So it appears MasterCard took a quiet U-turn over the festive break and dropped the requirement for an onsite QSA audit for level 2 merchants for July 2010:
A more sensible date of 30 June 2011 is listed, along with the footnote that Merchants can use their own staff as long as they have sat and passed the QSA (or merchant-equivalent) exam.
I can’t quite make up my mind whether that’s good or bad.
On the plus point, Merchants won’t get an inexperienced QSA onsite with no retail experience making incorrect scoping decisions.
On the negative side, Merchants whom have a poor grasp of the standard and like ticking boxes will still be able to get through this ‘loophole’ for another year or so. Even if Merchants put an employee through the QSA programme, it’s only going to teach them how to tick more boxes and use different coloured marker pens.