SCHEDULES
SCHEDULE 12OFCOM’s powers of entry, inspection and audit
4Audit
1
OFCOM may give the provider of a regulated service a notice (an “audit notice”) requiring the provider to permit OFCOM to carry out an audit—
a
to assess whether the provider has complied or is complying with enforceable requirements that apply in respect of the service, or
b
to assess—
i
the nature and level of risk of the provider failing to comply with an enforceable requirement that applies in respect of the service, and
ii
ways to mitigate such a risk.
2
An audit notice may require the provider to take any of the following actions for a purpose mentioned in sub-paragraph (1)—
a
to permit an authorised person to enter and inspect specified premises;
b
to permit an authorised person to observe the carrying on of the regulated service at the premises;
c
to direct an authorised person to documents on the premises that are of a specified description;
d
to assist an authorised person to view information of a specified description that is capable of being viewed using equipment or a device on the premises;
e
to assist an authorised person to view, using equipment or a device on the premises, information demonstrating in real time the operation of systems, processes or features of a specified description, including functionalities or algorithms of a specified description;
f
to assist an authorised person to view, using equipment or a device on the premises, information generated in real time by the performance of a test or demonstration of a specified description;
g
to comply with a request from an authorised person for a copy (in such form as may be requested) of the documents or information to which the person is directed or which the person is assisted to view;
h
to permit an authorised person to inspect the documents, information or equipment to which the person is directed or which the person is assisted to view;
i
to provide an authorised person with an explanation of such documents or information;
j
to make available for interview by the authorised person a specified number of people of a specified description who are involved in the provision of the regulated service (not exceeding the number who are willing to be interviewed).
3
An audit notice—
a
must be given at least 28 days in advance of the start of the audit, and
b
must specify the time or times at which, or period or periods within which, each requirement imposed by the notice must be complied with.
4
An audit notice may not require a provider to permit an authorised person to enter domestic premises.
5
An audit notice may not require a provider to do anything that would result in the disclosure of information or documents in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
6
An audit notice must contain information about the consequences of not complying with the requirements which it imposes.
7
An audit notice may by further notice—
a
be revoked by OFCOM;
b
be varied by OFCOM so as to make it less onerous.
8
OFCOM may require a provider to pay some or all of the reasonable costs of an audit carried out in accordance with an audit notice.
9
10
In this paragraph “specified” means specified in an audit notice.