If…, then how…
If a supplier refuses our audit clause, then do we sign anyway?
Add to board memoOpen the memo
The short answer
- Recommendation
- Often yes, on a fallback, and never quietly. Where a regulator's audit and access rights are required, do not sign without them. Otherwise accept equivalent wording or a fallback backed by current independent assurance, and approve what you gave up as an exception before signature.
- Reasoning
- The audit clause lets you, your auditors and, where they apply, your regulators check that the controls exist instead of relying on the supplier's word. The library puts it in every Tier 1 and Tier 2 contract and wherever the supplier processes personal data for you. Large providers often refuse on-site audits, so the pack's fallback is a document-based audit with the right to go on site only after an incident or a material finding. For DORA critical or important functions, the competent authority's rights cannot be negotiated away.
- Considerations
- A current certification or independent report with the right scope is a fair substitute for an on-site audit, except after an incident and for a regulator.
- An internal exception cannot waive the law (EX-02). A missing legal requirement is a compliance issue for legal advice and your escalation process.
- Agreement by email, in a meeting or by a manager is not an exception. Where the gap leaves the supplier outside appetite or scored Critical, the risk approver also signs, and the stricter approver applies.
- Approvers and maximum durations are the pack's defaults. A Critical exception goes to the board, a board risk committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.
Start
The supplier refuses our right-to-audit clause
The audit clause lets you, your auditors and your regulators check that the supplier's controls exist, instead of relying on its word. Large providers often refuse on-site audits because they serve thousands of customers. The refusal is a negotiating position. Your answer depends on the tier, the data and whether a regulator's rights are at stake.
In the pack
- P06-A07 Supplier Contract Security Clause LibraryCL-03 Right to audit and access
Decision
Does the tier or the data require the audit clause?
The pack's library puts the clause in every Tier 1 and Tier 2 contract, and wherever the supplier processes personal data for you or holds customer, sensitive or mass personal data. For Tier 3 it applies only where a finding needs checking on site. If the supplier has no tier yet, answer not known and tier it before you sign.
- No: Sign: the clause is not required for this supplier
- Yes, or not known: Must a regulator have audit and access rights here?
In the pack
- P06-A07 Supplier Contract Security Clause LibraryCL-03 Right to audit and access
- P06-A07 Supplier Contract Security Clause LibraryHow to use this library
- P06-A07 Supplier Contract Security Clause LibraryBy data type
Outcome
Sign: the clause is not required for this supplier
Drop the clause and rely on the evidence the tier asks for. The pack's advice is to negotiate from the tier: a supplier asked for everything because it is in the template will not understand why. Keep the tier's other clauses.
In the pack
- P06-A07 Supplier Contract Security Clause LibraryNegotiating with suppliers
Decision
Must a regulator have audit and access rights here?
For regulated entities, the pack says hold firm on access and audit rights for the competent authority. For services supporting a DORA critical or important function, these rights cannot be negotiated away. If you are unsure whether you are in scope, answer not known and ask your lawyer.
- Yes, or not known: Will the supplier grant the regulator's rights, at least?
- No: Do the supplier's own terms achieve the same outcome?
In the pack
- P06-A07 Supplier Contract Security Clause LibraryCL-03 Right to audit and access
- P06-A07 Supplier Contract Security Clause LibraryDORA Article 30(3): critical or important functions
Decision
Will the supplier grant the regulator's rights, at least?
The pack holds firm on the regulator's rights and allows fallbacks for your own audits. So ask for the regulator's audit and access rights on their own. If the supplier will not confirm them in the contract, answer no.
- No, or not known: Do not sign: a legal duty cannot be waived
- Yes: Do the supplier's own terms achieve the same outcome?
In the pack
- P06-A07 Supplier Contract Security Clause LibraryCL-03 Right to audit and access
Outcome
Do not sign: a legal duty cannot be waived
An internal exception cannot waive the law, so a missing legal requirement is not something the exception route can approve. It is a compliance issue for legal advice and your escalation process. Tell the business owner the contract cannot proceed on these terms, and look for another supplier or a different service model.
In the pack
- P02-A02 Security Exception & Waiver StandardWhen an exception is needed (rule EX-02)
- P06-A07 Supplier Contract Security Clause LibraryCL-03 Right to audit and access
Decision
Do the supplier's own terms achieve the same outcome?
Compare the supplier's wording with what the clause achieves, not word for word. Large cloud and software providers usually offer their own terms. Read them clause by clause and note what they cover. If they do not let anyone check the controls, answer no.
- Yes: Sign with the supplier's equivalent wording
- No, or not known: Will it accept a fallback audit right?
In the pack
- P06-A07 Supplier Contract Security Clause LibraryNegotiating with suppliers
- P06-A07 Supplier Contract Security Clause LibraryHow to use this library
Outcome
Sign with the supplier's equivalent wording
Record in the contract file which of the supplier's terms covers the audit clause, so the next assessor does not have to work it out again. Check it still holds at the next reassessment.
In the pack
- P06-A07 Supplier Contract Security Clause LibraryNegotiating with suppliers
Decision
Will it accept a fallback audit right?
