Art. 7 Procedures for the preparations for the audit | Performance of independent audits | DSA

This article establishes the formal contractual foundation for the audit relationship between the audited provider and the auditing organisation.

Before any audit work begins, both parties must enter into a written agreement that governs the scope, responsibilities, logistics and dispute resolution of the audit.

The article also connects directly to the audit report itself, as required under Article 6, by mandating that this agreement — and any other related agreements or engagement letters — be annexed to it, ensuring full transparency of the audit's governing terms.

Important points:

Audited providers and auditing organisations must conclude a written agreement before the audit covering scope, responsibilities, data access procedures, timeframes, and a dispute resolution procedure.
All agreements and engagement letters between both parties related to the audit must be annexed to the final audit report.
Any changes made to the written agreement during the audit must be explicitly disclosed in the audit report.

1. The audited provider and the auditing organisation shall conclude a written agreement setting out:
  1. the exhaustive list of audited obligations and commitments;
  2. the responsibilities of the audit organisation, including, where applicable, detailed for each legal person constituting the auditing organisation, and the parties empowered to sign the audit report;
  3. the procedures and contact points made available by the audited provider for the auditing organisation to request access to data referred to in Article 5(2);
  4. the timeframe for the audit, including the start and end date of the audit procedures and the completion of the audit report;
  5. a procedure on how disputes between the audited provider and the auditing organisation arising from the performance of the audit shall be resolved.
1. The agreement referred to in paragraph 1, as well as any other agreements or engagements letters between the auditing organisation and the audited provider related to the performance of the audit, shall be annexed to the audit report.
1. Where changes are made to the agreement referred to in paragraph 1 during the performance of the audit, they shall be made explicit in the audit report.