Review of the security measures: Audit report

Article 3(3) of the Commission Delegated Regulation (EU) 2018/389 states that the “audit shall present an evaluation and report on the compliance of the payment service provider's security measures with the requirements set out in this Regulation”. This Regulation does not specify the format of the audit or the format or length of the audit report. If the payment service provider would like this audit to be conducted together with other audits on security measures, such an option is not excluded by the Regulation, provided that the auditors have “expertise in IT security and payments and be operationally independent within or from the payment service provider” and that they are conducted with the same frequency as foreseen in Article 3(2) of this Regulation. While the report may form part of a wider report, it should be extractable and isolated from the rest of any such report given the requirement in Article 3(3) for the report to be available to competent authorities upon request.