Sample Third-Party Administrator Agreements

Sample_Documents

DISCLAIMER: This is a sample template provided for informational purposes only. It does not constitute legal, tax, or financial advice. Organizations should consult their own legal and tax advisors and tailor this document to reflect their specific business needs, geographies, and applicable laws.

Document Header

Field	Value
Document Title	Third-Party Administrator Agreements
Document Type	Compliance & Governance
Company	<Company Name>
Version	v<Version Number>
Effective Date	<Effective Date: YYYY-MM-DD>
Next Review Date	<Review Date: YYYY-MM-DD> (review cycle: <12 months>)
Document Owner	<Title, e.g., Director, Total Rewards>
Document Sponsor	<Title, e.g., Chief Human Resources Officer>
Approvers	<Legal>; <Procurement>; <Information Security>; <Privacy/Compliance>; <Finance>; <Total Rewards Leadership>
Supersedes	<If applicable, prior version and date>
Applies To	All Total Rewards programs administered by third parties across <Countries/Regions>
Confidentiality	<Internal Use Only / Confidential>
Related Documents	Vendor Management Policy; Information Security Policy; Privacy Policy; Records Retention Schedule; Benefits Plan Documents; Code of Conduct

Purpose and Objectives

The purpose of this document is to establish the framework, standards, and procedures for negotiating, executing, and managing Third-Party Administrator (TPA) agreements for <Company Name> Total Rewards programs. It is intended to ensure compliance, safeguard employee data, drive service quality, manage costs, and promote consistent governance across all jurisdictions in which <Company Name> operates.

Objectives include:

• Define minimum contractual requirements and best practices for TPA agreements
• Clarify roles and responsibilities across Total Rewards, Procurement, Legal, Information Security, Privacy, Finance, HRIS, and vendor partners
• Set standard service level expectations, reporting, performance management, and remedies
• Provide guidance for implementation, change control, audits, and ongoing lifecycle management
• Support ethical sourcing, accessibility, inclusivity, and regulatory compliance across <Country/Region> laws

Scope and Applicability

This document applies to all third-party vendors that administer or support <Company Name> Total Rewards programs, including but not limited to health and welfare benefits, retirement plans, wellbeing programs, leave administration, recognition, flexible benefits, global mobility benefits, and related technology platforms.

In Scope

• Master Services Agreements (MSA), Statements of Work (SOW), Data Processing Agreements (DPA), Business Associate Agreements (BAA) where applicable, and ancillary schedules
• Selection, onboarding, contracting, implementation, and ongoing vendor management
• Service Level Agreements (SLAs), performance reporting, audits, security, and compliance requirements
• Fee models, invoicing, credits, penalties, and termination provisions
• Regions: <List of Countries/Regions>

Out of Scope

• Non-Total Rewards services (e.g., IT infrastructure unrelated to HR systems)
• Direct insurer contracts for fully insured policies where no TPA services are provided
• Individual employment agreements

Applicability

• Mandatory for all new TPA engagements effective <Effective Date>
• Mandatory for renewals and material amendments after <Effective Date>
• Strongly recommended for legacy agreements as they are updated

Governance Principles

• Employee-first: Protect employee privacy, deliver accessible services, and ensure equitable outcomes across <Countries/Regions>
• Compliance-by-design: Embed regulatory requirements into processes and agreements
• Risk-based controls: Apply due diligence and controls commensurate with risk
• Transparency: Clear pricing, reporting, metrics, and change management
• Accountability: Explicit responsibilities, escalation paths, and decision rights
• Continuous improvement: Use data to drive service enhancements and cost efficiency

Vendor Selection and Due Diligence

Process Overview

1. Define business requirements, including programs, populations, geographies, language needs, and integration scope
2. Conduct market scan and shortlist <3-5> vendors, considering capability, scale, compliance posture, and financial stability
3. Issue RFI/RFP with structured requirements and scoring criteria
4. Evaluate responses against weighted criteria and perform product demos and reference checks
5. Complete risk assessments (information security, privacy, business continuity, financial viability, sanctions screening)
6. Select preferred vendor and conduct commercial and legal negotiations
7. Obtain approvals and execute agreements

