Common use of Controls Audit Clause in Contracts

Controls Audit. (i) In addition to its other obligations under this Section 9.12. Supplier shall cause an International Standard of Assurance Engagements (ISAE) 3402 or Type 2 U.S. Statement on Standards for Attestation Engagements (SSAE) 16 (or an equivalent audit under such successor standard as may then be in effect) (a “Controls Audit”) to be conducted by an independent public accounting firm on an annual basis for Supplier Facilities at or from which the Services and/or services similar to the Services are provided at Allianz’s cost. Supplier shall (A) confer with Allianz as to the scope and timing of each such audit, and (B) accommodate Allianz’s requirements and concerns to the extent practicable. Unless otherwise agreed by the Parties, such audit shall be conducted with a date range of at least twelve (12) months and so as to result in a final audit opinion dated September 1 or later each calendar year. Supplier shall provide Allianz and its independent auditors with a copy of such opinion and the resulting Controls Audit report as soon as reasonably possible after the conclusion of such audit. At Allianz’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. Supplier shall respond to such reports in accordance with Section 9.12. (ii) If Supplier is unable to timely deliver to Allianz, in accordance with Section 9.12(h)(i) above, an unqualified opinion, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (A) provide Allianz, on or before the date such opinion is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any qualification, (B) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (C) permit Allianz and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Allianz and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have the right to review the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Allianz or such Permitted Auditors require clarification regarding the Controls Audit report to the extent such TCS AZL Master Effective 1.1.2020 audit rights are available under the agreements signed by Supplier with existing third-party audit firms. (iii) To the extent Allianz requests that, in addition to the Controls Audit described above, Supplier conduct a Allianz-specific Controls Audit, Supplier shall do so at Allianz’s expense (provided that Supplier notifies Allianz of such expense, obtains Allianz’s prior approval of, and uses commercially reasonable efforts to minimize, such expense).

Controls Audit. (i) In addition to its other obligations under this Section 9.12. 9.10, on an [**] basis from the Effective Date through the remainder of the Term, Supplier shall cause an International Standard of Assurance Engagements (ISAE) 3402 or a multi-client Type 2 U.S. Statement on Standards for Attestation Engagements (“SSAE”) 16 (or an equivalent audit under such successor standard as may then be in effect) effect (a “Controls Audit”) to be conducted by an independent public accounting firm on an annual basis registered with the Public Company Accounting Oversight Board. Each audit shall cover successive [**] periods of time with a favorable assessment of Supplier’s internal controls for Supplier Facilities Shared Service Centers and data centers at or from which the Services and/or services similar to the Services are provided. Each audit report must be provided at Allianz’s costas soon as such report is reasonably available upon completion of each test and Supplier shall provide any updates thereto necessary to address any deficiencies identified in each audit. Supplier shall (A) confer with Allianz Ascension Health as to the scope and timing of each such audit, and (B) accommodate AllianzAscension Health’s requirements and concerns to the extent practicable. Unless otherwise agreed by From the PartiesEffective Date through [**] Supplier will have Control Audits performed based on SSAE 16 and shall provide SOC 1 Type II reports. Thereafter, such audit shall be conducted with a date range of at least twelve (12) months and so as to result in a final audit opinion dated September 1 or later each calendar year. Supplier shall have Control Audits performed on [**] basis throughout the remainder of the Term of this Agreement, based on SSAE 16 and shall provide Allianz and its independent auditors with a copy of such opinion and SOC 2 Type II reports. If Supplier becomes certified in other programs intended to evaluate security, Supplier shall also provide information regarding certification to the resulting Controls Audit report as soon as reasonably possible after the conclusion of such auditapplicable Eligible Recipient. At AllianzAscension Health’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. The Controls Audit shall be conducted and the report provided at no additional charge to Ascension Health and any applicable Eligible Recipient. Supplier shall respond to such reports report in accordance with Section 9.129.10(g). (ii) If Supplier is unable to timely deliver or not required to Allianz, in accordance with Section 9.12(h)(i) above, an unqualified opinionprovide the Controls Audit for Shared Service Centers or data centers due to the timing of the onset of Services or other reason, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (A) provide AllianzAscension Health, on or before the date such opinion Controls Audit is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any qualification, (B) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (C) permit Allianz Ascension Health, the applicable Eligible Recipient and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Allianz Ascension Health, the applicable Eligible Recipient and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have [**] Indicates that text has been omitted which is the right