Compliance audit: every audit a B2B supplier faces, and how to run them from one evidence base

Your ISO 27001 surveillance audit is booked for March. The SOC 2 observation period runs until June. Then a bank customer writes to invoke the right-to-audit clause in its contract and asks for two days on site. Nobody in the team runs internal audit, and each request looks like a new project. A compliance audit does not have to work that way.

This guide is for founders, CTOs and security or compliance leads at UK B2B technology firms selling into financial services, insurance or the public sector. It maps every compliance audit a supplier faces, explains why regulated customers insist on audit rights, shows what you can negotiate, and sets out how to run every audit from one control set and one evidence base.

What is a compliance audit?

A compliance audit is an independent check that a firm meets a defined set of obligations, whether a standard, a regulation or a contract, and can prove it. A B2B supplier faces three kinds: internal audits, customer audits and certification or attestation audits. Run them all from one control set and one evidence base.

The word "audit" covers very different events. An ISO 27001 surveillance visit, a SOC 2 examination and a customer's on-site assessment differ in who runs them, what they test against and what happens if they find a problem. They share one thing: an auditor asks for evidence that a control works, and you either have it or you do not. That shared core is why a single approach can serve all of them.

What are first-, second- and third-party audits?

A first-party audit is one you run on yourself, such as an internal audit. A second-party audit is run by someone with an interest in you, usually a customer checking its supplier. A third-party audit is run by an independent body, such as a certification body or SOC 2 auditor. ISO 19011, the auditing guidelines, uses this split.

For a supplier, the three map neatly onto who is asking:

• First party: you. Your internal audit tests whether your own controls work. For ISO 27001 this is required by Clause 9.2 on internal audit.
• Second party: your customers. A customer, or someone it appoints, tests whether you deliver what the contract promises.
• Third party: independent bodies. A certification body audits you against ISO 27001; a CPA firm examines you for a SOC 2 report.

The distinction matters because it decides what you can reuse. A third-party report can often answer a second-party request, if the contract lets it.

Which compliance audits does a B2B supplier face?

A UK B2B supplier selling into regulated sectors typically faces five compliance audits: its own internal audit, ISO 27001 certification and surveillance audits, a SOC 2 examination, customer audits under contractual audit rights, and reviews that reach it because a regulator is examining a customer. They differ in who runs them and the consequences, but they test overlapping controls.

The detail of each process sits on its own page: the ISO 27001 certification process and the SOC 2 audit. This guide covers how they fit together.

Why do regulated customers demand audit rights?

Regulated customers demand audit rights because their regulators require them to. UK banks and insurers are expected to secure audit and information rights over material outsourcing. FCA rules require access to a provider's data and premises, and DORA requires them in contracts for ICT services supporting critical or important functions. Your customer is meeting its own obligations.

The rules that drive the clause in your contract:

• PRA SS2/21. The PRA's supervisory statement on outsourcing and third party risk management applies to UK banks, building societies, PRA-designated investment firms and Solvency II insurers. For material outsourcing, it expects written agreements to give the firm, its auditors and the PRA full access and unrestricted rights for audit and information.
• FCA SYSC 8. SYSC 8.1.8R requires a common platform firm outsourcing critical or important operational functions to ensure that the firm, its auditors and the FCA have effective access to data related to the outsourced activities and to the provider's business premises, where needed for effective oversight. Other FCA firms should take account of the chapter's main outsourcing rule, SYSC 8.1.1R, as if it were guidance.
• DORA. For EU financial entities, Regulation (EU) 2022/2554 has applied since 17 January 2025. Article 30 requires contracts for ICT services supporting critical or important functions to include unrestricted rights of access, inspection and audit by the financial entity, an appointed third party and the competent authority.

If your customer is regulated in the UK, the EU or both, expect these rights in the contract. The question is not whether to grant them, but how they will be exercised.

What can a supplier negotiate in a right-to-audit clause?

A supplier can usually negotiate how audit rights are exercised, not whether they exist. The areas worth discussing are scope, notice, frequency, cost, remote-first methods, pooled audits with other customers, and reliance on your ISO 27001 certificate and SOC 2 report. Regulated customers must keep their underlying rights, so aim to shape the method rather than remove the right.

The regulators' own guidance gives you room. PRA SS2/21 says firms may use offsite audits, such as certificates and independent reports supplied by providers, and onsite audits, individually or pooled with other firms. It describes pooled audits as more efficient and cost effective for firms, and less disruptive for providers running multi-tenanted environments. It also expects firms to give reasonable notice before an onsite audit, except in a crisis or where notice would defeat the purpose.

Two limits apply. The PRA expects firms to assess whether certificates and reports are adequate, not to assume they are sufficient simply because they exist. It also expects them to keep the contractual right to perform onsite audits at their discretion. Where an onsite audit would put your other clients at risk, PRA SS2/21 lets the firm and provider agree another route to the same assurance, such as specific controls tested in a report or certification. DORA likewise lets the parties agree alternative assurance levels where other clients' rights are affected.

