Should external audits be listed separately in the record of processing activities?

ANSWER

I would not treat this as a separate process. However, the external auditor should be entered in the record of processing activities in the column dedicated to data recipients – as a processor or separate controller, in all those processes where, given their involvement, they should be included.

Therefore, if the external auditor has access to employee data, they should be included as a data recipient in the employment process; if they have access to our customers' data, they should be included as a data recipient in customer-facing processes. Please note: a statutory auditor engaged by the organisation is also a data recipient, but in performing their activities within and on the basis of legislation they generally have the status of a separate controller.