Exhibit 1-C

Risk Assessment Services

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 1

of 11
Contract Work Authorization

62-4229 CWA (9/26/11) Sourcing 

Contract Work Authorization (CWA)

This Contract Work Authorization (“CWA”) No. C4236 CW2235749 is issued under and pursuant to the Blanket 

Agreement or Master Service Agreement No. 4400011340 dated January 19, 2017 (the “MSA”) between the below-named 

Contractor (“Contractor”), a Delaware Limited Liability corporation, and Pacific Gas and Electric Company (“PG&E”), a 

California corporation with its headquarters located at 77 Beale Street, San Francisco, California 94105. Contractor shall 

perform all Work under this CWA pursuant to and in accordance with the terms and conditions of the MSA.

Contractor’s 

Legal Name: 

KPMG LLP Total Number of Pages: 5 

Contractor’s 

Address: 

PO Box 120001 

DALLAS, TX 75312 

Project Name: THIRD PARTY RISK ASSESSMENT PROGRAM LOANED STAFF 

Job Location: Various PG&E Locations 

WORK: Contractor shall, at its own risk and expense, perform the Work described in this Contract Work Authorization and 

furnish all labor, equipment, and materials necessary to complete the Work as summarized below and as more fully described in 

Attachment 1, Scope of Work. 

All project related program information, tasks and deliverables are described in Attachment 1, Statement of Work. 

ATTACHMENTS: Each of the following documents are attached to this CWA and are incorporated herein by this reference: 

Attachment 1: Scope of Work (Page 3-5) 

CWA TERM: This CWA is effective upon signature by both parties and expires on June 30, 2018. Time is of the essence. 

CWA 

COMPLETION: 

Contractor shall commence performance hereof when directed to do so by PG&E and Work shall be 

completed by the completion date of June 30, 2018. 

CONSIDERATION: As full consideration for satisfactory performance of the Work under this CWA by Contractor, PG&E’s total 

obligation to Contractor shall not exceed the following amount. This amount is inclusive of all taxes incurred in the performance 

of the Work. Any change to this amount shall only be authorized in writing by a PG&E CWA Change Order, fully executed by 

both PG&E and Contractor. 

TOTAL: $156,000.00 USD

THE PARTIES, BY SIGNATURE OF THEIR AUTHORIZED REPRESENTATIVES, HEREBY AGREE TO THE TERMS OF 

THIS CONTRACT WORK AUTHORIZATION.

PACIFIC GAS AND ELECTRIC COMPANY CONTRACTOR: KPMG LLP

Signature Signature 

Name Nathan Floyd Name 

Title Sourcing Supervisor Title 

Date Date 

DocuSign Envelope ID: F679BD89-0353-45B7-B786-84E43C4D3E86

1/2/2018

Michael Gomez

Principal

1/2/2018

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 2

of 11
Contract Work Authorization

62-4229 CWA (9/26/11) Sourcing 

CWA No. C4236 CW2235749 

Page 2 of 5 

ADMINISTRATION

PG&E 

Negotiator

Elizabeth Haworth-Davis Contractor 

Represent

Geno Armstrong 

Phone 913.269.9030 Phone 415-963-7301 

Email E2HA@PGE.com Email garmstrong@kpmg.com 

Accounting Reference 

PG&E Work Supervisor: Phone: 

INVOICE 

INSTRUCTIONS: 

Contractor shall send 

invoices for each payment 

when due, showing the 

CWA number, to: 

PACIFIC GAS AND 

ELECTRIC COMPANY 

Send ORIGINAL Invoice to: 

(See note below if using PG&E’s 

electronic invoicing system)

PG&E Accounts Payable* 

PO Box 7760 

San Francisco, CA 94120-7760 

Send COPY of Invoice to: 

 

 

For information regarding invoice status, call PG&E’s Paid Help Line at (800) 756-PAID (7243) or go to AP 

Web Reporting site at www.pge.com/actpay. 

*Note: Contractors using PG&E’s electronic invoicing system do not need to mail a copy of the invoice to 

PG&E Accounts Payable. 

