EUDR Audit: How to Be Ready Before the Competent Authority Knocks

In an EUDR audit, a national competent authority checks whether your due diligence system meets the regulation. That means documentary checks of your Due Diligence Statements, verification of plot geolocation against satellite imagery, review of your risk assessment and mitigation, and sometimes physical or lab tests (such as isotope or DNA analysis) to confirm a product’s declared origin. Checks are risk-based and mandatory: authorities must inspect at least 1% of operators sourcing from low-risk countries, 3% from standard-risk, and 9% (plus 9% of volume) from high-risk. Authorities can also hold a supply chain for up to 72 hours and impose fines of at least 4% of EU turnover so an EUDR audit is a matter of when, not if.

Key Takeaways

• It tests your system, not your intentions. An audit checks whether your due diligence system can produce complete, dated, batch-linked evidence on demand not just whether your sourcing is clean.
• It’s when, not if. Check rates are mandatory minimums (1% / 3% / 9% by country risk, per commodity). For real volume, an audit is a statistical certainty, not a sign of suspicion.
• Audits are lost on retrieval. The common failure is records that exist but can’t be reconciled to a sampled batch in time not dirty supply.
• Paper must match the ground. Authorities verify geolocation against satellite imagery and can run isotope or DNA tests, then hold goods for up to 72 hours. Declared origin has to be real.

What an EUDR Audit Actually Checks

An EUDR audit is a compliance check carried out by a national competent authority to confirm that an operator or trader is meeting the EU Deforestation Regulation. In plain terms, it is an examination of your evidence, not just your product. The authority is testing whether your due diligence system under Article 12 can stand behind every Due Diligence Statement (DDS) you have filed.

A typical audit can include several layers:

• Documentary checks: your DDS records, geolocation data, risk assessment and mitigation evidence, and supplier reference numbers.
• Satellite verification: your plot geolocation compared against satellite forest imagery to confirm the deforestation-free claim.
• Physical and lab checks: inspection of goods and facilities, and technical means such as isotope or DNA testing to confirm a product’s declared origin and species.
• Enforcement powers: authorities can hold a supply chain for up to 72 hours, and sanctions run to confiscation, market bans, exclusion from public procurement and fines of at least 4% of EU turnover.

Those obligations become enforceable from 30 December 2026 for large and medium operators, and 30 June 2027 for micro and small operators — so an audit is a 2027 reality to prepare for now.

Why an Audit Is When, Not If

The most useful mindset shift is to stop treating an audit as something that happens to companies that did wrong. The checks are a mandatory, risk-tiered quota. Under Article 16, competent authorities must inspect at least 1% of operators sourcing from low-risk countries, 3% from standard-risk, and 9% plus 9% of product volume from high-risk, and those targets are met for each commodity separately.

Because the country benchmarking published in May 2025 puts only Belarus, Myanmar, North Korea and Russia in the high-risk band, almost everyone else sits at standard risk, facing that 3% floor every year. Spread across commodities and shipments, an audit becomes a statistical certainty for any serious importer not a red flag. On top of the quota, a substantiated concern raised by an NGO, whistleblower or competitor can pull you into a check with no warning at all.

So the honest question isn’t whether you’ll face an audit. It’s whether, on the day you do, you can produce a defensible file fast enough.

Understanding whether a sourcing country is classified as low, standard, or high risk is essential for designing the right due diligence strategy.

See How Country Risk Impacts Due Diligence →

Where an Audit Is Really Won or Lost: Real-World Scenarios

These illustrative field scenarios show that audits usually fail on evidence handling, not on deforestation and the practice that prevents each one.

The records that existed but couldn’t be pulled

An operator held its DDS and geolocation data across spreadsheets and email threads. When the authority asked for the complete file behind one sampled batch within days, the team couldn’t reconcile which plots fed which shipment in time and was flagged on process, despite clean sourcing. Best practice: keep a batch-linked, queryable evidence system so any shipment’s file is one click, not a scavenger hunt.

The reference numbers that didn’t reconcile

A downstream operator had stored plenty of DDS reference numbers, but they didn’t map to the invoices and consignments the authority sampled. The mismatch alone triggered a deeper check. Best practice: reconcile every reference number to its shipment at intake, so the paper trail ties end to end.

The paper that didn’t match the ground

Declared geolocation didn’t line up with the satellite forest layer, and an isotope test on a timber consignment didn’t match the declared region. The authority placed a 72-hour hold and opened an investigation. Best practice: pre-screen every plot against satellite data before filing, and make sure declared origin reflects physical reality.

The substantiated concern nobody saw coming

An NGO filed a substantiated concern about a sourcing region. Operators there were pulled into checks with no notice; those with a ready evidence file cleared quickly, while others scrambled for weeks. Best practice: maintain audit-ready files continuously, not reactively assume the request could land tomorrow.

How to Prepare for an EUDR Audit: An Audit-Ready System

Passing an EUDR audit is an exercise in retrieval and reconciliation. A platform built for audit-readiness should do six things.

1. Link every record to a batch. Tie each DDS, geolocation set, risk assessment and reference number to a specific shipment, so any batch’s file is retrievable in one step.
2. Reconcile reference numbers end to end. Match DDS reference and verification numbers to invoices and consignments at intake, closing the gap authorities probe first.
3. Pre-screen geolocation against satellite. Confirm plots hold up against forest data before filing, so paper and ground already agree when the authority checks.
4. Retain everything for five years. Keep a complete, tamper-evident record for the full retention period, with nothing purged early.
5. Run a mock audit. Drill the request: pick a random past shipment and time how long it takes to produce its full file. Fix whatever is slow before an authority finds it.
6. Keep one source of truth. Consolidate DDS, supplier and monitoring data in one system so nothing lives only in an inbox or a laptop.

TraceX EUDR Solutions simplifies EUDR audits by creating a centralized, audit-ready repository of supplier information, geolocation data, due diligence records, risk assessments, and supporting evidence. Every compliance activity is digitally documented, time-stamped, and traceable, enabling businesses to quickly demonstrate compliance, respond to auditor requests, and reduce the effort required during regulatory inspections.

EUDR compliance depends on more than knowing where commodities originate it requires maintaining a verifiable chain of custody from production plot to final product.

See How TraceX Digitizes Chain of Custody →

EUDR Audit Check Rates by Country Risk

Your inspection likelihood is set by where you source. These are the annual minimums.

Effective EUDR compliance requires more than identifying risks it requires assessing, documenting, and mitigating them with reliable evidence.

Explore EUDR Risk Assessment

Audit Readiness Checklist

Before an authority asks, confirm you can tick every box.

• ✓ Any sampled batch’s full evidence file can be produced within the authority’s deadline.
• ✓ DDS reference and verification numbers reconcile to invoices and consignments.
• ✓ Plot geolocation has been checked against satellite data and holds up.
• ✓ Risk assessment and mitigation are documented for standard- and high-risk sourcing.
• ✓ All records are retained for five years, with nothing purged early.
• ✓ You have run at least one mock audit and fixed the slow points.
• ✓ DDS, supplier and monitoring data live in one source of truth, not scattered files.

Frequently Asked Questions