Audit rights procedure: stages and deadlines
An audit rights procedure under a technology contract moves through five stages: notice, scoping, access, fieldwork and closure. Most run for four to eight weeks once notice is served. The clock starts when the requesting party delivers a written notice that meets the contract's format requirements, not when the idea of an audit first comes up.
Once notice is served, deadlines start running against both sides. The audited party must confirm a date within the response window set by the contract, usually ten to twenty business days. Missing that window does not cancel the audit. It shifts leverage towards the requesting party and often triggers whatever escalation clause the contract contains.
Steps to open the procedure
- The requesting party drafts a written audit notice, states the scope and proposed dates, and sends it to the counterparty's contract manager.
- The audited party's legal or compliance lead confirms receipt within the response window set by the notice clause.
- Both sides agree the scope in writing: systems, data sets, personnel to interview, and any exclusions such as third-party subcontractor environments.
- The requesting party's auditor or internal review team requests access credentials, extracts, and interview slots from the counterparty's IT lead.
- The auditor conducts fieldwork, on-site or remotely, within the agreed window, and records findings as they arise.
- Both parties sign off on a closure note listing findings, agreed remediation steps, and a deadline for each.
Who decides, and how long each stage takes
No external body rules on an audit rights procedure unless the contract sends disputes to arbitration or names a specific forum. Absent such a clause, the parties' own contract managers decide each step, and their legal teams step in only if fieldwork stalls.
| Stage | Who acts | Typical duration |
|---|---|---|
| Notice | Requesting party's contract manager | 1 day to draft and send |
| Scoping | Both contract managers, jointly | 5–10 business days |
| Access setup | Audited party's IT or security lead | 3–7 business days |
| Fieldwork | Auditor or internal review team | 5–15 business days |
| Closure | Both legal teams | 5–10 business days |
Total elapsed time from notice to closure sits between four and eight weeks in most cases. A contract with a shorter notice period compresses the first two stages, but rarely the fieldwork itself.
Documents you need before sending notice
Before drafting the notice, confirm which contract version governs the relationship and which schedule sets audit scope. Where the agreement ties a deadline to an underlying digital asset rather than a calendar date, treat that reference as a hard stop, not a target. See Reference asset tokenised rights explained and the deadline for how such deadline-linked references are defined outside the technology contracts context.
Gather the current signed contract, any amendment log, the data processing schedule if personal data is in scope, and a list of named contacts on both sides. A gap in any of these routinely adds a week to the scoping stage.
If your situation differs
- If the contract sets no notice period, treat ten business days as a reasonable default and state that assumption in the notice itself.
- If the counterparty sits outside the EU, add time for time-zone handovers and confirm which law governs the contract before fieldwork starts.
- If the audit follows a suspected breach rather than a routine check, run scoping and access setup in parallel instead of in sequence.
What this page does not decide
This page sets out the standard sequence. It does not tell you what the notice period should be in your specific contract, what counts as a material finding, or how the audit itself should be priced. Those depend on the clause you signed and on commercial judgement.
Deciding whether to renew a contract that contains a weak or missing audit clause is a separate question. Counterparty report before renewing a contract sets out what that decision costs when it goes wrong.
Where the audit turns on a date recorded in a register that no longer matches the contract file, the sequence above will not resolve the mismatch on its own. Document report when dates do not match the register covers who decides in that case.
Verified
Reviewed on 12 November 2025. This page describes a procedural sequence drawn from standard technology contract practice, not from a specific statute or regulation. For how sources are tiered and routed generally, see Sources by tier and delivery route overview and the page.
Related reading
For the parallel workflow that applies once an incident, rather than a scheduled audit, triggers contractual notice, see Incident notification workflow technology contract.
Frequently asked questions
How long does audit rights procedure take in practice?
Four to eight weeks from notice to closure in most contracts, assuming the audited party responds within the agreed window and access is granted on schedule.
Which documents are needed to start?
The current signed contract, any amendment log, the relevant data schedule, and named contacts for both parties. Gaps in any of these extend the scoping stage.
What happens if the other side does not respond?
Silence past the response window does not stop the audit. It typically triggers whatever escalation or dispute clause the contract contains, and the requesting party should document the missed deadline before invoking it.
Next step
If the contract you are working from also stays silent on a related question — what happens to AI-generated output when the agreement does not address it — the next page in this sequence covers that gap. When the contract is silent on AI output step sets out where to start.