> For the complete documentation index, see [llms.txt](https://admin-services.docs.intersectmbo.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://admin-services.docs.intersectmbo.org/governance/policies-and-guidance/third-party-assurance-tpa-policy.md).

# Third-Party Assurance (TPA) Policy

### **Third-Party Assurance (TPA) Policy**

**1. Policy Title:** Third-Party Assurance (TPA) Policy

**2. Version:** 1.2

**3. Effective Date:** 01/05/2026

**4. Review Date:** 01/05/2027 (Annual Review)

**5. Policy Owner:** Operations Director

**6. Policy sponsor:** Intersect Executive Director

***

**7. Purpose:**

The purpose of this policy is to establish a framework for independent verification of Treasury-funded project milestones. It aims to protect Cardano Treasury funds, increase community transparency, and ensure that all funded deliverables meet the high-quality and technical standards agreed upon in contractual agreements.

**8. Scope:**

This policy applies to:

* All vendors and delivery teams receiving funding via the Treasury, where Intersect is their named Administrator.
* Individuals or entities acting as Third-Party Assurers (TPAs).
* The Intersect Delivery Assurance team.
* All project milestones (excluding kick-off milestones)

**9. Principles:**

* Independence: Third-party assurers must remain impartial and free from conflict of interest.
* Evidence-Based: Approvals must be rooted in tangible proof, not assumptions.
* Transparency: All assessments must be clear, unbiased, and accessible to the community.
* Accountability: Ensuring Treasury funds are released only upon validated professional standards.<br>

**10. Definitions:**

* Third-Party Assurer (TPA): An independent subject matter expert responsible for verifying milestone completion and quality.
* Vendor: The entity responsible for delivering the project and managing the relationship with the TPA.
* Attestation: The formal submission of an assessment and supporting comments via the Milestone Acceptance Form (MAF).
* Independence: The absence of financial, personal, or professional ties to the vendor or project outcome.
* Milestone Acceptance Form: The form that vendors complete for each individual milestone.

**11. Policy Statements:**

* Mandatory Independence: TPAs must be from a different company than the delivery team and have no vested interest in the project or Intersect Committee seats.
* Expertise Alignment: TPAs must possess relevant expertise specific to the milestone they are assessing.
* Verification Requirement: No milestone funds shall be released without a completed TPA final attestation that confirms both milestone completion and quality.
* Right of Veto: Intersect reserves the right to reject a proposed TPA, at any point during delivery, if they do not meet suitability or independence criteria.
* Conflict of Interest: The vendor must disclose any potential conflict of interest immediately to the Intersect Delivery Assurance team.
* Objective Reporting: Assessments must be factual and unbiased.&#x20;

**12. Roles and Responsibilities:**

* Vendor: Responsible for selecting the TPA and budgeting for TPA costs. Also responsible for providing all necessary evidence to show milestone completion via the MAF.  The Vendor might also be requested to make any TPA review of the milestones public, e.g. an audit report completed by the Vendor.
* Third-Party Assurer (TPA): Responsible for delivering assessments of milestone quality and completion, providing evidence of how they have completed the assessment.
* &#x20;Intersect Delivery Assurance Team: Responsible for verifying TPA suitability, reviewing MAFs, and ensuring compliance to the assurance process.

**13. Procedures (or Referenced Procedures):**

The following workflow must be adhered to for all TPA engagements:

1. Selection: Vendor identifies a TPA with relevant subject-matter expertise.
2. Suitability Check: Intersect reviews the TPA for technical expertise and independence.
3. Onboarding: Optional session between Vendor, TPA, and Intersect to clarify responsibilities.
4. Assessment: TPA reviews milestone evidence against the contractual milestone acceptance criteria and deliverables.
5. Feedback Loop: If the quality for any milestone is not met, the TPA provides feedback to the vendor for remediation prior to formal submission.
6. Final Submission: Vendor submits the MAF to the Delivery Assurance Team, including the attestation from the TPA.
7. Final Sign-off: The Delivery Assurance Team is responsible for final sign-off of the MAF.&#x20;
8. TPA Milestone: There may be an additional milestone requirement to make any assessment documentation public, for e.g. a code audit report.
9. Report Review: Intersect’s DA team will review the report to ensure the quality of delivery by the Vendor is sufficient.

**14. Monitoring and Compliance:**

Compliance is monitored by the Intersect Delivery Assurance team through the review of every Milestone Acceptance Form.

* Non-Compliance: If a TPA is found to no longer meet the TPA requirements or has provided a substandard review, the attestation may be voided.
* Consequences: Failure by a vendor to engage a suitable TPA, at any point during delivery may result in the withholding of milestone payments.&#x20;

**15. Review and Amendment:**

This policy will be reviewed annually by the Policy Owner to ensure it remains aligned with community standards and organizational changes. Amendments require the formal approval of the Policy Sponsor.

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://admin-services.docs.intersectmbo.org/governance/policies-and-guidance/third-party-assurance-tpa-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.