How to answer
Do you allow customers to audit your security controls?
Answering yes to be agreeable grants a contractual right to send an assessor. Answering no with nothing offered instead leaves a gap in the reviewer's file. The useful answer is no, and here is what you get.
We do not offer on-site or customer-conducted audits. We satisfy audit rights through [our SOC 2 Type II report / an independent penetration test summary] and by answering security questionnaires such as this one. Where a data processing agreement requires it, we will provide the information reasonably necessary to demonstrate compliance, as set out in [clause].
Square brackets are yours to fill in. FillTrust grades an answer like this answered “no” from your documents when your documents support it.
- Answered from
- Your terms or data processing agreement, whichever sets out audit rights. If neither mentions them, that itself is the answer.
- Evidence to attach
- Whatever you offer instead: the third-party report, the penetration test summary, the completed questionnaire.
- Where it is asked
- CAIQ v4.0SIG LiteISO 27001 Annex A
This is a question where the confident negative is usually the correct answer and small vendors are reluctant to give it. Saying no feels like a failure, so the temptation is to write something accommodating. Resist it: an audit right is a commitment to receive somebody's assessor, answer their questions and produce evidence on their schedule, and for a company that runs on a few hours of attention a week, granting it casually to one customer is a promise that will be called in at the worst possible moment.
The reviewer is not actually trying to audit you. They have a control in their own vendor management programme that says they must have audit rights or an accepted alternative, and they need to write something in the box. Almost every one of them will accept a third-party report, a penetration test summary or a completed questionnaire. So the answer that works is not "no", it is "no, and here is what we provide instead", which lets them close their file without a negotiation.
Check your own contract before you answer. Standard data processing agreements built on Article 28(3)(h) usually do contain audit language, often with conditions attached: notice, frequency, cost, and a right to satisfy it with an existing report. If your DPA says one thing and your questionnaire says another, you have handed the reviewer an inconsistency in the one document set where consistency is the product. Read the clause and answer in a way that matches it, including the conditions, because the conditions are what make the obligation survivable.
If you have no third-party report yet, say so and offer the next best thing. A recent penetration test summary with the findings redacted, or a written description of your controls with the evidence behind each one, is a real answer. What does not work is an answer implying an assurance report exists. That is the specific claim a procurement team will ask for a copy of, and there is no graceful recovery from not having it.
How this one goes wrong
Specific to this question, not general advice.
- Answering yes to be agreeable. An audit right you did not mean to grant is a contractual obligation to host somebody's assessor, and a company of five people cannot absorb that more than once.
- Answering no flatly, with nothing offered instead. The reviewer is not trying to visit your office; they are trying to close a gap in their own file, and something in place of the audit closes it.
- Forgetting that the DPA may already grant this. Article 28(3)(h) audit language is in most standard agreements, and contradicting your own contract in a questionnaire is the worst possible place to be inconsistent.