Common use of Audit and Compliance Review Clause in Contracts

Audit and Compliance Review. 2.1. Subrecipient shall conduct an annual financial audit of the STIF Formula Funds received by the Subrecipient pursuant to this Agreement and OAR 732-040-0015. 2.2. All audits prepared pursuant to Section 2.1 shall include the agreed-upon procedures (AUP) engagement requirements, developed by ODOT, established in accordance with Generally Accepted Government Auditing Standards (GAGAS), and any subsequent amendments. Those procedures, and related costs, will be included with the Subrecipient’s annual financial statement audit as referenced in Section 2.1 The AUP should be completed at the same time as the Subrecipient’s annual financial audit but no later than 90 days after completion of the Subrecipient’s annual financial audit. 2.3. Subrecipient shall be subject to periodic on-site compliance reviews by TriMet, the QE, as prescribed in ODOT’s STIF Formula QE-Subrecipient Oversight Compliance Guide, and any amendments to such guide. The purpose of the compliance site review is to ensure that Subrecipient has appropriate, adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF Formula Funds. Compliance reviews may include, but not be limited to the following, as applicable: program and project management, financial management, operations management, procurement, use and maintenance of equipment, records retention, compliance with state and federal civil rights laws, compliance with the Americans with Disabilities Act (ADA), compliance with FTA drug and alcohol regulations, charter and school bus, and safety and asset management. 2.4. The following reports are required as part of the Subrecipient’s annual Financial Statement audit, in conjunction with the AUP engagement: 2.4.1 When conducting a financial statement audit in accordance with Generally Accepted Auditing Standards (GAAS) and Generally Accepted Government Auditing Standards (GAGAS or the Yellow Book), written representations are provided in Subrecipient’s Representation Letter regarding STIF Formula Funds to complement the auditing procedures of the independent auditor. TriMet requires the following language to be included in the Representation Letter to account for STIF Formula Funds, regardless of materiality: “We are responsible for complying, and have complied with, the requirements pursuant to ORS Chapter 184 and OAR 732, Divisions 40 and 42 for the use of STIF Formula funds identified in the approved FY2022-23 STIF Plan. We have all appropriate, adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF Formula Funds, including program and project management, financial management, operations management, procurement, use and maintenance of equipment, records retention, compliance with state and federal civil rights laws, compliance with the Americans with Disabilities Act (ADA), compliance with FTA drug & alcohol regulations, charter and school bus, and safety and asset management.” 2.4.2 No later than 30 days after receipt of the auditor’s financial report, Subrecipient will provide an electronic copy of the following documents to TriMet through the Nextcloud Dropbox: 2.4.2.1. Audited Financial Statement Report or Comprehensive Annual Financial Report (CAFR) or Annual Comprehensive Financial Report (ACFR) and Single Audit, when applicable;

Audit and Compliance Review. 2.1. All audit and compliance review requirements shall be based on the written guidance provided by ODOT regarding the responsibilities of the QE to conduct oversight activities. This guidance, currently captured in “QE- Subrecipient Oversight Compliance Guide” dated June 2021 and as amended in May 2022, shall be incorporated by reference and any subsequent amendments to that guide shall be incorporated into the audit and compliance processes as outlined in this agreement. In the event the parties cannot reach resolution, ODOT shall have responsibility to determine in writing any disagreements regarding implementation of the QE guidance. Subrecipient oversight should not duplicate oversight in areas already monitored by ODOT, FTA, or otherwise evaluated through the independent audit process. 2.2. Subrecipient shall conduct an agreed-upon procedure (AUP) to satisfy the annual financial audit of the STIF Formula Funds received and expended by the Subrecipient pursuant to this Agreement and OAR 732-040-0015. AUP will be carried out by an independent licensed public accountant contracted by the Subrecipient in conjunction with the Subrecipient’s annual financial audit or as a separately contracted out independent ad-hoc audit carried out by a licensed public accounting firm contracted by the Subrecipient. Subrecipient will adhere to financial management procedures in accordance with Oregon and other applicable laws and requirements, and specifically as provided by ORS 184.751 through 184.766 and OAR Chapter 732, Divisions 40 and 42 in addition to the requirements set forth in this Agreement. 