INTERNAL PG&E USE ONLY

Distribution Date 

Distribution of Copies: 

 Document Services 

(Signed Original Copy) 

Mail Code N5D 

245 MARKET ST., SAN FRANCISCO 

 Contractor 

(Signed Original Copy) 

 Work Supervisor Manager 

 Invoice Approver Supervisor 

 V.P. Sourcing/ Purchasing 

 Director Law 

DocuSign Envelope ID: F679BD89-0353-45B7-B786-84E43C4D3E86

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 3

of 11
Contract Work Authorization

62-4229 CWA (9/26/11) Sourcing 

CWA No. C4236 CW2235749 

Page 3 of 5 

Attachment 1: Scope of Work 

1. DESCRIPTION OF SERVICES 

The services to be performed by KPMG LLP (referred to as the “Contractor” henceforth) as Third Party Risk 

Assessment Program Loaned Staff for Pacific Gas & Electric Co. (referred to as “PG&E” henceforth) will cover 

the following objectives in support of PG&E’s Cybersecurity organization (Third Party Security and Risk 

Management) 

 Assist PG&E with management of active, and upcoming third party risk projects across PG&E 

lines of businesses (“LOBs”) 

 Coordinate project delivery activities with PG&E stakeholders for achieving various project 

objectives 

 Monitor project progress and report changes, issues, risks to PG&E Program Leads. 

 Perform or assist in performing the following activities, as applicable, at the direction of the PG&E 

Third Party Security and Risk Manager, with the following functions: 

Vendor security and risk assessment - Vendor risk management framework improvement 

2. SCOPE 

This CWA covers the current understanding of the Contractor’s assistance; however, the Contractor will work 

diligently with PG&E if changes are required to be documented in a change order or memo of understanding, as 

agreed between the parties. 

3. APPROACH 

KPMG will provide PG&E with 1 personnel who will assist in supporting PG&E personnel with respect to their 

security initiatives (“project”). Our assistance will be under the direction and supervision of Durand Hugues and or 

his designees, who will be responsible for communicating the tasks and requirements of the project to personnel 

we supply and for reviewing their work. KPMG will not be considered the preparer/developer of PG&E’s security 

initiative project outputs or artifacts and will not sign or use the KPMG name on any deliverable (s). 

In connection with this engagement, KPMG will not assist our personnel by: 

 providing any management oversight of our personnel in connection with the project; 

 participating in the determination of the scope and objectives of the project; 

 assisting in the development of the project plan; 

 providing any manager or partner review of the work or deliverable(s); or 

 Providing any comments or input on the work or deliverable(s) from this engagement during 

meetings with management. 

During this engagement our personnel will work at your direction but will not be expected to: 

 function as an employee or make business decisions for PG&E, 

 prepare or approve journal entries, 

 prepare financial statements, 

 perform management functions, including final review or approval of project artifacts such as 

policy, strategy, roadmap or framework 

 approve journal entries, 

 supervise other employees, or 

 Make employment decisions such as hiring or terminating employees. 

DocuSign Envelope ID: F679BD89-0353-45B7-B786-84E43C4D3E86

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 4

of 11
Contract Work Authorization

62-4229 CWA (9/26/11) Sourcing 

CWA No. C4236 CW2235749 

Page 4 of 5 

Attachment 1: Scope of Work (cont.) 

4. SCHEDULE 

We will begin work on or about Jan. 2nd after receiving a signed copy of this CWA. 

The period of the services per this CWA is effective from the execution of this CWA, currently estimated to be for 

1040 hours, starting from January 2nd, 2018 through June 29th 2018. 

NOTE - This schedule is a high-level estimate; the accuracy of this schedule is yet to be determined in close 

collaboration with PG&E. The Contractor will keep a regular, open, and forthright dialogue with PG&E Leads 

to identify and mitigate any risks to the schedule, and to keep them fully informed of progress towards this 

schedule. If the Contractor and PG&E agree on the need to adjust the project schedule, it will require 

submission and processing of a Change Order to the approved CWA. 

5. ENGAGEMENT RESOURCE 

The following KPMG professional will provide the highest quality of professional services as needed by the PG&E 

Cyber Program Manager for the duration of this CWA, as outlined below: 

 Harold Metzger: 

o As the Third Party Security Assessor, Harold’s responsibilities include; track budget, create and oversee 

schedules, track issues and risks, report to management as requested. 

6. ENGAGEMENT FEES 

 KPMG’s professional fees are based upon the specified skill level of the professionals providing the services 

and the amount of time and materials required to complete the engagement. KPMG Engagement Resource is 

prepared to begin work upon receipt of a signed copy of this CWA. 

 Based upon the engagement scope, assumptions, and estimated hours, KPMG anticipates the fees and 

expenses to $156,000.00 which represents a discount from our standard rates – an investment KPMG will 

make in continuing to build on our relationship with PG&E. The foregoing fees include a significantly 

discounted hourly rate which shall satisfy the “Volume Rebate” and other discount provisions set forth in the 

MSA, and such that the fees set shall not be recalculated in the “Volume Rebate” calculation. 

