Gap (GPS)

37.4 Internal Audits

In addition to the audits authorized by Gap as set forth above, to the extent Supplier performs any assessment or an internally conducted audit of its business and operations to evaluate its compliance with Gap’s Policies and Procedures and/or Supplier’s Service delivery or account management, Supplier shall provide Gap with a written report outlining the results of the audit or assessment.

At Supplier’s sole cost and expense, Supplier shall cooperate with Gap on SAS 70 Type II audits and on Sarbanes-Oxley related documentation and/or testing activities at the Gap Sites. At Supplier’s sole cost and expense, Supplier shall provide a multi-client SAS 70 Type II covering the common processes performed by Supplier in delivering, controlling and governing client accounts from an independent third party auditor. Supplier shall perform the SAS 70 Type II audit either (i) on a quarterly basis, or (ii) on an annual basis with quarterly updates throughout the year. Supplier shall provide Gap with an electronic and written copy of the SAS 70 Type II audit opinion within sixty (60) days after the completion of (i) the annual or quarterly SAS 70 Type II audit, and (ii) all updates thereto (if annual audit option is elected by Supplier). Supplier shall retain, in its sole discretion, either PricewaterhouseCoopers, Ernst & Young, Deloitte & Touche or KPMG for purposes of performing the SAS 70 Type II audit under this Section 37.4 (Internal Audits), unless otherwise agreed by the Parties in writing.

If a SAS 70 Type II audit reveals a significant deficiency in Supplier’s implementation of a control specified in Exhibit O (Sarbanes Oxley Reporting Requirements and Process), Supplier shall notify Gap promptly upon being advised of such significant deficiency, provide the audit report to Gap within the time provided above, and within fifteen (15) days of receipt by Supplier of the audit, initiate such corrective action (at its cost and expense) as necessary to remediate the subject control(s) and have the control(s) re-audited and validated by the auditor as functioning effectively. In the event Supplier has not delivered to Gap a supplemental audit report reflecting that the significant deficiency have been corrected on or before September 30 of the applicable Contract Year, then Supplier shall reimburse Gap *.