A030_Bridge_Letter_in_Support_of_Service_Organization_Control_Report.pdf

DD FORM 1423-1, FEB 2001

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

PREVIOUS EDITION MAY BE USED.

Form Approved OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services and Communications Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

1. DATA ITEM NO. 2. TITLE OF DATA ITEM 3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.) 5. CONTRACT REFERENCE 6. REQUIRING OFFICE

7. DD 250 REQ

8. APP CODE

9. DIST STATEMENT

REQUIRED

10. FREQUENCY

11. AS OF DATE

12. DATE OF FIRST SUBMISSION

13. DATE OF SUBSEQUENT

SUBMISSION

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

Draft Final

Reg Repro

15. TOTAL

16. REMARKS

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

G. PREPARED BY H. DATE I. APPROVED BY J. DATE

Page of Pages

September 30, 20XX (Insert Contractor Name) Responses to

SOC 1 Review Questionnaire

1. Any changes to the operating processes/internal control environment which were detailed and tested in the SOC 1 for the period ended September 30, 20XX. Do you expect any changes to occur prior to September 30, 20XX?

RESPONSE:

2. Are there any scope changes since the last SOC 1 noted above?

RESPONSE:

3. Can you identify any event that may impact DHA’s internal controls over financial reporting during the current year?

RESPONSE:

4. Please indicate if there has been a significant, i.e. greater than 10% personnel turnover in any of the following areas as it relates to the Health Care contract (XXX,XXX, if any):

a. Claim Processing

b. Electronic Claim Entry

c. Manual Claim Entry

d. Claims Adjudication

e. Master File Maintenance

f. Claims Adjustments

g. Financial Administration

RESPONSE:

5. When was the last independent audit completed by the internal audit department which covered the XXXX claims processing for the TRICARE contracts? Have there been any deficiencies noted by the internal audit department in FY XX as it relates to the XXXX claims processing for the TRICARE contracts?

RESPONSE:

6. Please discuss the progress of any corrective actions on any outstanding deficiencies noted in the SOC 1 referenced above as it relates to DHA.

RESPONSE:

Deficiency in FYE 9-30-XX TRICARE SOC 1 Current Status

1. Control Objective XX XXXXXX

2. Control Objective XX XXXXXX

3. Control Objective XX XXXXXX

4. Control Objective XX XXXXXX

7. Please indicate any system changes at XXXX or any changes XXXX needed to make due to requests from Defense Health Agency (DHA) as they relate to XXXX?

RESPONSE:

8. Please indicate any IT changes, as they relate to the XXXX Health Care contracts.

RESPONSE:

9. Please indicate any significant, i.e. greater than 10%, increases/decreases in the volume of claims processed for the XXXX Health Care contracts.

RESPONSE:

10. Please indicate any changes in the policies and procedures related to the claims processing and claims adjudication process, as they relate to the XXXX Health Care contracts.

RESPONSE:

11. Please indicate any changes in the policies and procedures related to the quality assurance department, as they relate to the XXXX Health Care contracts.

RESPONSE:

12. Please indicate any changes in the policies and procedures related to the duplicate claims reviews, as they related to the XXXX Health Care contracts.

13. If the Service Provider is using a Sub-Contractor, how is the Service Provider monitoring the Sub- Contractor’ controls in compliance with SSAE No 18?

RESPONSE:

14. When is the Contractor’s new SOC 1, compliant with SSAE No 18, expected to be delivered to

DHA?

Frequency: Annual (1 July - 30 June) Reporting Period (Bridge Letter): 1 July - 30 September Reporting Period Start Date: July 1, 2022 Due Date: 15 calendar days after end of reporting period

SUBSEQUENT SUBMISSION: CONTINUE FROM FIRST SUBMISSION

PHI/PII: No FILE FORMAT: No specific file format required

CONTENT DETAILS:

The contractor (service organization) and claims processing contractor (subservice organization) shall provide annually a Bridge Letter covering the period 1 July through 30 September, format to be provided by the government or its auditors. Such Bridge Letter shall be received by the government no later than 15 October.

Management/government reserves the right to perform additional monitoring procedures, such as site visits to the service organization to independently evaluate relevant controls.

The government reserves the right to perform additional monitoring activities at the subservice organizations (if applicable) with the assistance of the service organization such as:

- Reviewing and reconciling output reports

- Holding periodic discussions with the subservice organization

- Making regular site visits to the subservice organization

- Testing controls at the subservice organization.

Bridge Letter Template is attached with updates provided by the government as required.