Evaluation Criteria and Weighting Example

• Service capability and program fit: <30%>
• Data privacy, security, and compliance: <25%>
• Price, fee transparency, and total cost of ownership: <20%>
• Implementation approach, integrations, and change management: <15%>
• Reporting, analytics, and continuous improvement: <5%>
• Cultural fit, DEI commitments, accessibility, ESG: <5%>

Due Diligence Artifacts

• SOC 2 Type II or ISO/IEC 27001 certification with current audit period
• Privacy compliance documentation (e.g., GDPR, <Country> privacy law, HIPAA/BAA for U.S. PHI)
• Business continuity and disaster recovery plans with tested RTO/RPO
• Cyber insurance certificate and general liability insurance certificates with required limits
• Sample SLAs, call scripts, training materials, and communications
• Financial statements and ownership structure
• Sanctions and adverse media checks
• Accessibility statement and WCAG conformance evidence
• Sub-processor list with locations and data categories

Agreement Structure and Order of Precedence

• Master Services Agreement (MSA) sets overarching legal terms
• Statement(s) of Work (SOW) define program-specific scope, deliverables, and fees
• Data Processing Agreement (DPA) and, where applicable, Business Associate Agreement (BAA)
• Service Level Agreement (SLA) schedule and reporting templates
• Security, privacy, and integration schedules
• Order forms and change orders
• Order of precedence: SOW supersedes MSA only for program-specific terms; DPA/BAA controls for data processing; where conflict exists, the highest standard of protection applies

Term, Renewal, and Benchmarking

• Initial term: <36 months> with <1-2> optional renewals of <12 months> each
• Renewal notifications: <120 days> prior to end of term
• Benchmarking: <Once every 24-36 months> or at renewal, with right to adjust pricing to market if variance exceeds <10-15%>

Services and Deliverables

Core Services

• Eligibility management and life event processing
• Enrollment and elections, including annual enrollment and qualified life events
• Claims intake and adjudication support where applicable
• Contact center services across <Languages> and <Time Zones>
• Digital platform with SSO/MFA, mobile-responsive experience, and accessibility conformance
• Communications support and content updates aligned with plan changes
• Vendor coordination for point solutions and carriers
• Reporting and analytics, including operational and compliance reports
• Compliance support (e.g., <Country> required notices, ACA reporting, HMRC, CNESST, CPF, etc., as applicable)
• Data integrations with HRIS, payroll, insurers, and third parties

Optional Services

• Dependent eligibility audits
• COBRA/continuation coverage administration
• Leave and disability administration
• Spending account administration (FSA/HSA/HRA)
• Retirement recordkeeping data interface support
• Wellbeing challenges and incentives administration
• Global mobility and expatriate benefits support

Service Levels and Reporting

SLA Metric	Target	Measurement Window	Reporting Frequency	Remedies
Average Speed of Answer (phone)	≤ <30 seconds>	Monthly	Monthly	Service credit of <2%> of monthly fees if below target for 2 consecutive months
First Contact Resolution	≥ <80%>	Monthly	Monthly	Corrective action plan within <10> business days
Case Resolution Time (standard)	≤ <2> business days	Monthly	Monthly	<1%> credit per day over target, capped at <10%>
System Uptime	≥ <99.9%> excluding approved maintenance	Monthly	Monthly	<5%> credit if below target
EDI/File Transmission Timeliness	≥ <99.5%> on-time	Monthly	Monthly	<2%> credit per miss, capped at <10%>
Data Accuracy (critical fields)	≥ <99.8%>	Quarterly	Quarterly	Root cause analysis and reprocessing at vendor cost
Call Quality Score	≥ <90%>	Monthly	Monthly	Coaching plan and retraining at vendor expense

Key Performance Indicators (KPIs)

• Participant satisfaction score ≥ <85%>
• Digital self-service adoption ≥ <70%>
• Annual enrollment completion rate ≥ <98%>
• Issue backlog aged > <5> business days ≤ <2%> of total cases
• Grievances and escalations rate ≤ <0.5%> of contacts

Data Privacy, Security, and Compliance

Data Processing and Privacy

• Data processing governed by DPA aligned to <Country/Region> laws (e.g., GDPR, LGPD, PIPEDA, CCPA/CPRA)
• Lawful basis documented; vendor acts as processor, <Company Name> acts as controller
• Data minimization, purpose limitation, and retention aligned to Records Retention Schedule
• Cross-border transfers using approved mechanisms (e.g., SCCs, IDTA, <Country> equivalents)
• Data subject rights support within <30> days, including access, correction, deletion, and portability
• Privacy by design for new features; DPIA conducted for high-risk processing
• BAA executed if PHI is processed; HIPAA/HITECH compliance where applicable

