Terms of Service

1. About these terms

These Terms of Service (these "Terms") govern all services that Throughline LLP ("Throughline", "we", "us", or "our") provides to you (the "Client", "you", or "your"). Each engagement is initiated by a Statement of Work ("SOW") that specifies the engagement-specific scope, fees, deliverables, timing, and any standard‑specific terms. Together, these Terms and the applicable SOW form the agreement between us in respect of that engagement (the "Agreement").

If there is any conflict between these Terms and an SOW, the SOW prevails for that engagement, except that the provisions of Sections 6 (Independence and Impartiality), 10 (Complaints, Disputes, and Appeals), 12 (Reports, Certificates, and Marks), and 14 (General Terms of Business) prevail over conflicting SOW terms unless we expressly agree otherwise in a signed writing.

These Terms are designed to satisfy the engagement letter and contractual requirements of the standards under which we operate, including:

• The AICPA Statements on Standards for Attestation Engagements (SSAEs), including SSAE No. 21 and the AT-C sections (in particular AT-C 105 and AT-C 205), for our SOC 1, SOC 2, GDPR, and HIPAA‑related attestation services;
• ISO/IEC 17021-1 (and related standards including ISO/IEC 27006) governing certification bodies, for our ISO/IEC 27001 and ISO/IEC 42001 certification services;
• The AICPA Code of Professional Conduct, applicable independence rules, and applicable Statements on Quality Management Standards (SQMS); and
• Applicable accreditation requirements of our accreditation body or bodies (collectively, the "Standards").

2. Definitions

In these Terms, the following defined terms apply (additional defined terms appear inline):

• "Attestation Engagement" means an engagement performed under the AICPA SSAEs, including SOC 1, SOC 2, GDPR, HIPAA‑related examinations.
• "Certification Engagement" means an engagement to assess and, if appropriate, certify a Client's management system under ISO/IEC 27001, ISO/IEC 42001, or another standard for which we are a certification body.
• "Audit Documentation" means the documentation, records, evidence, observations, working papers, and other information we collect, generate, or receive in performing services for you.
• "Personal Data" has the meaning given in our Privacy Policy and includes "personal information" as that term is used under applicable privacy law.
• "Report" means any report, opinion, certificate, statement, communication, or other deliverable we issue under an Agreement, including SOC reports and ISO certificates.
• "Subject Matter" means the management system, controls, system description, processes, or other information that is the subject of our engagement.

3. Engagement structure

3.1 Master and SOW

These Terms operate as a master agreement. Each engagement is documented in an SOW signed (or otherwise affirmatively accepted) by both parties. The SOW will identify, at minimum:

• The engagement type (e.g., SOC 1 Type 1, SOC 2 Type 2, HIPAA examination, ISO/IEC 27001 initial certification, surveillance, recertification);
• The Subject Matter and scope, including the system or scope being audited;
• The applicable criteria or standard;
• The engagement fees;
• The key deliverables; and
• Any engagement‑specific terms that supplement these Terms.

3.2 Order of precedence

Order of precedence: (a) any signed amendment or change order; (b) the SOW; (c) these Terms (subject to the carve‑outs in Section 1); (d) our Privacy Policy and Data Processing Agreement, as applicable.

4. Services we provide

Throughline LLP operates as both:

• A licensed certified public accounting (CPA) firm, providing attestation and assurance services under the AICPA SSAEs; and
• A certification body, providing management system certifications under ISO/IEC 17021-1 and related accreditation requirements.

We maintain organizational and operational separations, conflict-of-interest controls, and quality management arrangements designed to satisfy the independence and impartiality requirements of both regimes (see Section 6).

The following sub‑sections describe the engagement types we offer and the engagement‑specific terms that apply to each. Only the sub‑sections that match the engagement type identified in your SOW apply to your engagement.

4.1 SOC 1 examinations (SSAE 21, AT-C 105, AT-C 205, AT-C 320)

We perform SOC 1 Type 1 and Type 2 examinations of controls at a service organization relevant to user entities' internal control over financial reporting, in accordance with AT-C section 320 and the related AT-C sections under SSAE 21.