to review subject of a confidential treatment request. The text has been separately filed with the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Allianz or such Permitted Auditors require clarification regarding the Controls Audit report to the extent such TCS AZL Master Effective 1.1.2020 audit rights are available under the agreements signed by Supplier with existing third-party audit firms. Securities and Exchange Commission. (iii) To the extent Allianz Ascension Health requests that, in addition to the Controls Audit described above, Supplier conduct a Allianz-an Ascension Health or Eligible Recipient- specific Controls Audit, Supplier shall do so at AllianzAscension Health’s expense (provided that Supplier notifies Allianz Ascension Health of such expense, obtains AllianzAscension Health’s prior approval of, and uses commercially reasonable efforts to minimize, such expense). If, however, Supplier undertakes additional or different Controls Audit (or equivalent audits) of Supplier Facilities in question (other than customer-specific audits requested and paid for by other Supplier customers), Supplier shall accord Ascension Health the rights described in the last two sentences of Section 9.10(h)(i) with respect to such audits.

Controls Audit. (i) i. In addition to its other obligations under this Section 9.12. 5, Supplier shall cause an International Standard of Assurance Engagements (ISAE) 3402 or a multi-client Type 2 U.S. Statement on Standards for Attestation Engagements (SSAE) 16 (or an equivalent audit under such successor standard as may then be in effect) effect (a “Controls Audit”) to be conducted by an independent public accounting firm on an annual [**] basis for Supplier Facilities data centers at or from which the ASP Services and/or services similar to the ASP Services are provided at Allianz’s costprovided. Supplier shall (Ai) confer with Allianz Ascension Health as to the scope and timing of each such audit, and (Bii) accommodate AllianzAscension Health’s requirements and concerns to the extent practicable. Unless otherwise agreed by the Parties, such Supplier will perform a security audit shall be conducted based on the Statement on Standards for Attestation Engagements (SSAE) No. 16 and will provide a SSAE 16 SOC 1 Type II report prepared by a certified public accountant registered with the Public Company Accounting Oversight Board that covers at least a [**] month period of time in a [**] with a date range favorable assessment of at least twelve (12) months Supplier’s internal controls and so will perform the same on [**] basis throughout the Term of this ASP Agreement. Annually, for Services being provided to an Eligible Recipient from a data center as to result in a final audit opinion dated September 1 or later each calendar of the beginning of Ascension Health’s fiscal year. , Supplier shall provide Allianz and its independent auditors the applicable Eligible Recipient with a copy of such opinion its then current SSAE 16 SOC 1 Type II audit for any [**] month period in a [**] by not later than [**] of the applicable year and the resulting Controls Audit report as soon as reasonably possible after the conclusion of shall provide any updates thereto necessary to address any deficiencies identified in such audit. If Supplier becomes certified in other programs intended to evaluate security, Supplier shall also provide information regarding certification to the applicable Eligible Recipient. At AllianzAscension Health’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. The Controls Audit shall be conducted and the report provided at no additional charge to Ascension Health and any applicable Eligible Recipient. Supplier shall respond to such reports report in accordance with Section 9.125(g). (ii) . If Supplier is unable to timely deliver or not required to Allianz, in accordance with Section 9.12(h)(i) above, an unqualified opinionprovide the Controls Audit for data centers due to the timing of the onset of Services or other reasons, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (Aa) provide AllianzAscension Health, on or before the date such opinion is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any ASCENSION HEALTH CONFIDENTIAL RC Tools ASP Agreement Page 8 qualification, (Bb) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (Cc) permit Allianz Ascension Health, the applicable Eligible Recipient and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Allianz Ascension Health, the applicable Eligible Recipient and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have the right to review the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Allianz Ascension Health, the applicable Eligible Recipient or such Permitted Auditors require clarification regarding on the Controls Audit report and work papers to the extent such TCS AZL Master Effective 1.1.2020 audit rights are available under the agreements signed by Supplier with existing third-party audit firms. iii. (iii) To the extent Allianz Ascension Health requests that, in addition to the Controls Audit described above, Supplier conduct a Allianzan Ascension Health or Eligible Recipient-specific Controls Audit, Supplier shall do so at AllianzAscension Health’s expense (provided that Supplier notifies Allianz Ascension Health of such expense, obtains AllianzAscension Health’s prior approval of, and uses commercially reasonable efforts to minimize, such expense). If, however, Supplier undertakes additional or different Controls Audit (or equivalent audits) of Supplier Facilities in question (other than customer-specific audits requested and paid for by other Supplier customers), Supplier shall accord Ascension Health the rights described in the last two sentences of Section 5(h)(i) with respect to such audits.

