundary, processing roles, jurisdictions, evidence set, stakeholders and sampling needs are understood.
Pricing basis
Quoted from a bottom-up estimate of planning, privacy-process review, interviews, sampling, reporting and quality review.
Important exclusions
- Certification or certification decisions
- Legal advice or a regulatory-compliance opinion
- Designing corrective actions
- Auditing work that would compromise independence
PIMS proof asset
Inspect a privacy-audit evidence trail.
The fictional extract connects PIMS scope, controller and processor roles, audit criteria, privacy-processing samples, evaluations and findings. It uses original summaries rather than reproducing protected standard text.
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.