Responding to the vendor audit
First, issue receipt of the request for audit. This can be a formal letter or email to the auditor. This is also the time to notify the auditor who the single point of contact is and that they should not approach anyone else. Additional information can also be requested at this point, such as:
Confirmation of the products that are subject to the audit
Provision(s) that the vendor/auditor believes entitles them to undertake the audit
Obtain an NDA
An NDA often represents the only opportunity to put a fence around the scope of a software audit. Many software publishers and their hired auditors may refuse to consider comprehensive pre-audit agreements. However, most typically will agree to negotiate NDAs to control the handling of audit data. An audited business needs to make the most of that opportunity by ensuring that the data to be disclosed is relevant to the kinds of questions that the auditor is allowed to ask. Almost always it is a good idea to include appropriate, corresponding protective measures in the NDA to protect all parties involved.
Although completion of the NDA phase can take time, it’s advised not to proceed with the audit until this step is complete.