Controls Audit. (i) i. In addition to its other obligations under this Section 9.12. 5, Supplier shall cause an International Standard of Assurance Engagements (ISAE) 3402 or a multi-client Type 2 U.S. Statement on Standards for Attestation Engagements (SSAE) 16 (or an equivalent audit under such successor standard as may then be in effect) ([**] Indicates that text has been omitted which is the subject of a “Controls Audit”) to be conducted by an independent public accounting firm on an annual basis for Supplier Facilities at or from which confidential treatment request. The text has been separately filed with the Services and/or services similar to the Services are provided at Allianz’s cost. Supplier shall (A) confer with Allianz as to the scope Securities and timing of each such audit, and (B) accommodate Allianz’s requirements and concerns to the extent practicable. Unless otherwise agreed by the Parties, such audit shall be conducted with a date range of at least twelve (12) months and so as to result in a final audit opinion dated September 1 or later each calendar year. Supplier shall provide Allianz and its independent auditors with a copy of such opinion and the resulting Controls Audit report as soon as reasonably possible after the conclusion of such audit. At Allianz’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. Supplier shall respond to such reports in accordance with Section 9.12Exchange Commission. (ii) . If Supplier is unable to timely deliver or not required to Allianz, in accordance with Section 9.12(h)(i) above, an unqualified opinionprovide the Controls Audit for data centers due to the timing of the onset of Services or other reasons, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (Aa) provide AllianzAscension Health, on or before the date such opinion is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any qualification, (Bb) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (Cc) permit Allianz Ascension Health, the applicable Eligible Recipient and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Allianz Ascension Health, the applicable Eligible Recipient and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have the right to review the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Allianz Ascension Health, the applicable Eligible Recipient or such Permitted Auditors require clarification regarding on the Controls Audit report and work papers to the extent such TCS AZL Master Effective 1.1.2020 audit rights are available under the agreements signed by Supplier with existing third-party audit firms. (iii) . To the extent Allianz Ascension Health requests that, in addition to the Controls Audit described above, Supplier conduct a Allianzan Ascension Health or Eligible Recipient-specific Controls Audit, Supplier shall do so at AllianzAscension Health’s expense (provided that Supplier notifies Allianz Ascension Health of such expense, obtains AllianzAscension Health’s prior approval of, and uses commercially reasonable efforts to minimize, such expense). If, however, Supplier undertakes additional or [**] Indicates that text has been omitted which is the subject of a confidential treatment request. The text has been separately filed with the Securities and Exchange Commission.

