Right to Audit vs Assurance Reports: When to Rely on Each

A SOC 2 report or an ISO/IEC 27001 certificate tells you what someone else chose to examine, and a right to audit clause lets you examine what you care about, yet most third-party programmes treat the two as interchangeable. The question is not which one is better. It is which supplier, which risk and which gap each one actually covers, and what you can do when a supplier refuses an audit or a report leaves out the part of the service you depend on. This guide sets out what assurance reports omit, what EU and UK financial regulators expect before you rely on them, how to decide by supplier tier, where each approach fails, and which fallbacks to negotiate. It is written for third-party risk managers, procurement and legal teams, internal auditors and security assurance leads. How to run an audit once you decide to is covered in the Supplier Security Audit Guide; regulatory status reflects official sources checked on 14 November 2026.

Key takeaways

Reports are evidence, audit rights are leverage. An assurance report answers the auditor's scope; a usable audit clause lets you test your own scope, and its existence is often what makes a supplier answer follow-up questions.
Read what the report leaves out before you rely on it. Carved-out subservice organisations, complementary user entity controls, period gaps and a certificate scope that excludes your service are the usual holes.
Financial regulators allow reliance with conditions. The EBA outsourcing guidelines and PRA SS2/21 both accept certificates, reports and pooled audits, but expect you to judge their adequacy, not rely on them alone over time, and keep the underlying audit right for critical services.
Decide by tier, not by habit. Critical suppliers need both a report you have actually reviewed and an executable audit right; low-risk suppliers rarely justify either beyond a certificate check.
Negotiate fallbacks before you need them. Scope extension requests, pooled audits, remote evidence sessions and for-cause audit triggers are easier to agree at signature than after an incident.

The short answer

Use assurance reports as the default evidence for most suppliers, because they are cheap for you, standardised and already exist. Hold an audit right in every contract where the supplier touches critical services, sensitive data or your environment, and exercise it when a report leaves a gap that matters, when something has changed, or when something has gone wrong. For EU and UK regulated financial services, the audit right for critical or important functions is not optional, and reports supplement it rather than replace it.

Question	Assurance report or certificate	Right to audit
Who sets the scope?	The supplier and its auditor or certification body	You, within the limits the clause sets
What is tested?	SOC 2 Type 2 and ISAE 3402 Type 2: controls over a period; ISO/IEC 27001: the management system, by sampling	Whatever controls you choose, including ones specific to your service
Cost to you	Review time only	Audit team, travel, follow-up, often a share of supplier costs
Cost to the supplier	Paid once, shared across all customers	Disruption per customer, which is why suppliers cap or resist it
Timeliness	Looks backwards; may be months old when you read it	Current at the time of the audit
Independence	Independent of you, chosen and paid by the supplier	Your own staff or an auditor you appoint
Use after an incident	Rarely answers incident-specific questions	The main tool for for-cause investigation, if the clause allows short notice
Typical weakness	Scope carve-outs and reliance on your own controls	Unenforceable wording, no budget, never exercised

What assurance reports omit

The report is only as useful as the overlap between its scope and your risk. Before accepting one, check each of the following, and record the result in the supplier file.

Service scope: a SOC 2 report covers a named system; an ISO/IEC 27001 certificate covers the scope written on it. A supplier can hold a valid certificate for its head office or one product line while the service you buy sits outside it. Ask for the scope statement and, for ISO/IEC 27001, the Statement of Applicability, and match both to the service, locations and data in your contract.
Carved-out subservice organisations: under the carve-out method, the hosting provider, payment processor or support outsourcer is excluded and the auditor does not test its controls. The report lists complementary subservice organisation controls (CSOCs) that the supplier expects those parties to operate, but these are disclosures, not tested assertions. You need the subservice organisation's own report, checked against the CSOCs, or other evidence. The inclusive method, where the subservice organisation is tested, is less common because it requires that organisation's cooperation.
Complementary user entity controls (CUECs): the report assumes you do certain things, such as reviewing user access or protecting API keys. If you do not, the supplier's controls may not achieve their criteria for you. Map each CUEC to an owner on your side.
Period and staleness: a Type 1 report describes design at one date; a Type 2 report tests operation over a period that ended before you received it. Bridge letters are management statements, not tested assurance. An ISO/IEC 27001 certificate runs a multi-year cycle with periodic surveillance audits, and it does not tell you which controls failed testing.
Exceptions and qualified opinions: a report can describe test exceptions in exactly the controls you depend on. A report with exceptions is still a report; it is not clean assurance.
Your specific requirements: contractual security clauses, data location, deletion on exit, incident notification times and penetration testing of your tenant are rarely within a standard report's scope.
Quality of the engagement itself: the AICPA has published a notice that it is looking into allegations about one compliance vendor's SOC practices and advises service organisations and CPA firms to evaluate SOC services thoroughly. Check who signed the report, whether the firm is a licensed CPA firm, and whether the testing described is real testing rather than templated text.