Security Controls

• SOC 2 Type II or ISO/IEC 27001 certification with annual audits
• Encryption of data in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
• Role-based access control and MFA for administrative access
• Secure software development lifecycle with regular static/dynamic testing
• Vulnerability management with critical patches within <7> days
• Segregation of client data; least-privilege access; quarterly access reviews
• Secure file transfers via SFTP, AS2, or equivalent
• Logging and monitoring with retention ≥ <12 months>

Incident and Breach Response

• Notify <Company Name> of suspected incident within <24 hours> and confirmed breach within <72 hours>
• Immediate containment, investigation, and remediation plan
• Cooperate with legal notification requirements and regulator inquiries
• Provide incident report with timeline, root cause, impact, and corrective actions within <10> business days
• Costs of notifications, credit monitoring, and remediation borne by vendor where vendor is at fault

Fees, Invoices, and Financial Controls

Fee Structure

• Implementation fees: fixed <Amount> tied to milestones
• Ongoing administration: PEPM (<Amount>) or transaction-based pricing (<Amount> per transaction)
• Contact center: included in PEPM or separate per-contact fee of <Amount>
• Optional services: rate card with time and materials rates by role
• Ancillary pass-through costs require pre-approval

Invoicing and Payment Terms

• Invoice monthly in arrears; Net <30> days from receipt
• Invoices must include client name, SOW number, period of service, itemized services, taxes, and currency
• No charges beyond agreed scope without signed change order
• Disputed amounts withheld pending resolution; undisputed amounts payable
• Annual not-to-exceed increases capped at <CPI or Percentage>

Financial Controls and Credits

• Service credits are not sole and exclusive remedy for material breach
• Most favored customer pricing or benchmarking adjustments if variance exceeds <10-15%>
• Right to audit financials related to services with <30> days notice

Performance Management and Remedies

Reviews and Governance Cadence

• Weekly implementation stand-ups during onboarding
• Monthly operational reviews
• Quarterly business reviews (QBRs) covering KPIs, trends, root causes, and roadmap
• Annual strategic review, benchmarking, and innovation planning

Remedies and Chronic Failure

• Corrective action plan within <10> business days of SLA breach
• Chronic failure defined as <3> or more critical SLA misses in a rolling <6> months
• Escalation to executive governance and right to terminate for cause upon chronic failure
• Service credits between <2-10%> of monthly fees depending on severity, capped at <15%> per month

Change Management and Release Control

1. Submit change request with description, business impact, and risk analysis
2. Assess scope, timeline, testing needs, and pricing if applicable
3. Approve via governance committee with documented decision
4. Implement in lower environments first, with regression testing and UAT sign-off by <Company Name>
5. Schedule production release during approved windows; post-implementation validation within <24 hours>

• Emergency changes require expedited approval and retrospective review
• Configuration changes documented with version control and rollback plans
• Release notes provided at least <5> business days prior to deployment

Issue Management and Escalation

Severity Levels

• Sev 1: Complete outage, major data breach, or regulatory deadline at risk; response within <1 hour>; restoration target <4 hours>
• Sev 2: Significant functionality impacted; response within <2 hours>; restoration target <8 hours>
• Sev 3: Partial impairment or minor defects; response within <1 business day>; resolution in <5> business days
• Sev 4: Cosmetic issues or inquiries; response within <2> business days

Escalation Path

1. Vendor Support Lead
2. Vendor Account Manager
3. Vendor Operations Director
4. Vendor Executive Sponsor
5. Joint Executive Steering Committee

Business Continuity and Disaster Recovery

• Documented BCP/DR plan with annual test results shared with <Company Name>
• Recovery Time Objective (RTO): <4-12 hours> for critical systems; Recovery Point Objective (RPO): <15-60 minutes>
• Redundant infrastructure across separate availability zones or data centers
• Pandemic and workforce continuity planning
• Prioritized restoration for payroll-impacting and regulatory functions

