Internal Audit & Risk Assessment Services

Last revised: October 2026

These General Terms and Conditions ("Terms") govern professional services provided by WCS Global North America Inc., operating as GRC Concierge ("GRC Concierge"), to the client identified in the applicable Statement of Work ("Client").

1. Agreement and Scope of Services

1.1 These Terms and each executed Statement of Work ("SOW") constitute the agreement between GRC Concierge and Client ("Agreement"). Each SOW will identify the services, scope, deliverables, fees, and timelines. These Terms prevail unless an SOW expressly identifies and modifies a specific provision.

1.2 Services may include ISO/IEC 27001 and ISO 9001 internal audits, HIPAA Security Risk Assessments, compliance assessments, and related professional services ("Services").

1.3 Changes to the agreed scope, including additional testing, frameworks, locations, or deliverables, require written approval and may incur additional fees.

2. Nature and Limitations of Services

2.1 GRC Concierge provides internal audit and risk assessment services, not accredited certification audits, statutory audits, or formal attestation engagements.

2.2 Assessments are conducted using professional judgment, evidence review, interviews, and sampling. Due to inherent limitations, GRC Concierge does not guarantee identification of every deficiency, vulnerability, or instance of noncompliance.

2.3 Findings are limited to the agreed scope, assessment period, and information available. GRC Concierge does not guarantee certification, regulatory approval, or favourable external audit outcomes.

2.4 Client retains responsibility for its compliance obligations, internal controls, risk management, and implementation of corrective actions. Remediation and follow-up assessments are excluded unless expressly included in the SOW.

2.5 GRC Concierge will conduct internal audits objectively and impartially. Where GRC Concierge also provides consulting or managed services, appropriate safeguards will be implemented to address conflicts of interest. GRC Concierge may decline or withdraw from an engagement where sufficient impartiality cannot be maintained.

3. Client Responsibilities

3.1 Client is responsible for providing accurate, complete, and timely information, documentation, access to personnel and systems, and disclosure of material incidents or deficiencies relevant to the engagement.

3.2 GRC Concierge may rely on information provided by Client without independently verifying every representation and is not responsible for consequences arising from inaccurate, incomplete, misleading, or withheld information, except to the extent caused by GRC Concierge's own conduct for which liability cannot lawfully be excluded.

3.3 Client is responsible for maintaining its systems and controls, evaluating findings, and implementing appropriate corrective actions.

3.4 Client delays or failure to cooperate may result in revised timelines, additional fees subject to written approval, or termination of the engagement.

4. Fees and Payment

4.1 Unless otherwise specified in the SOW, one hundred percent (100%) of the engagement fee is payable upon execution of the SOW and must be received before Services commence.

4.2 All fees are exclusive of applicable taxes. Additional services or approved expenses will be invoiced separately.

4.3 Overdue amounts accrue interest at 1.5% per month (18% per annum, calculated monthly without compounding), or the maximum permitted by law, whichever is lower. GRC Concierge may suspend Services or withhold deliverables for overdue, undisputed amounts following written notice.

4.4 Payment is not contingent upon certification, regulatory outcomes, the absence of findings, or Client's acceptance of assessment conclusions.

4.5 Client is responsible for reasonable collection costs, including legal fees, to the extent permitted by law. Client may not withhold or set off payments against alleged claims except as required by law or agreed in writing.

5. Confidentiality and Data Protection

5.1 GRC Concierge will protect Client's confidential information using reasonable safeguards and use it only for performing Services, administering the Agreement, and fulfilling legal obligations.

5.2 Confidential information may be disclosed to authorized personnel, contractors, professional advisers, and service providers subject to appropriate confidentiality obligations, or where disclosure is legally required. Confidentiality does not apply to information lawfully public, independently developed, or lawfully obtained without restriction.

5.3 Client authorizes GRC Concierge and its approved service providers to access, process, and store information within or outside Canada as necessary to perform the Services, subject to applicable privacy laws and appropriate safeguards. Client must disclose applicable data residency or processing restrictions before providing the affected information.

6. Deliverables, Ownership and Reliance

6.1 Deliverables are limited to those identified in the SOW. GRC Concierge retains professional discretion over findings and conclusions and may withhold final reports until all amounts due are paid.

6.2 Client may use and share complete, unaltered final reports with certification bodies, regulators, external auditors, customers, and relevant stakeholders for legitimate compliance purposes. Reports must not be misrepresented as certifications or formal attestations.

