12.2 Access, information and audit rights

Financial entities should ensure through the written contractual arrangement that the internal audit function is able to review the function performed by the TPSP using a risk-based approach.

Regardless of the criticality or importance of the function performed by TPSPs, the written contractual arrangements between institutions under CRD and TPSPs should refer to the information gathering and investigatory powers of competent authorities and resolution authorities under Article 63(1)(a) of Directive 2014/59/EU and Article 65(3) of Directive 2013/36/EU with regard to TPSPs located in a Member State and in third countries.

With regard to contractual arrangements supporting critical or important functions, financial entities should ensure that the TPSP grants them and their competent authorities, including resolution authorities, and any other person appointed by them or the competent authorities, the following:

• a. access to all relevant business premises (e.g. head offices and operational centres), as well as the right to take copies of relevant information and documentation if they are critical to the operations of the TPSP (‘access and information rights’) ; and
• b. unrestricted rights of inspection and auditing related to the third-party arrangement ( ‘audit rights’), to enable them to monitor the third-party arrangement and to ensure compliance with all applicable regulatory and contractual requirements.

For services not supporting critical or important functions provided by TPSPs, financial entities should consider including the access and audit rights as set out in paragraph 998 (a) and (b) and Section 12.2, on a risk-based approach, taking into account the nature of the function and the related operational and reputational risks, its scalability, the potential impact on the continuous performance of its activities, and the contractual period. Financial entities should take into account that functions may become critical or important over time.

Financial entities should ensure that the contractual arrangement does not impede or limit the effective exercise of access, information, and audit rights by them, competent authorities or third parties appointed by the financial entity or competent authorities to exercise such rights.

Financial entities should exercise their access and audit rights, determine the audit frequency and areas to be audited on a risk-based approach and adhere to relevant, commonly accepted, national and international audit standards (⁵⁷ ).

⁵⁷ For institutions, please refer to Section 22 of the EBA Guidelines on internal governance: https://eba.europa.eu/documents/10180/1972987/Final+Guidelines+on+Internal+Governance+%28EBA-GL-2017-11%29.pdf/eb859955-614a-4afb-bdcd-aaa664994889.

Without prejudice to their final responsibility regarding third-party arrangements, financial entities may use:

• a. pooled audits organised jointly with other clients of the same TPSP and performed by them and these clients or by a third party appointed by them, to use audit resources more efficiently and to decrease the organisational burden on both the clients and the TPSP; and
• b. relevant third-party certifications and third-party or internal audit reports, made available by the TPSP.

For services supporting critical or important functions provided by TPSPs financial entities should assess:

• a. whether third-party certifications and third-party or internal audit reports as referred to in paragraph 102(b) are adequate and sufficient to comply with their regulatory obligations. Financial entities should not rely solely on these certifications and reports over time.
• b. when relying on pooled audits as referred to in paragraph 102(a), whether they have sufficient information and are sufficiently involved in scoping, planning, performing and reporting the audit and its findings.

Financial entities should make use of the method referred to in paragraph 102(b) only if they:

• a. are satisfied with the audit plan for the services provided by TPSPs;
• b. ensure that the scope of the certification or audit report covers the systems (i.e. processes, applications, infrastructure, data centres, etc.) and key controls identified by the financial entity and the compliance with relevant regulatory requirements;
• c. thoroughly assess the content of the certifications or audit reports, on an ongoing basis and verify that the reports or certifications are not obsolete;
• d. ensure that key systems and controls are covered in future versions of the certification or audit report;
• e. are satisfied with the aptitude of the certifying or auditing party (e.g. with regard to rotation of the certifying or auditing company, qualifications, expertise, re-performance/verification of the evidence in the underlying audit file);
• f. are satisfied that the certifications are issued and the audits are performed against widely recognised relevant professional standards and include a test of the operational effectiveness of the key controls in place;
• g. have the contractual right to request the expansion of the scope of the certifications or audit reports to other relevant systems and controls; the number and frequency of such requests for scope modification should be reasonable and legitimate from a risk management perspective; and
• h. retain the contractual right to perform individual audits at their discretion with regard to the use of TPSPs to support critical or important functions.

Before a planned onsite visit, financial entities, competent authorities, and auditors or third parties acting on behalf of the financial entity or competent authorities should provide reasonable notice to the TPSP, unless this is not possible due to an emergency or crisis situation or would lead to a situation where the audit would no longer be effective.

When performing audits in multi-client environments, care should be taken to ensure that risks to another client ’ s environment (e.g. impact on service levels, availability of data, confidentiality aspects) are avoided or mitigated.

Where the third-party arrangement carries a high level of complexity, the financial entity should verify that whoever is performing the audit – whether it is its internal auditors, the pool of auditors, or external auditors acting on its behalf – has appropriate and relevant skills and knowledge to perform relevant audits and/or assessments effectively. The same applies to any staff of the financial entity reviewing third-party certifications or audits carried out by TPSP.