Engagement-specific terms:

• We will issue an examination report describing the system, our opinion on whether the description is fairly presented, the suitability of design of controls, and (for Type 2) the operating effectiveness of controls during the specified period.
• You will provide us with a written assertion regarding the description, the suitability of the design of the controls, and (for Type 2) the operating effectiveness of the controls.
• The engagement is not designed to detect all instances of fraud or error and does not provide assurance about controls or matters outside the defined scope.
• We may include the views of management in the report regarding identified deviations.

4.2 SOC 2 examinations (SSAE 21, AT-C 105, AT-C 205, TSP 100)

We perform SOC 2 Type 1 and Type 2 examinations against the Trust Services Criteria for one or more of Security, Availability, Processing Integrity, Confidentiality, and Privacy, in accordance with AT-C section 205 (and AT-C 105) and the AICPA Trust Services Criteria.

Engagement-specific terms:

• The SOW will specify which Trust Services Categories are in scope, the system being examined, and the period covered.
• You will prepare a description of the system that meets the AICPA description criteria and will provide us with a written assertion.
• For SOC 2 + HIPAA combined engagements, we will examine controls mapped to applicable HIPAA Security and Privacy Rule requirements as agreed in the SOW.

4.3 HIPAA examinations

Where engaged to perform a HIPAA-focused examination (whether stand-alone or combined with a SOC 2), we conduct the engagement as an attestation engagement under AT-C 105 and AT-C 205 against criteria that incorporate applicable provisions of the HIPAA Security Rule, Privacy Rule, and Breach Notification Rule.

Engagement-specific terms:

• The SOW will identify the HIPAA-related criteria, the entity type (covered entity or business associate), and the controls within scope.
• You acknowledge that issuance of an examination report is not a determination of HIPAA compliance by the U.S. Department of Health and Human Services or any other regulator and does not provide a defense to enforcement action.
• Where Protected Health Information ("PHI") is or may be shared with us during the engagement, we will, on request and where required, enter into a Business Associate Agreement before any PHI is transmitted to us.

4.4 ISO/IEC 27001 certification

As a certification body, we perform certification, surveillance, and recertification audits of information security management systems against ISO/IEC 27001, in accordance with ISO/IEC 17021-1 and ISO/IEC 27006.

Engagement-specific terms:

• The certification process consists of an initial audit in two stages (Stage 1 and Stage 2), surveillance audits at least annually, and recertification at three‑year intervals.
• Certification decisions are made by a person or committee that is independent of the audit team.
• We may suspend, reduce the scope of, withdraw, or refuse to grant certification in accordance with Section 12.
• You agree to comply at all times with the requirements of certification set out in Section 5 and Section 12, including providing access to information, sites, and personnel; informing us of changes that may affect certification; permitting witness audits by our accreditation body; and using the certification mark only as permitted.

4.5 ISO/IEC 42001 certification

As a certification body offering audits against ISO/IEC 42001 (artificial intelligence management systems), we perform certification, surveillance, and recertification audits in accordance with ISO/IEC 17021-1 and any AI management system–specific accreditation requirements that apply at the time of the engagement.

Engagement-specific terms:

• The certification process and obligations described in Section 4.4 apply equally to ISO/IEC 42001 engagements, adapted for the AI management system context.
• You acknowledge that certification confirms conformity of your management system with ISO/IEC 42001 at the time of audit; it does not constitute a certification of any specific AI system, model, output, or use case, and is not a substitute for any other regulatory or compliance obligation that applies to you.

4.6 Other services

We may, from time to time, provide other engagement types (including agreed-upon procedures engagements under AT-C 215, readiness assessments, and other advisory services) under a separate SOW. Where any such service would create an independence or impartiality threat in respect of attest or certification services we provide to you, we will manage or decline the engagement in accordance with Section 6.

