DSA VLOP and VLOSE Audit Pack Workflow

Start the pack at service level, not company level. Record the Commission designation, the service name, whether the service is treated as a VLOP or VLOSE, and the EU user-number basis used for designation or continued monitoring.

The audit perimeter should then list the DSA obligations and commitments to be tested for that service: Chapter III obligations, VLOP/VLOSE systemic-risk duties, and any commitments under codes of conduct or crisis protocols that the provider has undertaken.

The risk-assessment file should show how the provider identified, analysed, and assessed systemic risks for the audited service. It should not be a summary memo alone; it needs the underlying data, assumptions, tests, consultations, and sign-offs that explain how the assessment was reached.

Create one evidence row per risk category and per relevant system factor. The row should name the affected service feature, risk hypothesis, data used, regional or linguistic consideration, severity and probability assessment, control owner, and preserved supporting documents.

For each systemic risk, the audit pack should show which mitigation measures were considered, which were adopted, which were rejected, and why. The record should be specific enough for an auditor to test whether the measures are reasonable, proportionate, effective, and actually operating.

Use a mitigation-control matrix rather than a narrative-only policy. Each row should identify the risk, selected mitigation, control owner, system or process touched, implementation date, testing method, evidence location, residual risk, and management review outcome.

The independent-audit dossier should let the audit organisation verify scope, independence, methodology, evidence quality, sampling, findings, and the provider's response to recommendations. Keep a single index that links each audited obligation to the evidence set supplied to the auditor.

The dossier should also anticipate the public and confidential versions of the audit report and audit implementation report. Where information is confidential, record the reason for redaction and the evidence available to the auditor, Commission, or Digital Services Coordinator.

A VLOP/VLOSE audit pack should include the public accountability records that regulators, researchers, users, and auditors can compare against the provider's internal evidence. Keep the transparency-report, data-access, and compliance-governance records linked to the same service and reporting period as the audit.

For data access, maintain a request log that distinguishes Commission or Digital Services Coordinator access from vetted-researcher access. For governance, keep proof that the compliance function is independent from operational functions and can escalate risk or non-compliance to the management body.