How to Read Customer Audit Rights Before You Sign

Clause 11 says you may audit. The heading is not a usable right. Start with four sentences: purpose, written days, who pays, and whether the right dies on exit. An 18-person marketplace will not fly an auditor it always pays. Write a keep / narrow / walk log before Monday go-live.

On 2 September 2026, Hugo — Ops, 18-person UK marketplace — has Finance’s yes on a fulfilment-and-usage SaaS. Clause 11 of the MSA — the master services agreement, the frame vendors hang order forms on — is four sentences: once per calendar year, at Customer’s sole cost, upon reasonable notice, of books and records. Findings are Vendor’s Confidential Information. The right expires on termination. Typical mistake under Monday pressure: treating the heading as protection.

A short English clause is a lawsuit waiting for a construction. In Pixdene Ltd v Paddington and Company Ltd (High Court, England and Wales, 2022) the judge resolved ten issues from fewer than 60 words (Osborne Clarke, 2023, structure-only). The court would not imply a right to redact confidential (non-privileged) information. Hugo’s four sentences will not fare better.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

What may you inspect: books, usage, security — not a SOC 2 substitute?

The right to audit books and records is only as wide as the purpose you write. Name fees, usage meters, and records that calculate amounts owed under this agreement. “All books” without a purpose is a fishing expedition a court will shrink.

Freeze the packet — the exact file set that will be signed. Search audit, books and records, usage, shortfall, retain, confidential. One sentence on the freeze: the contract packet checklist. Travers Smith (2023), structure-only: purpose is the limit — no fishing (Pixdene; TGM v Thales, 2012). Legislate: name notice, frequency, scope, and who pays.

Security evidence lives in the exhibit — the attached schedule. One walk is enough: the vendor security addendum review checklist. UK GDPR Art. 28(3)(h) is the DPA — a data processing agreement — floor, not this paragraph.

• Do: write purpose = this agreement’s fees, usage meters, and records that calculate amounts owed.
• Do not: treat “all books” as a blank cheque or a security-report substitute.

How do frequency, notice, and for-cause extras work after a miss?

Once a year is a cap, not a complete right. A vendor audit once per year exception still needs written days of notice and extras after a documented miss. “Reasonable notice” is not a number.

Buyer colour, not a statute: 15–30 business days’ written notice (Clausie (2026), structure-only; ContractKen). SHI (2026), opposite chair, still gives 30–60 days on-site. Cap routine audits at once in any twelve-month period. Say no re-audit of a closed period except after a documented miss — Pixdene would not imply that ban. For example, a quiet meter export in February should spend the annual token unless you carved soft audits out. Accord (2026) flags any-time / 10 days as High.

• Do: lock once in any 12-month period, written days, and named extras.
• Do not: accept “reasonable notice” with no days.

Who pays if the shortfall crosses the threshold?

Who pays for a contract audit decides whether an 18-person team will ever use the right. “At Customer’s sole cost” forever is theatre. Default market colour: the auditing party pays unless the audit shows a material discrepancy. Then the bill can flip.

A common sample reimburses reasonable third-party fees when the discrepancy is at least 5% of the audited period (ContractKen). There is no UK statutory 5%. GOV.UK General Terms v1.0: each party bears its own costs unless the audit finds a Material Default, then the supplier repays reasonable costs. Steal the flip, not the Crown schedules. In practice, Hugo will not book that invoice unless someone else might pay it.

• Do: write Customer pays unless the shortfall crosses a stated percentage.
• Do not: leave always-Customer-pays with no flip.

How do you keep records after exit?

A right that expires on termination makes the last quarter unauditable. Write complete, accurate records that support invoices, usage, and fees for a stated period after the End Date. Match look-back to retain. Allow a post-termination exercise window.

Market colour is 3–5 years (ContractKen). UK Crown paper keeps records for seven years after the End Date — colour, not Hugo’s default ask. A post-exit window is often 12 months. Do not confuse this with delete-or-return of personal data on the DPA.

• Do: write years after the End Date and a post-exit window.
• Do not: let the right die on termination.

Are findings confidential — or is that a brick-wall NDA?

“Any findings are Vendor’s Confidential Information” that stops the auditor telling you the conclusion is a gag, not a protection. Write an independent, fee-based auditor — not a competitor — who signs an NDA — a non-disclosure agreement — with both sides. You see the report.

Travers Smith on Pixdene: the auditor may tell the customer the conclusion, the basis, whether an underpayment was found, and how it was calculated. Keep Hugo’s marketplace admin off vendor staff: named auditor, stated purpose, normal business hours. Bortstein (2026): SaaS vendors are narrowing on-site rights. Take report-first; keep on-site as fallback.

• Do: take an auditor report plus mutual confidentiality.
• Do not: accept a brick-wall NDA or a refuse of both site and records.

Checklist: keep, narrow, or walk?

Success bar: a one-page log and one sentence that would pause signature. “Once a year at Customer cost” is not that sentence if purpose, days, flip, retain, and findings are hollow. Then keep, narrow, or walk.

Workflow: packet → purpose/scope (books/usage ≠ security exhibit) → frequency + notice + for-cause → cost-shift on threshold → retain after exit → findings report not gag → keep / narrow / walk. Checkory can run a first-pass — a first machine pass on the same MSA PDF — at document analysis.

• Do: highlight one High sentence, then keep, narrow, or walk.
• Do not: tell Finance the heading is enough.