# Recommendations on calculating the audit cycle in EU Large-Scale IT Systems - Type: Guidance - Source: EDPB - Identifier: recommendations-calculating-audit-cycle-eu-large-scale-en - Date: 2025-10-13 - Original: https://www.edpb.europa.eu/our-work-tools/our-documents/csc-documents/recommendations-calculating-audit-cycle-eu-large-scale_en - Canonical: https://overview.legal/posts/51269 - Topics: Supervision ## Summary 1 Recommendations on calculating the audit cycle in EU Large-Scale IT Systems The EU's Large-Scale IT Systems’ regulations establish specific audit cycle requirements for Supervisory Authorities expressed in years. For Schengen Information System 1 (SIS), Visa Information System 2 (VIS) and in the framework for interoperability 3 , the required minimum frequency is once every four years. For Entry/Exit System 4 (EES) and European Travel Information and Authorisation System 5 (ETIAS), audits… ## Full text 1 Recommendations on calculating the audit cycle in EU Large-Scale IT Systems The EU's Large-Scale IT Systems’ regulations establish specific audit cycle requirements for Supervisory Authorities expressed in years. For Schengen Information System 1 (SIS), Visa Information System 2 (VIS) and in the framework for interoperability 3 , the required minimum frequency is once every four years. For Entry/Exit System 4 (EES) and European Travel Information and Authorisation System 5 (ETIAS), audits must be conducted at least every three years. Compliance with these audit cycles is a key element of the Schengen Evaluations, during which the on-site teams assess whether supervisory obligations have been met. In this context, the CSC recommends that both evaluated authorities and on-site teams consider the following aspects when evaluating the application of the Schengen acquis: 1. Full four calendar years without a completed audit in SIS 6 , VIS 7 and in the framework for interoperability 8 (respectively three calendar years in EES 9 and ETIAS 10 ) should be found non-compliant with applicable regulations. This conclusion stems from the clear wording of the relevant EU legal acts, which establish maximum time intervals between successive audits. 2. The audit cycle should be calculated in years, in accordance with Art. 3(2)(c) of Regulation 1182/71 11 which lays down the general rules for determining periods, dates and time limits in legal acts adopted by the EU institutions. 3. The date of audit completion should mark the starting point for calculating the next audit cycle. Although EU legal acts do not explicitly define what constitutes the completion of an audit, it is generally understood as the point at which all planned audit activities have been carried out. Common reference points include the final day of the on-site visit or the date of the audit report. This moment may vary depending on national procedures, methodologies and the international auditing standards followed. Given their independent status, Supervisory Authorities should have flexibility in determining when an audit is considered complete—particularly in cases where unforeseen developments (e.g. procedural delays, need to collect additional information or operational constraints) prevent strict adherence to the original plan. Nevertheless, such flexibility must not compromise compliance with the maximum intervals established by law. 2 4. Supervisory Authorities should remain responsible for determining the timing of the next audit within the legally allowed timeframe. While the regulations establish minimum audit frequency, they do not prescribe specific scheduling, leaving this decision to the discretion of each authority. This autonomy is essential to accommodate national specificities, including available resources, prioritisation of supervisory activities, and the results of previous audits. 1 Regulation (EU) 2018/1860 of the European Parliament and of the Council of 28 November 2018 on the use of the Schengen Information System for the return of illegally staying third-country nationals Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006 Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU 2 Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of information between Member States on short-stay visas, long- stay visas and residence permits (VIS Regulation) 3 Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 4 Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 5 Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 6 Art. 19 Regulation 2018/1860, Art. 55(2) Regulation 2018/1861, art. 69(2) Regulation 2018/1862 7 Art. 41(3) VIS Regulation 8 Art. 51(3) Interoperability regulations 9 Art. 55(2) EES Regulation 10 Art. 66(4) ETIAS Regulation 11 Regulation (EEC, Euratom) No 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits ## Cited law provisions (7) ### GDPR — gdpr-art-3-par-2-en This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ### GDPR — gdpr-art-41-par-3-en The competent supervisory authority shall submit the draft criteria for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63. ### GDPR — gdpr-art-51-par-3-en Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63. ### GDPR — gdpr-art-55-par-2-en Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply. ### GDPR — gdpr-art-66-par-4-en By derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the Board. ### GDPR — gdpr-art-69-par-2-en Without prejudice to requests by the Commission referred to in point (b) of Article 70(1) and in Article 70(2), the Board shall, in the performance of its tasks or the exercise of its powers, neither seek nor take instructions from anybody. ### GDPR — gdpr-art-19-en The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. --- Generated by overview.legal · https://overview.legal/posts/51269 · 2026-08-22