Most privacy leaders who go through a structured program assessment expect to find gaps. What they often find, though, is less straightforward, and some of the fixes turn out to be challenging.
In a previous Myna Partners webinar, Dave Cohen and Aaron Weller, who leads privacy innovation and assurance at HP, walked through what they tend to see when organizations take a close look at how their privacy programs operate in practice, as opposed to on paper. A few patterns emerged repeatedly.
Why Does the Remediation Gap Sometimes Catch Privacy Teams Off Guard?
Following assessments, privacy teams expect to hear about policy gaps or documentation issues. What often catches them off guard, though, is how often the real problem sits at the end of the process: not in identifying issues, but in closing them.
As Aaron put it during the session: you can do 90% of the work and still not have reduced the risk to the business at all. That last 10% the actual remediation, is where the risk comes down. And it is also where most programs quietly stall.
“I pointed out that really you can do all of the reviews you like, but until the remediation actions are actually closed out, you haven’t really reduced the risk to the business at all.”— Aaron Weller, Leader of Privacy Innovation and Assurance, HP
This is not a failure of intent. It is a structural problem. Most privacy teams are set up to identify and flag issues. Fewer are set up to own the follow-through. When remediation gets handed back to the business with a list of actions, it often sits there, not because people are unwilling, but because no one is accountable for getting it across the line, or because it is not prioritized.
The fix does not always require more headcount. It requires thinking about who in the program is specifically focused on what needs to be done, and who has the authority and ability to make it happen.
How Blurry Is Ownership Inside a Privacy Program?
The second common surprise is how fragmented accountability turns out to be when you map it out within the privacy function. Most organizations have a general sense of who handles privacy. What health checks typically surface is that activities can fall into the gaps between functions: between legal and IT, between compliance and the business, between the team that flagged an issue and the team that needs to fix it. That raises an obvious question: who is responsible for addressing it?
One of the most consistently useful outputs from these reviews is a RACI chart, which is a simple map of who is responsible, accountable, consulted, and informed for each compliance activity. It is not a complex deliverable. But as Dave noted in the session, the reaction from teams seeing it for the first time is almost always the same.
“I can’t tell you how many times we’ve done this for the very first time for a client. They’re like, wow, it’s so great to finally have this in one place.”
— Dave Cohen, Director, Myna Partners
That reaction is telling. It’s not that organizations don’t know what needs to get done. It’s that nobody ever put it all in one place, mapped it to specific people, and made it visible. When that clarity exists, things move. When it doesn’t, accountability drifts.
Why Do Privacy Programs Look More Mature on Paper Than They Operate in Practice?
Perhaps the most common pattern of all is the distance between what a privacy program looks like in documentation and how it functions day to day. Policies are written. Trainings are completed. Controls are documented. But when those policies are tested against actual workflows, against a regulator, an incident, or a business moving fast, the gaps in execution become visible in ways the documentation couldn’t have predicted.
Aaron described this as the difference between proof and promises. The role of a strong privacy assurance function is not to confirm that policies exist. It’s to confirm that those policies are operating in practice and that there is evidence to demonstrate it.
That distinction is what a health check is designed to surface: not what the program says it does, but what it does under pressure, in the real world.
How Do You Maximize Value from Health Check Findings?
The value of a health check is not in the list of findings. It’s in what happens next. Organizations maximize value from a structured review by being prepared to act on what they find, not to file the report and move on.
That means prioritizing remediation explicitly, not as an afterthought. It means assigning clear ownership to every open item. And it means building in a way to know not just that something was fixed, but that it stays fixed.
As Aaron put it, “How do we fix it, and how do we know it stays fixed?” For programs that want to move from reactive to resilient, that question is the right place to start.
Frequently Asked Questions
What is a privacy program health check?
A privacy program health check is a structured review of how a privacy program operates in practice, measured against what policy says it should be doing. It looks at remediation activity, ownership of compliance tasks, and whether policies are functioning as intended rather than simply existing on paper.
What does a privacy program health check typically find?
Three patterns seem to emerge consistently: a remediation gap where risk stays elevated until the final actions are closed, ownership that is blurrier than teams assume, and programs that look mature on paper but not in daily operation.
How is a privacy program health check different from a privacy audit?
An audit typically checks whether policies and controls exist and whether they meet a compliance standard. A health check goes further and looks at whether those controls are operating in practice and whether the program has the structure to sustain them over time.
What should happen after a privacy program health check?
Organizations that maximize value from a health check treat it as a starting point, not a final report. That means prioritizing remediation explicitly, assigning clear ownership to every open item, and building in a way to confirm not just that something was fixed, but that it stays fixed.
Who should be involved in a privacy program health check?
A health check works best when it involves stakeholders across legal, IT, security, and the business, not just the privacy team. Because ownership of privacy activities often sits across functions, mapping those responsibilities is one of the most valuable outputs of the review.
>> Also in this series: The Questions Executives Are Actually Asking About Privacy Programs Right Now
