Section IV, Article 9 · Commission Delegated Regulation (EU) 2024/436

Contents

Article 9Audit risks analysis#

1.The audit report shall include a substantiated audit risk analysis performed by the auditing organisation for the assessment of the audited provider’s compliance with each audited obligation or commitment.

2.The audit risk analysis shall be carried out prior to the performance of audit procedures and shall be updated during the performance of the audit, in the light of any new audit evidence which, according to the professional judgement of the auditing organisation, materially modifies the assessment of the audit risk.

3.The audit risk analysis shall consider:

(a)inherent risks;

(b)control risks;

(c)detection risks.

4.The audit risk analysis shall be conducted taking into account:

(a)the nature of the audited service and the societal and economic context in which the audited service is operated, including probability and severity of exposure to crisis situations and unexpected events;

(b)the nature of the obligations and commitments;

(c)other appropriate information, including:

(i)where applicable, information from previous audits to which the audited service was subjected;

(ii)where applicable, information from reports issued by the European Board for Digital Services or guidance from the Commission, including guidelines issued pursuant to Article 35(2) and (3) of Regulation (EU) 2022/2065, and any other relevant guidance issued by the Commission with respect to the application of Regulation (EU) 2022/2065;

(iii)where applicable, information from audit reports published pursuant to Article 42(4) of Regulation (EU) 2022/2065 by other providers of very large online platforms or of very large online search engines operating in similar conditions or providing similar services to the audited service.

Defined terms · 18

Show every defined term

audit criteria
means the criteria against which the auditing organisation assesses compliance with each audited obligation or commitment;
audit evidence
means any information used by an auditing organisation to support the audit findings and conclusions and to issue an audit opinion, including data collected from documents, databases or IT systems, interviews or testing performed;
audit procedure
means any technique applied by the auditing organisation in the performance of the audit, including data collection, the choice and application of methodologies, such as tests and substantive analytical procedures, and any other action taken to collect and analyse information to collect audit evidence and formulate audit conclusions, not including the issuing of an audit opinion or of the audit report;
audit risk
means the risk that the auditing organisation issues an incorrect audit opinion or reaches an incorrect conclusion concerning the audited provider’s compliance with an audited obligation or commitment, considering detection risks, inherent risks and control risks with respect to that audited obligation or commitment;
audited obligation or commitment
means an obligation or commitment referred to in Article 37(1) of Regulation (EU) 2022/2065 which forms the subject matter of the audit;
audited provider
means the provider of an audited service which is subject to independent audits pursuant to Article 37(1) of that Regulation;
audited service
means a very large online platform or a very large online search engine designated in accordance with Article 33 of Regulation (EU) 2022/2065;
auditing organisation
means an individual organisation, a consortium or other combination of organisations, including any sub-contractors, that the audited provider has contracted to perform an independent audit in accordance with Article 37 of Regulation (EU) 2022/2065;
control risk
means the risk that a misstatement is not prevented, detected and corrected in a timely manner by means of the audited provider’s internal controls;
detection risk
means the risk that the auditing organisation does not detect a misstatement that is relevant for the assessment of the audited provider’s compliance with an audited obligation or commitment;
inherent risk
means the risk of non-compliance intrinsically related to the nature, the design, the activity and the use of the audited service, as well as the context in which it is operated, and the risk of non-compliance related to the nature of the audited obligation or commitment;
internal control
means any measures, including processes and tests, that are designed, implemented and maintained by the audited provider, including its compliance officers and management body, to monitor and ensure the audited provider’s compliance with the audited obligation or commitment;
materiality threshold
means the threshold beyond which deviations or misstatements by the audited provider, individually or aggregated, would reasonably affect the audit findings, conclusions and opinions;
misstatement
means an intentional or unintentional omission, misrepresentation or error in the declarations or data reported or provided by the audited provider to the auditing organisation, or in the testing environment made available by the audited provider to the auditing organisation;
reasonable level of assurance
means a high but not absolute level of assurance, which allows the auditing organisation to assert in its audit opinion and audit conclusions whether the audited provider complies with the audited obligations or commitments, based on sufficient and appropriate evidence;
substantive analytical procedure
means an audit methodology used by the auditing organisation to assess information to infer audit risks or compliance with the audited obligation or commitment.
test
means an audit methodology consisting in measurements, experiments or other checks, including checks of algorithmic systems, through which the auditing organisation assesses the audited provider’s compliance with the audited obligation or commitment;
vetted researcher
means a researcher vetted in accordance with Article 40(8) of Regulation (EU) 2022/2065;