Most organisations have a right to audit clause in their supplier contracts and have never used it, so the clause gives comfort without giving assurance. Questionnaires and certificates tell you what a supplier says it does; an audit tests whether the controls that protect your data and your service actually operate. This guide covers when to audit rather than rely on a report, how to make the contract clause usable, how to scope, plan and run remote and onsite assessments, how to sample evidence and grade findings, and how to follow up. It is written for third-party risk, internal audit and security assurance teams who already run questionnaires and now need to execute audits. The questionnaire itself is covered in the Vendor Security Assessment Template and is not repeated here.
Key takeaways
- Audit by exception, not by default. Reserve audits for critical suppliers, material changes, incidents and assurance gaps that certificates and reports do not close.
- A clause you cannot execute is not a right. The contract must name scope, notice, who may audit, access to subcontractors, evidence formats, cost and remediation duties.
- Remote first, onsite when it matters. Remote evidence review and screen-share walkthroughs cover most control testing; onsite visits add value for physical, operational and help desk controls.
- Test operation, not existence. Sample real tickets, access lists and logs over a period, and re-perform the control where you can, instead of reading policies.
- Findings need owners and dates. Grade each finding, agree a remediation plan in writing and verify closure with evidence, or the audit changes nothing.
When an audit is the right tool
An audit is the most expensive form of supplier assurance for both sides, so decide deliberately. Regulators in financial services expect a risk-based approach: DORA Article 28(6) requires financial entities to pre-determine the frequency of audits and inspections, and the areas to be audited, on a risk basis, and the PRA's SS2/21 (paragraph 8.8) lets firms choose any audit method that meets their obligations, with the expected level of assurance rising with materiality. Outside regulated sectors, the NCSC's supply chain principle 10, "Build assurance activities into your supply chain management", says to include a right to audit in contracts and to use it.
| Assurance option | What it tells you | Use it when | Limits |
|---|---|---|---|
| Security questionnaire | What the supplier states about its controls | Onboarding and annual refresh for most suppliers | Self-reported, no testing |
| Certificate (ISO/IEC 27001, Cyber Essentials Plus) | A management system or baseline was assessed by a third party | Scope and statement of applicability cover your service | Scope can exclude your service; certificates do not report control failures |
| Independent assurance report (SOC 2 Type 2, ISAE 3402) | Controls tested over a period by an independent auditor | Report is current, scoped to your service and covers your concerns | Carve-outs, exceptions and complementary user entity controls shift work back to you |
| Targeted remote audit | Your own test of specific controls with live evidence | A report leaves a gap, a finding needs verification, or risk is high | Depends on supplier cooperation and screen-share access |
| Onsite audit | Direct observation of facilities, operations and staff practice | Critical supplier, physical or operational risk, serious incident, regulator expectation | Cost, travel, disruption; multi-tenant sites restrict access |
| Pooled audit | Shared audit by several customers of the same provider | Large multi-tenant providers that limit individual audits | Common scope may not match your specific risks |
Triggers that justify an audit: the supplier supports a critical or important function; it holds privileged or standing access into your environment; a report shows exceptions in controls you depend on; the supplier suffered an incident affecting you or its other customers; there is a material change such as an acquisition, new hosting location or new subcontractor; or the questionnaire answers conflict with what your own telemetry shows. For reading assurance reports first, see the How to Read a SOC 2 Report Guide.
Making the right to audit clause usable
Many clauses say only that the customer "may audit the supplier on reasonable notice". That wording invites a negotiation every time you try to use it. Draft the clause so that it can be executed without renegotiation. DORA Article 30(3)(e) sets the bar for contracts supporting critical or important functions in EU financial services: unrestricted rights of access, inspection and audit by the financial entity or an appointed third party, with the right to agree alternative assurance levels if other clients' rights are affected. The detailed DORA contract terms are covered in the DORA Article 30 Contract Provisions Guide.