5. Your responsibilities

You are responsible, throughout the engagement, for:

5.1 General responsibilities (all engagement types)

• Providing complete, accurate, and timely information, documentation, and access (including to systems, sites, personnel, and third parties) reasonably necessary for us to perform the services;
• The accuracy and completeness of all information, representations, assertions, and descriptions you provide to us;
• Maintaining the operation, governance, and effectiveness of the Subject Matter (e.g., your control environment, management system);
• Designating an authorized point of contact to coordinate the engagement;
• Identifying any restrictions on our access (such as personnel availability, regulatory restrictions, or confidentiality obligations to third parties) at the earliest possible point;
• Providing written representations or assertions in the form and at the times required by the applicable Standard;
• Promptly informing us of any change in circumstances that may affect the engagement, including changes to scope, the Subject Matter, ownership or control of your organization, or applicable legal or regulatory requirements; and
• Reviewing draft Reports we provide and identifying any matters of factual accuracy within the timeframe specified in the SOW.

5.2 Additional responsibilities for Attestation Engagements

• Preparing the description of the Subject Matter (including, for SOC engagements, the description of the system) in accordance with the applicable description criteria;
• Designing, implementing, operating, monitoring, and (where applicable) remediating the controls or other Subject Matter;
• Selecting the criteria where you have a choice and confirming their suitability and availability;
• Disclosing to us all known events, conditions, or matters that, individually or in the aggregate, could affect the Subject Matter or the engagement, including any known or suspected fraud, illegal acts, non‑compliance with laws or regulations, complaints, or significant deficiencies; and
• Providing us with a written representation letter at the conclusion of the engagement in accordance with AT-C 205.

5.3 Additional responsibilities for Certification Engagements

• Complying at all times with the certification requirements of the applicable standard, the requirements of ISO/IEC 17021-1 applicable to certified clients, and any specific scheme requirements that apply;
• Making only those claims regarding certification that are consistent with the scope of the certification we have granted;
• Not using the certification or marks in a way that brings us, our accreditation body, or the certification scheme into disrepute, and not making misleading or unauthorized statements about certification;
• Discontinuing all use of certification marks, certificates, and references in advertising, marketing, and other communications upon suspension, withdrawal, expiry, or termination of certification, and returning or destroying any certificates as we may direct;
• Maintaining a record of all complaints made known to you relating to compliance with certification requirements and making this record available to us on request;
• Taking appropriate action in respect of such complaints and any deficiencies identified in your management system that affect compliance, and documenting the actions taken;
• Informing us, without delay, of matters that may affect the management system's ability to continue to fulfill the certification requirements, including changes to: legal, commercial, organizational status or ownership; organization and management; contact address and sites; scope of operations under the certified management system; and major changes to the management system and processes;
• Providing the audit team and, where applicable, observers (including witness auditors from our accreditation body) with access to information, documentation, sites, areas, records, and personnel for the purposes of certification, surveillance, recertification, special audits, and resolving complaints; and
• Using your certification only to indicate that the relevant management system is certified to the relevant standard, and not in a way that may suggest we certify products, services, processes, or persons.

5.4 Personal data and audit evidence

You are responsible for the lawfulness of any Personal Data you provide to us as audit evidence. To support our shared commitment to data minimization (and as discussed further in Section 8.4), you may, and where reasonably practicable should, redact, sanitize, or pseudonymize Personal Data in evidence you provide to us where doing so does not impair the evidentiary value of the information for the engagement.

6. Our responsibilities, independence, and impartiality

6.1 Our responsibilities

We will:

• Perform the engagement with due professional care and in accordance with the applicable Standards;
• Apply the AICPA SSAEs and Code of Professional Conduct (for Attestation Engagements) and ISO/IEC 17021-1 and applicable scheme standards (for Certification Engagements);
• Maintain a system of quality management consistent with the AICPA Statements on Quality Management Standards;
• Use personnel with appropriate competence, training, and (where required) credentials and authorizations;
• Plan and perform our procedures with professional skepticism;
• Maintain Audit Documentation in accordance with the applicable Standards;
• Communicate significant matters to you on a timely basis; and
• Issue Reports that comply with the applicable Standards.

6.2 Independence (Attestation Engagements)

For Attestation Engagements, we are required to be independent of you in accordance with the AICPA Code of Professional Conduct, the U.S. Securities and Exchange Commission and Public Company Accounting Oversight Board independence rules to the extent applicable, and any other independence rules that apply to the engagement.

