How to prepare a privacy annual audit plan — scope, evidence gathering, control testing, findings, remediation tracking and board-ready reporting.