Start with an inventory
List forms, documents, external scripts, analytics systems and services receiving data. Without this map, the real processing flow cannot be assessed.
Compare documents with actual behavior
Policies and consent text should describe real processes. If a document says one thing and the website code does another, merely having the document does not reduce risk.
Record remediation and verify it
An audit result should become a list of assigned tasks. After changes are implemented, repeat the check and confirm that the issue is actually resolved.