# Audit right

Source: https://contracko.com/it/glossario/diritto-di-audit

# Audit right

A contractual right to inspect a counterparty's records or processes to verify compliance.

## Definizione

An audit right entitles one party, usually the client, to inspect the other party's records, systems or processes to verify compliance with the contract, pricing, quality or data-protection obligations. Contracts define the scope, frequency, notice period, confidentiality safeguards and who bears the cost. In data-processing contexts the right also supports the controller's oversight duties under GDPR Article 28.

## Esempio

> The client may audit the supplier's billing records once a year on thirty days' written notice, bearing its own audit costs.

## Perché rappresenta un rischio aziendale

An audit right without a clear exercise procedure is difficult to enforce. Suppliers who resist audits or impose unreasonable conditions can effectively nullify the right. Equally, an unlimited or poorly scoped audit right can disrupt a supplier's operations and damage the relationship. The risk is compounded in data-processing contexts, where the controller's failure to audit can itself be a GDPR compliance gap.

## Come gestirlo

- Define the audit scope precisely: which records, systems or sites are in scope, and which are excluded as commercially sensitive or unrelated to the contract.
- Fix the notice period, frequency and permitted auditor (in-house or independent) so the supplier can prepare without undue disruption.
- Include a confidentiality obligation for audit findings and restrict who within the client organisation can access the results.
- Track annual audit windows as a contract milestone so the right is exercised before it lapses for that year.
- For data-processing agreements, calendar the GDPR Article 28 audit right separately alongside the data-protection review cycle.

### Come aiuta Contracko

Contracko tracks audit-right exercise windows and GDPR-review milestones extracted from contracts, sending reminders before they lapse. Storing audit clauses, notice requirements and prior audit reports alongside the contract gives a complete compliance record accessible at a glance.

## Riferimenti normativi

- [GDPR Art. 28 GDPR: processor obligations and audits Diritto UE](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

Salvo diversa indicazione, i riferimenti riguardano il diritto olandese (Burgerlijk Wetboek, il Codice Civile olandese); gli strumenti UE come il GDPR si applicano in tutta l'UE. Si tratta di informazioni generali, non di consulenza legale. Altre giurisdizioni trattano questi concetti in modo diverso. Verifichi il testo vigente e la propria situazione con un avvocato qualificato.

## Rilevante per

[Servizi IT](https://contracko.com/it/settori/servizi-informatici)[Servizi finanziari](https://contracko.com/it/settori/servizi-finanziari)[Fornitori di servizi gestiti](https://contracko.com/it/settori/fornitori-servizi-gestiti)

## Clausole correlate

- [Audit Rights Clause](https://contracko.com/it/biblioteca-di-clausole/diritto-di-audit)
- [Compliance Clause](https://contracko.com/it/biblioteca-di-clausole/clausola-di-conformita)
- [Data Processing Clause](https://contracko.com/it/biblioteca-di-clausole/trattamento-dei-dati)

## Termini correlati

- [Compliance clause](https://contracko.com/it/glossario/clausola-di-conformita)
- [Data processing agreement (DPA)](https://contracko.com/it/glossario/accordo-sul-trattamento-dei-dati)
- [Procurement audit](https://contracko.com/it/glossario/audit-degli-acquisti)
- [Contract compliance](https://contracko.com/it/glossario/conformita-contrattuale)

### Non perda mai più una scadenza contrattuale

- L'AI trova le date di rinnovo e preavviso
- Rischi e obblighi emergono automaticamente
- I promemoria La aiutano ad agire prima che le date sfuggano

Trascini un contratto per iniziare

PDF, DOCX, PNG o JPG

[Inizi la prova di 7 giorni](https://app.contracko.com/register?appLanguage=it&utm_source=glossary_sidebar&utm_medium=lead_magnet&utm_campaign=glossary_sidebar_contract_upload&content_slug=audit-right&content_title=Audit+right&cta_placement=glossary_sidebar_cta&source_tool=glossary_sidebar_audit-right)

Conforme al GDPR. Cifrato. Mai usato per l'addestramento dell'AI.

## Domande frequenti

Domande comuni su questo termine.

- **Q:** Can a supplier refuse an audit?
  **A:** If the audit right is contractual, refusal is a breach. The client can enforce the right through the courts or use the refusal as grounds for termination for cause, depending on what the contract provides. For GDPR-mandated audits, refusal also risks regulatory enforcement.

- **Q:** Who pays for the audit?
  **A:** Typically the client bears the cost of exercising its own audit right. If the audit reveals a material discrepancy or breach, the contract may shift costs to the supplier. GDPR Article 28(3)(h) requires the processor to make information available, which shifts some of the data-protection audit burden to the processor.

- **Q:** Can a supplier substitute a third-party certification for an on-site audit?
  **A:** Many SaaS and cloud contracts allow the supplier to offer ISO 27001 or SOC 2 reports in lieu of a direct audit, provided the contract expressly permits this. Without that contractual carve-out, a certification report does not replace the client's right to audit.

- **Q:** How broad can an audit right be?
  **A:** Contractually there is no statutory limit, but proportionality and good faith under BW 6:248 limit how intrusively the right can be exercised. Courts have moderated overly broad audit rights that would expose a supplier's confidential commercial data unrelated to the audited contract.

- **Q:** Is an audit right required in every data-processing agreement?
  **A:** Yes. GDPR Article 28(3)(h) requires that the processor makes available all information necessary to demonstrate compliance and allows for and contributes to audits conducted by the controller or its mandated auditor. This is a mandatory term in every DPA.

## Veda questi termini nei suoi contratti

Carichi un contratto e Contracko estrae i termini chiave, le date e gli obblighi, poi la ricorda prima che ciascuno diventi rilevante.

[Inizia la prova gratuita di 7 giorni](https://app.contracko.com/register?appLanguage=it)

Prenota una demo