LESEN
Neuigkeiten

Compliance auditing: from questions to a Statement of Compliance

Date:March 27, 2026

Introduction

In May 2025, Projective Group NL (PGNL) was approached by DCA Market Intelligence (DCA) from Lelystad. DCA is an independent, privately owned price reporting agency (PRA) specialising in the provision of benchmark prices and market intelligence for global agricultural commodity markets, such as dairy, meat and potatoes.

For its dairy benchmarks, DCA wished—on a voluntary basis—to comply with the principles established in 2013 by IOSCO, the International Organization of Securities Commissions, for financial benchmarks. One of these principles requires DCA to appoint an independent internal or external auditor with the appropriate experience and expertise to periodically assess whether DCA complies with the established criteria and principles, and to report on the outcomes.

DCA requested PGNL to fulfil this role as independent internal auditor. Our experienced risk and audit consultant, Gerard Jong, subsequently carried out this compliance audit.

On 24 February 2026, DCA announced on its website that this PRA audit had been successfully completed. This resulted in a formal Statement of Compliance, which is available to third parties upon request. Gerard explains how this statement came about and how the collaboration with DCA developed:

“A great result for our client, which started with valid questions directed at us and at IOSCO. It was achieved through effective and pleasant collaboration with DCA’s PRA team, led by their coordinator and Head of PRA, Eric de Lijster.”

A great result for our client, achieved through effective and pleasant collaboration

Questions

DCA’s agricultural benchmarks are not financial benchmarks as defined by the European Union’s Benchmarks Regulation. Therefore, DCA does not require a licence from De Nederlandsche Bank or the Dutch Authority for the Financial Markets and is not subject to their supervision.

Compliance means meeting expectations, and this was the first time DCA had to demonstrably comply with a set of detailed expectations. Unsurprisingly, this raised a considerable number of questions, both for us and for IOSCO.

“DCA asked us, among other things, about the roles and responsibilities of the coordinator and team members, the documentation required for the audit, and the structure of the audit process,” Gerard explains. “They also asked about the main pitfalls for a relatively small organisation where roles and responsibilities are shared.”

These questions were addressed during an introductory meeting between Gerard and Eric at PGNL’s office in Amsterdam (IJburg).

From June onwards, attempts were also made to contact representatives of IOSCO in Madrid. Unfortunately, this did not result in answers to DCA’s questions, including those regarding IOSCO’s expectations of the external auditor’s role. In the absence of such guidance, DCA began preparing for the audit in early October.

At the time, DCA indicated that it was still working intensively on completing the necessary written documentation in the form of a compliance dossier. “They expected to be audit-ready by late October or early November,” Gerard recalls. “I advised them to take the time needed to reach that stage—quality should clearly take precedence over speed.”

Gerard was pleasantly surprised by the quality of the extensive compliance dossier when he received it in early December.

Audit process

Before reviewing the documentation, agreement was reached on the reporting format, as IOSCO had not provided guidance on this. The aim was to ensure that the format would be clear, readable, and self-explanatory for its intended users.

“The chosen format met both my expectations and those of DCA, so we reached agreement quickly,” Gerard notes.

An on-site audit at DCA’s office in Lelystad was scheduled for 8 January 2026 but had to be postponed by a week due to winter weather conditions.

Prior to the visit, Gerard reviewed the compliance dossier against the 19 IOSCO principles to form an initial view of how and to what extent DCA met the relevant expectations.

During the on-site audit, Gerard spoke with a wide range of individuals involved in the price reporting process, including price reporters, IT representatives, the Compliance Associate, the Head of PRA and the Managing Director. He also observed the evaluation and compilation of benchmark prices for week 3 of 2026.

Based on these discussions and additional information provided afterwards, Gerard began drafting the Statement of Compliance.

Before sharing the draft with the Head of PRA for review, it was internally reviewed by an experienced colleague as part of quality assurance. “It is important to note that audit reports such as this are always the result of at least ‘two pairs of eyes’. In practice, this significantly enhances quality,” Gerard explains.

