Common use of Controls Audit Clause in Contracts

Controls Audit. (i) In addition to its other obligations under this Section 9.10, Supplier shall cause a multi-client Type 2 U.S. Statement on Standards for Attestation Engagements 16 or an equivalent audit under such successor standard as may then be in effect (a “Controls Audit”) to be conducted by an independent public accounting firm on [**] basis for Supplier Shared Service Centers and data centers at or from which the Services and/or services similar to the Services are provided. Supplier shall (i) confer with Ascension Health as to the scope and timing of each such audit, and (ii) accommodate Ascension Health’s requirements and concerns to the extent practicable. Unless otherwise agreed by the Parties, Supplier will perform a security audit based on the Statement on Standards for Attestation Engagements (“SSAE”) No. 16 and will provide a SSAE 16 SOC 1 Type II report prepared by a certified public accountant registered with the Public Company Accounting Oversight Board that covers at least a [**] month period of time in a [**] with a favorable assessment of Supplier’s internal controls and will perform the same on [**] basis throughout the Term of this Agreement. [**], for Services being provided to an Eligible Recipient from a Shared Service Center or data center as of the beginning of Ascension Health’s fiscal year, Supplier shall provide the applicable Eligible Recipient with a copy of its then current SSAE 16 SOC 1 Type II audit for the applicable Shared Service Center for any [**] month period in a [**] by not later than June 1 of the applicable year and shall provide any updates thereto necessary to address any deficiencies identified in such audit. If Supplier becomes certified in other programs intended to evaluate security, Supplier shall also provide information regarding certification to the applicable Eligible Recipient. At Ascension Health’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. The Controls Audit shall be conducted and the report provided at no additional charge to Ascension Health and any applicable Eligible Recipient. Supplier shall respond to such report in accordance with Section 9.10(g). (ii) If Supplier is unable to or not required to provide the Controls Audit for Shared Service Centers or data centers due to the timing of the onset of Services or other reason, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (a) provide Ascension Health, on or before the date such Controls Audit is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any qualification, (b) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (c) permit Ascension Health, the applicable Eligible Recipient and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Ascension Health, the applicable Eligible Recipient and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have the right to review the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Ascension Health or Permitted Auditors require clarification on the Controls Audit report and work papers to the extent such audit rights are available under the agreements signed by Supplier with existing third-party audit firms. (iii) To the extent Ascension Health requests that, in addition to the Controls Audit described above, Supplier conduct an Ascension Health or Eligible Recipient-specific Controls Audit, Supplier shall do so at Ascension Health’s expense (provided that Supplier notifies Ascension Health of such expense, obtains Ascension Health’s prior approval of, and uses commercially reasonable efforts to minimize, such expense). If, however, Supplier undertakes additional or different Controls Audit (or equivalent audits) of Supplier Facilities in question (other than customer-specific audits requested and paid for by other Supplier customers), Supplier shall accord Ascension Health the rights described in the last two sentences of Section 9.10(h)(i) with respect to such audits. ASCENSION HEALTH CONFIDENTIAL MPSA Page 30

Controls Audit. (i) i. In addition to its other obligations under this Section 9.105, Supplier shall cause a multi-client Type 2 U.S. Statement on Standards for Attestation Engagements 16 or an equivalent audit under such successor standard as may then be in effect (a “Controls Audit”) to be conducted by an independent public accounting firm on [**] basis for Supplier Shared Service Centers and data centers at or from Indicates that text has been omitted which is the Services and/or services similar to the Services are providedsubject of a confidential treatment request. Supplier shall (i) confer with Ascension Health as to the scope and timing of each such audit, and (ii) accommodate Ascension Health’s requirements and concerns to the extent practicable. Unless otherwise agreed by the Parties, Supplier will perform a security audit based on the Statement on Standards for Attestation Engagements (“SSAE”) No. 16 and will provide a SSAE 16 SOC 1 Type II report prepared by a certified public accountant registered The text has been separately filed with the Public Company Accounting Oversight Board that covers at least a [**] month period of time in a [**] with a favorable assessment of Supplier’s internal controls Securities and will perform the same on [**] basis throughout the Term of this Agreement. [**], for Services being provided to an Eligible Recipient from a Shared Service Center or data center as of the beginning of Ascension Health’s fiscal year, Supplier shall provide the applicable Eligible Recipient with a copy of its then current SSAE 16 SOC 1 Type II audit for the applicable Shared Service Center for any [**] month period in a [**] by not later than June 1 of the applicable year and shall provide any updates thereto necessary to address any deficiencies identified in such audit. If Supplier becomes certified in other programs intended to evaluate security, Supplier shall also provide information regarding certification to the applicable Eligible Recipient. At Ascension Health’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. The Controls Audit shall be conducted and the report provided at no additional charge to Ascension Health and any applicable Eligible Recipient. Supplier