FreePublished on GitHub

audit-risk-assessment

Guides privacy audit risk assessment including risk universe development, inherent and residual risk scoring, control effectiveness evaluation, risk-based audit planning, heat map generation, risk appetite alignment, and audit prioritization by risk exposure. Covers the full audit risk assessment cycle from scoping through ongoing monitoring. Keywords: audit risk assessment, risk universe, inherent risk, residual risk, control effectiveness, risk-based audit planning.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

Run score Not tested

See how to install

Files included (5)

SKILL.md6.0 KB
assets/template.md3.4 KB
references/standards.md3.2 KB
references/workflows.md5.2 KB
scripts/process.py7.5 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Privacy Audit Risk Assessment

Overview

Privacy audit risk assessment is the systematic process of identifying, evaluating, and prioritising privacy risks to determine audit scope, frequency, and resource allocation. A risk-based approach ensures that audit effort is directed at areas of greatest exposure, aligning with the accountability principle under GDPR Article 5(2) and the proportionality requirements of ISO 19011:2018.

The International Internal Audit Standards (IIA Standard 2010) require the chief audit executive to establish a risk-based plan to determine the priorities of the internal audit activity. In the privacy domain, this means evaluating processing activities, data categories, transfer mechanisms, and regulatory exposure to identify where compliance failures would cause the greatest harm.

Risk Universe

The privacy audit risk universe encompasses all auditable entities within the organisation's privacy programme:

Risk Domain	Auditable Entities	Example Risks
Data Subject Rights	DSAR processing, consent management, automated decisions	Late DSAR responses, invalid consent, no human review for automated decisions
Data Processing	Processing registers, lawful basis documentation, purpose limitation	Undocumented processing, incorrect lawful basis, purpose creep
Data Transfers	International transfers, SCCs, BCRs, adequacy reliance	Transfer without safeguards, outdated SCCs, Schrems II non-compliance
Data Security	Technical controls, access management, encryption	Unauthorised access, unencrypted personal data, excessive permissions
Breach Management	Detection, notification, documentation, remediation	Late notification (>72 hours), inadequate forensics, poor remediation
Vendor Management	Processor contracts, sub-processor oversight, due diligence	Missing Article 28 clauses, no sub-processor approval, inadequate DPA
Privacy Governance	DPO independence, training, policies, ROPA	DPO conflict of interest, outdated policies, incomplete ROPA
Special Categories	Biometric data, health data, children's data	Missing DPIA, inadequate safeguards, no explicit consent

Risk Scoring Methodology

Inherent Risk (before controls)

Factor	Weight	Scale (1-5)	Description
Data Volume	20%	1=<1K records, 5=>1M records	Volume of personal data processed
Data Sensitivity	25%	1=basic contact, 5=special category/biometric	Sensitivity of data categories involved
Regulatory Exposure	25%	1=single jurisdiction, 5=global multi-regime	Number and stringency of applicable regulations
Processing Complexity	15%	1=simple storage, 5=AI/automated decisions	Complexity of processing operations
External Sharing	15%	1=internal only, 5=multiple third-party transfers	Extent of data sharing with external parties

Control Effectiveness

Rating	Score	Definition
Effective	1	Controls designed and operating effectively; no significant deficiencies
Partially Effective	2	Controls exist but have gaps in design or operation
Ineffective	3	Controls absent, poorly designed, or not operating as intended

Residual Risk

Residual Risk Score = Inherent Risk Score x Control Effectiveness Score

Residual Score	Rating	Audit Priority
1.0 – 2.0	Low	Audit every 3 years
2.1 – 3.5	Medium	Audit every 2 years
3.6 – 4.5	High	Audit annually
4.6 – 5.0	Critical	Audit semi-annually; continuous monitoring

Risk Appetite Alignment

Risk Category	Risk Appetite	Rationale
Regulatory compliance	Very Low	Zero tolerance for material non-compliance with GDPR, CCPA, or sector-specific regulation
Data subject harm	Very Low	Protecting individuals is the primary objective of the privacy programme
Operational disruption	Low	Privacy controls must not unduly impede business operations
Reputational	Low	Privacy incidents erode customer trust and brand value
Financial (penalties)	Very Low	Maximum GDPR penalty: EUR 20M or 4% global turnover

Audit Planning Integration

The risk assessment directly feeds the annual privacy audit plan:

Input	Output
Residual risk scores by auditable entity	Prioritised list of audit engagements
Risk appetite thresholds	Minimum audit frequency per entity
Resource constraints	Audit resource allocation model
Regulatory developments	Emerging risk adjustments (e.g., AI Act, new state laws)
Prior audit findings	Increased frequency for entities with unresolved high/critical findings
Management requests	Ad-hoc audit engagements for new processing activities or incidents

Heat Map Interpretation

Likelihood ↓ / Impact →	Low Impact	Medium Impact	High Impact	Critical Impact
Very Likely	Medium	High	Critical	Critical
Likely	Low	Medium	High	Critical
Possible	Low	Medium	High	High
Unlikely	Low	Low	Medium	High
Rare	Low	Low	Low	Medium

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill

Install

Install with a command

npx skills add https://github.com/mukul975/Privacy-Data-Protection-Skills --skill audit-risk-assessment

Paste it into your terminal and run it (requires Node.js). You can choose which agents to install it for, such as Claude Code or Codex.

Ask your agent

Please install the following Agent Skill.
https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/audit-risk-assessment

First review SKILL.md and the bundled files and confirm there is nothing suspicious (such as sending data externally or reading credentials). Then place it in ~/.claude/skills/audit-risk-assessment/ for Claude Code, or ~/.agents/skills/audit-risk-assessment/ for Codex.

Send this text to Claude Code or Codex as is. It checks the contents before installing.

View source on GitHub

Repository: mukul975/Privacy-Data-Protection-Skills
Stars: 317
Forks: 62
Category: Testing & Security
License: Apache-2.0
Original language: English
Last updated: Mar 17, 2026

A skill is a set of instructions and scripts for an agent. cccskills does not guarantee that skills are safe. Review the contents before you install.