Art. 17 Auditing compliance with codes of conduct and crisis protocols | Performance of independent audits | DSA

This article deals specifically with auditing compliance against voluntary codes of conduct and crisis protocols under the DSA (Regulation (EU) 2022/2065).

It sits alongside Articles 13–15, which address specific audit obligations, but this article focuses on the voluntary commitments an audited provider has signed up to.

It sets out what information the audited provider must hand over to the auditing organisation to enable that assessment, and then specifies a minimum standard for how compliance with codes of conduct should actually be measured, centring on agreed key performance indicators and data accuracy.

Important points:

Audited providers must make available to the auditing organisation all relevant codes of conduct, crisis protocols, associated commitments, KPIs, measurements, data, documentation, and any external assessments by the Commission or the Board.
Ensure that the assessment of compliance with codes of conduct includes measurement of the agreed key performance indicators, a specified materiality threshold, and verification that reported data is accurate.
This article connects directly to Articles 45, 46, and 48 of Regulation (EU) 2022/2065, meaning it only applies where the audited provider is actually a signatory to such codes or protocols.

1. The audited provider shall make available to the auditing organisation:
  1. a list and the text of all codes of conduct referred to in Articles 45 and 46 of Regulation (EU) 2022/2065 and crisis protocols referred to in Article 48 of that Regulation, to which the audited provider is a signatory;
  2. a detailed list of commitments within those codes of conduct and crisis protocols that the audited provider has taken;
  3. where applicable, the key performance indicators agreed under each code of conduct and crisis protocol;
  4. where applicable, any available measurements, data and documentation, and any reports prepared by the audited provider with respect to the compliance of the audited provider with the commitments taken, including access to all relevant information and data related to the functioning of the services offered by the audited provider relevant to the implementation of the code of conduct or the crisis protocol;
  5. where applicable, other measurements, data and documentation prepared by signatories of the code of conduct or the crisis protocol, and the assessments by the Commission or the Board referred to in Article 45(4) of Regulation (EU) 2022/2065.
1. The assessment of the audited provider’s compliance with codes of conduct referred to in Article 45 of Regulation (EU) 2022/2065 shall include, but not be limited to, the measurement of key performance indicators agreed in the code of conduct pursuant to Article 45(3) of that Regulation, specifying the materiality threshold of the audit conclusions, and whether the reported data is accurate.