Clause primer
Customer audit rights
The clause lets one party examine the other's records, systems or facilities to verify compliance with the agreement, including security and data protection obligations.
Legal information, not legal advice. What a clause does depends on its exact words, the rest of the agreement and the governing law.
Also called: right to audit, inspection rights, compliance audit clause. Where you find it: Vendor and outsourcing agreements, SaaS agreements, data processing agreements, software license agreements (where the licensor audits the licensee), and regulated industry service contracts.
SAMPLE CLAUSE (INVENTED FOR THIS PRIMER)
No more than once in any twelve-month period, and additionally after a Security Incident affecting Customer Data, Customer or an independent auditor bound by confidentiality obligations may audit Vendor's compliance with Sections 9 and 10 on at least thirty days' written notice. Vendor may satisfy the audit first by providing its most recent independent third-party audit report covering the Services. Any on-site audit will occur during business hours, will not unreasonably interfere with Vendor's operations, and will be at Customer's cost unless it reveals a material breach, in which case Vendor will reimburse Customer's reasonable audit costs and promptly remedy the breach.
How it works
Frequency and triggers
An annual limit protects the vendor from repeated disruption, and the security incident trigger gives the customer an additional audit when risk is highest. Regulators or data protection laws may require audit rights beyond these limits, so check whether the clause allows for that.
Who may audit and scope
Permitting an independent auditor under confidentiality lets the customer use specialists while protecting the vendor's other customers. Limiting scope to named sections keeps the audit focused on the obligations that matter.
Report-first approach
Allowing the vendor to supply a third-party report first reflects how cloud providers commonly handle audits. The customer should check what the report covers and whether it can still proceed if the report does not answer its questions.
Logistics, cost and remediation
Notice, business hours and cost allocation keep audits practical. Shifting cost to the vendor on a material breach, and requiring remediation, gives the audit a consequence.
Why it is there
Audit rights let a customer verify, rather than simply trust, that a vendor is meeting its security, data handling and other compliance obligations. They protect the customer and support its own obligations to regulators, auditors and data subjects. For the vendor, a well-defined clause limits cost and disruption and protects the confidentiality of its systems and other customers.
How it works with other clauses
- Data processing terms: data protection laws may require processors to allow audits or inspections, so the DPA audit clause and the main agreement should be consistent.
- Confidentiality: audit findings and vendor materials reviewed during the audit should fall within confidentiality obligations.
- Security incident and breach notice: an incident trigger links the audit right to the notification clause.
- Termination and remedies: the clause should say what follows an uncured material finding, such as a termination right.
Negotiating it
Who it protects: The customer or data controller.
If it protects you
- Keep an audit right that survives a third-party report if the report does not cover the relevant services or controls.
- Keep an additional audit after a security incident or regulator request.
- Keep cost shifting and a remediation obligation for material findings.
If it runs against you
- Standard ask: audits satisfied by current independent reports and questionnaires, with on-site audits only after an incident or regulator demand; fallback: one on-site audit per year on notice, at the customer's cost.
- Ask that auditors be independent, not competitors, and bound by confidentiality.
- Ask that scope exclude other customers' data and that access be limited to business hours.
Escalate before accepting: Unlimited audits by the counterparty's own staff or a competitor, with no notice, no scope limit and no confidentiality, usually warrant escalation.
What AI explanations get wrong
- Confusing customer audit rights with a licensor's audit of software license usage; check which party holds the right and what it verifies.
- Treating a third-party report as equivalent to an audit right; check whether the customer can still audit if the report is insufficient.
- Missing statutory audit requirements under data protection law; check whether the DPA must include audit or inspection terms for the jurisdictions involved.
- Overlooking conflicts between the DPA and the main agreement; check the order of precedence clause.
Where the law varies
Some data protection and sector regulations require specific audit or inspection terms, and those requirements differ by jurisdiction and industry. Confirm which regimes apply to the data and services involved.
TOOLS
Need a primer like this for a clause in front of you? The Clause Primer Kit, included in All-access, produces one in this format inside the AI tool you already use, with checks built in. For reviewing whole agreements, see the SaaS and Vendor Agreements Pack.