General Procedure for Inspections and Audits. Duration and scope of inspections or audits must be mutually agreed by Customer and Rizing in advance of the inspection or audit. If the scope of the audit, or parts of it, has been the subject of a third party audit or certification conducted or obtained in the 24 months preceding Customer’s audit request and where Rizing confirms that no known material changes have occurred, Customer shall accept the findings in the third party audit in lieu of carrying out its own audit. Audits may include examination of Rizing’s relevant facilities and records but will always be subject to Rizing’s relevant site access policies and procedures. Any inspection or audit must be conducted at a mutually agreed date and time during local business hours, shall be limited to no more than two (2) consecutive business days and shall not unreasonably disrupt Rizing’s day- to-day business operations or unduly burden the provision of services by Rizing to its customers. Customer shall provide at least thirty (30) calendar days’ prior written notice of its intention to conduct an inspection or audit, unless where the objective circumstances reasonably require a shorter notice period. Customer and any independent auditor retained by Customer must be subject to appropriate obligations of confidentiality. Customer shall bear all expenses for his inspections or audits including the time of any Rizing employees allocated to support an inspection or audit. Any subsequent audits shall only be permissible where mandated by applicable Data Privacy Law or where instructed by a Supervisory Authority.
