Right to audit
Also called audit rights, access, audit and information rights
A right to audit is a contract clause that lets a regulated firm, its auditors and its regulator access a supplier's premises, systems, data and staff to check how a service is delivered. Financial regulators require these rights in outsourcing and ICT contracts that support critical or important functions.
How it works
The firm negotiates the clause during contracting. It sets who may audit, how much notice is given, which sites and records are in scope and who pays. Firms use the right through on-site visits, document requests, independent certifications or pooled audits shared with other clients of the same provider. Findings go to the vendor owner and risk committee, with remediation tracked to closure.
The clause matters because a firm stays responsible for an outsourced service it cannot see directly. Supervisors check that audit rights exist and that firms use them. Large cloud and data providers often resist individual audits, so regulators accept pooled audits and certifications where they give equivalent assurance. The contractual right to audit and regulator access remains in place either way.
The rules
Requires contracts to grant unrestricted rights of access, inspection and audit to the financial entity, an appointed third party and the competent authority.
EU financial entities using ICT services that support critical or important functionsSection 13.3 requires full access and unrestricted audit rights for critical or important outsourcing, and allows pooled audits and third-party certifications.
Credit institutions, investment firms, payment and e-money institutions in the EUChapter 8 expects firms to secure access, audit and information rights in material outsourcing contracts and to use them, not merely negotiate them.
Banks, building societies, PRA-designated investment firms and insurersLists the right to audit and require remediation among the contract terms banking organisations consider when negotiating third-party agreements.
Banking organisations supervised by the Federal Reserve, FDIC and OCCCommon questions
What is a pooled audit?
A pooled audit is a single audit of a provider carried out on behalf of several client firms. It shares cost and reduces disruption for the provider. EU and UK regulators accept pooled audits where they give the same level of assurance as an individual audit.
Can a certification replace a right to audit?
Certifications such as SOC 2 reports or ISO 27001 can support assurance, and supervisors accept them where they cover the right scope. They do not remove the contractual right to audit, which firms keep for critical or important services.
Does the regulator also get audit rights?
Yes. DORA, the EBA guidelines and PRA SS2/21 all expect contracts to give the competent authority access and audit rights over the provider. Supervisors use these rights rarely, but contracts without them can block an outsourcing.
Do audit rights cover subcontractors?
For critical services, regulators expect the firm's access and audit rights to flow down to material subcontractors. Contracts usually require the provider to secure equivalent rights in its own subcontracts.
Our coverage
News and analysis on third-party risk from RegTech Post.
Read the coverage →RegTech PostManaging Third-Party Risk: What Legal Teams Must Focus on in 2026Read the article →RegTech PostDORA: A Complete Overview of Europe’s Digital Operational Resilience ActRead the article →