For the line-by-line method for a SOC 2 report, see the How to Read a SOC 2 Report Guide; for how subcontractor chains extend this problem, see the Fourth-Party and Nth-Party Risk Guide.

What regulators expect before you rely on reports

Outside regulated sectors, the choice is commercial. The NCSC's supply chain principle 10 recommends a right to audit in all contracts and using it, flowed down to suppliers' own subcontracts, while noting that this may not always be possible or desirable, particularly for cloud services. In EU and UK financial services the position is firmer.

Source	Audit right	Reliance on certificates and reports	Pooled audits and alternatives
DORA, Regulation (EU) 2022/2554 (applies from 17 January 2025)	Article 30(3)(e): contracts supporting critical or important functions include unrestricted rights of access, inspection and audit by the financial entity or an appointed third party; Article 28(6): frequency and areas of audit pre-determined on a risk basis, following commonly accepted audit standards	Alternative assurance levels may be agreed if other clients' rights are affected (Article 30(3)(e))	Recital 43 lets microenterprises delegate audit rights to an independent third party appointed by the provider, while keeping the right to request information and assurance
EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02)	Paragraph 87: full access and unrestricted rights of inspection and audit for critical or important functions; paragraph 88: risk-based for other functions; paragraph 89: the contract must not impede or limit these rights	Paragraph 92: assess adequacy and do not rely solely on reports over time; paragraph 93 sets conditions, including scope covering key systems and controls, reports not obsolete, auditor aptitude and rotation, testing of operational effectiveness, a contractual right to request scope expansion and retaining the right to perform individual audits	Paragraph 91(a): pooled audits with other clients; paragraph 96: avoid or mitigate risks to other clients in multi-client environments
PRA SS2/21 (version effective 31 December 2024)	Paragraph 8.10: for material outsourcing, retain rights to request additional information and to conduct onsite audits, individual or pooled	Paragraph 8.9: do not assume the mere existence of certificates and reports is sufficient evidence; Table 8 conditions on scope, content, expertise and process	Paragraph 8.12: where alternatives replace onsite audits, retain the underlying right and inform the supervisor for material arrangements; paragraphs 8.13 and 8.14 on pooled audits and assessing shared findings individually

Two points matter in practice. First, the EBA's feedback on its own guidelines states that where audit rights cannot be ensured for critical or important functions, those functions cannot be outsourced; a supplier refusing the right is therefore a sourcing decision, not a negotiation point to concede. Second, DORA recital 28 acknowledges that financial entities often struggle to enforce access and audit rights even when they are in the contract, which is why DORA sets minimum contract content. The PRA has also published a future version of SS2/21, effective 18 March 2027; check the current text before relying on paragraph numbers. Contract wording for DORA is covered in the DORA Article 30 Contract Provisions Guide, and UK resilience expectations in the UK Financial Operational Resilience Guide.

Deciding by supplier tier

Tie the evidence model to the tier your third-party programme already assigns. The table below is a starting point; adjust it to your own tiering criteria and regulatory obligations.

