Vendor privacy audits explained — risk-based scope, evidence review, contract and operational testing, remediation ownership and event-driven reassessment.