Implementation and Transition

Implementation Phases and Milestones

1. Mobilization and project kickoff; finalize project plan and governance
2. Requirements and design, including data mappings and configuration
3. Build and integration; establish SFTP and API connectivity; security validation
4. Testing: unit, system, integration, data conversion, and UAT
5. Parallel run and readiness assessment
6. Go-live and hypercare
7. Transition to steady state and QBR cadence

Deliverables

• Project plan with critical path and dependencies
• Data mapping and transformation specifications
• Integration specifications and encryption keys exchange
• Test strategy, scripts, and acceptance criteria
• Cutover plan with rollback and contingency
• Training materials and knowledge transfer
• Operating procedures and runbooks

Acceptance Criteria

• All critical defects resolved or mitigated
• Data reconciliation variance ≤ <0.5%> of records
• Successful parallel results across <2-3> cycles with variances within tolerance
• Security and privacy controls validated
• Executive go-live approval recorded

Subcontractors and Offshoring

• Vendor must disclose all subcontractors and their locations, roles, and data access
• No subcontracting of critical functions without <Company Name> approval
• Subcontractors bound to terms at least as protective as vendor’s obligations
• Offshoring of data or support services requires explicit written approval and DPIA where required

Legal and Regulatory Terms

Confidentiality and IP

• Mutual confidentiality obligations; duration <3-5 years> post-termination or longer where required by law
• Ownership: <Company Name> retains ownership of data and deliverables funded by <Company Name>; vendor retains pre-existing IP; license grants as needed
• Use of <Company Name> name and logo requires prior written consent

Indemnification and Insurance

• Vendor indemnifies <Company Name> against third-party claims arising from data breaches, IP infringement, and gross negligence
• Insurance minimums: Commercial General Liability <Amount> per occurrence; Professional Liability <Amount>; Cyber Liability <Amount>; Workers’ Compensation per statutory requirements; Evidence of insurance upon request

Limitation of Liability

• Cap at <12-24> months of fees under the applicable SOW, excluding uncapped liabilities for breach of confidentiality, data protection obligations, IP infringement, and willful misconduct

Compliance with Laws

• Vendor complies with all applicable laws, including anti-bribery and corruption (e.g., FCPA, UK Bribery Act), trade controls and sanctions, employment laws for vendor personnel, accessibility laws, and benefits regulations in <Countries/Regions>

Non-Solicitation and Key Personnel

• Mutual non-solicitation of key personnel during the term and <12 months> thereafter, subject to reasonable exceptions
• Key personnel identified in the SOW; replacements require prior approval and equivalent qualifications

Notices and Dispute Resolution

• Notices sent to <Company Legal Address> and vendor’s designated address; electronic notices permitted for operational matters
• Good-faith negotiation, then mediation; if unresolved, arbitration under <Arbitration Rules> in <Jurisdiction>
• Governing law: <Country/State> without regard to conflict of laws

Termination and Exit Management

Termination Rights

• For convenience by <Company Name> with <60-90> days’ notice after initial term or as negotiated
• For cause upon material breach not cured within <30> days, chronic SLA failure, insolvency, or regulatory non-compliance
• Partial termination of specific services or geographies permitted

Exit Assistance and Transition

• Vendor provides up to <90> days of exit assistance at agreed rates
• Data return and destruction within <30> days of termination; certification of destruction required
• Knowledge transfer, runbooks, and file format documentation provided to successor vendor
• Continuity of services during transition without degradation of SLAs
• Optional software escrow for critical configuration or custom code if applicable

Roles and Responsibilities

<Company Name> Roles

• Total Rewards: Define program strategy and requirements; own vendor relationship and performance management
• Procurement: Lead sourcing, commercial negotiations, and vendor risk program orchestration
• Legal: Draft and negotiate MSAs, SOWs, and DPAs; advise on disputes and compliance
• Information Security: Assess controls, approve security schedules, monitor vulnerabilities
• Privacy/Compliance: Ensure data protection, cross-border transfer mechanisms, and regulatory alignment
• HRIS/IT: Own integrations, SSO, data quality, and environment readiness
• Payroll/Finance: Validate financial impacts, funding, and invoice approvals
• Benefits Operations: Oversee day-to-day processes, case management, and communications
• Internal Audit: Conduct audits against policy and contract controls