| Clause element | What to specify | Why it matters at audit time |
|---|---|---|
| Who may audit | Your staff, internal audit, an appointed independent auditor and your regulator | Avoids disputes over sending an external firm |
| Scope | Premises, systems, data, personnel, policies, logs and records relevant to the service, including security test results | PRA SS2/21 paragraph 8.4 lists data, systems, networks, policies and controls, and the results of penetration testing on the provider's applications, data and systems |
| Notice | Standard notice period (for example 30 days), and a shorter or no-notice route after an incident or regulator request | SS2/21 paragraph 8.11 expects reasonable notice except in emergencies or where notice would defeat the purpose |
| Frequency | Routine audits per year or contract term, plus for-cause audits that do not count against the limit | Suppliers often cap audits; for-cause audits must sit outside that cap |
| Subcontractors | Flow-down of equivalent audit rights to material subcontractors, or supplier-led audits of them with results shared | NCSC guidance asks suppliers to apply the same rights in their own contracts |
| Evidence and confidentiality | Formats accepted (screen share, redacted exports), retention, NDA terms and treatment of other customers' data | Multi-tenant providers will refuse access that exposes other clients |
| Alternatives | Pooled audits and acceptance criteria for third-party reports, without giving up the underlying right | SS2/21 paragraph 8.12 says to keep the underlying onsite right when agreeing alternatives |
| Cost and cooperation | Who pays, cooperation duties, named contacts, response times for evidence requests | Prevents slow evidence delivery from stalling the audit |
| Remediation | Duty to remediate findings within agreed timeframes, re-test rights and escalation to termination rights | Turns findings into obligations |
Keep the clause consistent with your Supplier Security Policy Template so that procurement does not accept weaker wording for individual deals. For large cloud providers that will not accept bespoke audit terms, record the residual risk, rely on their published assurance programme and pooled audit routes, and document why that is adequate for the service.
Scoping and planning the audit
A good scope is narrow and tied to the risks of your service, not a rerun of the supplier's ISO certification audit. Start from the reason for the audit and the controls that matter most for your data and access paths.
- State the objective: for example, "confirm that access to our production tenant by supplier staff is approved, least privilege, logged and removed on leaving".
- Collect what you already have: questionnaire answers, certificates and statements of applicability, assurance reports and their exceptions, incident history, your own logs of supplier access.
- Select control areas: pick five to eight areas from the table below, weighted to the risk. Map each to your contract obligations and to a framework reference so findings are traceable.
- Define the period and sample: choose a test period (commonly the last 6 to 12 months) and sample sizes per control before fieldwork, so the supplier cannot pre-select evidence.
- Issue the audit notice and evidence request: scope, dates, auditors and their qualifications, evidence list, and a fieldwork agenda. SS2/21 paragraph 8.11 expects the notice to state location, purpose and personnel.
- Agree logistics: remote session tooling, data handling for evidence, onsite access and escort rules, and the people you need to interview.
| Control area | Evidence to request | Test to perform |
|---|---|---|
| Access to your data and tenant | List of supplier staff and service accounts with access; joiner, mover, leaver tickets | Reconcile list to HR leavers; check approvals for a sample; confirm no shared accounts |
| Privileged and remote access | PAM configuration, session recordings, MFA policy, jump host rules | Watch a live session start; sample recordings; confirm MFA is phishing-resistant for admins |
| Help desk and identity verification | Reset procedure, verification scripts, reset logs | Sample reset tickets for verification evidence; observe or role-play a reset request with consent |
| Secrets and machine credentials | Inventory of API keys, tokens and service accounts touching your service; rotation records | Sample credentials for owner, age and last rotation; check storage in a vault |
| Vulnerability and patch management | Scan reports, remediation SLAs, penetration test reports for your service | Trace critical findings to closure dates against SLA |
| Logging and detection | Log sources, retention settings, alert rules relevant to your data | Ask for a log extract for a known event; confirm retention matches contract |
| Incident response and notification | IR plan, last exercise report, incident register | Check notification timelines against your contract for a sample incident |
| Backup, resilience and exit | Backup schedules, restore test results, exit plan | Review the latest restore test for your data; confirm export format |
| Subcontractor management | Subprocessor list, their assurance evidence, flow-down terms | Sample material subcontractors for current assurance |
Remote and onsite assessments
Most control testing can be done remotely. Onsite visits are worth the cost where the risk lies in what people do and in physical or operational controls. Decide per control area, not per audit.
| Factor | Remote assessment | Onsite assessment |
|---|---|---|
| Best for | Access reviews, configuration, logs, tickets, policies, vulnerability data | Physical security, data centre and office controls, operations floors, help desk practice, culture |
| Evidence quality | Screen-share walkthroughs and live queries; risk of curated screenshots | Direct observation, unscripted interviews, spot checks |
| Cost and disruption | Low; can be split into short sessions | High; travel, escorts, scheduling across sites |
| Multi-tenant providers | Usually acceptable with redaction | Often restricted; SS2/21 paragraph 8.11 asks firms to avoid creating risk for other clients |
| Typical duration | Two to five sessions over one to three weeks | One to three days per site plus remote preparation |
Running remote fieldwork well:
- Live over static: ask the supplier to run queries and open consoles while you watch, rather than send screenshots. Note the system time and filter used so the result is reproducible.
