Must the LEA have a written agreement with the community-based organization prior to disclosing personally identifiable information (PII) from education records under the Audit Evaluation Exception?

Yes.  The LEA must use a written agreement to designate the community-based organization as its authorized representative.  The written agreement must include certain mandatory components as described in § 99.35(a)(3)(ii) of the regulations.  The specific policies and procedures outlined in the agreement should be consistent with FERPA and all other applicable laws.)  For additional information, see § 99.35 of the regulations