 Circumstances encountered during the performance of these services, such as scope changes discovered 

after initial planning & scoping exercise for each of the work-streams may warrant exceeding the $156,000.00 

estimate. We will not exceed this amount without PG&E’s permission. 

 We will calculate our professional fees for services rendered using the following hourly rates for the level of 

personnel as indicated below: 

Category Number of Professionals Hourly Rate*

Senior Associate 1 $150 

 Based upon the level of the professionals and the estimated amount of time devoted to the engagement 

between Jan. 2nd and June 29th, we anticipate that our professional fees for assisting PG&E for 26 weeks to 

be $156,000. 

 Throughout the engagement, KPMG will be responsible for the administration of this agreement and will 

submit progress bills monthly for fees and expenses incurred, with payment due upon receipt. 

 Should PG&E require additional hours, more professionals or a change in the current anticipated staff for this 

engagement, fees for such additional hours or professionals will be commensurate with the experience levels 

requested and utilized. We will require that you sign an addendum to this CWA in the event that the duration 

of the engagement or the scope of services is modified. 

DocuSign Envelope ID: F679BD89-0353-45B7-B786-84E43C4D3E86

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 5

of 11
Contract Work Authorization

62-4229 CWA (9/26/11) Sourcing 

CWA No. C4236 CW2235749 

Page 5 of 5 

Attachment 1: Scope of Work (cont.) 

7. ASSUMPTIONS 

The success of this project is highly dependent on coordination and support from PG&E. Contractor’s services 

described in this document are per following assumptions: 

 PG&E will work with KPMG to resolve any and all issues related to the project in a timely fashion 

 PG&E will identify a PG&E Lead to work with KPMG, who will assist in identifying appropriate resource, help 

obtain relevant technical information, actively participate in key discussions around project decisions, status 

reporting, and project issues. 

 The PG&E Lead will oversee the conduct of this service, including coordination of PG&E resources needed 

and review of draft deliverables. PG&E personnel assigned to the project will review draft deliverables on a 

timely basis. 

 PG&E and KPMG, will conduct this project collaboratively, whereby PG&E will assign representatives to work 

with KPMG throughout the project. Should PG&E be unable to assign representatives to work with KPMG, 

KPMG and the PG&E Lead would agree to meet and determine the impact and the appropriate course of 

action, which may include, but not be limited to, the following: 

o Modifying the level of KPMG resources (and modification of KPMG fees, in a manner consistent with 

this engagement letter). 

o This scope will be agreed upon by both PG&E and KPMG, and will not change without the prior 

approval from both parties. 

o PG&E management is responsible for establishing and maintaining an effective internal 

communication and control structure. 

 PG&E will provide resources, including hardware, software, and personnel. PG&E will provide appropriate 

workspace for the KPMG resources on-site, including, but not limited to, telephones, workstations, printers, 

whiteboards, office supplies, photocopiers, internet access, and fax machines. 

8. OTHER MATTERS 

KPMG will act as an independent contractor in providing the services as set out in this CWA and does not 

undertake to perform obligations of PG&E, whether regulatory or contractual. In carrying out our work hereunder: 

 Contractor will provide its services in accordance with the terms and conditions of this CWA and the MSA 

No. 4400006952. 

 KPMG will not act in the capacity equivalent to a member of management or as an employee of PG&E 

 KPMG will provide observations to PG&E management during this engagement. PG&E management is solely 

responsible for evaluating such observations and then determining what changes/improvements (if any) 

PG&E should implement in light of PG&E’s objectives in carrying out the project to which KPMG’s services 

relate (the “Project”) 

 KPMG will not form part of the PG&E’s internal control structure 

The responsibility for the Project rests with management of PG&E. With regard to KPMG’s services, PG&E is 

responsible for: 

 Determining the objectives, scope, and extent of KPMG’s services hereunder 

 Designating a management-level individual, who will have responsibility to manage and oversee, as assisted 

by the KPMG team, the Project progress and to address issues as they arise, and who has the skills and 

experience necessary to effectively perform this function, including but not limited to: 

o Familiarity with the business functions, processes or divisions that are the subject of the Project 

objectives; 

o Being in a position to evaluate the information provided to him/her by the KPMG engagement team; is 

responsible for, and authorized to make management decisions based on such information; and 

o In a sufficiently senior position, or to otherwise have a reporting relationship with senior management 

to provide appropriate internal PG&E communications regarding project status and potential 

concerns. 

