The contractual instrument binding the external assessment firm engaged under decision D-004. Independence is the deliverable; the program cannot direct the findings.
SOW-004 · Independent SOX Control Assessment
1 · Parties, Instrument and Term
| Item | Detail |
|---|---|
| SOW reference | SOW-004 — Independent SOX Control Assessment |
| Governing agreement | Master Services Agreement between the Client and the Vendor |
| Client | The health plan operating the Enrollment & Claims platform ("Client") |
| Vendor | the external assessment firm ("Vendor") |
| Client SOW owner | W. Donnelly — Vendor / Procurement Manager |
| Client technical authority | G. Fenwick — Internal Audit / SOX Compliance Lead |
| Client program authority | C. Tyrrell — Program Manager |
| Term | From execution through warranty exit at program closeout, Nov 2, 2027 |
| Pricing basis | Fixed fee per phase, quoted on scope confirmation |
This SOW is issued under and governed by the Master Services Agreement. It creates no rights independent of that agreement, and where the two conflict the order in Section 15 applies.
2 · Background and Purpose
Decision D-004, taken by the Steering Committee on Sep 3, 2026, engages an external firm for SOX compliance assessment rather than relying on internal audit alone, given program complexity. This SOW gives that decision contractual form.
⚠ Internal audit is not displaced. G. Fenwick, Internal Audit / SOX Compliance Lead, retains the internal SOX Control Impact Assessment at WBS 1.2B and is accountable here for one thing only: the independence of this firm, and the absence of program influence over its findings. That is why the Client technical authority for this SOW is a person who cannot instruct the work.
⚠⚠ No total value is committed in this SOW. Fees are quoted per phase on scope confirmation. A fixed price agreed before the control population is known would either be padded or would create pressure to narrow scope — and scope pressure on an independence engagement is the one thing the engagement exists to avoid.
3 · Definitions
| Term | Meaning |
|---|---|
| Acceptance | Client's written confirmation that a Deliverable meets its Acceptance Criteria, or the expiry of the Review Period without written rejection, whichever occurs first. |
| Acceptance Criteria | The objective, testable conditions stated against each Deliverable in Section 5. A condition that cannot be tested is not an Acceptance Criterion and does not become one by being written in this table. |
| Review Period | Ten (10) Business Days from Client's receipt of a Deliverable, unless a different period is stated against that Deliverable. |
| Business Day | Monday to Friday excluding US federal holidays. |
| Change Order | A written amendment to this SOW executed by both parties under Section 9. Work performed outside an executed Change Order is performed at Vendor's own cost. |
| Client Data | All data supplied by Client or generated on Client's behalf, including member, claims, provider and eligibility records. Client Data remains Client's property at all times. |
| Independence | The absence of any relationship, fee arrangement or instruction that could reasonably be seen to influence Vendor's findings. Assessed by reference to appearance as well as to fact. |
| Finding | A conclusion that a control is inadequately designed or is not operating effectively, stated with the evidence relied on. |
4 · Scope of Services
Scope is stated twice — what Vendor does, and what Vendor does not. The second list is the one that prevents disputes. A boundary discovered during delivery is renegotiated under pressure, at a price set by whoever can least afford to walk away; a boundary written down before execution is simply the deal. Where this SOW is silent, the work is Client's.
In scope. Vendor shall provide:
- Assessment of controls over financial reporting affected by the platform change.
- Independent testing of control design and operating effectiveness pre-go-live.
- Written findings with severity, each traced to the control and the evidence examined.
- Attendance at the Go-Live gate to present findings directly to the Steering Committee.
- Re-test of remediated controls where Client requests it under a Change Order.
Expressly out of scope. The following are Client's and are named here so that neither party discovers the boundary during delivery:
- Designing or remediating controls, which Vendor cannot do and then assess.
- The internal SOX Control Impact Assessment at WBS 1.2B, which is G. Fenwick's.
- Any advisory or implementation work that would compromise independence.
- Sign-off on Client's SOX certification, which is Client's officers' alone.
- Assessment of controls outside the platform's financial reporting scope.