shall respond to such report in accordance with Section 9.10(g)Exchange Commission. (ii) . If Supplier is unable to or not required to provide the Controls Audit for Shared Service Centers or data centers due to the timing of the onset of Services or other reasonreasons, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (a) provide Ascension Health, on or before the date such Controls Audit opinion is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any qualification, (b) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (c) permit Ascension Health, the applicable Eligible Recipient and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Ascension Health, the applicable Eligible Recipient and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have the right to review the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Ascension Health Health, the applicable Eligible Recipient or Permitted Auditors require clarification on the Controls Audit report and work papers to the extent such audit rights are available under the agreements signed by Supplier with existing third-party audit firms. (. iii) . To the extent Ascension Health requests that, in addition to the Controls Audit described above, Supplier conduct an Ascension Health or Eligible Recipient-specific Controls Audit, Supplier shall do so at Ascension Health’s expense (provided that Supplier notifies Ascension Health of such expense, obtains Ascension Health’s prior approval of, and uses commercially reasonable efforts to minimize, such expense). If, however, Supplier undertakes additional or different Controls Audit (or equivalent audits) [**] Indicates that text has been omitted which is the subject of Supplier Facilities in question (other than customer-specific audits requested a confidential treatment request. The text has been separately filed with the Securities and paid for by other Supplier customers), Supplier shall accord Ascension Health the rights described in the last two sentences of Section 9.10(h)(i) with respect to such audits. ASCENSION HEALTH CONFIDENTIAL MPSA Page 30Exchange Commission.

Controls Audit. (i) i. In addition to its other obligations under this Section 9.105, Supplier shall cause a multi-client Type 2 U.S. Statement on Standards for Attestation Engagements 16 or an equivalent audit under such successor standard as may then be in effect (a “Controls Audit”) to be conducted by an independent public accounting firm on [**] basis for Supplier Shared Service Centers and data centers at or from which the ASP Services and/or services similar to the ASP Services are provided. Supplier shall (i) confer with Ascension Health as to the scope and timing of each such audit, and (ii) accommodate Ascension Health’s requirements and concerns to the extent practicable. Unless otherwise agreed by the Parties, Supplier will perform a security audit based on the Statement on Standards for Attestation Engagements (“SSAE”) No. 16 and will provide a SSAE 16 SOC 1 Type II report prepared by a certified public accountant registered with the Public Company Accounting Oversight Board that covers at least a [**] month period of time in a [**] with a favorable assessment of Supplier’s internal controls and will perform the same on [**] basis throughout the Term of this ASP Agreement. [**]Annually, for Services being provided to an Eligible Recipient from a Shared Service Center or data center as of the beginning of Ascension Health’s fiscal year, Supplier shall provide the applicable Eligible Recipient with a copy of its then current SSAE 16 SOC 1 Type II audit for the applicable Shared Service Center for any [**] month period in a [**] by not later than June 1 [**] of the applicable year and shall provide any updates thereto necessary to address any deficiencies identified in such audit. If Supplier becomes certified in other programs intended to evaluate security, Supplier shall also provide information regarding certification to the applicable Eligible Recipient. At Ascension Health’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. The Controls Audit shall be conducted and the report provided at no additional charge to Ascension Health and any applicable Eligible Recipient. Supplier shall respond to such report in accordance with Section 9.10(g5(g). (ii) . If Supplier is unable to or not required to provide the Controls Audit for Shared Service Centers or data centers due to the timing of the onset of Services or other reasonreasons, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (a) provide Ascension Health, on or before the date such Controls Audit opinion is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any ASCENSION HEALTH CONFIDENTIAL RC Tools ASP Agreement Page 8 qualification, (b) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (c) permit Ascension Health, the applicable Eligible Recipient and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Ascension Health, the applicable Eligible Recipient and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have the right to review the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Ascension Health Health, the applicable Eligible Recipient or Permitted Auditors require clarification on the Controls Audit report and work papers to the extent such audit rights are available under the agreements signed by Supplier with existing third-party audit firms. (iii) . To the extent Ascension Health requests that, in addition to the Controls Audit described above, Supplier conduct an Ascension Health or Eligible Recipient-specific Controls Audit, Supplier shall do so at Ascension Health’s expense (provided that Supplier notifies Ascension Health of such expense, obtains Ascension Health’s prior approval of, and uses commercially reasonable efforts to minimize, such expense). If, however, Supplier undertakes additional or different Controls Audit (or equivalent audits) of Supplier Facilities in question (other than customer-specific audits requested and paid for by other Supplier customers), Supplier shall accord Ascension Health the rights described in the last two sentences of Section 9.10(h)(i5(h)(i) with respect to such audits. ASCENSION HEALTH CONFIDENTIAL MPSA Page 30.

