In the initial risk assessment phase, it is critical for the internal auditor to understand the current policies and procedures in place. By obtaining the most current approved copies of the organization's privacy policy, the auditor can assess whether these policies are in compliance with privacy laws and are effectively implemented. This approach provides a solid foundation for understanding the existing controls and identifying areas where there may be gaps or weaknesses. Consulting with legal counsel or a specialist can be subsequent steps if further expertise is needed, but understanding the internal policies is the primary and essential first step.
Reference:
Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2210 - Engagement Objectives.