Question

A privacy solutions engineer is supporting an internal audit of data subject access request (DSAR) handling across a large customer service organization that processes thousands of requests monthly. The auditor wants to conclude whether the DSAR control is operating effectively throughout the audit period, but the team lacks the time to review every request. What is the MOST appropriate approach for gathering audit evidence?

Accepted Answer

Select a statistically representative sample of DSARs from across the entire audit period and test them against the control's requirements

Answer

Review only the DSARs that were escalated as complaints, since those represent the highest-risk cases

Answer

Rely on management's self-assessment attestation that all DSARs were completed within the required timeframe

Answer

Examine the most recent 10 DSARs processed to confirm the control is currently functioning