# Audit right

Source: https://contracko.com/fr/glossaire/droit-d-audit

# Audit right

A contractual right to inspect a counterparty's records or processes to verify compliance.

## Définition

An audit right entitles one party, usually the client, to inspect the other party's records, systems or processes to verify compliance with the contract, pricing, quality or data-protection obligations. Contracts define the scope, frequency, notice period, confidentiality safeguards and who bears the cost. In data-processing contexts the right also supports the controller's oversight duties under GDPR Article 28.

## Exemple

> The client may audit the supplier's billing records once a year on thirty days' written notice, bearing its own audit costs.

## Pourquoi c'est un risque pour l'entreprise

An audit right without a clear exercise procedure is difficult to enforce. Suppliers who resist audits or impose unreasonable conditions can effectively nullify the right. Equally, an unlimited or poorly scoped audit right can disrupt a supplier's operations and damage the relationship. The risk is compounded in data-processing contexts, where the controller's failure to audit can itself be a GDPR compliance gap.

## Comment le gérer

- Define the audit scope precisely: which records, systems or sites are in scope, and which are excluded as commercially sensitive or unrelated to the contract.
- Fix the notice period, frequency and permitted auditor (in-house or independent) so the supplier can prepare without undue disruption.
- Include a confidentiality obligation for audit findings and restrict who within the client organisation can access the results.
- Track annual audit windows as a contract milestone so the right is exercised before it lapses for that year.
- For data-processing agreements, calendar the GDPR Article 28 audit right separately alongside the data-protection review cycle.

### Comment Contracko aide

Contracko tracks audit-right exercise windows and GDPR-review milestones extracted from contracts, sending reminders before they lapse. Storing audit clauses, notice requirements and prior audit reports alongside the contract gives a complete compliance record accessible at a glance.

## Références juridiques

- [GDPR Art. 28 GDPR: processor obligations and audits Droit de l'UE](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

Sauf mention contraire, les références renvoient au droit néerlandais (Burgerlijk Wetboek, le Code civil néerlandais) ; les instruments de l'UE tels que le RGPD s'appliquent dans toute l'UE. Il s'agit d'informations générales, pas de conseils juridiques. D'autres juridictions traitent ces concepts différemment. Vérifiez le texte en vigueur et votre situation avec un avocat qualifié.

## Pertinent pour

[Services informatiques](https://contracko.com/fr/secteurs/services-informatiques)[Services financiers](https://contracko.com/fr/secteurs/services-financiers)[Fournisseurs de services managés](https://contracko.com/fr/secteurs/prestataires-services-geres)

## Clauses associées

- [Audit Rights Clause](https://contracko.com/fr/bibliotheque-de-clauses/droit-daudit)
- [Compliance Clause](https://contracko.com/fr/bibliotheque-de-clauses/clause-de-conformite)
- [Data Processing Clause](https://contracko.com/fr/bibliotheque-de-clauses/traitement-des-donnees)

## Termes associés

- [Compliance clause](https://contracko.com/fr/glossaire/clause-de-conformite)
- [Data processing agreement (DPA)](https://contracko.com/fr/glossaire/accord-de-traitement-des-donnees)
- [Procurement audit](https://contracko.com/fr/glossaire/audit-des-achats)
- [Contract compliance](https://contracko.com/fr/glossaire/conformite-contractuelle)

### Ne manquez plus jamais une échéance de contrat

- L'IA repère les dates de renouvellement et de préavis
- Les risques et obligations sont mis en évidence automatiquement
- Les rappels vous aident à agir avant que les dates ne filent

Déposez un contrat pour commencer

PDF, DOCX, PNG ou JPG

[Démarrer l'essai de 7 jours](https://app.contracko.com/register?appLanguage=fr&utm_source=glossary_sidebar&utm_medium=lead_magnet&utm_campaign=glossary_sidebar_contract_upload&content_slug=audit-right&content_title=Audit+right&cta_placement=glossary_sidebar_cta&source_tool=glossary_sidebar_audit-right)

Conforme au RGPD. Chiffré. Jamais utilisé pour l'entraînement de l'IA.

## Foire aux questions

Questions courantes sur ce terme.

- **Q:** Can a supplier refuse an audit?
  **A:** If the audit right is contractual, refusal is a breach. The client can enforce the right through the courts or use the refusal as grounds for termination for cause, depending on what the contract provides. For GDPR-mandated audits, refusal also risks regulatory enforcement.

- **Q:** Who pays for the audit?
  **A:** Typically the client bears the cost of exercising its own audit right. If the audit reveals a material discrepancy or breach, the contract may shift costs to the supplier. GDPR Article 28(3)(h) requires the processor to make information available, which shifts some of the data-protection audit burden to the processor.

- **Q:** Can a supplier substitute a third-party certification for an on-site audit?
  **A:** Many SaaS and cloud contracts allow the supplier to offer ISO 27001 or SOC 2 reports in lieu of a direct audit, provided the contract expressly permits this. Without that contractual carve-out, a certification report does not replace the client's right to audit.

- **Q:** How broad can an audit right be?
  **A:** Contractually there is no statutory limit, but proportionality and good faith under BW 6:248 limit how intrusively the right can be exercised. Courts have moderated overly broad audit rights that would expose a supplier's confidential commercial data unrelated to the audited contract.

- **Q:** Is an audit right required in every data-processing agreement?
  **A:** Yes. GDPR Article 28(3)(h) requires that the processor makes available all information necessary to demonstrate compliance and allows for and contributes to audits conducted by the controller or its mandated auditor. This is a mandatory term in every DPA.

## Voyez ces termes dans vos propres contrats

Téléversez un contrat et Contracko en extrait les termes, dates et obligations clés, puis vous rappelle chacun d'eux avant qu'il ne compte.

[Démarrer l'essai gratuit de 7 jours](https://app.contracko.com/register?appLanguage=fr)

Réserver une démo