In practice, the points to raise are:

1. Scope. Limit the audit to the services, systems and data the customer uses.
2. Notice. Reasonable written notice, with the purpose, location and people attending, save for emergencies.
3. Frequency. Once a year in the normal course, plus after a material incident or a regulator's request.
4. Cost. Who pays for the audit, and for your time beyond an agreed allowance.
5. Method. Remote document review first; onsite only where remote review cannot give the assurance needed.
6. Reliance. Your current ISO 27001 certificate and SOC 2 report as the first source of assurance, with the scope mapped to the customer's services.
7. Pooling. Agreement to coordinate audits with other customers where several ask at once.

Take legal advice on the contract wording. This section explains the regulatory context, not the terms that suit your firm.

How does a compliance audit work from the supplier's side?

A compliance audit runs in five stages from the supplier's side: agree the scope and criteria, receive the request list, provide evidence and interviews during fieldwork, respond to draft findings, then deliver corrective actions with proof. The stages hold whether the auditor is a certification body, a CPA firm or a customer.

1. Scope and criteria. Confirm what is being audited, against which standard, contract clause or customer policy, and for what period.
2. Request list. Map every item to a control in your control set, and to evidence you already hold.
3. Fieldwork. Provide evidence, run walkthroughs and make owners available for interviews.
4. Draft findings. Check each finding for accuracy before it becomes final. Challenge facts, not judgements.
5. Corrective action. Agree owners and dates, then send evidence when each action is complete.

The fastest way through stage 2 is to have answered the same request before. That is where combining audits pays off. Standing readiness, with evidence kept current between audits, is what keeps stage 3 short.

How do you run every compliance audit from one evidence base?

Run every compliance audit from one evidence base by keeping a single control set mapped to every framework and contract you answer to, collecting evidence for each control continuously, and keeping one findings log that every audit draws on and updates. Each new audit then starts from what already exists, not from a blank request list.

Three things make this work:

• One control set. List each control once, then map it to ISO 27001, the SOC 2 criteria and the security schedules in your customer contracts. A user access review is one control, not three.
• One evidence base. Collect evidence for each control when it runs, in one place, named by control and date. The ISO 27001 auditor, the SOC 2 auditor and the customer then sample from the same records.
• One findings log. Record findings from every audit, internal or external, in one log with owners and dates. A finding raised by a customer and a nonconformity raised by a certification body about the same control are one problem, fixed once.

Continuous collection is what makes the evidence base hold up. When evidence is gathered as controls run, rather than rebuilt before each audit, the same records serve every auditor who asks.

The fifth audit of the year should be the easiest, not the most tiring.

How should you handle findings across audits?

Handle findings across audits by logging every finding in one place, linking it to the control it concerns, assigning one owner and a date, and fixing the cause rather than the symptom. When the same control draws findings from two audits, treat them as one issue. Send each auditor evidence of the fix in the form its process expects.

For ISO 27001, nonconformities follow the corrective action process in Clause 10.2: react, find the cause, act and check that the action worked. Customer findings often come with a remediation deadline in the contract. SOC 2 exceptions appear in the SOC 2 report itself, so the fix needs to be in place before the next period.

Keep the language consistent. If a customer calls something a finding and a certification body calls it a minor nonconformity, record both labels against the same entry, so nobody fixes it twice.

What should a compliance audit checklist include?

A compliance audit checklist for a supplier should confirm that your audit obligations are known, your controls are mapped, your evidence is current, findings have owners and your contracts say how audits will run. Work through it at least once a year, and again whenever a customer invokes an audit right or a new framework enters scope.

• Every audit you expect this year is listed, with dates, criteria and an internal owner.
• Every customer contract's audit clause is recorded: scope, notice, frequency, cost and reliance on reports.
• One control set is mapped to ISO 27001, SOC 2 and each customer's security schedule.
• Evidence for every control is current and stored in one place.
• Your current ISO 27001 certificate and SOC 2 report are ready to share under NDA, with their scope stated.
• One findings log covers every audit, with owners and dates.
• Internal audit covers the whole scope at planned intervals.

What are the most common compliance audit mistakes?

The most common compliance audit mistakes for suppliers are treating each audit as a separate project, conceding unlimited audit rights without discussing method, leaving findings without an owner, and answering a customer audit with different evidence from the certification audit. Each one multiplies the effort of the next audit and weakens trust in the evidence you present.

1. One project per audit. Separate spreadsheets, separate evidence folders and separate teams mean the same control is evidenced three times.
2. Unlimited audit rights. A clause with no notice, scope or frequency terms invites audits you cannot plan for.
3. Orphaned findings. A finding with no owner is still open when the next auditor arrives.
4. Inconsistent evidence. If the customer sees a different access review from the one the certification body saw, both lose confidence.
5. Scoping too wide. Offering the whole company when the customer only uses one service makes every audit longer than it needs to be.

An audit you can predict is a cost. An audit you cannot predict is a risk.

Fix these and audits become a routine draw on records you already keep, which is what regulated customers want to see.

Frequently asked questions