2.22.3. All financial audits prepared pursuant to Section 2.1 shall include the agreed-upon procedures (AUP) AUP engagement requirements, developed by ODOT, established as prescribed in ODOT’s STIF Formula QE-Subrecipient Oversight Compliance Guide, and in accordance with Generally Accepted Government Auditing Standards (GAGAS), and any subsequent amendmentsas well as annual expense testing as that meets the QE expense testing requirement as outlined in the QE- Subrecipient Oversight Compliance Guide. Those procedures, and related costs, will be included with the Subrecipient’s annual financial statement audit as referenced in Section 2.1 and will be reimbursed to Subrecipient as a cost of the Project or Projects from the subrecipient’s STIF allocation as included in the subrecipient’s approved STIF Plan. The AUP should and expense testing will be completed at the same time as the Subrecipient’s annual financial audit but no later than 90 days after completion if possible and results of the AUP and expense testing shall be submitted within 30 days of the submission of the finalized financial audit report, unless a change is mutually agreed by TriMet and Subrecipient’s annual financial audit. 2.32.4. In conjunction with the above-described audit and expense testing, as directed in writing by ODOT, TriMet may request additional information regarding specific projects or services. Provided, however, that it is the intent of the parties that TriMet will not request additional information if doing so would be duplicative of audits previously performed by Subrecipient or ODOT. As such, TriMet may not request an additional audit if either ODOT or Subrecipient has previously performed an audit (1) that covered the same time period as the audit requested by TriMet; (2) involved a review of the information required by OAR 000-000-000; and (3) was otherwise consistent with any audit procedures or requirements set forth in an ODOT-approved guidance document. 2.5. Subrecipient shall be subject to periodic on-site compliance reviews by TriMet, the QE, or third- party auditor, as prescribed in ODOT’s STIF Formula QE-Subrecipient Oversight Compliance Guide, and any amendments and addendums to such guide. The purpose of the compliance site review is to ensure that Subrecipient has appropriate, adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF Formula Funds. Compliance reviews may include, but not be limited to the following, as applicable: program and project management, financial management, operations management, procurement, use and maintenance of equipment, records retention, compliance with state and federal civil rights laws, compliance with the Americans with Disabilities Act (ADA), compliance with FTA drug and alcohol regulations, charter and school bus, and safety and asset management. This review shall occur at a frequency outlined in the QE- Subrecipient Oversight Compliance Guide or in amended guidance and will not duplicate any materials that have already been tested as part of the completion of the annual AUP, the annual expense testing completed by a third party auditor and any audits completed by ODOT or FTA during the period of review. 2.42.6. The following reports are required as part of the Subrecipient’s annual Financial Statement audit, in conjunction with the AUP engagementengagement and expense testing: 2.4.1 2.6.1. When conducting a financial statement audit in accordance with Generally Accepted Auditing Standards (GAAS) and Generally Accepted Government Auditing Standards (GAGAS or the Yellow Book), written representations are provided in Subrecipient’s Representation Letter regarding STIF Formula Funds to complement the auditing procedures of the independent auditor. TriMet requires the following language to be included in the Representation Letter to account for STIF Formula Funds, regardless of materiality: “We are responsible for complying, and have complied with, the requirements pursuant to ORS Chapter 184 and OAR 732, Divisions 40 and 42 for the use of STIF Formula funds identified in the approved FY2022FY2019-23 21 STIF Plan. We have all appropriate, adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF Formula Funds, including program and project management, financial management, operations management, procurement, use and maintenance of equipment, records retention, compliance with state and federal civil rights laws, compliance with the Americans with Disabilities Act (ADA), compliance with FTA drug & alcohol regulations, charter and school bus, and safety and asset management.” 2.4.2 No 0.0.0. Xx later than 30 days after receipt of the auditor’s financial report, Subrecipient will provide an electronic copy of the following documents to TriMet through the Nextcloud Dropbox: 2.4.2.12.6.2.1. Audited Financial Statement Report or Comprehensive Annual Financial Report (CAFR) or Annual Comprehensive Financial Report (ACFR) and Single Audit, when applicable;

