A service agreement could include the right to audit controls via a:

1. A customer often cannot inspect the provider directly. 2. Someone else can be given that access on their behalf. 3. The service agreement could include the right to audit controls via a third party. 4. So the answer is a third party. _Source: NIST SP 800-144, 'Guidelines on Security and Privacy in Public Cloud Computing'_