Certification of internal controls. The 2017 QI Agreement requires the QI’s responsible officer to make a periodic certification of internal controls provided in Appendix I, as previewed in the Proposed QI Agreement. The Proposed QI Agreement also listed the elements of the certification both in section 10.03 and in Appendix I. The 2017 QI Agreement retains the specified list of elements but eliminates the duplication by only listing the elements of the certification in Appendix I. In making the periodic certification of internal controls, the responsible officer may rely on, in addition to the results of the periodic review (if required), any other processes, procedures, reviews, or certifications made by other persons that the responsible officer has determined are necessary in order to make the certification. This flexibility allows the responsible officer to decide, for example, whether to hire an external reviewer (for example, a law firm or accounting firm) and what the scope of the engagement should be (for example, whether the external reviewer will conduct a review of the sufficiency of the QI’s internal controls or whether the review will be limited to the periodic review, if required). A responsible officer may also rely on a review, report, or certification made by another officer or employee who may, for example, have greater subject matter expertise in a particular area (including a responsible officer for FATCA purposes). The responsible officer must, however, document what he or she has relied on in making the certification and retain such documentation for the same period of time for which the compliance review report and certifications are required to be retained pursuant to section 10.06(D) of the 2017 QI Agreement. For example, if the responsible officer relies on an internal or external reviewer to conduct a review of the XX’s internal controls, the responsible officer must retain any report delivered by the reviewer. Comments to the Proposed QI Agreement requested further clarification regarding the certification of internal controls, including what a responsible officer should rely on if the QI requests and obtains a waiver of the periodic review requirement. When a QI does not request, or does not obtain, a waiver, the responsible officer must take into account the results of the periodic review in making the certification of internal controls and must also use any other process, certification, or review necessary in order to be able to certify to the QI’s internal co...
Certification of internal controls. Part II.A of Appendix I of the 2017 QI Agreement contains the certification of internal controls that a QI is required to make for a certification period and a list of material failures and events of default a QI must identify (when applicable). The 2023 QI Agreement adds a new certification regarding a QI’s procedures for complying with sections 1446(a) and (f) and (more generally) that the QI has acted only to the extent permitted under the QI agreement. Thus, for example, a QI would not be able to make this certification if it represents its status as a QI with respect to an amount realized paid to an account holder for an interest in a partnership that is not a PTP. The 2023 QI Agreement also adds material failures and an event of default specific to sections 1446(a) and (f) to Part II of Appendix I. The material failures added to Part II.D of Appendix I are as proposed in section 10.03 of Notice 2022-23, with the addition of a material failure for a QI failing to comply with section 5.01(A) of the 2023 QI Agreement in requesting U.S. TINs from account holders. See section 4.01(1) of this Revenue Procedure. Part II.D of Appendix I of the 2023 QI Agreement also reflects the 2023 and 2024 transitional relief for section 871(m) purposes discussed in section 4.02 of this Revenue Procedure by referencing a QI or QDD’s material failures based on a good faith standard.
Certification of internal controls. The contractor shall have clearly delineated processes and procedures for the internal control of sensitive data and processes, which are any data and processes of which the compromising of confidentiality, integrity, and/or availability could have a material adverse effect on Commonwealth of Virginia interests, the conduct of agency programs, or to the privacy of which individuals are entitled, when such sensitive data or processes are related to the goods and/or services provided pursuant to this agreement.
