A customer's policy requires the right to audit critical suppliers. A large multi-tenant cloud provider refuses individual on-site customer audits, citing security and the impact on other tenants, but offers current independent attestation reports and certifications. What is the most appropriate approach?
Select an answer to reveal the explanation.
Short Explanation
If every tenant audited the building in person, the landlord would never get any work done, and your neighbors' privacy would suffer. So you accept independent reports instead, and you write into the contract how you'll get them and what else you can ask for. Don't throw out the audit clause; reshape it.
Full Explanation
A right-to-audit clause gives the customer a way to verify that the provider meets its obligations. Large multi-tenant providers typically decline individual on-site audits because hundreds of customer audits would disrupt operations and could expose other tenants' data and security details. The common solution is to negotiate audit rights that are satisfied through independent third-party attestations and certifications, such as SOC 2 Type II reports and ISO/IEC 27001 and 27017 certificates, together with commitments to provide supporting documentation, answer questionnaires, notify of material changes and in some cases allow regulator access or pooled audits. Insisting on an on-site audit and walking away treats one form of evidence as the only acceptable one, even though independent attestations may provide stronger assurance than a single customer visit. Removing the clause gives up a contractual lever and may breach the customer's own regulatory obligations. Arranging an unannounced inspection without agreement is not supported by the contract and would breach the provider's security terms. Exam caveat: regulated sectors may require specific audit or regulator access rights that must be negotiated explicitly. Operational check: confirm the contract names the reports and certifications to be provided, how often and how the customer can request additional evidence.