As part of our supervisory work, we carry out audits in the EU institutions.
Inspections allow us to verify how data protection is applied in practice at an EU institution.
We choose to inspect an EU institution by taking into account a number of factors, including the results of our risk analysis, whether special categories of data are processed, the time elapsed since the last audit and whether there has been an increase in the numbers of complaints.
We also ensure that we cover institutions, bodies and agencies of all sizes in our annual audit planning.
Audits or other on-site checks (for example, as part of our investigations) may also be triggered by complaints, if they require verification on the spot.
Our supervisory work also requires us to regularly audit several large-scale IT systems : at least every four years for the Visa Information System and the Schengen Information System and at least every three years for EURODAC.
The reports of our audit are not made public, but we do periodically summarise these, for instance in our newsletter and annual report.
You may also want to check our Factsheet on the topic and the remote audit on Article 25.
Executive Summary of the Audit report on the Medical Service of the General Secretariat of the Council of the European Union (GSC MS).
Executive Summary of the Audit report on the European Commission's Medical Service (COM MS).
Executive Summary of the Audit report on HR Analytics, recruitment procedures and restriction of data subject rights at the European Central Bank (ECB).
Executive Summary of the Audit report on large-scale IT system concerned: Schengen Information System (SIS) at eu-LISA
Executive summary of the targeted audit at the premises of the European Public Prosecutor's Office (EPPO) in Luxemburg.