Art. 8 Audit opinion, audit conclusions and recommendations | Performance of independent audits | DSA

This is a substantive article that defines how the auditing organisation must structure and express its findings in the audit report.

It establishes a clear taxonomy of outcomes — positive, positive with comments, or negative — that applies at two levels: first at the granular level of individual obligations and commitments, and then rolled up into an overall audit opinion.

It also sets out how operational recommendations must be framed when conclusions fall short of fully positive, and provides a fallback rule for situations where the auditing organisation cannot reach a reasonable level of assurance at all.

The article connects closely to Article 37 of Regulation (EU) 2022/2065, which is the parent provision requiring independent audits of very large online platforms and search engines.

Important points:

The auditing organisation must express each audit conclusion as positive, positive with comments, or negative — and the overall audit opinion is directly determined by the worst-performing individual conclusion.
Where conclusions are positive with comments or negative, any operational recommendations included must be specific to each relevant obligation or commitment and explain their impact relative to the materiality threshold.
Where a reasonable level of assurance cannot be achieved, the audit report must include a documented explanation of the circumstances and reasons.

1. The audit report shall include the audit conclusions that the auditing organisation has reached on the audited provider’s compliance with each of the audited obligations and commitments. The audit conclusions shall be either:
  1. ‘positive’, where the auditing organisation concludes with a reasonable level of assurance that the audited provider has complied with an audited obligation or commitment;
  2. ‘positive with comments’, where the auditing organisation concludes with a reasonable level of assurance that the audited provider has complied with an audited obligation or commitment, but:
    the auditing organisation includes remarks on the benchmarks provided by the audited provider pursuant to Article 5(1), point (a); or
    the auditing organisation recommends improvements that do not have a substantive effect on its conclusion;
  3. ‘negative’, where the auditing organisation concludes with a reasonable level of assurance that the audited provider has not complied with an audited obligation or commitment.
1. Where an audit report includes operational recommendations pursuant to Article 37(4), point (h) of Regulation (EU) 2022/2065, those recommendations and their recommended timeframe shall be specific to each audited obligation or commitment for which the audit conclusion pursuant to paragraph 1 is ‘positive with comments’ or ‘negative’.
1. Where the operational recommendations referred to in paragraph 2 include specific measures to achieve compliance, they shall be formulated in a way that explains the auditing organisation’s assessment of how such measures would affect the materiality threshold by comparison with the audit conclusion for the respective audited obligation or commitment.
1. On the basis of the audit conclusions, the audit report shall include an audit opinion on the audited provider’s compliance with all audited obligations referred to in Article 37(1), point (a), of Regulation (EU) 2022/2065.
1. On the basis of the conclusions of all audited commitments, the audit report shall include an audit opinion or opinions, as applicable, on the audited provider’s compliance with all audited commitments made by the audited provider under each code of conduct and crisis protocol referred to in Article 37(1), point (b), of Regulation (EU) 2022/2065.
1. Audit opinions pursuant to paragraphs 4 and 5 shall be either:
  1. ‘positive’ if the auditing organisation has reached a ‘positive’ audit conclusion for all of the audited obligations or commitments;
  2. ‘positive with comments’ if the auditing organisation has reached at least one audit conclusion that is ‘positive with comments’ for an audited obligation or commitment and has not reached a ‘negative’ audit conclusion for any of the audited obligations or commitments;
  3. ‘negative’ if the auditing organisation reached a ‘negative’ audit conclusion for at least one audited obligation or commitment.
1. Where the auditing organisation assesses that, for a limited period during the period referred to in Article 3(2), the provider has not complied with an audited obligation or commitment, the audit report shall duly document that assessment.
1. Where the auditing organisation cannot issue with a reasonable level of assurance an audit conclusion pursuant to paragraph 1 or an audit opinion pursuant to paragraphs 4 and 5, the audit report shall include an explanation of the circumstances and the reasons why such a level of assurance could not be achieved.