You will inform us promptly of any matter that may, in your view, affect our independence, including any business relationship, financial interest, employment relationship, or other circumstance involving us, our personnel, or persons closely associated with us.

If we determine, in our reasonable professional judgment, that our independence is or may be impaired, we may suspend the engagement, take remedial action, or, if no acceptable safeguard is available, withdraw from the engagement, in each case without liability to you (other than refund of fees for services not yet performed, less amounts due to us).

6.3 Impartiality (Certification Engagements)

For Certification Engagements, we are required to be, and to be perceived to be, impartial in accordance with ISO/IEC 17021-1.

We do not provide management system consultancy in respect of management systems that we certify, and we do not certify a Client's management system where we have provided such consultancy within the timeframes prescribed by the applicable Standards (currently a minimum of two years for ISO/IEC 27001 under ISO/IEC 27006, and the equivalent provisions of ISO/IEC 17021-1 generally).

We do not market, offer, or perform Certification Engagements bundled with management system consultancy, internal audit of the certified management system, or any service that would create an unacceptable threat to impartiality. Where any threat to impartiality is identified, we apply our impartiality controls (including, where appropriate, review by our impartiality committee) and will decline or terminate the engagement if the threat cannot be eliminated or reduced to an acceptable level.

You will inform us promptly of any matter that may affect our impartiality, including any consulting, training, internal audit, or other service we have provided to you within the relevant period.

6.4 Conflicts of interest and related services

Where you wish to engage us for both Attestation and Certification services, or for additional advisory services, we will assess whether the combination is permitted under the applicable Standards and our internal policies. We may decline any engagement, or any combination of engagements, that we determine could not be performed consistently with our independence and impartiality obligations.

7. Confidentiality

7.1 Mutual confidentiality

Each party will treat as confidential any non‑public information of the other that is marked confidential or that, given the nature of the information and the circumstances of disclosure, a reasonable person would understand to be confidential ("Confidential Information"). The receiving party will use Confidential Information only for purposes of the Agreement, will protect it using at least the same care it uses to protect its own confidential information of similar sensitivity (and in any event a reasonable standard of care), and will limit access to those of its personnel and authorized advisors who have a need to know.

7.2 Exceptions

Confidential Information does not include information that: (a) is or becomes publicly available without breach of these Terms; (b) was rightfully known to the receiving party without restriction before disclosure; (c) is rightfully obtained from a third party without restriction; or (d) is independently developed without use of or reference to the disclosing party's Confidential Information.

7.3 Permitted disclosures

We may disclose Confidential Information: (a) to our personnel, subprocessors, advisors, insurers, and accreditation and peer review bodies, in each case bound by appropriate confidentiality obligations; (b) where required by law, regulation, professional standard, or legal process; (c) to defend ourselves in any proceeding relating to the engagement; and (d) as otherwise permitted by these Terms or the SOW.

7.4 Accreditation, peer review, and regulatory oversight

You acknowledge and agree that, as a condition of operating as a CPA firm and certification body, we are subject to peer review under the AICPA Peer Review Program and to oversight by our accreditation body or bodies, and may be subject to other regulatory inquiries. As part of these processes, peer reviewers and accreditation auditors (including witness auditors) may need access to Audit Documentation and other engagement information, including information that identifies you. We will use reasonable efforts to limit such disclosure to what is necessary for the relevant oversight purpose, and the parties involved are bound by confidentiality obligations equivalent in substance to those in this Section 7.

8. Data handling, privacy, and audit documentation

8.1 Privacy Policy and Data Processing Agreement

Our processing of Personal Data we collect about you, your representatives, and other individuals in connection with our business is described in our Privacy Policy. Where we process Personal Data on your behalf, our Data Processing Agreement (or equivalent provisions in the SOW) governs that processing.

8.2 Audit Documentation

We retain Audit Documentation in accordance with the requirements of the applicable Standards and applicable law, which require us, among other things, to:

• For Attestation Engagements, retain engagement documentation for the period required under AICPA standards (currently no fewer than five years from the report release date); and
• For Certification Engagements, retain records for the duration of the current certification cycle plus at least one further full cycle, in accordance with ISO/IEC 17021-1 § 8.4.

