![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
Data Protection Homepage |
|
|
![]() |
![]() |
|
![]() |
![]() |
Assessing the Evidence (print ref: Part 4, Section 2.2)Once the evidence has been gathered it has to be assessed objectively by the Auditor to decide whether it demonstrates compliance with the requirements of the Data Protection Act or not. While carrying out this assessment the Auditor should bear the following points in mind. Sources and Reliability It is very important that the evidence gathered is of high quality if it is going to be used to make a robust judgement. The source of the evidence will be a significant factor affecting its reliability, and it may come from a variety of places including:
When assessing the reliability of documentary evidence an Auditor should take various factors into account such as whether it is a formal or informal document, its age, authorship and distribution within the organisation. When assessing the reliability of information obtained from staff in interviews or focus groups it should be remembered that in these situations people can be argumentative, undisciplined, dishonest, opinionated, impatient, inarticulate, lazy, apathetic, domineering or downright rude. Equally, auditees might appear to be very helpful and co-operative because they are trying to tell the Auditor what they think they want to hear. Weaknesses in Information The previous section has dealt with some of the factors that may affect the reliability of any information gathered during an audit from the point of view of its origin. It is also important to take into account any lack of objectivity that might be introduced by the Auditor themselves. For example:
All of these factors may cause an Auditor to lose their objectivity and need to be guarded against carefully when assessing evidence. Strengthening the Evidence Base If an Auditor is to make a robust judgement then there needs to be a strong evidence base on which to make that judgement. The factors that will help to strengthen evidence include:
Validity, Reliability and Repeatability A useful final check for a piece of major evidence that is going to be used as the basis for a non-compliance is to subject it to a Validity, Reliability and Repeatability test as follows:
|
|
![]() |
![]() |