- Sample on the call: pick ticket numbers, user names or dates from the population in the session, not from a list the supplier prepared.
- Protect the evidence: agree what you may retain, store it in a restricted audit repository and delete it on the agreed date.
- Secure the channel: use your approved meeting platform with authenticated participants; never accept credentials to the supplier's systems for yourself.
Running onsite fieldwork well:
- Plan the walk: entrances, visitor process, secure areas, operations rooms and media disposal points, with time to observe shift handovers.
- Interview the doers: help desk analysts, administrators and on-call engineers, not only the account manager and security lead.
- Observe a live control: a badge-controlled entry, a privileged session start, a password reset verification or a leaver being processed.
- Close the day: hold a short daily debrief so the supplier can supply missing evidence before findings are drafted.
Testing, sampling and evidence standards
The difference between an audit and a long questionnaire is testing. For each control, choose the strongest test the supplier will support.
- Inquiry: ask how it works. Weakest on its own; always pair with another test.
- Inspection: examine a document, configuration or record. Confirms design and some operation.
- Observation: watch the control being performed. Strong for manual controls such as verification calls.
- Re-performance: repeat the control yourself with the supplier's data, for example reconcile the access list against a leavers report. Strongest evidence of operation.
Sampling: fix the population, period and sample size before fieldwork. Common practice is a larger sample for frequent manual controls (for example 25 tickets from a period with hundreds) and one or two instances for annual controls such as a restore test or a penetration test. Record any exception exactly: which item, what was expected, what was found.
Use what the reports already tested: where a current assurance report covers a control without exceptions, do not retest it; focus on the gaps, the carve-outs and the complementary controls you must operate. SS2/21 paragraphs 8.9 and 8.10 say firms should not assume a report proves the service meets their obligations, and should check that it covers key systems and controls, is up to date, is produced by competent parties and tests control effectiveness against recognised standards.
Supplier identities deserve their own test. Supplier staff accounts, contractor accounts and the API keys and service accounts a supplier uses against your tenant are frequently the path attackers take. In the Marks and Spencer cyberattack, attackers impersonated a third-party user, which makes the outsourced help desk's verification practice a control worth observing directly. See the Vendor Privileged Access Management (VPAM) Guide for the access model to audit against.
Grading findings and following up
| Rating | Meaning | Expected remediation |
|---|---|---|
| Critical | Control absent or failing with direct exposure of your data or access paths | Immediate containment; plan within 5 working days; escalate to relationship owner and risk committee |
| High | Control failing in a way that materially raises likelihood or impact | Remediation plan within 30 days; closure verified by evidence |
| Medium | Control operating with exceptions or partially designed | Plan within 60 days; verify at next review |
| Low | Documentation or improvement point | Track to closure at the supplier's discretion within the contract term |
These timeframes are a starting point; align them with your own risk appetite and the remediation clause in the contract.
- Draft findings: condition, criteria (contract clause or standard), cause, effect and recommendation, with evidence references.
- Factual accuracy review: share the draft with the supplier for factual corrections, not for negotiating ratings.
- Agree the action plan: named owner, action and target date per finding, signed by the supplier.
- Record the risk decision: accept, remediate, add compensating controls on your side, or exit. Update the supplier's risk rating in your register.
- Verify closure: require evidence for every high and critical finding and re-test where feasible; do not close on assertion.
- Feed the programme: recurring findings across suppliers become questionnaire questions, contract terms or onboarding requirements.
Where several customers audit the same provider, pooled audits share the cost; SS2/21 paragraphs 8.13 and 8.14 note they can be more cost-effective and less disruptive, and that each firm should still assess what common findings mean for it.
Small and large organisations
- Small organisations: you will rarely win bespoke audit terms with large providers. Concentrate on the two or three suppliers that hold your data or admin access, run short remote audits on access, help desk and backup controls, and rely on certificates and reports for the rest.
