Right to audit, a clause worth having and rarely worth using

A usable clause states who may audit — you, your appointed auditor, and your regulator — what is in scope, how much notice is required, how often, who pays, and what happens in an emergency such as a material incident where the standard notice period is useless. It should also flow down to material sub-contractors, because a right that stops at your direct supplier stops before the part of the chain you most wanted to see.

For processors, UK and EU GDPR make the substance non-negotiable: the data processing agreementmust require the processor to make available the information needed to demonstrate compliance and to allow for and contribute to audits, including inspections. In regulated financial services, the equivalent expectation extends explicitly to the supervisor's own access.

Rarely as written. Large providers will not host thousands of individual customer audits, and most customers lack the capacity to run them, so the right is generally satisfied by pooled evidence: SOC 2 Type II reports, ISO 27001 certificates with the statement of applicability, penetration test summaries and standardised questionnaire responses. That is a reasonable settlement, provided the evidence is current and its scope covers the service you buy.

The value of the clause is mostly in what it makes possible when something goes wrong. After a material incident, a firm with an audit right and an emergency trigger has a basis to demand answers; a firm without one is asking for a favour at the least convenient moment in the relationship.