Audit and Compliance Review. 2.1. All audit and compliance review requirements shall be based on the written guidance provided by ODOT regarding the responsibilities of the QE to conduct oversight activities. This guidance, currently captured in “QE- Subrecipient Oversight Compliance Guide” dated June 2021, shall be incorporated by reference and any subsequent amendments to that guide shall be incorporated into the audit and compliance processes as outlined in this agreement. In the event the parties cannot reach resolution, ODOT shall have responsibility to determine in writing any disagreements regarding implementation of the QE guidance. 2.1.1. Subrecipient oversight should not duplicate oversight in areas already monitored by ODOT, FTA, or otherwise evaluated through the independent audit process. 2.2. Subrecipient shall conduct an agreed-upon procedure (AUP) to satisfy the annual financial audit of the STIF Formula Funds received and expended by the Subrecipient pursuant to this Agreement and OAR 732-040-0015. AUP will be carried out by an independent licensed public accountant contracted by the Subrecipient in conjunction with the Subrecipient’s annual financial audit or as a separately contracted out independent ad-hoc audit carried out by a licensed public accounting firm contracted by the Subrecipient. Subrecipient will adhere to financial management procedures in accordance with Oregon and other applicable laws and requirements, and specifically as provided by ORS 184.751 through 184.766 and OAR Chapter 732, Divisions 40 and 42 in addition to the requirements set forth in this Agreement. 2.22.3. All financial audits prepared pursuant to Section 2.1 shall include the agreed-upon procedures (AUP) AUP engagement requirements, developed by ODOT, established as prescribed in ODOT’s STIF Formula QE-Subrecipient Oversight Compliance Guide, and in accordance with Generally Accepted Government Auditing Standards (GAGAS), and any subsequent amendmentsas well as annual expense testing as that meets the QE expense testing requirement as outlined in the QE- Subrecipient Oversight Compliance Guide. Those procedures, and related costs, will be included with the Subrecipient’s annual financial statement audit as referenced in Section 2.1 and will be reimbursed to Subrecipient as a cost of the STIF Project or Projects from the Subrecipient’s STIF allocation as included in the subrecipient’s approved STIF Plan. The AUP should and expense testing will be completed at the same time as the Subrecipient’s annual financial audit but no later than 90 if possible and results of the AUP and expense testing shall be submitted within 30 days of the submission of the finalized financial audit report, unless a change is mutually agreed by TriMet and Subrecipient. 2.4. If expense testing is performed by a third party auditor as authorized by the QE Subrecipient Guide, the results of the expense testing shall be submitted to TriMet within 30 days after completion finalized report has been issued by the auditor. 2.5. In conjunction with the above-described audit and expense testing, as directed in writing by XXXX, TriMet may request additional information regarding specific projects or services. Provided, however, that it is the intent of the Subrecipient’s annual financial auditparties that TriMet will not request additional information if doing so would be duplicative of audits previously performed by Subrecipient or ODOT. As such, TriMet may not request an additional audit if either ODOT or Subrecipient has previously performed an audit (1) that covered the same time period as the audit requested by TriMet; (2) involved a review of the information required by OAR 000-000-000; and (3) was otherwise consistent with any audit procedures or requirements set forth in an ODOT-approved guidance document. 2.32.6. Subrecipient shall be subject to periodic on-site compliance reviews reviews, by TriMet, or a third-party auditor contracted by the QESubrecipient, as prescribed in ODOT’s STIF Formula QE-Subrecipient Oversight Compliance Guide, and any amendments to such guide. The purpose of the compliance site review is to ensure that Subrecipient has appropriate, appropriate and adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF Formula Funds. Compliance reviews may include, but not be limited to the following, as applicable: program and project management, financial management, operations management, procurement, use and maintenance of equipment, records retention, compliance with state and federal civil rights laws, compliance with the Americans with Disabilities Act (ADA), compliance with FTA drug and alcohol regulations, charter and school bus, and safety and asset management. 