IT Control Reviews

IT Control Reviews: A Complete CIPT Guide to Privacy Risk Management

Introduction
In the IAPP Certified Information Privacy Technologist (CIPT) body of knowledge, IT Control Reviews sit within the Privacy Risk Management domain. They are the systematic examination of the technical, administrative and procedural safeguards that protect personal information inside an organization's IT environment. The CIPT expects you to understand privacy as a matter of engineering and operations, not only as a legal concept. IT control reviews are therefore one of the key mechanisms for turning privacy policy into verifiable practice.

Why IT Control Reviews Are Important
1. They bridge policy and practice. A privacy policy may state that data is encrypted, access is restricted and retention limits are enforced. An IT control review checks whether those promises are actually implemented and working.

2. They help meet regulatory accountability. Laws and frameworks require organizations to demonstrate appropriate technical and organizational measures. Examples include GDPR Articles 5(2), 24, 25 and 32, HIPAA's Security Rule, GLBA's Safeguards Rule, PCI DSS and many state laws. Documented control reviews are evidence of accountability.

3. They reduce the likelihood and impact of breaches. Reviews can uncover gaps before attackers or auditors do. Common findings include excessive privileges, unpatched systems, misconfigured cloud storage, weak logging and orphaned accounts.

4. They support continuous risk management. Systems, vendors, threats and data flows change constantly. Periodic and event-driven reviews keep the organization's risk posture current.

5. They build trust with stakeholders. Customers, partners, regulators and boards want assurance. Reports such as SOC 2 Type II and ISO/IEC 27001 certifications are formal outputs of control reviews.

6. They inform privacy-by-design decisions. Results from control reviews feed back into system design, Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs).

What IT Control Reviews Are
An IT control review is a structured evaluation that determines whether controls are:
- Designed appropriately (design effectiveness): does the control, as designed, address the identified risk?
- Implemented: is the control actually in place?
- Operating effectively over time (operating effectiveness): does the control consistently work as intended?

Categories of controls typically reviewed
- Administrative / managerial controls: policies, procedures, training, data classification, vendor management, roles and responsibilities.
- Technical / logical controls: access control (RBAC, ABAC), authentication (MFA), encryption at rest and in transit, pseudonymization, data loss prevention (DLP), logging and monitoring, network segmentation, secure configuration, patching.
- Physical controls: data center access, badge systems, secure disposal of media.

Controls classified by function
- Preventive: stop an incident before it happens, such as encryption and access restrictions.
- Detective: identify an incident when it happens, such as SIEM alerts and audit logs.
- Corrective: restore and remediate after an incident, such as backups and incident response.
- Deterrent, compensating and directive controls are also commonly referenced.

Related frameworks and standards
- NIST SP 800-53 (Security and Privacy Controls), including its privacy control families
- NIST Privacy Framework and NIST Cybersecurity Framework (CSF)
- ISO/IEC 27001 and 27002 (ISMS controls), ISO/IEC 27701 (privacy extension), ISO/IEC 29100 and 29151
- COBIT (IT governance)
- AICPA SOC 2 Trust Services Criteria, which includes a Privacy criterion
- CIS Critical Security Controls
- Fair Information Practice Principles (FIPPs) and the OECD Guidelines, which underpin privacy-specific controls

Types of reviews
- Internal audits: performed by the organization's own audit function, which should be independent of the system owners.
- External / third-party audits: for example, SOC 2 or ISO certification audits.
- Self-assessments: control owners attest to their own controls. These are useful but less independent.
- Vendor / supplier assessments: questionnaires, on-site audits, review of the vendor's SOC reports.
- Technical testing: vulnerability scans, penetration tests, configuration reviews, code reviews.
- Access reviews / recertification: periodic validation that users have only the access they need.

How IT Control Reviews Work
Step 1: Define scope and objectives. Identify the systems, data types (especially personal and sensitive data), business processes, locations and vendors in scope. Tie the objectives to specific legal, contractual or policy requirements.

Step 2: Inventory data and map data flows. Use the data inventory and data flow diagrams to understand where personal data is collected, stored, processed, transferred and deleted. You cannot assess controls on data you do not know exists.

Step 3: Identify risks and map controls. Using a risk assessment, link each risk to the control(s) intended to mitigate it. For example, the risk of unauthorized access to an HR database maps to RBAC, MFA, quarterly access reviews and audit logging. The result is a control matrix.

Step 4: Select a framework and testing criteria. Choose a baseline such as NIST 800-53, ISO 27002 or internal standards. Define what 'effective' means for each control.

Step 5: Gather evidence and test. Common techniques include:
- Inquiry: interviewing control owners. This is the weakest form of evidence on its own.
- Observation: watching a process being performed.
- Inspection: reviewing documents, configurations, logs and tickets.
- Re-performance: the reviewer independently executes the control. This is the strongest form of evidence.
- Sampling: testing a representative subset of transactions over a period.
- Automated testing: scanners, configuration compliance tools, continuous control monitoring.

Step 6: Evaluate findings. Classify deficiencies, for example as a design gap, an implementation gap or an operating failure. Rate severity using likelihood and impact on individuals as well as on the organization.

Step 7: Report. Communicate findings, root causes, risk ratings and recommendations to management and governance bodies such as the privacy committee, CISO, DPO or board.

Step 8: Remediate and track. Create corrective action plans with owners and deadlines. Where a control cannot be fixed immediately, use compensating controls or formal risk acceptance by an appropriate authority.

