AOA25-CPA-01-AUDTSVCS-ad1.pdf

05/21/2025

TO: ALL OFFERORS

FROM: Robert Sisk Deputy Auditor

SUBJECT: ADDENDUM TO RFP

CONTRACT NO. AOA25-CPA-01-AUDTSVCS

Professional Audit Services

ADDENDUM #1

This addendum is to address the questions and answers for the current Request for

Proposal. All other terms and conditions remain the same. If you have any questions, please contact me at 302-269-7203 or ROBERT.SISK@DELAWARE.GOV.

Question: Section 7 – page 10 of 62 - Could you please provide guidance on how to complete the cost proposal section? Given that there is no defined scope of work for this proposal, would it be appropriate to submit a list of rates categorized by level?

Response: Yes. Firms' cost proposals should detail the hourly rate to be charged for each categorized level of staff, rather than providing a fixed price for engagements.

Section 7.3 is deleted

Question: Section 8.3.f, page 13 - RFP reads: “The Firm must identify the engagement team:

engagement partners, managers, supervisors, and specialists who will be providing services to

AOA.”

Can the State please clarify/confirm bidders will need to propose staff for EACH of the services outlined in Section 4. Nature of Services Required including financial audits, internal audit controls, compliance audits, performance audits, forensic audit investigations, IT audits of IT systems and controls and grant audits?

Response: Firms do not need to propose staff for every listed service. Engagement teams can be structured flexibly, allowing firms to designate professionals based on anticipated projects and expertise on a case-by-case basis. AOA primarily engages in Yellow Book audits, following Government Auditing Standards (GAS). Firms should structure team staffing proposals accordingly, ensuring that anticipated staff and methodologies align with Yellow Book requirements.

mailto:ROBERT.SISK@DELAWARE.GOV

Question: Section 9.2.b, page 14 - RFP reads: “For the Firm that will be assigned responsibility for the services, the Firm must list other entities receiving similar services in the last three years.

These engagements must be ranked on the basis of total staff hours and must indicate the scope of work, date, engagement partners, total hours, and the name and telephone number of the principal client contact.”

Can the State please clarify/confirm bidders should include entities/projects that address EACH of the services outlined in Section 4. Nature of Services Required including financial audits, internal audit controls, compliance audits, performance audits, forensic audit investigations, IT audits of IT systems and controls and grant audits?

Response: Paragraph 9.2b. is amended to read as follows:

b. Similar Engagements with Other Government Entities If the Firm has previously provided similar services to other government entities, it must list at least two (2) other entities receiving similar services in the last three (3) years. If only one

(1) qualifying engagement entity exists, the Firm may submit a single engagement.

Engagements must be ranked on the basis of total staff hours and must indicate the scope of work, date, engagement partners, total hours, and the name and telephone number of the principal client contact. Engagements can include any of the services outlined in Section 4 – Nature of Services Required.

Question: Section 8.3.b & Section 8.3.c, pages 12 & 13 - Both sections indicate that a bidder must provide “a copy of a current State of Delaware business license for the Firm, issued by the Delaware Division of Revenue” – should the State of Delaware business license be included twice to respond to Section 8.3.b. [License to Practice in Delaware and Delaware Business License] and Section 8.3.c. [Firm Qualifications]?

Response: Firms should submit both a State of Delaware business license for the Firm, issued by the Delaware Division of Revenue, and a copy of a valid Delaware firm professional license, also known as a permit to practice, issued by the State Board of Accountancy.

Question: Section 4.1, page 6 - Will the State seek financial statement audits in accordance with

GASB?

Response: The specific audit requirements will be determined on a case-by-case basis.

Question: Section 9.2.c, page 14 - Does the State expect the offeror to detail a work plan for each of the services detailed in section 4.1?

Response: No. Since engagements have not yet been determined, firms are not required to submit a detailed work plan for each service. Instead, firms must provide a generalized approach outlining their methodology, staffing strategy, and quality assurance processes.

Question: Section 4.1.f, page 6 – IT Audits

• What types of IT audits are expected to be conducted? Compliance, risk assessments, cybersecurity, operational efficiency?

• Does Delaware AOA follow a compliance framework or standard? CIS, NIST, ISO 27001, etc.?

• Please confirm which in-scope applications are in-scope.

o Are any of these applications hosted and managed by a vendor?

o Where are the systems hosted? On-premises, cloud, hybrid, etc.?

