This sample work program provides audit steps for a privacy controls review. Specific objectives of the work program include: verifying management direction and support for privacy controls; checking system implementations and changes are appropriately tested; reviewing policies and procedures; and testing that privacy controls are working effectively.