6.3 Reports are prepared for Client's specified engagement purposes. No third party may rely upon them as creating a duty of care or liability on the part of GRC Concierge without its express written consent.

6.4 GRC Concierge retains ownership of its methodologies, templates, tools, and working papers. Upon full payment, Client receives a perpetual, non-exclusive licence to use the final deliverables for its business and compliance purposes, including permitted disclosures.

6.5 GRC Concierge may retain and securely dispose of engagement records in accordance with its retention policies and applicable law. Client remains responsible for retaining its own records and reports.

7. Term and Termination

7.1 Either party may terminate an engagement upon fifteen (15) days' written notice, unless otherwise specified in the SOW.

7.2 GRC Concierge may suspend or terminate Services upon written notice for material nonpayment, failure to cooperate, materially misleading information, or circumstances that compromise legal, security, or professional requirements.

7.3 Upon termination, Client remains responsible for Services performed, approved expenses, and reasonable non-cancellable commitments incurred through the termination date. Prepaid amounts will be applied against these obligations, with any remaining balance refunded, subject to applicable law.

7.4 GRC Concierge is not obligated to complete or issue a report for an engagement terminated before completion.

8. Limitation of Liability

8.1 To the maximum extent permitted by law, the total aggregate liability of GRC Concierge, its affiliates, directors, officers, employees, and contractors arising from or relating to an SOW, whether in contract, negligence, tort, or otherwise, shall not exceed the professional fees actually paid to GRC Concierge under that SOW.

8.2 GRC Concierge will not be liable for indirect, consequential, special, incidental, or punitive damages, including lost profits, revenue, business opportunities, goodwill, or reputational harm, to the maximum extent permitted by law.

8.3 GRC Concierge is not responsible for certification failures, regulatory penalties, security incidents, or control deficiencies to the extent resulting from Client's acts or omissions, inaccurate information, failure to implement corrective actions, or circumstances outside the agreed scope.

8.4 These limitations do not exclude liability for fraud, wilful misconduct, or other liability that cannot lawfully be excluded or limited.

9. Indemnification

9.1 Client agrees to indemnify, defend, and hold harmless GRC Concierge, its affiliates, directors, officers, employees, and contractors against third-party claims, damages, liabilities, penalties, and reasonable legal expenses arising from:

• Client's material breach of the Agreement;

• Inaccurate, incomplete, or misleading information provided by Client;

• Client's violation of applicable laws or third-party rights;

• Unauthorized or misleading use or distribution of reports; or

• Client's failure to maintain appropriate controls or implement corrective actions.

9.2 Indemnification applies only to the extent the claim arises from the circumstances above and not from GRC Concierge's own negligence, breach, fraud, or wilful misconduct.

9.3 Client's indemnification obligations are not subject to the liability cap applicable to GRC Concierge under Section 8, to the extent permitted by law.

10. General Provisions

10.1 Governing Law: This Agreement is governed by the laws of Ontario and the applicable federal laws of Canada. The parties submit to the exclusive jurisdiction of Ontario courts.

10.2 Dispute Resolution: The parties will first attempt to resolve disputes through good-faith negotiations before pursuing available legal remedies. Nothing prevents GRC Concierge from pursuing overdue payments or urgent legal relief.

10.3 Independent Contractors: The parties are independent contractors. GRC Concierge may engage qualified personnel and subcontractors while remaining responsible for its contractual obligations.

10.4 Force Majeure: Neither party is liable for delays caused by circumstances beyond its reasonable control, excluding accrued payment obligations.

10.5 Assignment: Client may not assign this Agreement without GRC Concierge's written consent. GRC Concierge may assign it to an affiliate or business successor, subject to applicable law.

10.6 Entire Agreement: These Terms and the applicable SOW constitute the entire agreement. Amendments must be agreed to in writing. Invalid provisions will not affect the enforceability of remaining provisions.

10.7 Notices and Execution: Notices must be provided in writing to authorized representatives. Electronic signatures and counterparts are permitted.

10.8 Survival: Payment obligations, confidentiality, intellectual property, report reliance, limitation of liability, indemnification, and dispute resolution provisions survive termination or expiration as applicable.

Acknowledgement

By executing an SOW incorporating these Terms, Client acknowledges and agrees to be bound by these General Terms and Conditions.