5 · Deliverables and Acceptance
| ID | Deliverable | Acceptance Criteria | Review Period |
|---|---|---|---|
| D-S1 | Scope and independence confirmation | Control population agreed in writing; Vendor confirms no relationship impairing independence, and discloses any it has. | 5 BD |
| D-S2 | Control design assessment | Each in-scope control assessed for design adequacy, with the evidence examined named against each conclusion. | 10 BD |
| D-S3 | Operating effectiveness test results | Test procedures, sample sizes, exceptions found, and a conclusion per control that a reader can retrace. | 10 BD |
| D-S4 | Findings report to the Steering Committee | Findings by severity with management response recorded separately from the finding, so the two cannot be confused. | 10 BD |
Each Deliverable is submitted with the evidence its Acceptance Criteria call for. Client has the Review Period to accept or to reject in writing with specific, criterion-by-criterion reasons. Silence for the whole Review Period is Acceptance — deemed acceptance — because a program cannot hold a vendor to a date while leaving its own review open-ended.
A rejection must identify which Acceptance Criterion failed and how. "Not what we expected" is not a rejection; it is a Change Order conversation. Vendor re-submits within ten Business Days and a second Review Period of five Business Days runs. A Deliverable rejected twice on the same criterion escalates under Section 12 rather than looping.
The Review Period is deliberately short and deliberately symmetrical. Client gains a fixed window in which to find defects, and Vendor gains certainty that the window closes. Neither party benefits from an acceptance process that can be extended by not answering — the program has a baselined schedule and an acceptance clause that cannot expire is a schedule risk carried by whichever party is not writing the emails.
6 · Client Responsibilities and Dependencies
Vendor's obligations are conditional on the following. Each dependency names a Client owner, because a dependency without an owner is an excuse rather than a commitment. Where Client fails to meet a dependency and that failure demonstrably delays Vendor, the affected dates move by the period of delay and no more — a missed dependency does not reopen scope or price.
| Client provides | Named owner |
|---|---|
| Control documentation and process narratives | G. Fenwick — Internal Audit / SOX Compliance Lead |
| Access to systems, evidence and control owners | M. Alvarez — Infrastructure Lead |
| Test environments reflecting production controls | J. Albert — Solution Architect |
| Commercial terms and Change Order signature | W. Donnelly — Vendor / Procurement Manager |
7 · Fees and Payment
Money is expressed against named Deliverables rather than against elapsed time, so that the question of whether a sum has been earned has an answer that does not depend on recollection. Percentages are used rather than restated dollar amounts, so that a Change Order to the value does not silently leave a payment schedule that no longer sums.
⚠ No total is committed. Each phase is quoted as a fixed fee on confirmation of the control population in D-S1, and invoiced on Acceptance of that phase's Deliverable:
- D-S1 scope and independence confirmation — quoted on engagement.
- D-S2 design assessment — quoted on Acceptance of D-S1.
- D-S3 operating effectiveness — quoted on Acceptance of D-S2.
- D-S4 findings report — included in the D-S3 phase fee.
⚠⚠ No fee is contingent on the findings. Not on their number, their severity, or whether the program passes its Go-Live gate. A contingent fee would make the assessment worthless and is expressly prohibited by this clause.
Invoices are payable thirty days from receipt of a correct invoice. Client may withhold the disputed portion of an invoice, and only that portion, pending resolution under Section 12.
8 · Key Personnel and Service Levels
Service levels are stated as measures a third party could evaluate from the reporting alone. A commitment that requires the parties to agree afterwards whether it was met is not a service level; it is a topic for a meeting. Each measure below is either evidenced by a Deliverable in Section 5 or is directly observable in the weekly delivery forum.
| Measure | Commitment |
|---|---|
| Engagement partner | Named at engagement; not replaced without Client consent |
| Independence | Confirmed in writing at D-S1 and re-confirmed at D-S4 |
| Findings turnaround | Draft findings within 10 Business Days of test completion |
| Escalation of a Severity 1 finding | Direct to the Steering Committee within 2 Business Days |
Vendor shall not replace a named individual without Client's prior written consent, save where the individual leaves Vendor's employment. A replacement is inducted at Vendor's cost and Client is not charged for the replacement's familiarization.
9 · Change Orders
Either party may propose a change. Vendor prices it within five Business Days, stating the effect on fees, on dates, and on any other Deliverable. No change is effective until both parties sign, and work performed in anticipation of a Change Order is at Vendor's own cost — the clause exists so that goodwill work does not become an invoice later.