Vendor Roles

• Executive Sponsor: Accountable for overall success and strategic alignment
• Account Manager: Single point of contact; oversees delivery and reporting
• Implementation Lead: Manages onboarding and project milestones
• Security Officer: Ensures security controls and incident response
• Contact Center Manager: Oversees training, QA, staffing, and schedules
• Data Integration Lead: Manages file and API exchanges and data quality
• Compliance Manager: Ensures adherence to laws and timely reporting

RACI Overview

Activity	Total Rewards	Procurement	Legal	InfoSec/Privacy	HRIS/IT	Finance/Payroll	Vendor
Business requirements	R	C	C	C	C	I	C
Sourcing and selection	C	R	C	C	I	I	C
Contract negotiation	C	R	R	C	I	I	C
Security assessment	I	I	I	R	C	I	C
Implementation	R	I	I	C	R	I	R
Operations and SLAs	R	I	I	C	C	I	R
Invoicing and payment	I	I	I	I	I	R	C
Audits and compliance	C	I	R	R	I	I	C

Legend: R = Responsible, C = Consulted, I = Informed

Implementation Guidelines

Readiness Checklist

• Executive sponsor and steering committee established
• Approved project plan, budget, and resourcing
• Data quality assessment completed; remediation plan defined
• Integration inventory and credentials prepared
• Communication plan drafted with employee segments and channels
• Training plan for <Company Name> admins and vendor agents
• Regulatory calendar and deliverables mapped by <Country/Region>

Testing Standards

• Minimum test coverage: <95%> of benefit scenarios, including edge cases
• Negative testing for data validation, error handling, and access controls
• Performance testing for peak open enrollment loads
• Security testing for SSO, MFA, and file transfer endpoints

Cutover and Hypercare

• Blackout window agreed and communicated to stakeholders
• Real-time monitoring of files, calls, and portal during first <2> weeks
• Daily war-room and executive summaries during hypercare
• Post-implementation review after <30> days with lessons learned and backlog prioritization

Review, Audit, and Approval

Internal Approvals

1. Total Rewards prepares business case and vendor selection summary
2. Procurement validates commercial terms and vendor risk status
3. Legal reviews and approves MSA, SOW, DPA, and schedules
4. Information Security and Privacy approve controls and data flows
5. Finance approves fees and budget alignment
6. Executive sponsor signs final approval

Ongoing Reviews

• Quarterly performance and risk reviews with action items tracking
• Annual contract compliance audit and pricing validation
• Annual privacy and security attestation refresh with SOC reports
• Regulatory deliverables tracked against compliance calendar

External Audits and Cooperation

• Vendor to cooperate with <Company Name> internal/external audits
• Advance notice of <10-30> days for on-site or remote audits
• Remediation plans with timelines for any findings; priority for high-risk items

Records Retention and Documentation

• Contracts, amendments, and change orders retained for <7-10 years> post-termination or longer if required by law
• Operational and SLA reports retained for <3-5 years>
• Incident logs and security reports retained for <5-7 years>
• Data subject request logs retained per privacy policy
• Destroy records securely per retention schedule and legal holds

Regional and International Considerations

• Country-specific regulatory schedules annexed to SOWs (e.g., ACA in the U.S., GDPR in EU/EEA, LGPD in Brazil, PDPA in <Country>)
• Language support and localization requirements documented
• Data residency constraints captured; approved transfer mechanisms in place
• Works councils or employee representative bodies consulted where required
• Accessibility standards aligned to WCAG <2.1 AA> or local equivalents

Compliance Disclaimers

• This document provides sample provisions and does not replace legal advice tailored to <Company Name>’s specific jurisdictions and programs
• Regulatory examples provided are illustrative; actual requirements may differ by <Country/Region>
• Insurance, liability caps, and remedies must reflect risk tolerance and are subject to negotiation

Example Clauses and Language

Sample Order of Precedence Clause

• In the event of conflict, the following order governs: DPA/BAA, SOW, MSA, SLA, and any other attachments. The higher standard of protection shall apply to personal data.

Sample Data Ownership Clause

• All data, including personal data, created or processed under this Agreement is the exclusive property of <Company Name>. Vendor shall not use the data for any purpose other than fulfilling contractual obligations.

Sample Service Credit Clause

• If Vendor fails to meet a Critical SLA in any calendar month, Vendor shall issue a service credit equal to <5%> of the monthly fees for the affected service, up to a maximum of <15%> per month. Service credits do not limit <Company Name>’s right to seek additional remedies for material breach.

