INDEPENDENT ASSURANCES. Contractor shall submit, and cause its subcontractors who perform key internal controls to submit, to certain independent audits to ascertain that processes and controls related to the contracted service are operating properly. Independent assurances may be in the form of a Service Organization Control (“SOC”) 1, Type II and/or SOC 2, Type II report resulting from an independent annual SSAE 18 engagement of the operations. The SSAE 18 engagement will be performed at least annually by an audit firm that will conduct tests and render an independent opinion on the operating effectiveness of the controls and procedures. The audit firm that will conduct the SSAE 18 engagement will submit a final report on controls placed in operation for the project and include a detailed description of the audit firm’s tests of the operating effectiveness of controls. The Contractor shall supply the State with an exact copy of the SOC report resulting from the SSAE 18 engagement within the specified timeframe. As an alternative to a SSAE 18 engagement and resulting SOC 1, Type II and/or SOC 2, Type II report, if approved by OGB on or before January 15th of each calendar year, Contractor may provide a quality control plan [such as third party Quality Assurance (QA), an Independent Verification and Validation (IV & V)], or any other independent Contractor project or performance review or independent internal audit report. The cost of such independent assurances will be borne solely by Contractor. Such independent assurances shall be performed at least annually during the term of the Contract. Contractor may review any audit report before delivery to the State and include with the report a supplementary statement containing facts that Contractor considers pertinent to the audit or engagement. Contractor shall implement recommendations as suggested by the program review, audit, and/or SSAE 18 engagement within three (3) months of report issuance and at no cost to the State.
INDEPENDENT ASSURANCES. The [Agency Name] will require the Contractor and/or subcontractors, if performing a key internal control, to provide some form of assurances that internal controls over the process being administered by the Contractor for the [Agency Name] is operating properly. The assurances provided by the Contractor may be in the form of SOC I and/or type II reports resulting from independent SSAE 18 engagement of internal controls, quality assurance reports or other financial and performance audits from outside companies to assure both the financial viability of the (outsourced) program and the operational viability, including the policies and procedures placed into operation. If an SSAE 16 review is required, the audit firm will conduct tests of the Contractor’s activities and render an independent opinion on the operating effectiveness of the controls and procedures. Other forms of assurances may be required by the [Agency Name]. The Contractor may be required to provide a quality control plan, such as third party Quality Assurance (QA), Independent Verification and Validation (IV & V), or other internal project/program reviews or audits. These audits and/or assurances will require the Contractor to provide any assistance, records access, information system access, staff access, and space access to the party selected to perform the indicated audit. If a SSAE 18 review or audit is required of the Contractor, the audit firm will submit to the [Agency Name] and/or Contractor a final report on controls placed in operations for the project and include a detailed description of the audit firm’s tests of the operating effectiveness of controls. The Contractor shall supply the [Agency Name] with an exact copy of the report within 30 calendar days of completion. When required by the [Agency Name], such audits may be performed annually during the term of this Contract. The Contractor shall agree to implement recommendations as suggested by the audits within three months of report issuance at no cost to the [Agency Name]. The cost of the SSAE 18 engagement is to be borne by the Contractor and it was included in the cost proposed in response to the RFP.