It is important to note that audit reports such as this are always the result of at least ‘two pairs of eyes

Following DCA’s review and some minor textual adjustments, the statement was finalised and deemed fit for purpose. At DCA’s request, a short audit statement was also prepared, which is publicly available on DCA’s website.

Statement of Compliance and follow-up

The IOSCO principles allow for proportional implementation:

“IOSCO does not expect a one-size-fits-all method of implementation to achieve these objectives… In particular, the application and implementation of the Principles should be proportional to the size and risks posed by each Benchmark and/or Administrator and the benchmark-setting process.”

According to the Statement of Compliance, the audit resulted in:

  • 14 findings of “Compliant”
  • 4 findings of “Compliant (proportionally applied and implemented)”
  • 1 finding of “Not Applicable”

When presenting the final Statement of Compliance and audit statement to the Managing Director, Gerard also highlighted areas for further improvement in DCA’s overall price reporting process.

Collaboration

Gerard emphasises that both the audit and its outcome were the result of a constructive and positive collaboration between auditor and auditee.

“It was frustrating that we were unable to reach IOSCO last year to obtain answers to DCA’s legitimate questions. However, we took on the challenge together regardless. There was a strong working relationship with Eric—he clearly understood what was required to carry out the audit effectively and acted accordingly.”

“This result is well deserved for him and his team and provides a solid foundation for DCA’s future international development. I am pleased to have contributed to this as an external auditor.”

Reflection from DCA

According to Eric de Lijster, Head of PRA at DCA, the process began with a fundamental question: where do you start as an organisation with such a compliance process?

“The initial phase felt like a considerable challenge. You know you must comply with the IOSCO principles, but translating them into concrete steps and internal processes is not straightforward.”

The collaboration with Gerard Jong proved to be a crucial first step:

“Gerard helped us bring structure to the initial phase and to build the dossier in a focused way. His extensive experience and strong compliance background provided valuable guidance. At the same time, it raised the bar—we realised that the dossier needed to be both complete and substantively robust, and that our internal processes had to align properly with the IOSCO guidelines.”

A defining feature of the collaboration was that responsibility for implementation remained with DCA:

“Gerard guided us professionally, without compromising his role as an independent auditor. We had to develop and present the solutions ourselves. With the invaluable support of our Compliance Associate, we succeeded in building a solid and consistent dossier.”

Internally, the process also required a shift in mindset:

“Initially, compliance was sometimes seen as an additional burden. Now it is widely recognised as a valuable support to our operations and decision-making as a PRA.”

Initially, compliance was sometimes seen as an additional burden. Now it is widely recognised as a valuable support to our operations and decision-making as a PRA.

The audit day itself was a key moment:

“For some colleagues, it initially felt like a strict examination. It was therefore encouraging to see them return from discussions energised and enthusiastic. The questions were sharp and relevant, yet always asked in an open and constructive atmosphere. Gerard remained approachable and empathetic, without losing sight of the IOSCO guidelines.”

Looking back, the overall sentiment is one of satisfaction:

“We look back on this compliance audit and the collaboration with great satisfaction. It has not only enabled us to demonstrate compliance with IOSCO principles, but also strengthened our internal processes.”

Conclusion

A well-designed and properly executed compliance audit provides independent and expert insight into the effectiveness of a compliance framework. It helps organisations to:

  • identify risks at an early stage;
  • uncover blind spots in processes;
  • test assumptions against reality; and
  • steer improvements in a substantiated manner.

A compliance audit requires thorough preparation, a sharp eye, and effective collaboration. DCA invested significant effort in becoming audit-ready, enabling us to assess whether IOSCO principles are demonstrably adhered to.

“It was a pleasure that the collaboration required for this process was so constructive,” Gerard concludes. “Audit processes are ultimately about people we need each other to ensure they are successfully carried out and completed, regardless of the outcome.”