DSA VLOP and VLOSE Audit Pack Workflow

Start the pack at service level, not company level. Record the Commission designation, the service name, whether the service is treated as a VLOP or VLOSE, and the EU user-number basis used for designation or continued monitoring.

The audit perimeter should then list the DSA obligations and commitments to be tested for that service: Chapter III obligations, VLOP/VLOSE systemic-risk duties, and any commitments under codes of conduct or crisis protocols that the provider has undertaken.

The Article 34 risk-assessment file should show how the provider identified, analysed, and assessed systemic risks for the audited service. The first assessment is due by the date the Section 5 obligations apply, followed by an assessment at least annually and before deploying a functionality likely to have a critical impact on an identified risk. Include the underlying data, assumptions, tests, consultations, and sign-offs that explain how the assessment was reached.

Create one evidence row per risk category and per relevant system factor. The row should name the affected service feature, risk hypothesis, data used, regional or linguistic consideration, severity and probability assessment, control owner, and preserved supporting documents.

For each systemic risk, the audit pack should show which mitigation measures were considered, which were adopted, which were rejected, and why. The record should be specific enough for an auditor to test whether the measures are reasonable, proportionate, effective, and actually operating.

Use a mitigation-control matrix rather than a narrative-only policy. Each row should identify the risk, selected mitigation, control owner, system or process touched, implementation date, testing method, evidence location, residual risk, and management review outcome.

The independent-audit dossier should let the audit organisation verify scope, independence, methodology, evidence quality, sampling, findings, and the provider's response to recommendations. Keep a single index that links each audited obligation to the evidence set supplied to the auditor. Schedule successive audited periods without gaps and early enough for each audit to be completed at least once a year.

The dossier should also anticipate the public and confidential versions of the audit report and audit implementation report. Where information is confidential, record the reason for redaction and the evidence available to the auditor, Commission, or Digital Services Coordinator.

A VLOP/VLOSE audit pack should include the public accountability records that regulators, researchers, users, and auditors can compare against the provider's non-public evidence. Keep the transparency-report, data-access, and compliance-governance records linked to the same service and reporting period as the audit.

For data access, maintain a request log that distinguishes Commission or Digital Services Coordinator access from vetted-researcher access. For governance, keep proof that the compliance function is independent from operational functions and can escalate risk or non-compliance to the management body.