Service Center Reviews. a) On an annual basis during the Term, EVERTEC shall engage a reputable independent certified public accounting firm of recognized national or regional standing (the “Firm”), to conduct a review of its IT operations and application controls for the Services provided to COMPANY, BPPR, and their respective Subsidiaries, in accordance with industry-wide best practices and FFEIC Guidelines. The aforesaid review shall be conducted in accordance with the American Institute of Certified Public Accountants Statement on Auditing Standards Number 70 (“SAS 70”) or any applicable successor standard, the findings and recommendations of which shall be set forth in a report (the “Service Center Review”). The Service Center Review shall (i) include a Type II Service Auditor’s Report under SAS 70, (ii) cover, at a minimum, a period of six (6) months, (iii) be dated as of September 30 of the year in question, and (iv) be delivered to COMPANY, BPPR, and their respective Subsidiaries on or before December 15 of such year. b) The parties agree and acknowledge that prior to the date hereof, EVERTEC periodically provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers a report of EVERTEC’s IT operations and applications controls for the services provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers (the “Previous Control Reports”). During the Term, Popular and BPPR agree to make a payment to EVERTEC for the Service Center Review within 30 days of EVERTEC’s delivery to COMPANY and BPPR of the Service Center Review. Such payment shall be an amount equal to the excess, if any, of (i) the fees or expenses paid by EVERTEC to the Firm in connection with the first Service Center Review performed during the period between the date of this Master Agreement and the first anniversary of the date hereof, over (ii) the costs, fees and expenses that EVERTEC paid in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof (provided that any costs, fees and expenses allocated to EVERTEC by the Popular Parties in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof shall be deemed to have been “paid” by EVERTEC for purposes of calculating the amount of such excess). c) If the Service Center Review contains any recommendations, EVERTEC shall, at its sole cost and expense, promptly take all actions necessary to comply with such recommendations and shall advise COMPANY and BPPR when such compliance is achieved. d) If, at any time during the Term, COMPANY or BPPR has reasonable material concerns regarding (i) the scope of the Service Center Review, (ii) any material qualification in the aforesaid report, and/or (iii) EVERTEC’s operational and application controls and such concerns are not addressed in the Service Center Review to COMPANY’s or BPPR’s reasonable satisfaction (as applicable), COMPANY or BPPR (as applicable) shall so notify EVERTEC and EVERTEC shall promptly meet with COMPANY or BPPR in an effort to resolve such concern.
Appears in 4 contracts
Samples: Master Services Agreement, Master Service Agreement (EVERTEC, Inc.), Master Service Agreement (Popular Inc)
Service Center Reviews. a) On an annual basis during the Term, EVERTEC shall engage a reputable independent certified public accounting firm of recognized national or regional standing (the “Firm”), to conduct a review of its IT operations and application controls for the Services provided to COMPANY, BPPR, and their respective Subsidiaries, in accordance with industry-industry wide best practices and FFEIC Guidelines. The aforesaid review shall be conducted in accordance with the American Institute of Certified Public Accountants Statement on Auditing Standards Number 70 (“SAS 70”) or any applicable successor standard, the findings and recommendations of which shall be set forth in a report (the “Service Center Review”). The Service Center Review shall (i) include a Type II Service Auditor’s Report under SAS 70, (ii) cover, at a minimum, a period of six (6) months, (iii) be dated as of September 30 of the year in question, and (iv) be delivered to COMPANY, BPPR, and their respective Subsidiaries on or before December 15 of such year.
b) The parties agree and acknowledge that prior to the date hereof, EVERTEC periodically provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers a report of EVERTEC’s IT operations and applications controls for the services provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers (the “Previous Control Reports”). During the Term, Popular and BPPR agree to make a payment to EVERTEC for the Service Center Review within 30 days of EVERTEC’s delivery to COMPANY and BPPR of the Service Center Review. Such payment shall be an amount equal to the excess, if any, of (i) the fees or expenses paid by EVERTEC to the Firm in connection with the first Service Center Review performed during the period between the date of this Master Agreement and the first anniversary of the date hereof, over (ii) the costs, fees and expenses that EVERTEC paid in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof (provided that any costs, fees and expenses allocated to EVERTEC by the Popular Parties in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof shall be deemed to have been “paid” by EVERTEC for purposes of calculating the amount of such excess).
c) If the Service Center Review contains any recommendations, EVERTEC shall, at its sole cost and expense, promptly take all actions necessary to comply with such recommendations and shall advise COMPANY and BPPR when such compliance is achieved.
d) If, at any time during the Term, COMPANY or BPPR has reasonable material concerns regarding (i) the scope of the Service Center Review, (ii) any material qualification in the aforesaid report, and/or (iii) EVERTEC’s operational and application controls and such concerns are not addressed in the Service Center Review to COMPANY’s or BPPR’s reasonable satisfaction (as applicable), COMPANY or BPPR (as applicable) shall so notify EVERTEC and EVERTEC shall promptly meet with COMPANY or BPPR in an effort to resolve such concern.
