Audit report and audit implementation report
1. The audit report referred to in Article 37(4) of Regulation (EU) 2022/2065 shall be established by the auditing organisation, without interference from the audited provider. That audit report shall be drawn up in accordance with the template in Annex I, and shall contain detailed and substantiated conclusions in relation to all elements of the template.
2. Where applicable, the audit implementation report referred to in Article 37(6) of Regulation (EU) 2022/2065 shall be drawn up in accordance with the template in Annex II.
Procedures for the preparations for the audit
1. The audited provider and the auditing organisation shall conclude a written agreement setting out:
(a)
the exhaustive list of audited obligations and commitments;
(b)
the responsibilities of the audit organisation, including, where applicable, detailed for each legal person constituting the auditing organisation, and the parties empowered to sign the audit report;
(c)
the procedures and contact points made available by the audited provider for the auditing organisation to request access to data referred to in Article 5(2);
(d)
the timeframe for the audit, including the start and end date of the audit procedures and the completion of the audit report;
(e)
a procedure on how disputes between the audited provider and the auditing organisation arising from the performance of the audit shall be resolved.
2. The agreement referred to in paragraph 1, as well as any other agreements or engagements letters between the auditing organisation and the audited provider related to the performance of the audit, shall be annexed to the audit report.
3. Where changes are made to the agreement referred to in paragraph 1 during the performance of the audit, they shall be made explicit in the audit report.
Audit opinion, audit conclusions and recommendations
1. The audit report shall include the audit conclusions that the auditing organisation has reached on the audited provider’s compliance with each of the audited obligations and commitments. The audit conclusions shall be either:
(a)
‘positive’, where the auditing organisation concludes with a reasonable level of assurance that the audited provider has complied with an audited obligation or commitment;
(b)
‘positive with comments’, where the auditing organisation concludes with a reasonable level of assurance that the audited provider has complied with an audited obligation or commitment, but:
(i)
the auditing organisation includes remarks on the benchmarks provided by the audited provider pursuant to Article 5(1), point (a); or
(ii)
the auditing organisation recommends improvements that do not have a substantive effect on its conclusion;
(c)
‘negative’, where the auditing organisation concludes with a reasonable level of assurance that the audited provider has not complied with an audited obligation or commitment.
2. Where an audit report includes operational recommendations pursuant to Article 37(4), point (h) of Regulation (EU) 2022/2065, those recommendations and their recommended timeframe shall be specific to each audited obligation or commitment for which the audit conclusion pursuant to paragraph 1 is ‘positive with comments’ or ‘negative’.
3. Where the operational recommendations referred to in paragraph 2 include specific measures to achieve compliance, they shall be formulated in a way that explains the auditing organisation’s assessment of how such measures would affect the materiality threshold by comparison with the audit conclusion for the respective audited obligation or commitment.
4. On the basis of the audit conclusions, the audit report shall include an audit opinion on the audited provider’s compliance with all audited obligations referred to in Article 37(1), point (a), of Regulation (EU) 2022/2065.
5. On the basis of the conclusions of all audited commitments, the audit report shall include an audit opinion or opinions, as applicable, on the audited provider’s compliance with all audited commitments made by the audited provider under each code of conduct and crisis protocol referred to in Article 37(1), point (b), of Regulation (EU) 2022/2065.
6. Audit opinions pursuant to paragraphs 4 and 5 shall be either:
(a)
‘positive’ if the auditing organisation has reached a ‘positive’ audit conclusion for all of the audited obligations or commitments;
(b)
‘positive with comments’ if the auditing organisation has reached at least one audit conclusion that is ‘positive with comments’ for an audited obligation or commitment and has not reached a ‘negative’ audit conclusion for any of the audited obligations or commitments;
(c)
‘negative’ if the auditing organisation reached a ‘negative’ audit conclusion for at least one audited obligation or commitment.
7. Where the auditing organisation assesses that, for a limited period during the period referred to in Article 3(2), the provider has not complied with an audited obligation or commitment, the audit report shall duly document that assessment.
8. Where the auditing organisation cannot issue with a reasonable level of assurance an audit conclusion pursuant to paragraph 1 or an audit opinion pursuant to paragraphs 4 and 5, the audit report shall include an explanation of the circumstances and the reasons why such a level of assurance could not be achieved.
