# Audit right

Source: https://contracko.com/es/glosario/derecho-de-auditoria

# Audit right

A contractual right to inspect a counterparty's records or processes to verify compliance.

## Definición

An audit right entitles one party, usually the client, to inspect the other party's records, systems or processes to verify compliance with the contract, pricing, quality or data-protection obligations. Contracts define the scope, frequency, notice period, confidentiality safeguards and who bears the cost. In data-processing contexts the right also supports the controller's oversight duties under GDPR Article 28.

## Ejemplo

> The client may audit the supplier's billing records once a year on thirty days' written notice, bearing its own audit costs.

## Por qué es un riesgo para la empresa

An audit right without a clear exercise procedure is difficult to enforce. Suppliers who resist audits or impose unreasonable conditions can effectively nullify the right. Equally, an unlimited or poorly scoped audit right can disrupt a supplier's operations and damage the relationship. The risk is compounded in data-processing contexts, where the controller's failure to audit can itself be a GDPR compliance gap.

## Cómo gestionarlo

- Define the audit scope precisely: which records, systems or sites are in scope, and which are excluded as commercially sensitive or unrelated to the contract.
- Fix the notice period, frequency and permitted auditor (in-house or independent) so the supplier can prepare without undue disruption.
- Include a confidentiality obligation for audit findings and restrict who within the client organisation can access the results.
- Track annual audit windows as a contract milestone so the right is exercised before it lapses for that year.
- For data-processing agreements, calendar the GDPR Article 28 audit right separately alongside the data-protection review cycle.

### Cómo ayuda Contracko

Contracko tracks audit-right exercise windows and GDPR-review milestones extracted from contracts, sending reminders before they lapse. Storing audit clauses, notice requirements and prior audit reports alongside the contract gives a complete compliance record accessible at a glance.

## Referencias legales

- [GDPR Art. 28 GDPR: processor obligations and audits Derecho de la UE](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

Salvo indicación en contrario, las referencias remiten al derecho neerlandés (Burgerlijk Wetboek, el Código Civil neerlandés); los instrumentos de la UE como el RGPD se aplican en toda la UE. Se trata de información general, no de asesoramiento legal. Otras jurisdicciones tratan estos conceptos de forma distinta. Verifique el texto vigente y su situación con un abogado cualificado.

## Relevante para

[Servicios informáticos](https://contracko.com/es/sectores/servicios-informaticos)[Servicios financieros](https://contracko.com/es/sectores/servicios-financieros)[Proveedores de servicios gestionados](https://contracko.com/es/sectores/proveedores-servicios-gestionados)

## Cláusulas relacionadas

- [Audit Rights Clause](https://contracko.com/es/biblioteca-de-clausulas/derecho-de-auditoria)
- [Compliance Clause](https://contracko.com/es/biblioteca-de-clausulas/clausula-de-cumplimiento)
- [Data Processing Clause](https://contracko.com/es/biblioteca-de-clausulas/tratamiento-de-datos)

## Términos relacionados

- [Compliance clause](https://contracko.com/es/glosario/clausula-de-cumplimiento)
- [Data processing agreement (DPA)](https://contracko.com/es/glosario/acuerdo-de-tratamiento-de-datos)
- [Procurement audit](https://contracko.com/es/glosario/auditoria-de-compras)
- [Contract compliance](https://contracko.com/es/glosario/cumplimiento-contractual)

### No vuelva a perder un plazo de contrato

- La IA encuentra las fechas de renovación y preaviso
- Los riesgos y obligaciones afloran automáticamente
- Los recordatorios le ayudan a actuar antes de que las fechas se escapen

Suelte un contrato para empezar

PDF, DOCX, PNG o JPG

[Empezar prueba de 7 días](https://app.contracko.com/register?appLanguage=es&utm_source=glossary_sidebar&utm_medium=lead_magnet&utm_campaign=glossary_sidebar_contract_upload&content_slug=audit-right&content_title=Audit+right&cta_placement=glossary_sidebar_cta&source_tool=glossary_sidebar_audit-right)

Conforme con el RGPD. Cifrado. Nunca se usa para entrenar la IA.

## Preguntas frecuentes

Preguntas comunes sobre este término.

- **Q:** Can a supplier refuse an audit?
  **A:** If the audit right is contractual, refusal is a breach. The client can enforce the right through the courts or use the refusal as grounds for termination for cause, depending on what the contract provides. For GDPR-mandated audits, refusal also risks regulatory enforcement.

- **Q:** Who pays for the audit?
  **A:** Typically the client bears the cost of exercising its own audit right. If the audit reveals a material discrepancy or breach, the contract may shift costs to the supplier. GDPR Article 28(3)(h) requires the processor to make information available, which shifts some of the data-protection audit burden to the processor.

- **Q:** Can a supplier substitute a third-party certification for an on-site audit?
  **A:** Many SaaS and cloud contracts allow the supplier to offer ISO 27001 or SOC 2 reports in lieu of a direct audit, provided the contract expressly permits this. Without that contractual carve-out, a certification report does not replace the client's right to audit.

- **Q:** How broad can an audit right be?
  **A:** Contractually there is no statutory limit, but proportionality and good faith under BW 6:248 limit how intrusively the right can be exercised. Courts have moderated overly broad audit rights that would expose a supplier's confidential commercial data unrelated to the audited contract.

- **Q:** Is an audit right required in every data-processing agreement?
  **A:** Yes. GDPR Article 28(3)(h) requires that the processor makes available all information necessary to demonstrate compliance and allows for and contributes to audits conducted by the controller or its mandated auditor. This is a mandatory term in every DPA.

## Vea estos términos en sus propios contratos

Suba un contrato y Contracko extrae los términos, fechas y obligaciones clave, y luego le recuerda cada uno de ellos antes de que importe.

[Iniciar la prueba gratuita de 7 días](https://app.contracko.com/register?appLanguage=es)

Reservar demo