We may retain Audit Documentation for longer where required by law, contract, or our risk management policies.

8.3 Hosting and security

Audit Documentation is hosted and processed in accordance with our information security program (see Section 14.5). Default hosting is described in our Privacy Policy. Where you require regional hosting (for example, within the EU, Australia, New Zealand, or Singapore) we will accommodate this on request where commercially feasible and as expressly agreed in the SOW.

8.4 Personal data minimization in audit evidence

We support data minimization in audit evidence. You may redact, sanitize, mask, pseudonymize, or otherwise minimize Personal Data in evidence you provide to us, including by:

• Replacing identifiers with role descriptions or non‑identifying placeholders in screenshots and documents;
• Providing pseudonymized samples instead of raw data;
• Limiting the population from which samples are drawn to what is reasonably necessary to support our procedures; and
• Using representative or test data where appropriate and where this does not impair the evidentiary value of the information.

You remain responsible for ensuring that any such redaction, sanitization, or substitution does not undermine the evidentiary value of the information for the engagement. We will tell you if we determine that minimized evidence is insufficient to support our procedures and may request alternative evidence. Where, despite reasonable efforts, you are unable to provide evidence sufficient to support our procedures, we may modify or qualify our Report or, if necessary, withdraw from the engagement.

8.5 Sensitive data and PHI

You will not provide us with Personal Data of categories not contemplated by the engagement (including special category data under the GDPR or sensitive information under the Australian Privacy Act). Where the engagement contemplates PHI or other regulated data, the relevant regulatory contract (such as a Business Associate Agreement) will govern our handling of that data and will prevail over conflicting provisions in these Terms or the SOW in respect of that data.

9. Engagement quality, sampling, and inherent limitations

You acknowledge the inherent limitations of audit and certification engagements, including:

• Our work is based on procedures (including testing of samples) that are designed to provide reasonable, not absolute, assurance;
• Even effective controls or management systems can fail to prevent or detect every error, fraud, or non‑conformity;
• Information we receive may be inaccurate, incomplete, or fraudulent in a way our procedures are not designed to detect;
• The Subject Matter and circumstances change over time, and our Report addresses the Subject Matter only as of the dates or for the period stated; and
• Projection of any evaluation of effectiveness to future periods is subject to the risk that controls or the management system may become inadequate or fail.

Our Reports are not, and should not be relied upon as, an opinion on the Client's overall compliance with any law or regulation, an investment recommendation, or a substitute for independent verification by users of the Report.

10. Complaints, disputes, and appeals

10.1 Complaints

We welcome feedback on the conduct of any engagement. Complaints regarding our services, personnel, or conduct may be submitted to complaints@throughlineaudit.com or to the address in Section 14.13.

We acknowledge complaints promptly and investigate them in accordance with our documented complaints handling procedure. For Certification Engagements, our complaints process is maintained in accordance with ISO/IEC 17021-1 § 9.7. The decision on a complaint is reviewed and approved by a person or persons not previously involved in the subject matter of the complaint.

You acknowledge that we may also receive complaints from third parties about certified clients. Where appropriate, we will inform you of any such complaint and the nature of any inquiry we propose to make in connection with it.

10.2 Appeals (Certification Engagements)

You may appeal a certification decision (including refusal, suspension, scope reduction, or withdrawal of certification) in accordance with our documented appeals procedure, which complies with ISO/IEC 17021-1 § 9.8. Appeals must be submitted in writing to appeals@throughlineaudit.com within the timeframes set out in our appeals procedure. Appeals are considered by personnel not involved in the original decision. Submitting an appeal does not result in any discriminatory action against the appellant.

10.3 Dispute resolution between the parties

The parties will attempt in good faith to resolve any dispute arising out of or in connection with the Agreement promptly through discussion at the operational level and, if necessary, escalation to senior representatives of both parties. If a dispute is not resolved within thirty (30) days of escalation, either party may pursue any remedy available to it, subject to Sections 14.10 (Governing law) and 14.11 (Dispute resolution).

10.4 Regulatory complaints

Nothing in this Section 10 limits any right you have to bring a complaint to a regulator, professional body, accreditation body, or other competent authority, including the AICPA, our State Board(s) of Accountancy, our accreditation body or bodies, or a privacy regulator.