Appears in 2 contracts
Samples: Master Service Agreement (Popular Inc), Master Service Agreement (Popular Inc)
Service Center Reviews. a) On an annual basis during the Term, EVERTEC shall engage a reputable independent certified public accounting firm of recognized national or regional standing (the “Firm”), to conduct a review of its IT operations and application controls for the Services provided to COMPANY, BPPR, and their respective Subsidiaries, in accordance with industry-wide best practices and FFEIC Guidelines. The aforesaid review shall be conducted in accordance with the American Institute of Certified Public Accountants Statement on Auditing Standards Number 70 (“SAS 70”) or any applicable successor standard, the findings and recommendations of which shall be set forth in a report (the “Service Center Review”). The Service Center Review shall (i) include a Type II Service Auditor’s Report under SAS 70, (ii) cover, at a minimum, a period of six (6) months, (iii) be dated as of September 30 of the year in question, and (iv) be delivered to COMPANY, BPPR, and their respective Subsidiaries on or before December 15 of such year.
b) The parties agree and acknowledge that prior to the date hereof, EVERTEC periodically provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers a report of EVERTEC’s IT operations and applications controls for the services provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers (the “Previous Control Reports”). During the Term, Popular and BPPR agree to make a payment to EVERTEC for the Service Center Review within 30 days of EVERTEC’s delivery to COMPANY and BPPR of the Service Center Review. Such payment shall be an amount equal to the excess, if any, of (i) the fees or expenses paid by EVERTEC to the Firm in connection with the first Service Center Review performed during the period between the date of this Master Agreement and the first anniversary of the date hereof, over (ii) the costs, fees and expenses that EVERTEC paid in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof (provided that any costs, fees and expenses allocated to EVERTEC by the Popular Parties in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof shall be deemed to have been “paid” by EVERTEC for purposes of calculating the amount of such excess).
c) If the Service Center Review contains any recommendations, EVERTEC shall, at its sole cost and expense, promptly take all actions necessary to comply with such recommendations and shall advise COMPANY and BPPR when such compliance is achieved.
d) If, at any time during the Term, COMPANY or BPPR has reasonable material concerns regarding (i) the scope of the Service Center Review, (ii) any material qualification in the aforesaid report, and/or (iii) EVERTEC’s operational and application controls and such concerns are not addressed in the Service Center Review to COMPANY’s or BPPR’s reasonable satisfaction (as applicable), COMPANY or BPPR (as applicable) shall so notify EVERTEC and EVERTEC shall promptly meet with COMPANY or BPPR in an effort to resolve such concern.
Appears in 1 contract
Service Center Reviews. (a) On an annual basis during the Term, EVERTEC shall engage a reputable independent certified public accounting firm of recognized national or regional standing (the “Firm”), to conduct a review an examination of its IT operations and application controls for the Services provided to COMPANY, BPPR, and their respective Subsidiaries, in accordance with industry-wide best practices applicable Industry Standards and FFEIC Guidelinesapplicable Legal Requirements. In addition to IT operations and application controls, the Firm should complete an examination of EVERTEC’s controls related to security, availability, processing integrity, confidentiality or privacy. The aforesaid review examinations shall be conducted for the relevant System and organization controls (“SOC 1” and “SOC 2”) criteria in accordance with the American Institute of Certified Public Accountants Statement on Auditing Standards Number 70 for Attestation Engagements no. 18 (“SAS 70SSAE 18”) or any applicable successor standard, the findings and recommendations of which shall be set forth in a report (the “Service Center Review”). .
(i) The SOC 1 Service Center Review shall (iA) include a Type II Service Auditor’s Report under SAS 70SSAE 18, (iiB) cover, at a minimum, a period of six nine (69) months, (iiiC) be dated as of September 30 of the year in question, and (ivD) be delivered to COMPANY, BPPR, COMPANY and their respective Subsidiaries BPPR on or before December 15 of such year. EVERTEC management will provide a bridge letter for the remaining period of the calendar year that is not covered by the SOC 1 Type II report no later than January 31st of the following year.
(ii) The SOC 2 Service Center Review shall (A) include a Type II Service Auditor’s Report under SSAE 18, (B) cover, at a minimum, a period of twelve (12) months, (C) be dated as of September 30 of the year in question, and (D) be delivered to COMPANY and BPPR by February 15 of the following year.
