Should an external audit be treated as a separate processing activity in the record of processing activities?

ANSWER

This should not be treated as a separate processing activity. The external auditor should nevertheless be entered in the controller's record of processing activities among data recipients — as a processor or separate controller — in those processing activities where they should be included. Therefore, if the external auditor has access to employee data, they should be entered among recipients in the employment processing activity; if they have access to client data, they should be entered among recipients in client-related processing activities. Note: a statutory auditor is also a recipient, but with the status of a separate controller: https://uodo.gov.pl/pl/225/1248.