Agree
Confirm the objective, authority, systems, criteria, access and exclusions. Establish how information will be shared and handled.
Internal audit / New Zealand
ISO 27701 internal audit
Aegentra conducts scoped ISO 27701 privacy information management system internal audits for New Zealand organisations. We trace processing responsibilities, controls and sampled records against agreed criteria, with findings your team can act on.
Scope and pricing
Plan the work. Know the fee.
Request a scoped quote
A scoped NZD quote follows review of processing activities, entities, systems, controller and processor roles, evidence access and required reporting. The proposal separates planning, fieldwork and reporting from implementation, legal advice, certification-body fees, travel and additional follow-up.
Request a quotePrices in NZD, excluding any applicable tax. Your written proposal confirms the scope, tax treatment and total payable before you approve the work.
Starting prices and indicative ranges are for the stated scope, not an unconditional fixed fee. Other services are priced by scoped quote. Academy course prices are separate from consulting, audit and technical-service fees.
On this page
Start with the boundary
Define the work that is needed.
For organisations operating a PIMS, preparing for a separate certification assessment, or reviewing privacy-management evidence for customer and supplier requirements.
- PIMS boundary, applicable standard edition and controller or processor responsibilities
- Privacy risks, applicable requirements and control decisions
- Risk-based sampling of processing records, supplier interfaces and information-handling procedures
- Management review, previous findings, improvement and agreed follow-up
Keep the responsibilities distinct
Internal audit does not issue an organisational ISO certificate, establish compliance with every provision of the Privacy Act 2020, or replace legal advice. Implementation, remediation, independent certification and any further follow-up are separate unless included in the written scope.
What the engagement can produce
Useful outputs, agreed in advance.
- An agreed audit plan, criteria and secure evidence request
- Evidence-linked findings with clear sample and scope limitations
- A report of conclusions and management actions for consideration
- A separately agreed corrective-action effectiveness review where commissioned
Starting prices and indicative ranges are for the stated scope, not an unconditional fixed fee. Other services are priced by scoped quote. Academy course prices are separate from consulting, audit and technical-service fees.
Who delivers the work
Audit competence and independence
Our audit capability brings together management-system auditing, IT audit and controls assurance. The standard, sector, evidence and prior involvement determine the competence and impartiality checks for each assignment.
Qualifications, professional credentials and formal training are held across our delivery team, not by every person. We match the relevant capability to your scope and confirm the assigned people, responsibilities and current qualification evidence before work begins.
Before accepting the assignment, we confirm privacy-management knowledge, relevant audit competence, sector context and qualification evidence. Generic security credentials alone do not establish ISO 27701 audit competence. We do not claim an unverified ISO 27701 Lead Auditor qualification for every team member.
Implementation and internal audit stay separate
Where we support implementation and internal audit, a different appropriately competent auditor is assigned. Prior involvement, objectivity and impartiality are checked before fieldwork; an internal audit does not issue an organisational ISO certificate.
Explore our delivery-team capability · Discuss the competence your engagement requires
How we work
From evidence to a practical next step.
Examine
Gather the records and context required by the scope. Distinguish what evidence supports from what is still uncertain.
Act or report
Carry out the agreed consulting, audit, assessment or implementation task. Obtain approval before operational changes.
Verify and hand over
Document outcomes, limitations, owners and follow-up. Retesting or ongoing work is included only when expressly scoped.
We deliver online and arrange visits by appointment where agreed. Scope, assigned competence, timing, access requirements and any travel are confirmed before an engagement.
An illustrative starting point
What a useful first decision looks like.
Fictional example to explain the service, not a New Zealand client case study or a promised outcome.
Original fictional example—not a client result or a complete audit checklist. A SaaS provider's approved deletion procedure requires confirmation from an in-scope processor before the request can be marked complete. Criterion and sample: select three closed deletion requests against that approved procedure; record how and why the sample was chosen. Evidence: one request has an application deletion log but no required processor confirmation. Check interviews and other records before concluding that the evidence is missing. Finding: describe the sampled failure to demonstrate the required confirmation. Do not infer that every record remains stored or declare a legal breach without evidence. Follow-up: management addresses the request, investigates why closure was possible without confirmation, and provides evidence of an effective correction to the process. Boundary: agreed backup retention, legal holds and processor dependencies must be considered; deletion does not automatically mean immediate erasure from every backup.
Questions for the first discussion
- Which processing activities, entities, systems and suppliers are included?