(iii) All such Service Center Reviews shall be deemed to be EVERTEC’s Confidential Information hereunder, provided that EVERTEC shall promptly share such Service Center Reviews with BPPR upon request. EVERTEC may redact information from any Service Center Reviews shared with BPPR if and solely to the extent necessary to protect the confidential information of other customers of EVERTEC or the information of EVERTEC that is not related to either BPPR or EVERTEC’s provision of Services to BPPR.
(iv) Additionally, EVERTEC will use its Best Efforts to obtain and provide to COMPANY and BPPR SOC 1 and 2 Type II reports or other equivalent control reports for each Data Subcontractor that stores, transfers or processes Personal Data. If a Data Subcontractor proposes to limit EVERTEC’s rights in this regard in any new contract or contract renewal after the Effective Date, EVERTEC will notify COMPANY and BPPR reasonably in advance of the contract execution date of the issue and use Best Efforts to address any concerns relating to the issue that COMPANY or BPPR may raise with EVERTEC.
(b) The parties agree and acknowledge that prior to EVERTEC will review the date hereof, EVERTEC periodically provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers a report scope of EVERTEC’s IT operations and applications controls for the services provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers (the “Previous Control Reports”). During the Term, Popular and BPPR agree to make a payment to EVERTEC for the Service Center Review within 30 days of to be conducted by the Firm on an annual basis with BPPR and incorporate reasonable input and additional requirements reasonably requested by BPPR. If BPPR requires additional scope in a Service Center Review that is (i) incremental to the scope in EVERTEC’s delivery to COMPANY and BPPR of the standard Service Center Review. Such payment shall ; and (ii) solely attributable to BPPR (and not to be an amount equal to the excessshared with any other EVERTEC customers) (“Incremental BPPR Requirements”), if any, of (i) the fees or expenses paid BPPR will reimburse EVERTEC for any additional amounts payable by EVERTEC to the Firm in connection with to include the first Service Center Review performed during the period between the date of this Master Agreement and the first anniversary of the date hereof, over (ii) the costs, fees and expenses that EVERTEC paid in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof (provided that any costs, fees and expenses allocated to EVERTEC by the Popular Parties in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof shall be deemed to have been “paid” by EVERTEC for purposes of calculating the amount of such excess)Incremental BPPR Requirements.
(c) If the Service Center Review contains any recommendations, EVERTEC shall, at its sole cost and expense, promptly take all reasonable actions necessary to comply with such recommendations on a timeline that will take into account the nature and shall materiality of the recommendations. Upon request, EVERTEC will advise COMPANY and BPPR when on its progress in completing such compliance is achievedactions.
(d) If, at any time during the Term, COMPANY or BPPR has reasonable material concerns regarding (i) the scope of the Service Center Review, (ii) any material qualification in the aforesaid report, and/or (iii) EVERTEC’s operational and application controls and such concerns are not addressed in the Service Center Review to COMPANY’s or BPPR’s reasonable satisfaction (as applicable), COMPANY or BPPR (as applicable) shall so notify EVERTEC and EVERTEC shall promptly meet with COMPANY or BPPR in an effort to resolve such concern.
(e) For all other requests by COMPANY or BPPR to review all or a portion of the Services and EVERTEC’s operation controls relating thereto, outside the scope of an Audit or SSAE 18, the parties will agree in writing to the terms and conditions applicable to such review, including the scope of the review and any expenses related thereto. If, at any time, whether or not in connection with the Service Center Review, EVERTEC becomes aware of a significant issue of concern related to the operational and application controls operating at EVERTEC for the Services provided to the COMPANY, BPPR, or any of its respective subsidiaries, EVERTEC shall promptly notify and subsequently meet with COMPANY or BPPR in an effort to address such concern.
Appears in 1 contract
Service Center Reviews. (a) On an annual basis during the Term, EVERTEC shall engage a reputable independent certified public accounting firm of recognized national or regional standing (the “Firm”), to conduct a review an examination of its IT operations and application controls for the Services provided to COMPANY, BPPR, and their respective Subsidiaries, in accordance with industry-wide best practices applicable Industry Standards and FFEIC Guidelinesapplicable Legal Requirements. In addition to IT operations and application controls, the Firm should complete an examination of EVERTEC’s controls related to security, availability, processing integrity, confidentiality or privacy. The aforesaid review examinations shall be conducted for the relevant System and organization controls (“SOC 1” and “SOC 2”) criteria in accordance with the American Institute of Certified Public Accountants Statement on Auditing Standards Number 70 for Attestation Engagements no. 18 (“SAS 70SSAE 18”) or any applicable successor standard, the findings and recommendations of which shall be set forth in a report (the “Service Center Review”). .
