In short
A right-to-audit clause in a vendor contract gives the customer, and often its auditors and regulators, the right to inspect the vendor's records, controls and facilities.
Key takeaways
- It supplements, or substitutes for, assurance reports such as System and Organization Controls (SOC) reports.
- Large providers often limit it and offer their SOC reports instead.
- It is especially important for critical or regulated outsourcing.
Where it's tested
ISC: Third-Party & Vendor Risk — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
Why does a company include a 'right to audit' clause in an outsourcing contract?