The pack's fallback is a document-based audit, with the right to go on site only after an incident or a material finding. Pooled audits with other customers are a reasonable compromise. If the supplier rejects every form of audit, answer no.
- Yes: Back the fallback with current independent assurance
- No, or not known: Treat the missing clause as a known gap
In the pack
- P06-A07 Supplier Contract Security Clause LibraryCL-03 Right to audit and access
Step
Back the fallback with current independent assurance
A current certification or independent report with the right scope is a fair substitute for an on-site audit, except after an incident and for a regulator. Validate its scope, dates and the company named against the service you buy. Keep the on-site right after an incident in the contract.
In the pack
- P06-A07 Supplier Contract Security Clause LibraryNegotiating with suppliers
- P06-A02 Third-Party Security PolicyAssessment and decision (rule TP-04)
Outcome
Sign with the fallback in the contract
The fallback is in the contract and the evidence is on file. Look at what you gave up again at the next reassessment. A certificate that lapses, or a scope that stops matching the service, reopens the question.
In the pack
- P06-A07 Supplier Contract Security Clause LibraryNegotiating with suppliers (rule TP-09)
Step
Treat the missing clause as a known gap
A clause you give up is a known gap. Record it as an exception, and as a risk too if it leaves the supplier outside appetite. Agreement by email, in a meeting or by a manager is not an exception. Legal raises the request, before signature.
In the pack
- P06-A07 Supplier Contract Security Clause LibraryHow to use this library
- P06-A02 Third-Party Security PolicyExceptions
- P06-A03 Supplier Security Assessment ProcedureEscalation (rule TP-07)
Decision
Does the gap leave the supplier outside appetite?
Score the residual risk the supplier leaves you with the audit right missing, on your risk scale, and compare the band with your appetite for third-party risk. If you have not scored it, answer not known.
- Yes, or not known: Exception and risk entry; the stricter approver signs
- No: Request an exception, approved before you sign
In the pack
- P06-A03 Supplier Security Assessment ProcedureStage 6 — Residual risk
- P05-A02 Risk Assessment Methodology & Scoring ModelThe position rule
Outcome
Request an exception, approved before you sign
Use your exception form: the clause not met, why, the compensating evidence such as a certification, and a remediation plan such as raising it at renewal. The band sets the approver and the maximum duration. Sign once it is approved, and revisit it at the next reassessment.
In the pack
- P02-A02 Security Exception & Waiver StandardRequesting an exception (rule EX-03)
- P02-A02 Security Exception & Waiver StandardApproval authority and maximum duration (rules EX-05, EX-06)
Outcome
Exception and risk entry; the stricter approver signs
Enter the supplier risk in your risk register, and raise the exception as well. The approver the risk method requires for that position also signs the exception. Outside appetite, executive management signs as well as the band's approvers. Outside tolerance, only the board may accept, or a board risk committee it delegates to; the management board in a two-tier structure; executive management where there is no board.
In the pack
- P06-A02 Third-Party Security PolicyExceptions
- P05-A02 Risk Assessment Methodology & Scoring ModelWhat the band decides (rule RM-08)
Practical checklist
- Check the supplier's tier and data type. If it has no tier, stop and tier it before you sign.
- Decide whether a regulator must have audit and access rights here, and ask your lawyer if you are unsure.
- If so, ask for the regulator's rights on their own, and do not sign if the supplier will not confirm them in the contract.
- Read the supplier's own terms against what the clause achieves, clause by clause, and accept wording that achieves the same outcome.
- Otherwise offer the fallback: a document-based audit, with the right to go on site after an incident or a material finding.
- Validate the supplier's certification or independent report: its scope, dates and legal entity must match the service you buy (TP-04).
- Raise an exception for any audit right you give up, approved before signature, and enter a risk where the gap leaves the supplier outside appetite.
- Look at the gap again at the next reassessment (TP-09).
Evidence to have ready
- The supplier's tier and data type, and the clauses they require.
- The contract's audit wording, or a note of which of the supplier's own terms covers it.
- The validated certification or independent report, with its scope, dates and company name checked.
- The approved exception for any audit right given up, with its compensating evidence, remediation plan and expiry date.
- Where the gap leaves the supplier outside appetite, the risk register entry and the risk approver's signature on the exception.
Assumptions
- The supplier has been tiered. If it has not, stop and tier it first.
- Notice periods and approval levels shown are the defaults in the CISO Times supplier and exception packs. Your own standard may set different ones.
- Your lawyer confirms what your regulators require. This flow does not replace that advice.
Not covered here
- Which clauses a contract needs in general. That is “How do we decide which security clauses go into a contract?”.
- Whether a service supports a DORA critical or important function. That is “When is a supplier supporting a "critical or important function" under DORA?”.
- Whether a gap needs an exception or a risk acceptance. That is “Is this a risk acceptance or a security exception?”.
Related questions
- How do we decide which security clauses go into a contract?
- When is a supplier supporting a "critical or important function" under DORA?
- How do we check a supplier's evidence rather than trusting their questionnaire answers?
- When does a deviation from policy need a formal exception?
- Is this a risk acceptance or a security exception?