Audit rights procedure: documents to prepare
An audit clause in a technology or outsourcing contract only works if the paperwork exists before the clause is invoked. The party invoking the right needs a written notice, a defined scope, and a record of the trigger event. The party subject to audit needs its own copy of the contract, prior correspondence on the same subject, and an internal note confirming which systems or data actually sit inside the stated scope.
Practical consequence of missing documents
A missing notice does not stop an audit outright, but it shifts control of the timeline to the party that received the informal request. Once information is requested without a written trigger, the responding side can treat the exchange as voluntary and set its own pace. A properly documented trigger removes that discretion: it starts a clock both sides are expected to observe, and it fixes the scope against which later disputes are measured.
The point of no return sits at delivery and acknowledgement of the formal notice. Before that moment, either side can still adjust scope by ordinary agreement, and the requesting party can withdraw without consequence. After it, withdrawal or a scope change usually has to go through the same formal channel that started the process, and any later delay is measured against the date on the notice rather than the date informal discussions began.
Keep every version of the notice and every response letter for the life of the contract plus the period the contract sets for bringing a claim. A gap in that file is often the first thing the other side checks if the audit itself is later disputed.
Documents to prepare, by stage
| Stage | Document | Who prepares it |
|---|---|---|
| Before notice | Copy of the contract, audit clause and related definitions highlighted | Requesting party |
| Before notice | Internal note recording the trigger event and its date | Requesting party |
| Notice | Written audit notice: scope, proposed dates, named contact | Requesting party |
| Response | Acknowledgement letter, confirming or disputing scope | Responding party |
| Response | Inventory of systems, data or personnel inside scope | Responding party |
| During audit | Daily access log, signed by both sides | Both parties |
| Closing | Findings summary and agreed follow-up items | Requesting party, countersigned by responding party |
| Post-audit | Remediation timetable, if the findings call for one | Responding party |
Steps to take
- Confirm the trigger event against the exact wording of the clause before drafting anything. The commercial team identifies the event; the legal team checks it against the contract text.
- Draft the written notice with a fixed scope, a proposed date range, and the name of the person who will receive the auditors. Vague scope is the single most common reason an audit stalls in week two.
- Send the notice through the contractual notice channel, not by an informal email or a call. Keep proof of delivery; the date on that proof becomes the reference point for every later deadline.
- Collect a written acknowledgement within the period the contract sets for a response. If the contract sets no period, record in writing what interval is being treated as reasonable, so the position is not argued after the fact.
- Assemble the inventory of systems, data and personnel inside the agreed scope before the audit date itself. The responding party's operations lead, not its legal team, is normally the right person to compile this list.
- Keep a daily access log during the audit, signed by a representative of each side at the end of each working day.
If internal counsel cannot confirm the wording quickly enough before the notice goes out, How to reach a partner in detail sets out the fastest route to a second opinion.
Who decides
Disputes about scope are resolved first by the two parties' contract managers, not by a court or a regulator. Most technology contracts route an unresolved disagreement to a senior escalation contact named in the notices clause, with a fixed number of days to respond before either side may treat the process as stalled. Only if escalation fails does the matter move to whichever forum the contract names for disputes generally, and that forum is usually separate from the audit clause itself.
Where the contract sets no escalation contact at all, the request should go to whoever signed the contract on the responding side, since that person is presumed to hold authority to receive it.
Three scenarios
If the responding party disputes the scope but accepts the right to audit, the two sides usually narrow scope by written agreement rather than argue the clause itself; this is the most common outcome and rarely needs escalation.
If the responding party disputes the right to audit entirely, the requesting party should pause and re-check the trigger event before pressing further. An audit run outside a valid trigger creates exposure of its own, and that exposure is worse than a short delay.
If the responding party simply does not answer, the requesting party moves to the escalation contact named in the notice clause, on the schedule that clause sets, rather than waiting indefinitely for a reply that may not come.
What this page does not cover
This page describes the sequence of documents and decision points common to audit clauses in technology and outsourcing agreements. It does not set out which sector-specific obligations apply to a given business, and it does not calculate a deadline under a particular governing law, since that depends on the contract's own choice-of-law clause and on facts this page cannot see. A file review is the only way to confirm which clock applies to a specific agreement.
Sources and limit
This description sits at the level of contract mechanics shared across technology and outsourcing agreements generally; it does not depend on a single statute, and none is cited on this page.
Where an audit right sits alongside a counterparty check in another jurisdiction, the product layer handles that check directly, for example Counterparty in France and what to prepare.
For a document-level check in a different jurisdiction, the equivalent report is Document in Cyprus explained.
Reviewed: this page reflects the current internal procedural note on audit clauses in technology and outsourcing contracts.
Related publications
A similar document-preparation sequence applies to breach notification under a technology contract; see Incident notification workflow: documents to prepare.
FAQ
How long does audit rights procedure take in practice?
Most audits under a technology contract run four to eight weeks from notice to closing, depending on scope and how ready the responding party already is. The contract's own notice period sets the floor; the volume of data inside scope sets the ceiling.
Which documents are needed to start?
A written notice with a defined scope and proposed dates, plus an internal note confirming the trigger event and its date. Without both, the responding party can reasonably treat the request as informal and set its own pace.
What happens if the other side does not respond?
The requesting party escalates to the contact named in the notices clause, on the timetable that clause sets. Silence past that point is normally treated under the contract as a failure to cooperate, not as consent to skip the audit.
If an audit clause overlaps with a licensing deadline elsewhere in a portfolio, the same logic on time limits is set out in When a collection uses third-party artwork and the deadline.