11. Suspension, termination, and consequences

11.1 Termination for convenience

Either party may terminate an SOW for convenience on thirty (30) days' written notice unless the SOW provides otherwise. Termination of an SOW does not, by itself, terminate these Terms or any other SOW.

11.2 Termination for cause

Either party may terminate the Agreement (or any SOW) immediately on written notice if the other party: (a) materially breaches the Agreement and fails to cure within fifteen (15) days of written notice (where the breach is curable); (b) becomes insolvent, makes an assignment for the benefit of creditors, or becomes the subject of insolvency proceedings; or (c) is in breach of an obligation that cannot reasonably be cured.

11.3 Termination by us for professional reasons

We may terminate or withdraw from any engagement on written notice if we determine in our reasonable professional judgment that: (a) our continued performance would breach the Standards, applicable law, or our independence or impartiality obligations; (b) you have provided information that is materially false, incomplete, or misleading; (c) you have failed to provide the access, information, or cooperation reasonably necessary to perform the services; or (d) circumstances have arisen that make it impracticable to complete the engagement.

11.4 Effect of termination

On termination of an SOW: (a) you will pay us for all services performed and expenses incurred through the effective date of termination; (b) we will deliver work product completed through the effective date of termination, subject to payment of fees due; (c) provisions intended to survive termination will continue in effect (see Section 14.16); and (d) for Certification Engagements, you must cease use of certification marks and references in accordance with Section 12.

12. Reports, certificates, and certification marks

12.1 Reports

Reports are issued in the form required by the applicable Standard. Draft Reports are provided for the purpose of confirming factual accuracy and are not for distribution. Final Reports may be distributed only as permitted by the SOW and the applicable Standard.

12.2 Use of Reports

Unless the SOW expressly provides otherwise, Reports are issued for your use and the use of those parties identified in the Report (such as user entities and their auditors in the case of SOC reports). You may not, without our prior written consent, use Reports, our name, or our logo for any other purpose, in any solicitation or marketing material, or in any way that suggests we endorse you, your services, or your products.

12.3 Certification decisions

For Certification Engagements, the decision to grant, maintain, renew, expand, reduce, suspend, or withdraw certification is made by Throughline. The audit team makes a recommendation; the decision is made by personnel independent of the audit team in accordance with ISO/IEC 17021-1.

12.4 Suspension, scope reduction, withdrawal

We may suspend, reduce the scope of, or withdraw certification, including (without limitation) where: (a) you persistently or seriously fail to meet certification requirements; (b) you do not allow surveillance or recertification audits to be conducted at the required frequencies; (c) you have voluntarily requested suspension; (d) you misuse the certification marks or make misleading claims about certification; or (e) other grounds set out in our certification rules apply. Following suspension, withdrawal, or expiry, you must cease all use of references to certification and the certification marks. We may publish information about suspension, withdrawal, or scope changes as required by the applicable Standards or our accreditation body.

12.5 Certification marks and public information

Use of certification marks and any logo of an accreditation body is subject to our published rules and the rules of the relevant accreditation body. We maintain publicly accessible information about valid, suspended, and withdrawn certifications as required by ISO/IEC 17021-1 § 8.1.

12.6 Transfer of certification

Where you transfer certification from another certification body to us, or from us to another body, the transfer will be conducted in accordance with applicable accreditation body and IAF requirements.

13. Intellectual property and use of work product

13.1 Pre‑existing IP

Each party retains ownership of its pre‑existing intellectual property. Nothing in the Agreement transfers ownership of pre‑existing intellectual property.

13.2 Reports and Audit Documentation

Subject to your payment of fees: (a) you may use Reports for the purposes for which they are issued, in accordance with Section 12; and (b) we retain ownership of the Audit Documentation, our methodologies, working papers, templates, internal tools, and know‑how. We may use de‑identified information about engagements (not identifying you or your Confidential Information) for internal training, methodology improvement, statistical analysis, benchmarking, and similar professional purposes.

13.3 Client materials

You grant us a limited, non‑exclusive license to use information, materials, and data you provide to us for the purpose of performing the services and complying with our obligations under the Standards.