- Mid-sized organisations: build an annual audit plan from supplier tiering, use a standard evidence request per control area, and keep a findings tracker shared with procurement.
- Large and regulated organisations: run a formal audit programme with qualified auditors, for-cause audit triggers, pooled audit participation for hyperscale providers and regulator reporting where alternatives to onsite audits are agreed. DORA has applied since 17 January 2025 to EU financial entities; see the DORA ICT Third-Party Risk and Register of Information Guide.
Measuring the audit programme
- Coverage: percentage of critical suppliers audited (or covered by an accepted independent report with no unresolved gaps) within the planned cycle.
- Timeliness of evidence: median days from evidence request to complete evidence received.
- Finding closure: percentage of high and critical findings closed with verified evidence by the agreed date.
- Repeat findings: number of findings recurring at the same supplier across two audits.
- Clause readiness: percentage of critical supplier contracts with an executable audit clause covering scope, notice, subcontractors and remediation.
Report these alongside the wider programme measures in the Third-Party Risk Metrics.
Framework mapping
| Framework | Reference | Relevance to supplier audits |
|---|---|---|
| NIST CSF 2.0 | GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07 | Supplier criticality, contract requirements, due diligence, and assessing and monitoring supplier risk over the relationship |
| NIST SP 800-53 Rev. 5 | SR-6, SR-6(1), SA-9, CA-2 | Supplier assessments and reviews (by the organisation or an independent third party), testing and analysis, external system services with ongoing compliance monitoring, control assessments |
| ISO/IEC 27001:2022 Annex A | A.5.19, A.5.20, A.5.21, A.5.22 | Supplier relationships, security in supplier agreements, ICT supply chain, monitoring, review and change management of supplier services |
| CIS Controls v8.1 | Safeguards 15.5, 15.6 | Assess service providers; monitor service providers |
| DORA | Articles 28(6), 30(3)(e) | Risk-based audit frequency and areas; unrestricted access, inspection and audit rights for critical or important functions |
| NCSC supply chain principles | Principle 10 | Build assurance activities, including audit rights, into supply chain management |
For the ISO supplier relationship standard behind these controls, see the ISO/IEC 27036 Supplier Relationships Guide.
Common failure patterns
- Clause without mechanics: a one-line right to audit with no scope, notice or subcontractor flow-down, which the supplier then narrows to a document review.
- Auditing the certificate scope, not your service: fieldwork covers the supplier's head office ISMS while your data sits with a subcontractor or in a region outside the certificate scope.
- Accepting curated evidence: screenshots and pre-selected samples instead of live queries and auditor-chosen samples.
- Ignoring complementary controls: the supplier's report assumes you review its staff access to your tenant, and nobody on your side does.
- Skipping the people controls: technical controls pass while the outsourced help desk resets credentials on a phone call, the path seen in third-party impersonation incidents.
- Findings that never close: no signed action plan, no verification and no link to renewal or termination decisions.
Practitioner checklist
- Tier suppliers and define which tiers and triggers lead to a remote or onsite audit.
- Review every critical supplier contract for an executable audit clause, including subcontractor flow-down and remediation duties.
- Read current assurance reports first and scope audits to the gaps, carve-outs and complementary controls.
- Write a one-sentence objective and select five to eight control areas per audit.
- Fix population, period and sample sizes before fieldwork and select samples live.
- Test supplier staff access, service accounts and API keys against your tenant, and the help desk verification process.
- Grade findings consistently and get a signed action plan with owners and dates.
- Verify closure of high and critical findings with evidence and update the supplier risk rating.
- Join pooled audits for large multi-tenant providers while keeping your underlying audit right.
- Report coverage, closure and repeat-finding metrics to the risk committee.
Standards and references
- EUR-Lex: Regulation (EU) 2022/2554 (Digital Operational Resilience Act)
- Bank of England PRA: SS2/21 Outsourcing and third party risk management
- NCSC: Supply chain security, check your arrangements
- NIST: SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- CIS: Control 15 Service Provider Management
Related NHI Mgmt Group resources: Third-Party Risk Management Guide · Vendor Security Assessment Template · Audit, Assurance and Compliance Guide · How to Read a SOC 2 Report Guide · SaaS Vendor Security Review Checklist