Enrollment & Claims Platform Modernization

Independent external assessment of controls over financial reporting, engaged under decision D-004. Issued under the governing master agreement.

SOW-004 · Independent SOX Controls Assessment

1 · Parties and Instrument

2 · Scope

The platform handles financial transactions, so it falls within Sarbanes-Oxley control scope, and SOX control testing is a Go-Live gate rather than a post-implementation activity. Decision D-004, taken by the Program Manager on Sep 3, 2026, was to engage an external firm to perform the assessment rather than rely on internal testing alone.

The reason is structural. The program's Internal Audit / SOX Compliance Lead designs the control set and will operate it after go-live. A person who designed a control is not the right person to conclude that it works, and an assessment produced inside the program carries the program's own optimism. The Vendor is engaged to reach a conclusion the Client cannot reach about itself; independence is the deliverable, and everything else in this Statement of Work exists to protect it.

In scope. Assessment of the design and operating effectiveness of controls over financial reporting within the platform's scope; walkthroughs with control owners; sample testing against the agreed control population; written findings with severity and management response; and an assessment opinion issued to the Client's Internal Audit function.

Out of scope. Designing or remediating controls, which would make the Vendor the assessor of its own work. Advising on the control set before it is assessed. Any operational role in the program. Assessment of controls outside the platform's financial-reporting scope. Attestation or audit opinions reserved to the Client's external auditor.

Anything not described in this section is out of scope. In particular, a request for remediation advice during the assessment is a variation and compromises independence if accepted informally.

3 · Approach

The assessment runs in three phases: scoping the control population, testing it, and reporting. The phases are sequential because a sample drawn before the population is confirmed tests the wrong thing, and a finding reported before the control owner has responded is an accusation rather than an assessment.

The Vendor works from the Client's own control documentation and evidence rather than from interviews alone. Where documented evidence does not exist, that absence is itself a finding — a control that cannot be evidenced cannot be concluded on, whatever the control owner recalls.

Findings are put to the control owner before they are finalized, and the management response is published beside the finding rather than replacing it. The Vendor does not negotiate the finding; it records the disagreement. A report that only contains findings the program accepted is not an independent assessment.

The engagement is priced on a rate card against a per-phase estimate, with no fee contingent on the findings and no total committed before the control population is confirmed. A fixed price agreed in advance of a known population is either padded or becomes pressure to narrow scope, and both outcomes damage the thing being bought.

4 · Delivery Phases

Phase 1 — Scoping

The control population confirmed in writing before any sample is drawn.

Phase 2 — Testing

Design and operating effectiveness tested against the agreed population, with evidence retained.

Phase 3 — Reporting

Findings put to control owners, then an opinion issued to Internal Audit.

5 · Acceptance

Each Deliverable is submitted with the evidence its acceptance criteria call for. The Client has the stated Review Period to accept, or to reject in writing with specific, criterion-by-criterion reasons. Silence for the whole Review Period is acceptance — deemed acceptance — because a program cannot hold a supplier to a date while leaving its own review open-ended.

A rejection must identify which criterion failed and how. An objection that the Deliverable is not what was expected, where it meets every stated criterion, is a variation rather than a rejection. The Vendor re-submits within ten Business Days and a second Review Period of five Business Days runs. A Deliverable rejected twice on the same criterion is escalated rather than looped.

The Review Period is deliberately short and deliberately symmetrical. The Client gains a fixed window in which to find defects; the Vendor gains certainty that the window closes.

6 · Timeline and Resourcing

The assessment is scheduled so that its opinion is available before the Go-Live gate it informs. Phase 1 must complete before Phase 2 begins; Phase 3 cannot compress, because the management response period is what makes the report defensible.

The table below shows who is involved on each side. G. Fenwick commissions the assessment and provides access; ⚠ he does not perform it and does not approve its findings, which is the point of engaging externally.

7 · Fees and Payment

Charged monthly in arrears on hours actually worked, at the rates in the rate card, against a per-phase estimate. No total is committed before the control population is confirmed at the end of Phase 1.

• No fee is contingent on the findings, on the number of findings, or on the opinion reached. This clause is the reason the assessment is worth having.
• The Phase 1 estimate is fixed. Phase 2 and Phase 3 estimates are issued once the population is agreed, and become chargeable only on the Client's written acceptance.
• Work beyond an accepted phase estimate requires a variation before it is performed.

Invoices are payable thirty days from receipt of a correct invoice. The Client may withhold the disputed portion, and only that portion.

8 · Assumptions

The dates and the price in this Statement of Work rest on the following. Each is stated so that its failure is visible rather than argued about later; where one fails, the consequence is handled under Project Variations.

• Control documentation exists and is current at the start of Phase 1. Where it does not, the absence is recorded as a finding rather than remedied by the Vendor.
• Control owners are available for walkthroughs within ten Business Days of request. Unavailability is reported as a scope limitation in the opinion.
• Evidence is retrievable for the full sample period. A sample that cannot be evidenced is reported as a deficiency, not re-drawn to avoid it.
• The control population is confirmed in writing before testing begins. No sample is drawn against an unconfirmed population.
• No total is committed before Phase 1 completes. The per-phase estimate is revised once the population is known, and the revision is a variation.
• The Vendor performs no remediation, advisory or design work for the Client on the controls it assesses, during the engagement or for its duration.

9 · Project Variations

Either party may propose a variation. The Vendor prices it within five Business Days, stating the effect on fees, on dates, and on any other Deliverable. No variation takes effect until both parties sign, and work performed in anticipation of one is at the Vendor's own cost — the clause exists so that goodwill work does not arrive later as an invoice.

Where an assumption in the preceding section fails, the consequence is handled here rather than absorbed silently. A failed dependency moves the affected dates by the period of delay and no more; it does not reopen scope or price unless the parties agree that it should.

A variation that alters the program baseline set at the Nov 3, 2026 milestone is additionally subject to program change control and the Change Control Board, not to this SOW alone. A change within the SOW is a commercial matter between the parties; a change to the baseline is a program matter that other work packages depend on.

10 · Terminology

11 · Governing Agreement

This Statement of Work is issued under the Master Services Agreement between the parties and creates no rights independent of it. Warranty, limitation of liability, intellectual property, confidentiality, data protection, insurance, termination and dispute resolution are governed by the MSA and are not restated here. Restating them invites the two documents to disagree, and a Statement of Work that contradicts its own master agreement is worse than one that is silent.

Where the Vendor handles protected health information, the parties' Business Associate Agreement governs and prevails over both this SOW and the MSA to the extent of any conflict. On any other matter the order is: the BAA, the MSA, this SOW, then an executed variation, which prevails over this SOW only on the matter it changes. The Vendor's standard terms — in a portal click-through, an invoice footer or an order acknowledgement — are excluded.

12 · Execution

Executed following the approval convention this suite uses in SOW-001: the Vendor / Procurement Manager signs for the Client, the Vendor signs through its own authorized representative, and the internal approvals below are recorded separately. ⚠ The Program Manager approves but does not sign — program authority is not signing authority, and the separation is deliberate.

⚠ The Vendor is deliberately unnamed throughout this suite, so the vendor signature line carries a role rather than a person. That is the convention, not an omission — and an unexecuted Statement of Work does show a blank signature line on both sides. The Client side names individuals because they are the program's own people, who appear by name across the rest of the suite.