Changes that alter the program baseline set at the Nov 3, 2026 milestone are additionally subject to program change control and the Change Control Board, not to this SOW alone.
10 · Warranty
Vendor warrants that the Services are performed by suitably qualified personnel in a professional and workmanlike manner, and that Deliverables conform to their Acceptance Criteria for ninety (90) days after Acceptance. Vendor's sole obligation for a breach of this warranty is to re-perform the affected Services at no charge.
The warranty does not cover defects arising from Client's modification of a Deliverable, from Client Data supplied incorrectly, or from an environment Vendor does not control. It survives to program closeout on Nov 2, 2027.
11 · Data Protection, Confidentiality and Intellectual Property
Client Data is disclosed for the sole purpose of performing the Services. Vendor processes it only on Client's documented instructions, restricts access to personnel with a demonstrable need, and returns or destroys it within thirty days of termination, certifying destruction in writing.
Where Vendor handles protected health information, the parties' Business Associate Agreement governs and prevails over this SOW to the extent of any conflict. Vendor notifies Client of any suspected unauthorized access without undue delay and in any event within twenty-four hours of becoming aware.
Client owns all Deliverables and all derivative work created under this SOW on Acceptance. Vendor retains its pre-existing materials and grants Client a perpetual, irrevocable, royalty-free license to use them to the extent embedded in a Deliverable — so that Client is never unable to operate what it has paid for.
12 · Governance and Escalation
Day-to-day direction runs through the Client SOW owner. Matters not resolved within five Business Days escalate to the Program Manager; matters not resolved within a further five Business Days escalate to the Steering Committee. Neither party may suspend performance while an escalation is open.
Vendor attends the program's weekly delivery forum and reports against the measures in Section 8. Reporting is a contractual obligation, not a courtesy: a service level that is not reported is not being managed.
13 · Limitation of Liability
Each party's aggregate liability under this SOW is limited to the fees paid or payable under this SOW in the twelve (12) months preceding the event giving rise to the claim. Neither party is liable for indirect, incidental or consequential loss, or for loss of profit, revenue or anticipated saving.
⚠ The cap does not apply to: breach of confidentiality; unauthorized access to or disclosure of Client Data, including any incident engaging HIPAA breach-notification obligations; infringement of a third party's intellectual property; or either party's fraud or wilful misconduct. Those are uncapped, deliberately — a cap expressed as a multiple of fees is meaningless against a notifiable breach affecting member records.
14 · Termination and Transition Assistance
Client may terminate for convenience on thirty days' written notice, paying for Services properly performed and for Deliverables accepted to the date of termination, and for no more. Either party may terminate for material breach unremedied thirty days after written notice.
On termination for any reason Vendor provides transition assistance for up to ninety days at the rates in Section 7: knowledge transfer, documentation, configuration exports and reasonable access to the personnel who did the work. Transition assistance is not conditional on the reason for termination or on any disputed sum — a program that cannot exit a vendor it is in dispute with does not have a contract, it has a hostage.
15 · Order of Precedence
Where documents conflict, the order of precedence is: (1) the Business Associate Agreement, on any matter it addresses; (2) the Master Services Agreement; (3) this SOW; (4) an executed Change Order, which prevails over this SOW only on the matter it changes; (5) any Vendor quotation, proposal or order-acknowledgement, which is included for reference and creates no obligation.
⚠ Vendor's standard terms, wherever they appear — in a portal click-through, an invoice footer, or an order acknowledgement — are expressly excluded.
16 · General Conditions
Neither party may assign this SOW without the other's written consent, save to a successor to substantially the whole of its business. Vendor may not subcontract any part of the Services without Client's prior written consent, and remains fully responsible for any permitted subcontractor's acts and omissions.
Neither party is liable for failure caused by an event beyond its reasonable control, provided it notifies promptly and mitigates. Inability to pay is never such an event. Nothing in this SOW creates a partnership, joint venture or employment relationship, and neither party may hold itself out as agent of the other.
Vendor's personnel remain Vendor's employees or contractors for all purposes including tax, benefits and insurance. Client directs the what and the when; Vendor directs the how and the who.
17 · Execution
Executed by the authorized representatives of each party. ⚠ The Program Manager signs nothing: program authority is not signing authority, and the separation is deliberate.