The Chamber believes that the costs of targeted security audits must be reimbursed to companies of all sizes

The Ministry of Justice and Digital Affairs has prepared a draft regulation entitled “Detailed Conditions and Procedure for Conducting Targeted Security Audits”, which sets out the principles for conducting security audits as part of supervision and reimbursing their costs. In its opinion, the Chamber pointed out that the rules governing the reimbursement of the costs and the organisation of targeted security audits need to be clarified in order to prevent unequal treatment of entrepreneurs.

Reimbursement of security audit costs must be extended to all entrepreneurs
Under the draft regulation, only small enterprises and public sector institutions would be entitled to apply for reimbursement of the costs of targeted security audits. The Chamber believes that restricting eligibility for reimbursement and requiring entrepreneurs to bear the costs of security audits result in unequal treatment. This also unreasonably increases the costs borne by medium-sized and large enterprises. A targeted security audit is a supervisory measure, the costs of which should not be borne by an entrepreneur acting in good faith if the audit identifies no deficiencies. The Chamber proposed that all companies, regardless of their size, should have the right to apply for reimbursement of the costs.

Costs must also be reimbursed when no deficiencies are identified
The grounds for reimbursement currently set out in the draft regulation are too narrow. The Chamber considers it unreasonable that an entrepreneur should have to bear the costs of an audit conducted as a supervisory measure initiated by the Information System Authority, even when no violations are found in the entrepreneur's activities. The Chamber proposed adding a provision to the draft regulation under which the Information System Authority would also reimburse the costs of a security audit if the final report identifies no deficiencies.

Each repeated security audit must be based on a separate administrative act
The draft regulation would allow an administrative act to specify a period during which targeted security audits could be carried out repeatedly. The Chamber believes that each decision to require a security audit must be based on a current risk assessment and issued by a separate administrative act. A general right to conduct repeated audits creates legal uncertainty for entrepreneurs, so the Chamber proposed removing this option from the draft regulation.

The criteria for market prices and reimbursable costs need to be clarified
Under the draft regulation, the Information System Authority would take the market price of an equivalent audit into account when determining reimbursement. However, because the audit market is limited and specialised, assessing the market price at the Information System Authority's discretion creates uncertainty for entrepreneurs. The Chamber proposed establishing clear grounds for assessing market prices and specifying in the draft regulation that necessary auditor fees and directly related unavoidable costs (including labour costs) are reimbursable.

More information about the planned amendments is available HERE. Under the draft regulation, the regulation will enter into force in accordance with the general procedure, that is, on the third day after its publication in the Riigi Teataja. It is not yet known when the amendments will enter into force.