Step 9: Follow up and monitor continuously. Re-test remediated controls. Schedule periodic reviews, such as annual or quarterly ones. Trigger ad hoc reviews after major changes such as new systems, mergers, new vendors, breaches or new regulations.

Privacy-specific focus areas in IT control reviews
- Data minimization: are only necessary data fields collected and retained?
- Purpose limitation: are technical controls preventing secondary use?
- Retention and deletion: are automated deletion jobs running, and are backups covered?
- Data subject rights: can systems locate, export, correct and erase personal data?
- Consent and preference management: are preferences propagated across systems?
- De-identification: are anonymization and pseudonymization techniques effective against re-identification?
- Cross-border transfer controls: are data residency settings enforced?
- Logging that respects privacy: are logs themselves minimized and protected?
- Vendor and cloud configurations: shared responsibility, encryption key management and access by provider staff.

Key roles
- Control owners: operate the controls.
- Privacy technologists and engineers: design and implement privacy controls.
- Internal audit / independent reviewers: assess the controls objectively.
- DPO / CPO / CISO: oversee the program and escalate risk.
- Senior management: accept residual risk and fund remediation.

The three lines model
- First line: operational management that owns and operates controls.
- Second line: risk, compliance and privacy functions that oversee them.
- Third line: internal audit, which provides independent assurance.

Common Pitfalls
- Relying solely on interviews or self-attestations without evidence.
- Reviewing design but never testing operating effectiveness.
- Ignoring third parties and cloud services.
- Treating the review as a one-time event rather than a continuous process.
- Failing to remediate or re-test findings.
- Focusing only on security (confidentiality) while ignoring privacy principles such as minimization, transparency and individual rights.

Exam Tips: Answering Questions on IT Control Reviews
1. Recognize the purpose being tested. If a question asks why an organization performs a control review, the best answer usually involves verifying that controls are operating effectively to mitigate identified privacy risks and demonstrating accountability. Answers like 'to satisfy auditors' alone are rarely the best.

2. Distinguish design vs. operating effectiveness. If a control exists on paper but failed during testing, that is an operating effectiveness issue. If the control would not address the risk even when working, that is a design issue. Also note that a SOC 2 Type I covers design at a point in time, while Type II covers operating effectiveness over a period.

3. Rank evidence quality. Re-performance and inspection are stronger than observation, and observation is stronger than inquiry. When asked for the MOST reliable evidence, choose independent, documented or re-performed evidence over interviews.

4. Value independence. Questions often hint that the person reviewing a control should not be the person operating it. Segregation of duties is a frequent correct answer.

5. Think risk-based. When asked what to review FIRST or what to prioritize, choose systems with the most sensitive personal data, highest volume or greatest exposure. Examples include internet-facing systems, special category data and new vendors.

6. Remember the lifecycle. The correct sequence is generally: scope, inventory/data mapping, risk assessment, control mapping, testing, reporting, remediation, follow-up. If a question asks what to do before testing, data inventory and risk identification are typical answers. If it asks what comes after findings, remediation plans with owners and re-testing are typical.

7. Know the remediation options. When a gap cannot be closed immediately, look for compensating controls or documented risk acceptance by an appropriate senior authority. Ignoring the finding is never correct. Also be wary of transferring all responsibility, for example to an insurer or a vendor, as the sole response.

8. Watch for change triggers. Scenarios involving a merger, new cloud migration, new vendor, breach or new law usually point toward conducting a new or updated review, PIA or DPIA.

9. Include vendors. If a scenario involves a processor or cloud provider, the best answer often includes reviewing the vendor's controls. Methods include SOC 2 reports, ISO certifications, contractual audit rights and questionnaires. Keep the shared responsibility model in mind.

10. Connect to privacy principles, not just security. The CIPT is privacy-focused. Prefer answers that address minimization, retention, purpose limitation and data subject rights alongside confidentiality, integrity and availability.

11. Map frameworks correctly.
- NIST SP 800-53 is a control catalog.
- The NIST Privacy Framework is a risk management tool built around Identify-P, Govern-P, Control-P, Communicate-P and Protect-P.
- ISO 27701 extends ISO 27001 for privacy.
- SOC 2 is an attestation report.
- COBIT addresses IT governance.

12. Prefer automation and continuity where appropriate. For scenarios involving large or dynamic environments, continuous control monitoring and automated configuration checks are often better answers than infrequent manual reviews.

13. Read qualifiers carefully. Words like BEST, FIRST, MOST effective and PRIMARY matter. Several options may be true, so pick the one that most directly addresses the risk in the scenario with the strongest, most independent assurance.

14. Eliminate extremes. Be skeptical of options that rely on 'trust' without verification, rely on a single control, or propose actions without management involvement.

Sample Question Walkthrough
Scenario: A company's policy requires quarterly access reviews for its customer database. During an IT control review, the auditor finds that reviews were documented for only two of the last four quarters. What is the BEST classification and next step?

Reasoning: The control is properly designed, because quarterly reviews address the risk of excessive access. However, it is not operating consistently. That makes it an operating effectiveness deficiency. The best next step is to report the finding and assign remediation, such as automating reminders and assigning an accountable owner. The control should then be re-tested in subsequent quarters, and the auditor should check for any inappropriate access that may have accumulated in the meantime.

Summary
IT control reviews provide verifiable assurance that privacy and security safeguards are designed well, implemented and working over time. For the CIPT exam, keep these points in mind:
- Think risk-based and evidence-based.
- Value independence.
- Follow the lifecycle from scoping to remediation and follow-up.
- Include vendors.
- Always tie technical controls back to privacy principles and accountability obligations.