NATIONAL INSURANCE CRIME BUREAU - Laserfiche WebLink

20 Part 8: Audit Procedures 1 . Introduction ISO establishes and publishes these audit procedures (“procedures”) for auditing ISO ClaimSearch® Participating Organizations to assure compliance with the policies and rules relating to ISO ClaimSearch. ISO may conduct audits of Participating Organizations in accordance with this Part 8: Audit Procedures of the ISO ClaimSearch Privacy and Security Policies. The goals of this process are to (1) assure compli- ance with the Privacy and Security Policies and rules relating to Participating Organization database access; (2) verify the accuracy of claims information submitted to the database; and (3) assure compli- ance with rules regarding the query of ISO ClaimSearch Information function and queries for retrieval of third-party information. ISO ClaimSearch may perform periodic audits of customer compliance with best-practice industry pro- cedures related to password administration and privacy safeguards to ensure protection of personally identifiable (PI) information provided by ISO. At the sole and exclusive discretion of ISO, these procedures apply to the conduct of on-site and off-site customer reviews. Entities subject to audit agree to submit to and cooperate with audits conducted by ISO or an auditor appointed and paid for by ISO in accordance with ISO ClaimSearch audit procedures. ISO, in its sole and exclusive discretion, may perform random audits on a scheduled or unscheduled basis. ISO will supply reasonable notice for audits. ISO ClaimSearch Participating Organizations shall cooperate with an audit, including the completion of a Participating Organization self-review using ISO-provided instructions. ISO may require a Participating Organization self-review in lieu of or in addition to any other audit type authorized in these procedures. An audit may result from: • random selection • an increase in query volume with no increase in claim reporting volume • red flags indicating claims inquiries are not related to reported claims • claim reporting where insureds or claimants are not policyholders or names are clearly fictitious • other questions related to system use and/or access ISO ClaimSearch will provide reports on audits and self-reviews to ISO ClaimSearch management and the listed Participating Organization home office liaison or designee. ISO will not share information about audits or self-reviews with any other entity except as required by law or as authorized by the Participating Organization. ISO strongly encourages Participating Organizations to perform self-audits to ensure authorized proper access is occurring within their organizations. Significant findings must be presented to the ISO ClaimSearch compliance unit through ClaimSearchCompliance@iso.com. Docusign Envelope ID: 329281D2-142C-8B83-837A-7CD218C257C4