14. General terms of business

14.1 Fees and expenses

Fees, rate cards, and reimbursable expenses are set out in the SOW. Unless otherwise stated, fees are exclusive of taxes (including sales, use, VAT, and similar taxes), which you are responsible for paying. We may charge for reasonable out‑of‑pocket expenses (including travel) at cost or in accordance with our travel policy as referenced in the SOW.

14.2 Invoicing and payment

We invoice in accordance with the milestones or schedule in the SOW. Invoices are payable within thirty (30) days of the invoice date unless the SOW provides otherwise. Undisputed amounts not paid when due may accrue interest at the lower of one and one‑half percent (1.5%) per month or the maximum rate permitted by law. We may suspend services on reasonable notice if undisputed amounts remain unpaid.

14.3 No contingent fees

Consistent with the AICPA Code of Professional Conduct and applicable independence rules, our fees for Attestation Engagements and Certification Engagements are not contingent on the outcome of the engagement, the issuance of any particular form of Report, or the granting of certification.

14.4 Changes in scope

If circumstances arise that materially change the scope, complexity, or timing of an engagement (including additional locations, additional criteria, scope creep, delays caused by you, or significant remediation activities), we will discuss and agree any change to fees and timelines in a written change order or amended SOW.

14.5 Information security

We maintain an information security program with administrative, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of Confidential Information and Audit Documentation, taking into account the nature, scope, and sensitivity of the information processed. Our information security program is described in greater detail in our security documentation, available on request and subject to a non‑disclosure agreement.

14.6 Limitation of liability

Excluded losses. Neither party will be liable to the other for any indirect, incidental, consequential, special, exemplary, or punitive damages, or for any loss of profits, revenue, business, goodwill, anticipated savings, or data, arising out of or in connection with the Agreement, even if advised of the possibility of such damages.

Liability cap. Each party's aggregate liability arising out of or in connection with each SOW will not exceed an amount equal to [TWO TIMES (2x) / THREE TIMES (3x)] the fees paid or payable by you to us under that SOW in the twelve (12) months preceding the event giving rise to the claim.

Exclusions from cap. The exclusions and cap above do not apply to: (a) liability that cannot be excluded or limited under applicable law; (b) your obligation to pay fees and expenses; (c) either party's obligations of confidentiality; (d) either party's indemnification obligations under Section 14.7; or (e) liability arising from fraud, gross negligence, or willful misconduct.

Allocation of risk. The parties acknowledge that the limitations and exclusions in this Section 14.6 are a fundamental basis of the bargain and would not enter into the Agreement without them.

14.7 Indemnification

You will indemnify and hold harmless Throughline, its partners, members, personnel, and affiliates from and against any third‑party claim, loss, damage, liability, cost, or expense (including reasonable legal fees) arising out of or in connection with: (a) your breach of the Agreement; (b) inaccuracy or incompleteness of information, representations, assertions, or descriptions you provide to us; (c) your use of Reports or certification marks in breach of the Agreement; or (d) your products, services, or operations, except to the extent caused by our gross negligence or willful misconduct.

14.8 Insurance

We maintain professional indemnity, general liability, and other insurance policies appropriate to the nature and scope of our services. Certificates of insurance are available on request.

14.9 Non‑solicitation of personnel

During each engagement and for twelve (12) months after its conclusion, neither party will solicit for employment any personnel of the other party who has been substantively involved in the engagement, without the other party's prior written consent. General advertising and recruitment not specifically targeted at the other party's personnel is not a breach of this Section.

14.10 Governing law

The Agreement is governed by the laws of [JURISDICTION], without regard to its conflict of laws principles.

14.11 Dispute resolution and venue

Subject to Section 10, any dispute arising out of or in connection with the Agreement that is not resolved through good‑faith discussion will be [resolved exclusively in the courts of [JURISDICTION] / submitted to binding arbitration under the [AAA Commercial Arbitration Rules / other rules] in [SEAT], and judgment on the award may be entered in any court of competent jurisdiction]. Each party waives any right to a jury trial to the maximum extent permitted by applicable law.

