(Which of the following should be your first step when conducting an internal privacy audit...

The CIPM Operational Lifecycle requires that assessments begin with an understanding of what data exists and how it is classified. Reviewing the data inventory is the foundational step in any privacy audit because it establishes the scope of personal data, processing purposes, and system ownership. Without an accurate inventory, efforts to map cross-border transfers or identify processing locations will be incomplete or inaccurate.

While mapping data flows and locations (Option A) is critical, it must be informed by a validated inventory. Encryption and cloud provider reviews are protective controls and vendor management activities that occur later in the lifecycle. CIPM stresses that privacy audits should follow a structured approach: inventory → mapping → risk evaluation → controls. Starting with the data inventory ensures the audit is comprehensive, repeatable, and aligned with accountability obligations under global privacy laws.