(1) The authority shall develop the audit guide with input from the data vendor, lead organization, and stakeholders. The audit guide shall include, but is not limited to, the following topics:

(a) The audit standards that will be used for all audits to ensure compliance with generally accepted auditing practices;

(b) The process that will be used to select an auditor, including the auditor qualifications, process to identify and address conflicts of interest;

(c) Specific contract terms that should be included in any contract with an auditor including retention and destruction process for working papers.

(2) The authority shall develop a process to allow for stakeholder review and comment on drafts of the audit guide and all subsequent changes to the guide. Prior to final adoption, the DPC shall be given an opportunity to review and provide comments on the draft audit guide to the authority. The authority shall have final approval authority over the adoption of the audit guide and all subsequent changes.

(3) The authority shall conduct an annual review of the audit guide. The authority will post notice that the review is being conducted and provide a time period for stakeholder to submit comments and changes to the audit guide. The authority will follow the process developed pursuant to subsection (2) of this section for review and comment on draft changes to the guide.

(4) The authority shall notify data suppliers before changes to the audit guide are final. Notification shall occur no less than one hundred twenty calendar days prior to the effective date of any change.

(5) The version of the audit guide that is in effect must be posted on the authority website. Notice should be given through the authority listserv when a new audit guide is posted.