DocuSign Envelope ID: F679BD89-0353-45B7-B786-84E43C4D3E86

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 6

of 11
Certificate Of Completion

Envelope Id: F679BD89035345B7B78684E43C4D3E86 Status: Completed

Subject: CW2235749 - CWA C4236 CW2235749 KPMG 12272017 E2HA.pdf

Source Envelope: 

Document Pages: 5 Signatures: 2 Envelope Originator: 

Certificate Pages: 5 Initials: 0 Elizabeth Haworth-Davis

AutoNav: Enabled

EnvelopeId Stamping: Enabled

Time Zone: (UTC-08:00) Pacific Time (US & Canada)

77 Beale Street

San Francisco, CA 94105

E2HA@pge.com

IP Address: 216.109.111.59 

Record Tracking

Status: Original

 1/2/2018 7:32:11 AM

Holder: Elizabeth Haworth-Davis

 E2HA@pge.com

Location: DocuSign

Signer Events Signature Timestamp

Michael Gomez

michaelgomez@kpmg.com

Principal

Security Level: Email, Account Authentication 

(None) Using IP Address: 100.16.90.67

Sent: 1/2/2018 7:32:51 AM

Viewed: 1/2/2018 7:33:30 AM 

Signed: 1/2/2018 7:33:46 AM

Electronic Record and Signature Disclosure: 

 Accepted: 1/2/2018 7:33:30 AM

 ID: 1d1c21fa-cdf9-4f6e-ac95-c42835bded8d

Nathan Floyd

NAF2@pge.com

Supervisor-Exempt, Sourcing

PG&E

Security Level: Email, Account Authentication 

(None)

Using IP Address: 131.89.210.92

Sent: 1/2/2018 7:33:47 AM

Viewed: 1/2/2018 8:27:01 AM 

Signed: 1/2/2018 8:27:25 AM

Electronic Record and Signature Disclosure: 

 Not Offered via DocuSign

In Person Signer Events Signature Timestamp

Editor Delivery Events Status Timestamp

Agent Delivery Events Status Timestamp

Intermediary Delivery Events Status Timestamp

Certified Delivery Events Status Timestamp

Carbon Copy Events Status Timestamp

Notary Events Signature Timestamp

Envelope Summary Events Status Timestamps

Envelope Sent Hashed/Encrypted 1/2/2018 7:33:47 AM

Certified Delivered Security Checked 1/2/2018 8:27:02 AM

Signing Complete Security Checked 1/2/2018 8:27:25 AM

Completed Security Checked 1/2/2018 8:27:25 AM

Payment Events Status Timestamps

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 7

of 11
Electronic Record and Signature Disclosure

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 8

of 11
ELECTRONIC RECORD AND SIGNATURE DISCLOSURE

From time to time, PG&E (we, us or Company) may be required by law to provide to you certain

written notices or disclosures. Described below are the terms and conditions for providing to you

such notices and disclosures electronically through your DocuSign, Inc. (DocuSign) Express user

account. Please read the information below carefully and thoroughly, and if you can access this

information electronically to your satisfaction and agree to these terms and conditions, please

confirm your agreement by clicking the 'I agree' button at the bottom of this document. 

Getting paper copies

At any time, you may request from us a paper copy of any record provided or made available

electronically to you by us. For such copies, as long as you are an authorized user of the

DocuSign system you will have the ability to download and print any documents we send to you

through your DocuSign user account for a limited period of time (usually 30 days) after such

documents are first sent to you. After such time, if you wish for us to send you paper copies of

any such documents from our office to you, you will be charged a $0.00 per-page fee. You may

request delivery of such paper copies from us by following the procedure described below. 

Withdrawing your consent 

If you decide to receive notices and disclosures from us electronically, you may at any time

change your mind and tell us that thereafter you want to receive required notices and disclosures

only in paper format. How you must inform us of your decision to receive future notices and

disclosure in paper format and withdraw your consent to receive notices and disclosures

electronically is described below. 

Consequences of changing your mind

If you elect to receive required notices and disclosures only in paper format, it will slow the

speed at which we can complete certain steps in transactions with you and delivering services to

you because we will need first to send the required notices or disclosures to you in paper format,

and then wait until we receive back from you your acknowledgment of your receipt of such

paper notices or disclosures. To indicate to us that you are changing your mind, you must

withdraw your consent using the DocuSign 'Withdraw Consent' form on the signing page of your

DocuSign account. This will indicate to us that you have withdrawn your consent to receive

required notices and disclosures electronically from us and you will no longer be able to use your

DocuSign Express user account to receive required notices and consents electronically from us

or to sign electronically documents from us. 