(i) The SOC 1 Service Center Review shall (iA) include a Type II Service Auditor’s Report under SAS 70SSAE 18, (iiB) cover, at a minimum, a period of six nine (69) months, (iiiC) be dated as of September 30 of the year in question, and (ivD) be delivered to COMPANY, BPPR, COMPANY and their respective Subsidiaries BPPR on or before December 15 of such year. EVERTEC management will provide a bridge letter for the remaining period of the calendar year that is not covered by the SOC 1 Type II report no later than January 31st of the following year.
(ii) The SOC 2 Service Center Review shall (A) include a Type II Service Auditor’s Report under SSAE 18, (B) cover, at a minimum, a period of twelve (12) months, (C) be dated as of September 30 of the year in question, and (D) be delivered to COMPANY and BPPR by February 15 of the following year.
(iii) All such Service Center Reviews shall be deemed to be EVERTEC's Confidential Information hereunder, provided that EVERTEC shall promptly share such Service Center Reviews with BPPR upon request. EVERTEC may redact information from any Service Center Reviews shared with BPPR if and solely to the extent necessary to protect the confidential information of other customers of EVERTEC or the information of EVERTEC that is not related to either BPPR or EVERTEC’s provision of Services to BPPR.
(iv) Additionally, EVERTEC will use its Best Efforts to obtain and provide to COMPANY and BPPR SOC 1 and 2 Type II reports or other equivalent control reports for each Data Subcontractor that stores, transfers or processes Personal Data. If a Data Subcontractor proposes to limit EVERTEC’s rights in this regard in any new contract or contract renewal after the Effective Date, EVERTEC will notify COMPANY and BPPR reasonably in advance of the contract execution date of the issue and use Best Efforts to address any concerns relating to the issue that COMPANY or BPPR may raise with EVERTEC.
(b) The parties agree and acknowledge that prior to EVERTEC will review the date hereof, EVERTEC periodically provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers a report scope of EVERTEC’s IT operations and applications controls for the services provided to COMPANY, BPPR and their respective Subsidiaries and to other EVERTEC customers (the “Previous Control Reports”). During the Term, Popular and BPPR agree to make a payment to EVERTEC for the Service Center Review within 30 days of to be conducted by the Firm on an annual basis with BPPR and incorporate reasonable input and additional requirements reasonably requested by BPPR. If BPPR requires additional scope in a Service Center Review that is (i) incremental to the scope in EVERTEC’s delivery to COMPANY and BPPR of the standard Service Center Review. Such payment shall ; and (ii) solely attributable to BPPR (and not to be an amount equal to the excessshared with any other EVERTEC customers) (“Incremental BPPR Requirements”), if any, of (i) the fees or expenses paid BPPR will reimburse EVERTEC for any additional amounts payable by EVERTEC to the Firm in connection with to include the first Service Center Review performed during the period between the date of this Master Agreement and the first anniversary of the date hereof, over (ii) the costs, fees and expenses that EVERTEC paid in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof (provided that any costs, fees and expenses allocated to EVERTEC by the Popular Parties in connection with the Previous Control Reports prepared during the most recent fiscal year completed prior to the date hereof shall be deemed to have been “paid” by EVERTEC for purposes of calculating the amount of such excess)Incremental BPPR Requirements.
(c) If the Service Center Review contains any recommendations, EVERTEC shall, at its sole cost and expense, promptly take all reasonable actions necessary to comply with such recommendations on a timeline that will take into account the nature and shall materiality of the recommendations. Upon request, EVERTEC will advise COMPANY and BPPR when on its progress in completing such compliance is achievedactions.
(d) If, at any time during the Term, COMPANY or BPPR has reasonable material concerns regarding (i) the scope of the Service Center Review, (ii) any material qualification in the aforesaid report, and/or (iii) EVERTEC’s operational and application controls and such concerns are not addressed in the Service Center Review to COMPANY’s or BPPR’s reasonable satisfaction (as applicable), COMPANY or BPPR (as applicable) shall so notify EVERTEC and EVERTEC shall promptly meet with COMPANY or BPPR in an effort to resolve such concern.
(e) For all other requests by COMPANY or BPPR to review all or a portion of the Services and EVERTEC’s operation controls relating thereto, outside the scope of an Audit or SSAE 18, the parties will agree in writing to the terms and conditions applicable to such review, including the scope of the review and any expenses related thereto. If, at any time, whether or not in connection with the Service Center Review, EVERTEC becomes aware of a significant issue of concern related to the operational and application controls operating at EVERTEC for the Services provided to the COMPANY, BPPR, or any of its respective subsidiaries, EVERTEC shall promptly notify and subsequently meet with COMPANY or BPPR in an effort to address such concern.
Appears in 1 contract
