PKIoverheid: TSP KPN Findings in 2025 ETSI Audit - Incident Report #3 – Internal Audit

This case addresses a minor non-conformity identified during an internal audit at a KPN subcontractor, where a required internal audit had not been performed. The incident was disclosed during an annual ETSI audit, leading to the creation of a Corrective Action Plan. Key actions included formalizing audit responsibilities in agreements with subcontractors and ensuring that supplier audits are included in the internal audit schedule. The external audit of the subcontractor is currently in progress, with commitments made to improve compliance oversight.

1. 2025-07-11 CAB identifies finding
2. 2025-07-17 KPN created a Corrective Action Plan
3. 2025-08-12 Corrective Action Plan approved by auditor
4. 2026-02-09 External audit of subcontractor scheduled
5. 2026-04-09 Closure summary proposed