2.42.6.1. This review shall occur at a frequency outlined in the QE- Subrecipient Oversight Compliance Guide or in amended guidance, and will not duplicate any materials that have already been tested as part of the completion of the annual AUP, expense testing, or any audits or reviews completed by ODOT or FTA during the period of review. 2.6.2. Alternative methods of this review (i.e., desk review) are acceptable, however, require prior approval by ODOT. 2.7. The following reports are required as part of the Subrecipient’s annual Financial Statement audit, in conjunction with the AUP engagementengagement and expense testing: 2.4.1 2.7.1. When conducting a financial statement audit in accordance with Generally Accepted Auditing Standards (GAAS) and Generally Accepted Government Auditing Standards (GAGAS or the Yellow Book), written representations are provided in Subrecipient’s Representation Letter regarding STIF Formula Funds to complement the auditing procedures of the independent auditor. TriMet requires the following language to be included in the Subrecipient’s Representation Letter to account for STIF Formula Funds, regardless of materiality: “We are responsible for complying, and have complied with, the requirements pursuant to ORS Chapter 184 and OAR 732, Divisions 40 and 42 for the use of STIF Formula funds identified in the approved FY2022FY2024-23 2025 STIF Plan. We have all appropriate, adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF Formula Funds, including program and project management, financial management, operations management, procurement, use and maintenance of equipment, records retention, compliance with state and federal civil rights laws, compliance with the Americans with Disabilities Act (ADA), compliance with FTA drug & alcohol regulations, charter and school bus, and safety and asset management.” 2.4.2 2.7.2. No later than 30 days after receipt of the auditor’s financial report, Subrecipient will provide an electronic copy of the following documents to TriMet through the Nextcloud DropboxDropbox or emailed to TriMet STIF Compliance Monitoring Team <XXXXXxxxxxxxxx@XxxXxx.xxx>: 2.4.2.12.7.2.1. Audited Financial Statement Report or Comprehensive Annual Financial Report (CAFR) or Annual Comprehensive Financial Report (ACFR)) and Single Audit, when applicable;

Audit and Compliance Review. 2.1. All audit and compliance review requirements shall be based on the written guidance provided by ODOT regarding the responsibilities of the QE to conduct oversight activities. This guidance, currently captured in “QE- Subrecipient Oversight Compliance Guide” dated June 2021, shall be incorporated by reference and any subsequent amendments to that guide shall be incorporated into the audit and compliance processes as outlined in this agreement. In the event the parties cannot reach resolution, ODOT shall have responsibility to determine in writing any disagreements regarding implementation of the QE guidance. 2.1.1. Subrecipient oversight should not duplicate oversight in areas already monitored by ODOT, FTA, or otherwise evaluated through the independent audit process. 2.2. Subrecipient shall conduct an agreed-upon procedure (AUP) to satisfy the annual financial audit of the STIF Formula Funds received and expended by the Subrecipient pursuant to this Agreement and OAR 732-040-0015. AUP will be carried out by an independent licensed public accountant contracted by the Subrecipient in conjunction with the Subrecipient’s annual financial audit or as a separately contracted out independent ad-hoc audit carried out by a licensed public accounting firm contracted by the Subrecipient. Subrecipient will adhere to financial management procedures in accordance with Oregon and other applicable laws and requirements, and specifically as provided by ORS 184.751 through 184.766 and OAR Chapter 732, Divisions 40 and 42 in addition to the requirements set forth in this Agreement. 2.22.3. All financial audits prepared pursuant to Section 2.1 shall include the agreed-upon procedures (AUP) AUP engagement requirements, developed by ODOT, established as prescribed in ODOT’s STIF Formula QE-Subrecipient Oversight Compliance Guide, and in accordance with Generally Accepted Government Auditing Standards (GAGAS), and any subsequent amendmentsas well as annual expense testing as that meets the QE expense testing requirement as outlined in the QE- Subrecipient Oversight Compliance Guide. Those procedures, and related costs, will be included with the Subrecipient’s annual financial statement audit as referenced in Section 2.1 and will be reimbursed to Subrecipient as a cost of the STIF Project or Projects from the Subrecipient’s STIF allocation as included in the subrecipient’s approved STIF Plan. The AUP should and expense testing will be completed at the same time as the Subrecipient’s annual financial audit but no later than 90 if possible and results of the AUP and expense testing shall be submitted within 30 days of the submission of the finalized financial audit report, unless a change is mutually agreed by TriMet and Subrecipient. 