Mondelez 2012 Annual Report Download - page 218

CONFIDENTIAL TREATMENT HAS BEEN REQUESTED FOR PORTIONS OF THIS EXHIBIT. THE COPY FILED HEREWITH OMITS
THE INFORMATION SUBJECT TO A CONFIDENTIALITY REQUEST. OMISSIONS ARE DESIGNATED [ * * * ]. A COMPLETE
VERSION OF THIS EXHIBIT HAS BEEN FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION.
69
9.10.7
Supplier Response
. Supplier and Kraft shall meet promptly upon the completion of an audit conducted pursuant to this
Section 9.10
(i.e., an exit interview) and/or issuance of an interim or final report to Supplier and Kraft following such an audit. Supplier will
respond to each exit interview and/or audit report in writing within 30 days, unless a shorter response time is specified in such report.
Supplier and Kraft shall develop and agree upon an action plan to promptly address and resolve any deficiencies, concerns and/or
recommendations identified in such exit interview and/or audit report and Supplier, at its own expense, shall undertake remedial action
in accordance with such action plan and the dates specified therein to the extent necessary to comply with Supplier’
s obligations under
this Agreement.
9.10.8
Supplier Response to External Audits
. If an audit by a governmental body, standards organization or regulatory authority having
jurisdiction over Kraft, an Eligible Recipient or Supplier results in a finding that Supplier is not in compliance with any applicable
Law or standard required by this Agreement, including any generally accepted accounting principle, Supplier shall, at its own expense
and within the time period specified by such auditor, address and resolve the deficiency(ies) identified by such governmental body,
standards organization or regulatory authority.
9.10.9 SSAE Audit
.
9.10.9.1
Regular Audits
. Supplier shall appoint one of the American Institute of Certified Public Accountants member firms (“
AICPA Auditors ”) to conduct Type II ISAE 3402/SSAE 16 audit of each of the following Supplier’s operating systems
using Supplier control standards located at a Supplier’s Service Management Centers (“ SMC ”): Mainframe OS 390,
Windows NT/2000/2003, Unix HP, Unix IBM AIX, Unix Sun Solaris, Linux, and AS 400 platforms. Each such audit is
called a “ SSAE Audit ”. Supplier’s obligation under the preceding sentences extends to Kraft, only to the extent that
Supplier processes Kraft Data on any such operating system. Supplier agrees that, each calendar year during the Term, it
will have one of the AICPA Auditors conduct, at Supplier’s expense, at least one SSAE Audit covering each type of
operating system from which Kraft Data is processed at each SMC. Supplier shall provide Kraft with one copy of each
applicable audit report resulting from such SSAE Audit (“ SSAE Report ”). To the extent Kraft obtain Services from
Supplier’s SMC’s, any incremental remediation costs due to Supplier’s non-compliance with its obligation to provide the
Services in accordance with Supplier’s control standards shall be borne by Supplier. For purposes of clarification, the
Parties agree that if Kraft changes its environment in a manner that does not meet Supplier control standards, Supplier shall
so notify Kraft and any operating system so affected may be excluded from the SSAE Audits discussed above.
9.10.9.2
Additional Audits
. To the extent Kraft provides reasonable notice and requests that, in addition to the SSAE Audit
described in Section 9.10.9.1 , Supplier conducts a Kraft-specific SSAE Audit, Supplier shall do so at Kraft’s expense
(provided, Supplier notifies Kraft of such expense, obtains Kraft’s approval and uses commercially reasonable efforts to
minimize such expense). If, however, Supplier undertakes additional or different SSAE Audits (or equivalent audits) of
Supplier Facilities at, from or through which Services are provided to Kraft and/or the Eligible Recipients (other than
customer-specific audits requested and paid for by other Supplier customers), Supplier shall accord Kraft the rights
described in the preceding paragraph with respect to such audits.