Page 1 of 13 THIRD AMENDMENT TO AGREEMENT Between BROWARD COUNTY BROWARD COUNTY PROPERTY APPRAISER BROWARD COUNTY SHERIFF SUPERVISOR OF ELECTIONS HOUSING FINANCE AUTHORITY OF BROWARD COUNTY, FLORIDA CROWE HORWATH LLP For INDEPENDENT AUDIT SERVICES RLI # R0761007R1
Page 2 of 13 THIRD AMENDMENT TO AGREEMENT Between BROWARD COUNTY BROWARD COUNTY PROPERTY APPRAISER BROWARD COUNTY SHERIFF SUPERVISOR OF ELECTIONS HOUSING FINANCE AUTHORITY OF BROWARD COUNTY, FLORIDA CROWE HORWATH LLP For INDEPENDENT AUDIT SERVICES RLI # R0761007R1 This Third Amendment ("Third Amendment") to the Agreement hereinafter defined between BROWARD COUNTY, a political subdivision of the State of Florida, acting by and through its Board of County Commissioners ("COUNTY"), AND The BROWARD COUNTY PROPERTY APPRAISER, a constitutional officer of the State of Florida, his/her successors and assigns ("PROPERTY APPRAISER"), AND The BROWARD COUNTY SHERIFF, a constitutional officer of the State of Florida, his/her successors and assigns ("SHERIFF"), 2
Page 3 of 13 AND The BROWARD COUNTY SUPERVISOR OF ELECTIONS, a constitutional officer of the State of Florida, his/her successors and assigns ("SUPERVISOR OF ELECTIONS"), AND The HOUSING FINANCE AUTHORITY OF BROWARD COUNTY, Florida, a public body corporate and politic ("HFA"), AND CROWE HORWATH LLP, Certified Public Accountants, doing business or authorized to do business in the State of Florida, its successors and assigns ("AUDITOR"), is entered into effective as of the date this Third Amendment is executed by the County ("Effective Date"). RECITALS: WHEREAS, the COUNTY, PROPERTY APPRAISER, SHERIFF, SUPERVISOR OF ELECTIONS, HFA, AND AUDITOR (collectively, the "Parties") entered into an agreement, dated January 26, 2010, for independent auditing services (the "Original Agreement"); and WHEREAS, the Parties entered into two amendments to the Original Agreement, which among other things, extended the term of the Original Agreement (the Original Agreement, together with the amendments, shall be referred to collectively as the "Agreement"); and WHEREAS, the Agreement is currently set to expire on January 26, 2017 or upon completion of the final audit for Fiscal Year 2015-2016, whichever occurs later; and WHEREAS, the Parties desire to enter into this Third Amendment to authorize the performance of additional auditing services by AUDITOR pursuant to Article 3.1 of the Agreement; and WHEREAS, the Parties wish to increase the maximum fee specified in the Agreement for Fiscal Year 2015-16 by Eighty Thousand Dollars and Zero Cents ($80,000.00) in exchange for the additional auditing services provided by AUDITOR pursuant to this Third Amendment; NOW THEREFORE, For good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties amend the Agreement as follows: 3
Page 4 of 13 1. The above-stated recitals are true and correct and are incorporated herein by reference. 2. Article 1.15 of the Agreement is hereby deleted in its entirety and replaced as follows: 1.15 Special Auditing Services: Any and all services specified on Exhibit A-1, attached hereto and made a part hereof, which services shall be performed exclusively by AUDITOR S auditing staff. 3. Article 6 of the Agreement is hereby amended to read as follows: 6.1 MAXIMUM FEE FOR FISCAL YEARS... 6.1.7 The fees for Fiscal Year 2015-2016 shall be Eight Hundred Fifty Three Thousand Dollars ($853,000.00) Nine Hundred Thirty Three Thousand Dollars and Zero Cents ($933,000.00). This fee includes the cost of all work, services, Special Auditing Services, and reports set forth in this Agreement, and Exhibit "A.," and Exhibit A-1.... 4. In addition to any and all services required in the Agreement (including Exhibit "A" of the Agreement), AUDITOR shall, prior to the expiration of the Agreement, perform the Special Auditing Services specified in Exhibit A-1 of the Agreement, attached hereto and made a part hereof, on the same terms and conditions required for the performance of all other services under the Agreement, except that the provisions of Article 11.2 of the Agreement shall not apply to the Special Auditing Services. 5. AUDITOR shall receive, as compensation for the Special Auditing Services, the maximum amount of Eighty Thousand Dollars and Zero Cents ($80,000.00), to be invoiced and paid in accordance with Article 6.6 of the Agreement and the hourly rates contained in the IT Consulting Services section of Exhibit B to the Agreement. 6. AUDITOR shall, in performing the Special Auditing Services, abide with all laws, rules, regulations, and professional standards governing the performance of such services. 7. In the event of any conflict or ambiguity between this Third Amendment and the Agreement, this document shall control. 4