Controls Audit. (i) In addition to its other obligations under this Section 9.10, on an [**] basis from the Effective Date through the remainder of the Term, Supplier shall cause a multi-client Type 2 U.S. Statement on Standards for Attestation Engagements (“SSAE”) 16 or an equivalent audit under such successor standard as may then be in effect (a “Controls Audit”) to be conducted by an independent public accounting firm on registered with the Public Company Accounting Oversight Board. Each audit shall cover successive [**] basis periods of time with a favorable assessment of Supplier’s internal controls for Supplier Shared Service Centers and data centers at or from which the Services and/or services similar to the Services are provided. Each audit report must be provided as soon as such report is reasonably available upon completion of each test and Supplier shall provide any updates thereto necessary to address any deficiencies identified in each audit. Supplier shall (iA) confer with Ascension Health as to the scope and timing of each such audit, and (iiB) accommodate Ascension Health’s requirements and concerns to the extent practicable. Unless otherwise agreed by From the Parties, Effective Date through [**] Supplier will perform a security audit have Control Audits performed based on the Statement on Standards for Attestation Engagements (“SSAE”) No. SSAE 16 and will shall provide a SSAE 16 SOC 1 Type II report prepared by a certified public accountant registered with the Public Company Accounting Oversight Board that covers at least a [**] month period of time in a [**] with a favorable assessment of Supplier’s internal controls and will perform the same reports. Thereafter, Supplier shall have Control Audits performed on [**] basis throughout the remainder of the Term of this Agreement. [**], for Services being provided to an Eligible Recipient from a Shared Service Center or data center as of the beginning of Ascension Health’s fiscal year, Supplier shall provide the applicable Eligible Recipient with a copy of its then current based on SSAE 16 SOC 1 Type II audit for the applicable Shared Service Center for any [**] month period in a [**] by not later than June 1 of the applicable year and shall provide any updates thereto necessary to address any deficiencies identified in such auditSOC 2 Type II reports. If Supplier becomes certified in other programs intended to evaluate security, Supplier shall also provide information regarding certification to the applicable Eligible Recipient. At Ascension Health’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. The Controls Audit shall be conducted and the report provided at no additional charge to Ascension Health and any applicable Eligible Recipient. Supplier shall respond to such report in accordance with Section 9.10(g). (ii) If Supplier is unable to or not required to provide the Controls Audit for Shared Service Centers or data centers due to the timing of the onset of Services or other reason, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (aA) provide Ascension Health, on or before the date such Controls Audit is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any qualification, (bB) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (cC) permit Ascension Health, the applicable Eligible Recipient and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Ascension Health, the applicable Eligible Recipient and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have [**] Indicates that text has been omitted which is the right to review subject of a confidential treatment request. The text has been separately filed with the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Ascension Health or Permitted Auditors require clarification on the Controls Audit report Securities and work papers to the extent such audit rights are available under the agreements signed by Supplier with existing third-party audit firmsExchange Commission. (iii) To the extent Ascension Health requests that, in addition to the Controls Audit described above, Supplier conduct an Ascension Health or Eligible Recipient-Recipient- specific Controls Audit, Supplier shall do so at Ascension Health’s expense (provided that Supplier notifies Ascension Health of such expense, obtains Ascension Health’s prior approval of, and uses commercially reasonable efforts to minimize, such expense). If, however, Supplier undertakes additional or different Controls Audit (or equivalent audits) of Supplier Facilities in question (other than customer-specific audits requested and paid for by other Supplier customers), Supplier shall accord Ascension Health the rights described in the last two sentences of Section 9.10(h)(i) with respect to such audits. ASCENSION HEALTH CONFIDENTIAL MPSA Page 30.

