--- title: Audit Policy description: "Effective date: January 1, 2026 This Audit Policy explains how Customers may audit [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/)’s compliance with its obligations under the Data Processing Addendum (“DPA”) and applicable European data protection legislation. This policy is designed to support transparency without compromising…" url: "https://www.acceptmission.com/nl/knowledge/audit-policy/" updated: "2026-04-15" category: Legal --- # Audit Policy Effective date: January 1, 2026 This Audit Policy explains how Customers may audit [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/)’s compliance with its obligations under the Data Processing Addendum (“DPA”) and applicable European data protection legislation. This policy is designed to support transparency without compromising security, confidentiality, or the rights of other customers. ## 1) General Customer may audit [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/)’s compliance with its obligations under the DPA: - Up to once per calendar year, and - On other occasions where required by applicable European data protection legislation, including where mandated by Customer’s competent supervisory authority. [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will contribute to such audits by providing information and assistance reasonably necessary to conduct the audit, subject to this Audit Policy. ## 2) Audit formats Audits may be satisfied through one or more of the following, depending on scope and [Risk](https://www.acceptmission.com/nl/encyclopedia/risk/): - Written responses to security or privacy questionnaires - Remote review of relevant policies and evidence - Review of independent third-party reports - A remote audit session with [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) representatives - An on-site audit, only where strictly necessary and agreed in advance [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will work with Customer to select the least intrusive method that still meets Customer’s regulatory requirements. ## 3) Independence of the auditor If Customer appoints a third-party auditor, [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) may object if the auditor is, in [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/)’s reasonable opinion: - Not independent, - A competitor of [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/), or - Otherwise manifestly unsuitable (for example due to conflict of interest, insufficient qualifications, or security [Risk](https://www.acceptmission.com/nl/encyclopedia/risk/)). If [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) objects, Customer will appoint another auditor or conduct the audit itself. ## 4) Audit request and planning ### 4.1 Notice period To request an audit, Customer must submit a proposed audit plan at least eight (8) weeks before the proposed start date. ### 4.2 Audit plan requirements The proposed audit plan must include: - Proposed scope and controls to be assessed - Proposed audit method (questionnaire, remote, on-site) - Proposed start date and duration - People involved (Customer and any auditor) - Evidence requested (documents, interviews, screenshots, logs) - Any specific regulatory driver (for example supervisory authority request) ### 4.3 Confidentiality and NDA Any third-party auditor must sign a customary non-disclosure agreement mutually acceptable to the parties (acceptance not to be unreasonably withheld). All information exchanged and any audit results must be treated as confidential. Nothing in this policy requires [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) to breach duties of confidentiality to other customers, employees, or vendors. ### 4.4 Review and agreement [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will review the proposed audit plan and respond with questions or concerns, including where a request could compromise: - Security controls - Privacy obligations - Employment or internal policy requirements - Confidentiality obligations - Availability or stability of the Service The parties will work cooperatively to agree on a final audit plan. ### 4.5 Timing and conduct Audits must: - Be conducted during regular business hours, - Follow the agreed final audit plan, - Comply with [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) safety and security requirements, and - Not unreasonably interfere with [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) business operations. ## 5) Use of third-party reports in lieu of audit If the controls requested by Customer are addressed in a qualified third-party report (for example SOC, ISO, NIST, or similar) performed within the prior twelve (12) months, and [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) confirms there are no known material changes to the audited controls, Customer agrees to accept that report in lieu of auditing those same controls. This approach reduces duplication and helps keep the audit focused on any Customer-specific requirements not covered by existing independent assurance. ## 6) Audit findings and reports Customer will promptly notify [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) of any non-compliance discovered during the audit. Customer will provide [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) with any audit report generated in connection with the audit, unless: - prohibited by applicable European data protection legislation, or - otherwise instructed by a supervisory authority. Customer may use audit reports only for: - meeting Customer regulatory audit requirements, and - confirming compliance with the DPA. Customer must not use audit materials or reports to benchmark, publish, or disclose [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) security practices beyond those purposes. ## 7) Audit costs Audits are conducted at Customer’s expense. Customer will: - Pay the fees of any auditor appointed by Customer, and - Reimburse [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) for time spent supporting the audit at [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/)’s then-current professional services rates (available on request). Customer is also responsible for any fees charged by third-party subprocessors if their involvement is required for the audit. Nothing in this policy requires [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) to provide more information about subprocessors than those subprocessors generally make available to their customers. ## 8) Contact To request an audit or submit an audit plan, contact: security@acceptmission.com