Tier	Typical supplier	Report expectation	Audit right	When to exercise it
1: critical	Supports a critical or important function, holds privileged access into your environment, or processes large volumes of sensitive data	Current Type 2 report or certificate, reviewed against your scope each year, with subservice reports for carved-out parties	Mandatory, executable, flowed down to material subcontractors, with a for-cause route	Risk-based cycle set in advance, plus on any trigger below
2: high	Sensitive data or important but substitutable service	Current report or certificate covering the service; questionnaire to cover gaps	Included; remote audit as the default form	On trigger, or when report gaps cannot be closed by questions
3: moderate	Limited data, limited access	Certificate or report if available; questionnaire otherwise	Standard clause, for-cause only	After an incident affecting you
4: low	No data, no access, easily replaced	None beyond baseline due diligence	Optional	Rarely

Triggers for exercising the right: a report shows exceptions in controls you rely on; the service sits outside the report or certificate scope; a material subcontractor is carved out and has no report of its own; the supplier suffered an incident affecting you or its customers; a material change such as an acquisition, new hosting region or new subcontractor; questionnaire answers conflict with your own telemetry; or a regulator asks. Questionnaire practice is covered in the Security Questionnaires Guide, and how outside-in ratings fit alongside these evidence types in Security Ratings vs Vendor Assessments.

Threat model and failure modes for each approach

Relying on reports

The threat is a gap between what was examined and what can hurt you. A support outsourcer with access to your tenant may be carved out; an identity provider's report may test its own staff access but say nothing about how your API tokens are stored in its support tooling. The architecture of reliance is a chain: your control depends on the supplier's control, which depends on CSOCs at a subservice organisation, which you have only seen described.

Accepting the report unread: the file contains a PDF, nobody mapped scope, exceptions or CUECs, and the risk rating says "assured".
Stale evidence: the period ended many months ago, a bridge letter covers the rest, and the service changed in between.
Certificate as proof of control operation: an ISO/IEC 27001 certificate confirms a management system was audited; it does not report whether a specific control worked during your period of concern.
Ignored CUECs: the supplier's access controls assume you review user lists quarterly; nobody does.

Relying on audit rights

The threat is a right that exists only on paper. The architecture is contractual: notice periods, caps, scope wording and cost allocation decide whether you can actually look.

Unenforceable clauses: "reasonable audit on reasonable notice" with no scope, no access to subcontractors and no evidence format invites renegotiation at the moment you need it.
Caps that consume the right: one audit per year with no carve-out for for-cause audits leaves nothing after an incident.
Pooled audits that miss your risk: a common scope agreed by several customers may not cover your specific integration, and findings shared with the pool still need your own assessment.
Never exercised: the right exists, no budget or team exists, and the supplier knows it.
Multi-tenant refusal: large cloud providers restrict individual onsite access to protect other customers; without a negotiated alternative the right is theoretical.

Negotiation fallbacks when a supplier resists

Suppliers resist audits because each customer audit costs them time and may expose other customers. Offer alternatives that preserve your assurance rather than conceding the right. Ordered from strongest to weakest:

Keep the right, agree the default form: retain an unrestricted audit right but agree that routine assurance will normally be delivered by report plus a remote evidence session. This mirrors the regulators' position of keeping the underlying right while agreeing alternatives.
Scope extension requests: a contractual right to ask the supplier to add specific controls or systems to the next report period, which the EBA lists as a condition for reliance.
Pooled audit participation: join or organise a pooled audit with other customers, agree the scope jointly and keep your own analysis of shared findings.
Appointed independent auditor: allow audits by an independent firm bound by confidentiality, so the supplier is not exposing information directly to a customer.
For-cause only: accept no routine audits but keep a short-notice right after an incident, a regulator request or a material report exception.
Evidence packs and penetration test summaries: agree a list of artefacts delivered each year, such as test summaries, access review evidence and subservice reports.

Record any concession as a risk decision with an owner, using the process in the Security Exceptions and Risk Acceptance Guide. Clause wording to start from is in the Third-Party Security Contract Clauses Template.

Worked scenario

A mid-sized insurer in the EU outsources claims handling to a managed service provider that runs on a public cloud platform and uses an offshore support subcontractor. The provider offers a SOC 2 Type 2 report and an ISO/IEC 27001 certificate, and asks to remove the audit clause from the renewal.