All notices and disclosures will be sent to you electronically

Unless you tell us otherwise in accordance with the procedures described herein, we will provide

electronically to you through your DocuSign user account all required notices, disclosures,

authorizations, acknowledgements, and other documents that are required to be provided or

made available to you during the course of our relationship with you. To reduce the chance of

you inadvertently not receiving any notice or disclosure, we prefer to provide all of the required

notices and disclosures to you by the same method and to the same address that you have given

us. Thus, you can receive all the disclosures and notices electronically or in paper format through

the paper mail delivery system. If you do not agree with this process, please let us know as

described below. Please also see the paragraph immediately above that describes the

consequences of your electing not to receive delivery of the notices and disclosures

electronically from us. 

How to contact PG&E:

Electronic Record and Signature Disclosure created on: 11/15/2017 11:09:37 AM

Parties agreed to: Michael Gomez

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 9

of 11
You may contact us to let us know of your changes as to how we may contact you electronically,

to request paper copies of certain information from us, and to withdraw your prior consent to

receive notices and disclosures electronically as follows:

 To contact us by email send messages to: pcpc@pge.com

To advise PG&E of your new e-mail address 

To let us know of a change in your e-mail address where we should send notices and disclosures

electronically to you, you must send an email message to us at pcpc@pge.com and in the body of

such request you must state: your previous e-mail address, your new e-mail address. We do not

require any other information from you to change your email address.. 

In addition, you must notify DocuSign, Inc to arrange for your new email address to be reflected

in your DocuSign account by following the process for changing e-mail in DocuSign. 

To request paper copies from PG&E

To request delivery from us of paper copies of the notices and disclosures previously provided

by us to you electronically, you must send us an e-mail to pcpc@pge.com and in the body of

such request you must state your e-mail address, full name, US Postal address, and telephone

number. We will bill you for any fees at that time, if any. 

To withdraw your consent with PG&E

To inform us that you no longer want to receive future notices and disclosures in electronic

format you may:

i. decline to sign a document from within your DocuSign account, and on the subsequent

page, select the check-box indicating you wish to withdraw your consent, or you may;

ii. send us an e-mail to pcpc@pge.com and in the body of such request you must state your

e-mail, full name, IS Postal Address, telephone number, and account number. We do not

need any other information from you to withdraw consent.. The consequences of your

withdrawing consent for online documents will be that transactions may take a longer time

to process.. 

Required hardware and software

Operating Systems: Windows2000? or WindowsXP? 

Browsers (for SENDERS): Internet Explorer 6.0? or above 

Browsers (for SIGNERS): Internet Explorer 6.0?, Mozilla FireFox 1.0,

NetScape 7.2 (or above) 

Email: Access to a valid email account 

Screen Resolution: 800 x 600 minimum 

Enabled Security Settings: 

•Allow per session cookies

•Users accessing the internet behind a Proxy

Server must enable HTTP 1.1 settings via

proxy connection 

** These minimum requirements are subject to change. If these requirements change, we will

provide you with an email message at the email address we have on file for you at that time

providing you with the revised hardware and software requirements, at which time you will

have the right to withdraw your consent. 

Acknowledging your access and consent to receive materials electronically

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 10

of 11
To confirm to us that you can access this information electronically, which will be similar to

other electronic notices and disclosures that we will provide to you, please verify that you

were able to read this electronic disclosure and that you also were able to print on paper or

electronically save this page for your future reference and access or that you were able to

e-mail this disclosure and consent to an address where you will be able to print on paper or

save it for your future reference and access. Further, if you consent to receiving notices and

disclosures exclusively in electronic format on the terms and conditions described above,

please let us know by clicking the 'I agree' button below. 

By checking the 'I Agree' box, I confirm that: 

• I can access and read this Electronic CONSENT TO ELECTRONIC RECEIPT OF

ELECTRONIC RECORD AND SIGNATURE DISCLOSURES document; and

• I can print on paper the disclosure or save or send the disclosure to a place where I can

print it, for future reference and access; and

• Until or unless I notify PG&E as described above, I consent to receive from

exclusively through electronic means all notices, disclosures, authorizations,

acknowledgements, and other documents that are required to be provided or made

available to me by PG&E during the course of my relationship with you.

Case: 19-30088 Doc# 2172-5 Filed: 05/21/19 Entered: 05/21/19 17:15:01 Page 11

of 11