Controls Audit. (i) In addition to its other obligations under this Section 9.10, 9.12. Supplier shall cause a multi-client an International Standard of Assurance Engagements (ISAE) 3402 or Type 2 U.S. Statement on Standards for Attestation Engagements (SSAE) 16 (or an equivalent audit under such successor standard as may then be in effect effect) (a “Controls Audit”) to be conducted by an independent public accounting firm on [**] an annual basis for Supplier Shared Service Centers and data centers Facilities at or from which the Services and/or services similar to the Services are providedprovided at Allianz’s cost. Supplier shall (iA) confer with Ascension Health Allianz as to the scope and timing of each such audit, and (iiB) accommodate Ascension HealthAllianz’s requirements and concerns to the extent practicable. Unless otherwise agreed by the Parties, Supplier will perform such audit shall be conducted with a security audit based on the Statement on Standards for Attestation Engagements (“SSAE”) No. 16 and will provide a SSAE 16 SOC 1 Type II report prepared by a certified public accountant registered with the Public Company Accounting Oversight Board that covers date range of at least a [**] month period of time twelve (12) months and so as to result in a [**] with a favorable assessment of Supplier’s internal controls and will perform the same on [**] basis throughout the Term of this Agreementfinal audit opinion dated September 1 or later each calendar year. [**], for Services being provided to an Eligible Recipient from a Shared Service Center or data center as of the beginning of Ascension Health’s fiscal year, Supplier shall provide the applicable Eligible Recipient Allianz and its independent auditors with a copy of its then current SSAE 16 SOC 1 Type II audit for such opinion and the applicable Shared Service Center for any [**] month period in a [**] by not later than June 1 resulting Controls Audit report as soon as reasonably possible after the conclusion of the applicable year and shall provide any updates thereto necessary to address any deficiencies identified in such audit. If Supplier becomes certified in other programs intended to evaluate security, Supplier shall also provide information regarding certification to the applicable Eligible Recipient. At Ascension HealthAllianz’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. The Controls Audit shall be conducted and the report provided at no additional charge to Ascension Health and any applicable Eligible Recipient. Supplier shall respond to such report reports in accordance with Section 9.10(g)9.12. (ii) If Supplier is unable to or not required timely deliver to provide the Controls Audit for Shared Service Centers or data centers due to the timing of the onset of Services or other reasonAllianz, in accordance with Section 9.12(h)(i) above, an unqualified opinion, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (aA) provide Ascension HealthAllianz, on or before the date such Controls Audit opinion is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any qualification, (bB) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (cC) permit Ascension Health, the applicable Eligible Recipient Allianz and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Ascension Health, the applicable Eligible Recipient Allianz and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have the right to review the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Ascension Health Allianz or such Permitted Auditors require clarification on regarding the Controls Audit report and work papers to the extent such TCS AZL Master Effective 1.1.2020 audit rights are available under the agreements signed by Supplier with existing third-party audit firms. . (iii) To the extent Ascension Health Allianz requests that, in addition to the Controls Audit described above, Supplier conduct an Ascension Health or Eligible Recipienta Allianz-specific Controls Audit, Supplier shall do so at Ascension HealthAllianz’s expense (provided that Supplier notifies Ascension Health Allianz of such expense, obtains Ascension HealthAllianz’s prior approval of, and uses commercially reasonable efforts to minimize, such expense). If, however, Supplier undertakes additional or different Controls Audit (or equivalent audits) of Supplier Facilities in question (other than customer-specific audits requested and paid for by other Supplier customers), Supplier shall accord Ascension Health the rights described in the last two sentences of Section 9.10(h)(i) with respect to such audits. ASCENSION HEALTH CONFIDENTIAL MPSA Page 30.