Which of the following should be reviewed FIRST as part of an audit of controls implemented to mitigate data privacy risk?

A PIA is a structured document that maps data processing activities, identifies associated privacy risks, and records the controls selected to mitigate those risks. Reviewing it first gives auditors an authoritative baseline of what risks were anticipated and what controls are supposed to be operating, which frames all subsequent audit testing and evidence collection. Without this context, auditors cannot determine whether the implemented controls are appropriate for the identified risks.

A security impact assessment focuses on information security risks and controls, not privacy-specific risks; reviewing it first would not provide the privacy-focused baseline needed to audit privacy risk controls.

Privacy policies and procedures describe intended practices and are reviewed to assess design adequacy, but they should be evaluated against the risk context established in the PIA rather than reviewed in isolation first.

A privacy risk and control framework defines the overall methodology and categories of controls but does not document the specific risks and controls applicable to the organization's actual processing activities the way a PIA does.