- Are you a controller, a processor or both for those activities?
- Which edition and customer or certification requirements apply?
- What previous findings and evidence-access constraints should be considered?
Before you begin
Your questions, answered.
Does an ISO 27701 internal audit prove compliance with New Zealand privacy law?
No. We distinguish the ISO management-system criteria from the applicable Privacy Act 2020 obligations and your organisation's own requirements. The audit can examine agreed privacy-management evidence, but its sample and scope are limited. The Office of the Privacy Commissioner is the primary source for New Zealand privacy principles; legal interpretation may require separate advice.
What can be included in iso 27701 internal audit?
The agreed scope can include pIMS boundary, applicable standard edition and controller or processor responsibilities; privacy risks, applicable requirements and control decisions; risk-based sampling of processing records, supplier interfaces and information-handling procedures; management review, previous findings, improvement and agreed follow-up. We confirm the exact deliverables and exclusions before work begins, rather than treating every organisation as the same project.
How much does this service cost?
Request a quote. A scoped NZD quote follows review of processing activities, entities, systems, controller and processor roles, evidence access and required reporting. The proposal separates planning, fieldwork and reporting from implementation, legal advice, certification-body fees, travel and additional follow-up. Prices in NZD, excluding any applicable tax. Your written proposal confirms the scope, tax treatment and total payable before you approve the work.
How do you deliver the work in New Zealand?
We deliver online and arrange visits by appointment where agreed. Scope, assigned competence, timing, access requirements and any travel are confirmed before an engagement.
What should we provide before a proposal?
Bring answers to these starting questions: Which processing activities, entities, systems and suppliers are included? Are you a controller, a processor or both for those activities? Which edition and customer or certification requirements apply? What previous findings and evidence-access constraints should be considered? A short initial discussion should establish the boundary and next evidence needed. Do not email secrets or detailed personal records before secure handling has been agreed.
What is an ISO 27701 internal audit?
It is an evidence-based assessment of your privacy information management system against agreed criteria. The engagement defines the standard edition, processing activities, organisational roles and sample before fieldwork. You receive findings and limitations, not an organisational certificate or a blanket opinion that every privacy law has been met.
Do we need ISO 27001 certification before a PIMS internal audit?
ISO/IEC 27701:2025 is a standalone management-system standard, so ISO 27001 certification is not a prerequisite for auditing a PIMS against that edition. An integrated audit can examine shared processes where appropriate, but the plan and findings must identify which privacy and information-security criteria were actually evaluated.
Which edition will the ISO 27701 audit cover?
We agree the edition explicitly before accepting the engagement. ISO/IEC 27701:2025 is the current edition; the earlier 2019 edition was an extension to information-security standards. If your programme or certificate still references 2019, clarify the relevant certification-body arrangements and any transition scope rather than silently mixing requirements.
Can you audit privacy controls you helped implement?
The person who designed or implemented the work must not independently audit that same work. Where Aegentra provides both services, we assess prior involvement, conflicts, reporting arrangements and competence, then assign an appropriately impartial auditor. A different name alone is insufficient; if the conflict cannot be managed, use a separate provider.
What evidence is needed for an ISO 27701 privacy audit?
Start with the PIMS scope, processing activities, controller and processor responsibilities, privacy risks, applicable requirements and control decisions. The agreed sample can then trace notices, requests, retention, supplier instructions and operational records. We agree minimised evidence access first; do not send raw personal records or passwords through the enquiry form.
How long does a PIMS audit take, and can it be remote?
The schedule and delivery method follow the agreed scope, evidence access and interview availability, not a promised universal number of days. Remote review can use controlled document access or supervised screen-sharing. Any onsite work, sample limitations, reporting deadline and follow-up effort are confirmed in the proposal before fieldwork begins.
Is this a privacy certification audit or a Lead Auditor course?
Neither. This is an organisational internal-audit service with an agreed scope and report. A certification body separately decides whether to issue an ISO certificate. A PECB Lead Auditor course develops an individual's knowledge and has its own exam and credential conditions. Training, implementation and certification fees are not included automatically.
Reference points
Check the underlying guidance.
Page prepared and source references checked . References explain the relevant standard or technology; they are not endorsements of Aegentra.
Discuss your requirement
Start with your business.
Start with the requirement, the systems involved and the outcome you need. Please do not send passwords, sensitive records or unrestricted tenant access in an initial enquiry.