How to review an audit rights clause

An audit rights clause lets one party check that the other is keeping its promises: that invoices are right, that royalties are fully reported, that software is used within the license or that data is protected. Drafted loosely, it can mean open-ended access to systems and staff. This guide covers the rules behind these clauses, a checklist of points to check and how to review one in Word with LexDraft.

Last checked: 18 October 2026. The law changes; check the current position before relying on this page.

Where audit rights come from

• Mostly from the contract. In ordinary commercial contracts there is usually no right to audit the other side unless the contract grants it, so the scope is whatever the clause says.
• Data processing. Under the GDPR and UK GDPR (Article 28(3)(h)), a processor contract must require the processor to make available the information needed to demonstrate compliance and to allow for and contribute to audits, including inspections. See our DPA review guide.
• Health data. HIPAA's business associate rules (45 CFR 164.504(e)) require a business associate agreement to make the business associate's internal practices, books and records available to the HHS Secretary for compliance purposes. See our BAA review guide.
• Federal government contracts. Federal contracts often include government audit and records clauses from the Federal Acquisition Regulation, and some of them must be flowed down to subcontractors.

Clause checklist

• Purpose and scope. What may be audited: invoices and fees, royalty reports, license usage, security controls or compliance with the whole agreement? Tie the scope to the purpose.
• Notice. Written notice a set number of days in advance, except where a regulator requires otherwise or after a security incident.
• Frequency. Usually no more than once a year, with extra audits allowed after a breach or a failed audit.
• Who audits. The party itself, or an independent auditor bound by confidentiality? Many suppliers exclude auditors who compete with them or are paid on a contingency basis.
• Manner. During business hours, without unreasonable disruption, and following the audited party's site and security rules. Remote audits and document requests first, on-site only if needed.
• Reports in place of audits. For security audits, whether a current SOC 2 report, ISO 27001 certificate or questionnaire satisfies the right, with an on-site audit only if gaps remain.
• Cost. The auditing party usually pays, but the cost often shifts to the audited party if the audit finds an underpayment above a set threshold, for example 5%.
• Remedy. Payment of any shortfall within a set period, with or without interest, and whether an overpayment is refunded too.
• Records retention. How long records must be kept, often for a period after the contract ends, so that late audits can still happen.
• Software license audits. For customers: a true-up at the price you actually pay rather than list price, a chance to fix shortfalls before penalties and no audit fees for small gaps.
• Confidentiality. Audit findings and information seen during the audit stay confidential and are used only for the audit. See our confidentiality clause guide.

A audit rights clause review workflow in Word

LexDraft is a Word add-in from Microsoft AppSource. It opens as a side panel in Word 365 (Windows and Mac), Word 2021 and Word on the web, so the agreement never leaves the tool you already draft in.

1. Open the agreement in Word and open LexDraft in the side panel.
2. Pick the governing law. Select the state named in the governing law clause so LexDraft looks for state-specific red flags.
3. Run the review. Run the review on the whole agreement. For NDAs, SaaS MSAs, DPAs and services agreements, run the matching playbook on the whole agreement; for other contracts LexDraft runs a general AI review against the governing law you chose. LexDraft has no separate clause-only playbook. The DPA playbook reviews audit rights as part of a data processing addendum.
4. Triage by severity. Findings are graded Critical, High, Medium or Low, and LexDraft flags standard terms that are missing.
5. Run the quick checks. The defined-term and cross-reference checks are rule-based and run without AI.
6. Accept or reject each redline. Accepted changes land as native Word tracked changes.
7. Verify and sign off. You check every output before it goes to the client or the other side.

Common mistakes

• "Audit the Supplier's compliance with this Agreement" with no limit on scope, frequency or access to systems.
• No records retention period, so the records needed for an audit may already be gone.
• A license audit clause that prices any shortfall at list price, which can cost more than the original deal.

What LexDraft does not do

LexDraft does not give legal advice, carry out audits or assess whether a party complies with a contract. Nothing changes in your document until you accept a redline.

This guide is general information, not legal advice. LexDraft does not give legal advice; qualified counsel must review every draft. Spotted something out of date? Email support@lexdraft.ai and we will fix it.