Question

An internal privacy audit team is scheduled to assess whether the organization's data retention controls are operating effectively across three business units. Each unit has documented retention schedules and automated deletion jobs. The audit lead wants to provide the audit committee with assurance about how the controls actually perform in practice, not just whether they exist. Which approach will BEST support this assurance objective?

Accepted Answer

Select a sample of records past their retention period and test whether the automated deletion jobs actually purged them

Answer

Review the retention policy documents and confirm each business unit has signed off on the retention schedules

Answer

Interview the business unit managers to obtain their confirmation that deletion jobs are running as scheduled

Answer

Verify that deletion job scripts are configured with the correct retention parameters in the scheduling tool