14.12 Force majeure

Neither party will be liable for any delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including acts of God, natural disasters, pandemic, war, terrorism, civil unrest, governmental action, labor disputes, failures of utilities or telecommunications, and cyber attacks affecting third‑party infrastructure, provided the affected party uses reasonable efforts to mitigate the effects.

14.13 Notices

Notices under the Agreement must be in writing and sent to the addresses specified in the SOW or, if none, to:

Throughline LLP
[REGISTERED ADDRESS]
Attn: [General Counsel / Managing Partner]
Email: legal@throughlineaudit.com

Notices are effective on receipt.

14.14 Assignment

Neither party may assign or transfer the Agreement, in whole or in part, without the other party's prior written consent, except that either party may assign the Agreement to a successor in connection with a merger, reorganization, or sale of substantially all of its assets or business, with notice to the other party. Any prohibited assignment is void.

14.15 Subcontractors

We may engage subcontractors and individual contractors (including for technical specialists or auditors needed to support an engagement) to assist in the performance of the services, provided we remain responsible for their work product to the same extent as for our own personnel and they are bound by confidentiality obligations equivalent in substance to those in Section 7.

14.16 Survival

The following provisions survive termination or expiry of the Agreement: Sections 1, 2, 6.2–6.3 (insofar as they relate to past engagements), 7, 8, 9, 10, 12 (insofar as it relates to existing Reports or certifications), 13, 14, and any other provision that by its nature should survive.

14.17 Independent contractors; no third‑party beneficiaries

The parties are independent contractors. Nothing in the Agreement creates a partnership, joint venture, employment, fiduciary, or agency relationship. The Agreement does not confer any rights on any person other than the parties, except that the indemnified persons in Section 14.7 are intended third‑party beneficiaries of that section. Nothing in this Section limits the rights of users of Reports as identified in the Report itself.

14.18 Entire agreement

The Agreement (these Terms, the SOW, the Privacy Policy and Data Processing Agreement as applicable, and any documents expressly incorporated by reference) is the entire agreement between the parties regarding the engagement and supersedes all prior or contemporaneous agreements, understandings, and communications, whether oral or written.

14.19 Amendments

We may update these Terms from time to time. Updates take effect for new SOWs entered into after the update is published. For an existing SOW, the version of these Terms in effect at the time the SOW was signed continues to govern unless the parties agree otherwise in writing.

14.20 Severability and waiver

If any provision of the Agreement is held unenforceable, the remaining provisions remain in full force and effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable. No waiver is effective unless in writing and signed by the waiving party. A waiver of any breach is not a waiver of any other or subsequent breach.

14.21 Counterparts and electronic signatures

The Agreement may be executed in counterparts, each of which is an original and which together constitute one instrument. Electronic signatures and copies are as effective as originals.

15. Acknowledgment

By signing an SOW that references these Terms, or by engaging us under an SOW, you acknowledge that you have read, understood, and agree to these Terms.

Schedule A - Standards and references (informational)

The following is a non‑exhaustive list of the standards, criteria, and frameworks referenced in or applicable to engagements we perform. The version in effect at the time of the engagement applies.

• AICPA Statements on Standards for Attestation Engagements (SSAEs), including SSAE No. 21
• AICPA AT-C sections, including AT-C 105 (Concepts Common to All Attestation Engagements), AT-C 205 (Assertion-Based Examination Engagements), AT-C 215 (Direct Examination Engagements), and AT-C 320 (SOC 1)
• AICPA Trust Services Criteria (TSP Section 100) for SOC 2
• AICPA Code of Professional Conduct
• AICPA Statements on Quality Management Standards (SQMS 1, 2)
• HIPAA Security Rule, Privacy Rule, and Breach Notification Rule (45 C.F.R. Parts 160 and 164)
• ISO/IEC 17021-1 (Conformity assessment - Requirements for bodies providing audit and certification of management systems)
• ISO/IEC 27001 (Information security management systems - Requirements)
• ISO/IEC 27006 (Requirements for bodies providing audit and certification of information security management systems)
• ISO/IEC 42001 (Artificial intelligence management systems - Requirements)
• IAF Mandatory Documents and accreditation body requirements applicable to our certification scopes