Controls Audit. (i) In addition to its other obligations under this Section 9.12. 9.10, Supplier shall cause an International Standard of Assurance Engagements (ISAE) 3402 or a multi-client Type 2 U.S. Statement on Standards for Attestation Engagements (SSAE) 16 (or an equivalent audit under such successor standard as may then be in effect) effect (a “Controls Audit”) to be conducted by an independent public accounting firm on an annual [**] basis for Supplier Facilities Shared Service Centers and data centers at or from which the Services and/or services similar to the Services are provided at Allianz’s costprovided. Supplier shall (Ai) confer with Allianz Ascension Health as to the scope and timing of each such audit, and (Bii) accommodate AllianzAscension Health’s requirements and concerns to the extent practicable. Unless otherwise agreed by the Parties, such Supplier will perform a security audit shall be conducted based on the Statement on Standards for Attestation Engagements (“SSAE”) No. 16 and will provide a SSAE 16 SOC 1 Type II report prepared by a certified public accountant registered with the Public Company Accounting Oversight Board that covers at least a [**] month period of time in a [**] with a date range favorable assessment of at least twelve (12) months Supplier’s internal controls and so will perform the same on [**] basis throughout the Term of this Agreement. [**], for Services being provided to an Eligible Recipient from a Shared Service Center or data center as to result in a final audit opinion dated September 1 or later each calendar of the beginning of Ascension Health’s fiscal year. , Supplier shall provide Allianz and its independent auditors the applicable Eligible Recipient with a copy of such opinion its then current SSAE 16 SOC 1 Type II audit for the applicable Shared Service Center for any [**] month period in a [**] by not later than June 1 of the applicable year and the resulting Controls Audit report as soon as reasonably possible after the conclusion of shall provide any updates thereto necessary to address any deficiencies identified in such audit. If Supplier becomes certified in other programs intended to evaluate security, Supplier shall also provide information regarding certification to the applicable Eligible Recipient. At AllianzAscension Health’s request at any time, Supplier shall confirm in writing that there have been no changes in the relevant policies, procedures and internal controls since the completion of such audit. The Controls Audit shall be conducted and the report provided at no additional charge to Ascension Health and any applicable Eligible Recipient. Supplier shall respond to such reports report in accordance with Section 9.129.10(g). (ii) If Supplier is unable to timely deliver or not required to Allianz, in accordance with Section 9.12(h)(i) above, an unqualified opinionprovide the Controls Audit for Shared Service Centers or data centers due to the timing of the onset of Services or other reason, or the Controls Audit reveals any deficiencies or material weakness, Supplier shall (Aa) provide AllianzAscension Health, on or before the date such opinion Controls Audit is delivered or due to be delivered, a written statement describing the circumstances giving rise to any delay or any qualification, (Bb) take such actions as shall be necessary to resolve such circumstances as soon as practicable, and (Cc) permit Allianz Ascension Health, the applicable Eligible Recipient and its Permitted Auditors to perform such procedures and testing as are reasonably necessary for their assessment of the operating effectiveness of Supplier’s policies, procedures and internal controls. Supplier acknowledges and agrees that Allianz Ascension Health, the applicable Eligible Recipient and Permitted Auditors, upon receiving a copy of the Controls Audit report, shall have the right to review the auditor work papers at the auditor premises, as well as interview the auditor personnel who did the actual audit work in the event Allianz Ascension Health or such Permitted Auditors require clarification regarding on the Controls Audit report and work papers to the extent such TCS AZL Master Effective 1.1.2020 audit rights are available under the agreements signed by Supplier with existing third-party audit firms. . (iii) To the extent Allianz Ascension Health requests that, in addition to the Controls Audit described above, Supplier conduct a Allianzan Ascension Health or Eligible Recipient-specific Controls Audit, Supplier shall do so at AllianzAscension Health’s expense (provided that Supplier notifies Allianz Ascension Health of such expense, obtains AllianzAscension Health’s prior approval of, and uses commercially reasonable efforts to minimize, such expense).. If, however, Supplier undertakes additional or different Controls Audit (or equivalent audits) of Supplier Facilities in question (other than customer-specific audits requested and paid for by other Supplier customers), Supplier shall accord Ascension Health the rights described in the last two sentences of Section 9.10(h)(i) with respect to such audits. ASCENSION HEALTH CONFIDENTIAL MPSA Page 30