The Inspection Clause as Evidence: Audit Rights That Withstand Regulatory Scrutiny

Most commercial contracts contain an inspection clause. Fewer contain an inspection process. The difference matters when a regulator asks the business to demonstrate how a supplier, subcontractor or joint venture partner has performed. At that point, a right to audit is not a compliance control in itself. It is a route to evidence, and only useful if the route has been mapped, resourced and tested before the request arrives.

The problem is rarely that the clause is absent. It is that the clause was drafted to reassure the buyer at signing rather than to produce admissible, complete and timely records later. Broad language such as ‘the Supplier shall permit the Customer to audit its records on reasonable notice’ can survive negotiation and then fail in practice. Reasonable notice to whom? Which records? In what format? At whose cost? With what consequence if access is delayed, narrowed or refused?

The clause is not the control

A contractual inspection right should be understood as part of an evidence chain. The chain begins with a clear obligation to create and retain records, continues through a defined request and response process, and ends with material that can be provided to a regulator, used in a dispute or relied on in an internal investigation. If any link is missing, the right becomes a statement of intent.

That is why drafting should start with the evidential question, not the access question. What will the business need to show, to whom, and by when? A payment services firm responding to a supervisory information request may need transaction-level records and control testing evidence. A manufacturer facing a product safety enquiry may need batch records, supplier certifications and deviation reports. A public sector contractor may need evidence of subcontractor compliance with security or anti-bribery obligations. Each requires a different inspection design.

Notice mechanics that create a record

Notice provisions are often treated as administrative boilerplate. In practice they determine whether an audit happens promptly or becomes a negotiation. The clause should identify the recipient of a notice, the permitted method, the minimum notice period and any urgent-access mechanism. A single ‘reasonable notice’ formula is unlikely to help when a regulator has imposed a short deadline.

It is also sensible to require a written audit plan. That plan can set out the records sought, the personnel to be interviewed, the systems to be accessed and the proposed timetable. This does not need to be adversarial. It creates a shared record of what was requested and what was provided, which is valuable if the supplier later claims that the request was unclear or disproportionate.

Notice should not be so short that it is unworkable, nor so long that it defeats the purpose. A tiered structure often works better: a defined period for standard requests, a shorter period for urgent regulatory or security incidents, and an escalation route if the parties cannot agree the scope. The clause should also address whether the customer may take copies, extracts or images, and whether the supplier must certify completeness of the material provided.

Scope, standards and the limits of access

Scope is where many inspection clauses become either useless or unworkable. A right to inspect ‘all records’ may be resisted as disproportionate, particularly where personal data or third-party confidential information is involved. A right to inspect only ‘relevant records’ may be too narrow when the relevance is not yet known.

A better approach is to define categories of records and the purpose for which they may be inspected. Accounting records, compliance policies, training logs, incident reports, subcontractor due diligence files and system logs can each be described with enough precision to be enforceable without closing off legitimate enquiry. The clause can also permit sampling where full production would be excessive, provided the sampling method is objective and the supplier cannot control which sample is selected.

Access to people is often as important as access to documents. The clause should state whether the customer may interview relevant personnel, whether those interviews may be recorded and whether the supplier must make staff available within a defined period. Access to systems raises separate questions about read-only permissions, data extraction and security. These should be addressed in the contract or in an accompanying audit protocol, not left to the first request.

Data protection, confidentiality and privilege

Audit rights frequently intersect with UK GDPR and the Data Protection Act 2018. Records may contain personal data relating to employees, customers or third parties. The contract should require appropriate minimisation, redaction and secure transfer, and it should allocate controller and processor responsibilities clearly. A supplier should not be able to refuse access altogether simply because personal data is involved, but neither should the customer assume that an unlimited inspection right overrides data protection obligations.

Confidentiality clauses need a regulatory disclosure carve-out. If the customer is required to provide material to the FCA, PRA, CMA, ICO or another regulator, the supplier’s confidentiality obligation should not stand in the way. The clause can require notice to the supplier where lawful, but it should not require consent that may never come.

Privilege requires particular care. Legal professional privilege belongs to the client and should not be waived by the mechanics of an audit. Where an inspection is conducted for the purpose of obtaining legal advice, the arrangement should be directed and supervised by counsel, with documents clearly segregated. But privilege will not attach to underlying commercial facts merely because a lawyer is involved. A contractual right to inspect does not create privilege, and a supplier cannot be compelled to hand over privileged material simply because the clause is widely drafted.

Cooperation, cost and consequences

The obligation to cooperate should be explicit. That means a duty to respond within defined periods, to provide complete and accurate records, to explain gaps and to remediate identified deficiencies. Cost allocation should also be addressed. The customer may bear the cost of a routine audit, while the supplier may bear the cost of re-performance or remediation where deficiencies are found. The clause should say so.

Remedies for refusal need to be proportionate but real. A service credit may be poor compensation for missing evidence in a regulatory investigation. Termination may be too blunt where the relationship is otherwise functioning. Useful options include escalation to an independent auditor, suspension of further work, step-in rights, a defined remediation plan and, where refusal is material, a right to treat the conduct as a breach. Specific performance is available in principle, but it is discretionary and slow. The contract should not depend on it alone.

Rehearsing the right before it is needed

An inspection clause that has never been used is not a tested control. Businesses should run a low-stakes exercise at least annually: serve a template notice, request a defined sample, test the supplier’s response time and review whether the material produced would satisfy an external request. The exercise often reveals practical problems — outdated contact details, unclear record ownership, over-redaction, or a supplier that has never retained the relevant data.

The remedy is not more boilerplate. It is a shorter, clearer clause supported by an audit protocol, a records-retention schedule and an internal owner. When the regulator asks, the question will not be whether the contract contained a right to inspect. It will be whether the business can produce the evidence. The inspection clause is only the beginning of that answer.