Shall a Beneficiary accept all requests from auditors?

According to the Article 25.1.1 “The granting authority may — during the action or afterwards — check the proper implementation of the action and compliance with the obligations under the Agreement, including assessing costs and contributions, deliverables and reports.”

Considering that the European Commission is granting research project – and it is not a loan (which must be reimbursed) – it is normal and even mandatory that audit services are carrying out checks, controls, reviews, audits and investigation to ensure the proper use of the grant.

While cooperation is essential for a smooth and successful audit, blind acceptance of every request can lead to inefficiency, unnecessary costs, operational disruptions, or even risks to confidentiality and privilege. The key is professional, risk-based cooperation grounded in relevance, reasonableness, and clear communication.

Now, shall a Beneficiary accept all requests from auditors?

That an audit is carried out by internal auditors (officials from the DG RTD) or by external audit firms (KPMG, Deloitte, EY…), the answer is NO, you should not accept all requests from auditors without question.

Why You Should Generally Cooperate?

First of all, it is a contractual obligation that every Beneficiary accepts when signing the Grant Agreement. The consequence of non-compliance is “If a beneficiary breaches any of its obligations under this Article, costs or contributions insufficiently substantiated will be ineligible (see Article 6) and will be rejected (see Article 27), and the grant may be reduced (see Article 28).” Art.25.5.2 of the Grant Agreement.

Additionally, auditors need sufficient appropriate evidence to check the costs and to form their opinion. Stonewalling legitimate requests can:

• Lead to scope limitations, qualified opinions, or regulatory issues.
• Lead to the rejection of 100% of the costs declared for the period audited, with potential extrapolation to all other H2020 and Horizon Europe projects.
• Damage the working relationship and raise red flags.
• Delay the audit and increase fees.

Transparency and prompt responses to standard requests (financial records, reconciliations, contracts, etc.) demonstrate, professionalism, strong controls and integrity.

When (and How) to Push Back

Now, by experience, we could notice that not every request is reasonable or necessary. There are common situations where you should evaluate carefully, such as:

• Irrelevant or overly broad “fishing” expeditions — Requests far outside the audit scope or risk areas. The scope of the audit is indicated in the Letter of Announcement (LoA) and, normally, auditors should not ask any information on projects or periods not indicated in the LoA.
• Unreasonable deadlines or formats that create disproportionate burden. The dates for the venue of the auditors (the one they have chosen) is not always matching with you calendar (closure of the accounts, customer event, holidays of the employees…), and you are totally able to ask for new dates.

As for the preliminary information, auditors will ask you – with unreasonable deadline – to send them a list of documentation before the audit on the spot. This represents almost 1 Person Month of work and it is the most important phase of the audit as you are going to set the mind of the auditors (are you well prepared or not)

• Excessive volume that would unreasonably disrupt operations: If the preliminary information must be sent to the auditor prior their venue, only a part of it shall be prepared before the audit and they will check all original document during their venue.
• Requests that could waive legal privilege (e.g., certain internal investigation documents or attorney work product). 1 external audit firm is requesting that you are downloading on their “internal platform” ALL documents, even some which confidential (work contracts, payslips, contract with clients of with subcontractors….). This information must be shown at the time of the audit, but auditors cannot request to take this information with them.
• Redundant or duplicative tasks that were already provided. If an information was already provided, there is no reason to accept to provide it several times. Auditors are professional people and well organised, so they should be able to retrieve the documentation.

Best practices for handling requests:

As a general rule, EFMC always recommends to fully cooperate with the auditors and to maintain polite and respectful relations. But for every single audit we have been supporting so far (Beneficiary side), at some point auditors are always overstepping their bounds.

1. Ask “Why?” — Politely request clarification on the purpose and relevance. A good auditor will explain the risk or assertion being tested.
2. Assess reasonableness — Refer to the engagement letter, audit plan, or applicable standards (e.g., what is “reasonable” under the circumstances).
3. Propose alternatives — Offer similar evidence that achieves the same objective with less burden (e.g., samples instead of full populations, or summaries with access to details).
4. Document everything — Track all requests, responses, and any pushback with dates and rationales. Use a centralized log or audit liaison.
5. Escalate constructively — Discuss with the audit manager or engagement partner. Involve your CFO, audit committee, or legal counsel for sensitive matters. When the audit manager refuses to communicate, do not hesitate to involve the Deputy Head of Unit of the CAS.
6. Set boundaries early — Agree on communication protocols, response timelines, and a single point of contact during the planning phase.

Real-World Perspective

Many organizations report that auditors sometimes expand requests as fieldwork progresses. Companies that know their rights and the license/contract terms (in the case of vendor audits) can successfully limit overreach by tying responses back to agreed scope.

Pushing back with justification does not make you difficult — it shows you are a responsible steward of company resources. Unjustified resistance, however, can harm credibility.

Practical Tips in the Preparation Phase

• Designate an audit coordinator / Single contact point to triage requests.
• Define the strategy of the audit and the approach you have with the auditors.
• Prepare a strong Prepared by Client (PBC) list in advance to fulfill most needs proactively.
• Review prior-year requests to identify patterns. You have to check every single information before sending them to the auditors
• Involve legal counsel for any requests involving litigation, investigations, or privileged information. Consider that an audit is a tax control. It is of most importance that you have external support.

Bottom Line

Cooperate fully on legitimate, relevant requests — but do not hesitate to challenge or negotiate those that are unreasonable, irrelevant, or overly burdensome. A successful audit is a collaborative process, not a one-way submission of everything asked. Professional skepticism goes both ways.

If you’re facing specific types of requests (e.g., IT systems access, legal letters, or large data pulls), feel free to share more details for tailored advice. Strong preparation and clear communication (as discussed in the previous article) make it much easier to handle these situations effectively.

Preparing for a CAS audit?

Our experts support Horizon Europe and H2020 beneficiaries with audit preparation, documentation reviews, risk assessment and communication with auditors.

Get in touch with EFMC to ensure your organisation is fully prepared for a successful audit.