Page 5 of 13 8. Except as expressly modified herein, all terms and conditions contained within the Agreement shall remain in full force and effect. 9. The Agreement, as modified by this Third Amendment, incorporates and includes all prior negotiations, correspondence, conversations, agreements, and understandings applicable to the matters contained herein, and the Parties agree that there are no commitments, agreements, or understandings concerning the subject matter hereof that are not contained in the Agreement as modified hereby. Accordingly, the Parties agree that no deviation from the terms hereof shall be predicated upon any prior representations or agreements, whether oral or written. 10. Preparation of this Third Amendment has been a joint effort of the Parties, and the resulting document shall not, solely as a matter of judicial construction, be construed more severely against one of the Parties than any other. 11. Each individual executing this Third Amendment hereto hereby represents and warrants that he or she is, on the date he or she signs this Third Amendment, duly authorized by all necessary and appropriate action to execute this Third Amendment on behalf of such party and does so with full legal authority. 12. The Agreement, as amended, is hereby ratified and confirmed. 13. Multiple originals of this Third Amendment may be executed by the Parties, each of which, bearing original signatures, shall have the force and effect of an original document. 14. AUDITOR acknowledges that, through the date hereof, it has no claims against COUNTY or any other Parties with respect to any of the matters covered by the Agreement, as amended. [THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK] 5
Page 6 of 13
Page 7 of 13
Page 8 of 13
Page 9 of 13
Page 10 of 13
Page 11 of 13
Page 12 of 13 EXHIBIT A-1 Network Security and Management 1. Governance Review the documentation for policies and procedures by inspecting current documentation and interviewing key personnel to confirm that these policies and procedures represent best practices while supporting core business objectives. These policies are a key component of overall network security and stability. Areas of review include: Security policy development/maintenance Security roles, responsibilities, authority and accountability assignments Development/maintenance of a security and control framework Risk Assessment Classification and assignment of ownership of information assets Monitoring and metrics of security compliance and performance Information Security Training Annual information security evaluations and performance reports to the Board 2. Security Policies and Procedures Review the documentation for policies and procedures by inspecting current documentation and interviewing key personnel to confirm that these policies and procedures represent best practices while supporting core business objectives. These policies are a key component of overall network security and stability. Areas of review include: Information Security Program End User Security Awareness Training End User Security Policy Human Resources Sensitive Data Security Access Controls Password Management Information Systems Security Policies Network Security Policies Information and Event Management Physical and Environmental Security Information Security Incident Management 3. Network Management and Operations Appropriate change management and processes are essential components of an effective information security and system management program. Review the processes by which network equipment are implemented, changed, archived, and destroyed and identify points of risk. Areas of review include: Logging and Monitoring Computer Inheritance Procedures 12
Page 13 of 13 Patch Management Information System Acquisition, Development and Maintenance Vulnerability Testing Configuration Management Asset Management 4. Deliverables Phased payments up to the agreed upon lump sum amount will be made based upon approval by the Contract Administrator of deliverables submitted. The following deliverables are required: An audit plan. An entrance conference to be coordinated by the County and the contractor. Bi-weekly interim progress reports that include a summary of preliminary findings, specific accomplishments achieved during the reporting period, and projected completion dates for specific tasks remaining to be completed. An exit conference at a time to be determined by the County and the contractor that includes a detailed oral presentation of findings, recommendations, and detailed action plans along with any identified cost savings opportunities. A draft audit report that includes the following: o An executive summary of all issues, findings, and recommendations as a result of all work required by the contract and audit plan, o Detailed descriptions of the work performed, conclusions/findings prioritized by risk and recommendations, o Clear and unambiguous proposals to achieve any improvements recommended by the contractor, o Citations of recognized security frameworks such as NIST Cyber Security Framework, ISO/27001, ISO/27002 when applicable, and o Comments or responses to recommendations from the County s staff. The County s staff will have 30 days to respond in writing to the draft report. The timeframe for the due date of the draft audit report will be negotiated between the County Auditor or his designee and the contractor. A final audit report that includes the elements of the draft report outlined above. The timeframe for the due date for the final audit report will be negotiated between the County Auditor or his designee and the contractor. Exhibit A-1 13