Approval and Version Control

Version	Date	Summary of Changes	Author	Approvals
v<1.0>	<Date>	Initial release	<Name, Title>	<Approver Names/Titles>
v<1.1>	<Date>	Updated SLA targets and added benchmarking clause	<Name, Title>	<Approver Names/Titles>

Glossary

• TPA: Third-Party Administrator
• MSA: Master Services Agreement
• SOW: Statement of Work
• DPA: Data Processing Agreement
• BAA: Business Associate Agreement
• SLA: Service Level Agreement
• KPI: Key Performance Indicator
• PEPM: Per Employee Per Month
• SOC 2: Service Organization Control 2 audit report
• ISO/IEC 27001: Information security management standard
• RTO/RPO: Recovery Time Objective / Recovery Point Objective
• DPIA: Data Protection Impact Assessment
• SSO/MFA: Single Sign-On / Multi-Factor Authentication
• SFTP/AS2: Secure File Transfer Protocol / Applicability Statement 2
• PII/PHI: Personally Identifiable Information / Protected Health Information
• QBR: Quarterly Business Review
• ESG: Environmental, Social, and Governance
• WCAG: Web Content Accessibility Guidelines

Communication Section: Message to Employees and Managers

The way you access and manage your benefits matters. Beginning on <Effective Date>, <Company Name> is partnering with <Vendor Name>, a trusted benefits administrator, to deliver a clearer, faster, and more secure experience for you and your family members.

What this means for you is straightforward. Your benefits will be available through a refreshed portal, with a simplified design, easy navigation, and mobile access. You will be able to review your coverage, make changes when life events happen, and see helpful reminders before important deadlines. If you prefer to talk to someone, trained specialists will be available during extended hours across <Time Zones> and languages that meet our workforce needs.

Your privacy remains a top priority. Only the data necessary to administer your benefits will be shared with <Vendor Name>, and that information is protected by strong security controls, including encryption and multi-factor authentication. We have reviewed the vendor’s privacy and security practices and will continue to monitor them.

As we make this transition, here is what to expect. Before go-live, you will receive instructions on how to sign in to the new portal using your <Company Name> credentials. You will also see a short guide that highlights what is new and where to find popular features, like viewing your current elections or adding a dependent. If you are in the middle of a benefits change or claim, it will continue without interruption. We are moving your information securely to the new system, and our teams are working together to make sure everything is accurate.

During annual enrollment, the new experience is designed to help you compare options and understand the value of your choices. You will see plan details side-by-side, learn about costs, and take advantage of tools that recommend plans based on your preferences. If you have a life event, such as a marriage or a new child, the portal will guide you step by step and show the documents you may need to upload.

If you have questions after go-live, you have options. You can search the help center articles, start a chat for quick answers, or call the support team. For more complex questions, the support team will create a case and keep you updated until it is resolved. If something does not look right, tell us. We will investigate and fix any issues quickly.

We know change can be disruptive, and our goal is to make this one as smooth as possible. We chose <Vendor Name> because they offer strong service quality, a user-friendly experience, and the ability to support our global teams. We will keep you informed with regular updates and tips. Thank you for your attention during this transition and for taking an active role in your benefits.

Key dates will be included in your upcoming emails and on the benefits site. Please watch for messages from <Company Name> Benefits or <Vendor Name>. If you manage a team, remind your employees to update their contact information and verify dependents so that their benefits are set up correctly. If you need support in other languages or accessibility accommodations, those services are available; just let the support team know your preferences.

Your benefits are an important part of your total rewards. This change is about making them easier to use and understand, so you can focus on what matters most.

---

Document Information:

• Document Type: Third-Party Administrator Agreements
• Category: Compliance & Governance
• Generated: August 28, 2025
• Status: Sample Template
• Next Review: <Insert Review Date>

Usage Instructions:

1. Replace all text in angle brackets < > with your company-specific information
2. Review all sections for applicability to your organization
3. Customize content to reflect your company's policies and local regulations
4. Have legal and HR leadership review before implementation
5. Update document header with your company's version control information
6. At bottom of the document you find a short example on how the content could be communicated to end-users, for instance employees.

This sample document is provided for reference only and should be customized to meet your organization's specific needs and local legal requirements.