Tier: the insurer has assessed claims handling as supporting a critical or important function under DORA, so it is tier 1 and Article 30(3)(e) applies.
Report review: the report carves out both the cloud platform and the support subcontractor. The cloud platform publishes its own reports, which cover the CSOCs listed. The support subcontractor has no report, and its staff have remote access to production data.
Certificate check: the ISO/IEC 27001 scope names the provider's head office and development function, not the claims operations centre.
Decision: the audit right stays; removal is refused because the function is important and the gap is real. The parties agree that routine assurance will be by report plus an annual remote evidence session, that the next report period will include the support subcontractor's access controls, and that the insurer keeps a short-notice for-cause audit right that does not count against any annual cap.
Follow-up: the insurer maps the CUECs to internal owners and logs the support subcontractor gap as a time-bound risk acceptance until the next report covers it.

Where identity fits

Supplier access to your environment is the area reports most often miss. Service accounts, API keys, OAuth grants and support staff access held by suppliers sit at the boundary between the supplier's controls and your CUECs. Whatever the evidence model, list each supplier's non-human and human access into your systems, confirm that the report or audit covers how those credentials are issued, stored and revoked, and make credential revocation on exit an auditable obligation. See the Third-Party Risk Management Guide for the wider programme.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.SC-05, GV.SC-06, GV.SC-07	Requirements in contracts, due diligence before engagement, supplier risk assessed and monitored over the relationship
NIST SP 800-53 Rev. 5	SA-9 External System Services; SR-6 Supplier Assessments and Reviews; SA-4 Acquisition Process	Requiring and assessing provider controls, including through contract
ISO/IEC 27001:2022 Annex A	5.19 to 5.22 (supplier relationships, agreements, ICT supply chain, monitoring and review of supplier services)	Supplier security requirements in agreements and their ongoing review
CIS Controls v8.1	Control 15 Service Provider Management (15.4, 15.5, 15.6)	Contract security requirements, assessing and monitoring providers
DORA	Articles 28(6), 30(3)(e)	Risk-based audit planning, audit rights for critical or important functions

Implementing the model: a phased approach

Inventory: list tier 1 and tier 2 suppliers, what evidence you hold for each, its date and whether the contract holds an audit right.
Gap review: for each report, record scope match, carve-outs, CUECs, exceptions and period; for each contract, test the clause against the elements in the Supplier Security Audit Guide.
Policy: set the tier table, the triggers and who may accept a weaker evidence model, and publish it to procurement and legal.
Contract refresh: fix clauses at renewal, prioritising tier 1; agree fallbacks rather than deleting rights.
Pilot exercise: run one remote audit on a tier 1 supplier with a known report gap to prove the clause works and to size the effort.
Steady state: annual report review for tier 1 and 2, risk-based audit cycle, for-cause audits on triggers. If a supplier relationship deteriorates during an audit, fall back to the agreed evidence pack rather than abandoning assurance.

Measuring it

Report coverage: percentage of tier 1 and 2 suppliers with a current report or certificate whose scope matches the contracted service.
Review depth: percentage of reports with a documented review of carve-outs, CUECs and exceptions.
Executable rights: percentage of tier 1 contracts with an audit clause meeting your clause standard, including subcontractor flow-down and a for-cause route.
Gap closure: median days from identifying a report gap to closing it by scope extension, audit or accepted risk.
Exercise rate: audits performed against those planned, and for-cause audits triggered.

Practitioner checklist

Match every report and certificate scope to the contracted service, locations and data.
Obtain subservice reports for every carved-out party that matters, and check them against the CSOCs.
Assign an internal owner to every CUEC and test that they are performed.
Check report dates and treat bridge letters as statements, not assurance.
Keep an executable audit right for every tier 1 supplier, flowed down to material subcontractors.
Exclude for-cause audits from any annual audit cap.
Negotiate scope extension rights and pooled audit participation as fallbacks.
Record every weakened evidence model as a time-bound risk acceptance with a named owner.
For EU and UK financial services, confirm the arrangement meets DORA, EBA and PRA expectations and notify the supervisor where required.

Right to Audit vs Assurance Reports: When to Rely on Reports and When to Audit