2.4. If expense testing is performed by a third party auditor as authorized by the QE Subrecipient Guide, the results of the expense testing shall be submitted to TriMet within 30 days after completion finalized report has been issued by the auditor. 2.5. In conjunction with the above-described audit and expense testing, as directed in writing by ODOT, TriMet may request additional information regarding specific projects or services. Provided, however, that it is the intent of the Subrecipient’s annual financial auditparties that TriMet will not request additional information if doing so would be duplicative of audits previously performed by Subrecipient or ODOT. As such, TriMet may not request an additional audit if either ODOT or Subrecipient has previously performed an audit (1) that covered the same time period as the audit requested by TriMet; (2) involved a review of the information required by OAR 000-000-000; and (3) was otherwise consistent with any audit procedures or requirements set forth in an ODOT-approved guidance document. 2.32.6. Subrecipient shall be subject to periodic on-site compliance reviews reviews, by TriMet, or a third-party auditor contracted by the QESubrecipient, as prescribed in ODOT’s STIF Formula QE-Subrecipient Oversight Compliance Guide, and any amendments to such guide. The purpose of the compliance site review is to ensure that Subrecipient has appropriate, appropriate and adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF Formula Funds. Compliance reviews may include, but not be limited to the following, as applicable: program and project management, financial management, operations management, procurement, use and maintenance of equipment, records retention, compliance with state and federal civil rights laws, compliance with the Americans with Disabilities Act (ADA), compliance with FTA drug and alcohol regulations, charter and school bus, and safety and asset management. 2.42.6.1. This review shall occur at a frequency outlined in the QE- Subrecipient Oversight Compliance Guide or in amended guidance, and will not duplicate any materials that have already been tested as part of the completion of the annual AUP, expense testing, or any audits or reviews completed by ODOT or FTA during the period of review. 2.6.2. Alternative methods of this review (i.e., desk review) are acceptable, however, require prior approval by ODOT. 2.7. The following reports are required as part of the Subrecipient’s annual Financial Statement audit, in conjunction with the AUP engagementengagement and expense testing: 2.4.1 2.7.1. When conducting a financial statement audit in accordance with Generally Accepted Auditing Standards (GAAS) and Generally Accepted Government Auditing Standards (GAGAS or the Yellow Book), written representations are provided in Subrecipient’s Representation Letter regarding STIF Formula Funds to complement the auditing procedures of the independent auditor. TriMet requires the following language to be included in the Subrecipient’s Representation Letter to account for STIF Formula Funds, regardless of materiality: “We are responsible for complying, and have complied with, the requirements pursuant to ORS Chapter 184 and OAR 732, Divisions 40 and 42 for the use of STIF Formula funds identified in the approved FY2022FY2024-23 2025 STIF Plan. We have all appropriate, adequate internal controls and management procedures to meet the terms and conditions of agreements governing the disbursement of STIF Formula Funds, including program and project management, financial management, operations management, procurement, use and maintenance of equipment, records retention, compliance with state and federal civil rights laws, compliance with the Americans with Disabilities Act (ADA), compliance with FTA drug & alcohol regulations, charter and school bus, and safety and asset management.” 2.4.2 2.7.2. No later than 30 days after receipt of the auditor’s financial report, Subrecipient will provide an electronic copy of the following documents to TriMet through the Nextcloud DropboxDropbox or emailed to TriMet STIF Compliance Monitoring Team <XXXXXxxxxxxxxx@XxxXxx.xxx>: 2.4.2.12.7.2.1. Audited Financial Statement Report or Comprehensive Annual Financial Report (CAFR) or Annual Comprehensive Financial Report (ACFR)) and Single Audit, when applicable;