Plan, conduct and report an internal audit of privacy and records controls

What has happened

The first audit in Meridian's annual program is privacy and records management, scheduled for the week of 12 October. In August a client personnel file was emailed to the wrong client contact, and an earlier audit found that closed client folders older than seven years had not been destroyed under the retention schedule. Both are open in the risk and compliance register. The Quality, Risk and Compliance Manager wants the audit planned and conducted under the Internal Audit Procedure with criteria drawn from the Privacy and Information Security Policy, the Australian Privacy Principles and the retention schedule, findings classified and recorded, and a report issued within ten business days. The auditee is the finance and administration team with people services in scope for the email incident.