• Are information technology policies, procedures, and processes centralized and standardized across systems and locations?

o If not, please briefly summarize the extent of de-centralization/distribution and variation.

• Please summarize the kinds of IT services and applications that are outsourced/provided by service providers (Data center/Cloud Hosting, Help Desk, Security Monitoring, etc.).

• Please describe the size and complexity of the IT environment (number of servers, users, applications, locations, etc.)

• How many IT controls are in-scope for the IT internal audit(s)?

• Does the State have an in-house internal audit team?

o If yes, will we be working with the Internal Audit Team on risk assessments and scoping, or will the internal audits be separate?

• Would the State prefer us to perform the fieldwork remotely, on-site, or both? (If onsite, please indicate location(s) to visit)

• Is there an expected timeline for the IT audits?

Response: The audit engagements for this RFP have not been predetermined. Therefore, the Delaware Office of Auditor of Accounts (AOA) is unable to provide specific responses to these questions. However, as audit requirements are developed, each audit engagement will be outlined through a Statement of Work (SOW), which will specify the scope, compliance requirements, timeline, and relevant IT systems. IT audits have not been a predominant component of past engagements under the current audit services contract, but have typically included assessment of the adequacy of access management, system protection measures and agency needs.

Detailed questions—such as expected types of audits, applicable compliance frameworks, in-scope applications, hosting environments, IT policy standardization, and audit timelines—have not yet been specifically addressed by AOA.

As additional details emerge, the Selected Firm will collaborate closely with AOA’s assigned liaison to refine audit procedures and tailor approaches accordingly.

Question: Section 4.1.b, page 6 – Internal Control Audits - How many internal control audits are typically performed each year?

Response: The frequency may vary based on audit priorities, resource availability, and emerging risks. The Government Auditing Standards (GAGAS) require auditors to assess internal controls as part of financial, compliance, and performance audits to ensure accountability and transparency. While AOA has not performed standalone internal control audits, internal control evaluations are incorporated into audit procedures.

Question: Section 4.1.b, page 6 – Internal Control Audits - Is there an audit plan that outlines departments that are in-scope to be audited?

Response: The types of engagements will be determined on a case-by-case basis with the awarded firm. The duties of the Auditor of Accounts are outlined in Title 29 Del. C.

ch 29, and state that “The Auditor shall conduct audits of all the financial transactions of all state agencies.” All state agencies are in-scope.

Question: Section 4.1.b, page 6 – Internal Control Audits - Is there an expected timeline for the Internal control audits?

the awarded firm. There is no defined timeline.

Question: Section 4.1.b, page 6 – Internal Control Audits –

• If the Finance/Accounting Department is in-scope for an internal controls audit, how many processes (i.e. AP, AR, Financial Close) do we need to consider for the audit plan?

• Is there currently an audit plan that the State would want the firm to consider, or would we need to create an audit plan? Specifically, to determine in-scope audits.

• Has the State performed a risk assessment or is this something the firm would need to consider performing?

• Please describe the size and complexity of the internal control's environment.

• How often are the departments audited?

• Is there an internal controls audit team that the firm would need to work with?

• Are policies, procedures, and processes (narratives and/or flowcharts) centralized and standardized across the departments?

• Will this information be available to review during the audit?

• Are process narratives updated with the latest processes and controls?

Response: The audit engagements for this RFP have not been predetermined. Therefore, the Delaware Office of Auditor of Accounts (AOA) is unable to provide specific responses to these questions. However, as audit requirements are developed, each audit engagement will be outlined through a Statement of Work (SOW), which will specify the scope, compliance requirements and timeline.

As additional details emerge, the selected firm will collaborate closely with AOA’s assigned liaison to refine audit procedures and tailor approaches accordingly. The types of engagements will be determined on a case-by-case basis with the awarded firm.

Question: If applicable, who is the incumbent firm(s) performed the scope of services?

Response: The incumbent firms are Belfint Lyons & Shuman, P.A. and Gunnip & Company, LLP

Question: How is the audit plan determined? How often is the plan updated?

Response: AOA develops an annual audit plan guided by mandated requirements in Delaware Code, incorporating a risk-based approach. The plan is informed by:

- Hotline Submissions – Reviewing reports of potential fraud, waste, or abuse to identify high-risk areas.

- State Transaction Analysis – Evaluating financial data and operational trends to detect irregularities and assess risk.

- Legislative & Regulatory Mandates – Ensuring compliance with statutory requirements for audits.

Assignments are based upon available resources.

Question: Has a risk assessment been performed by the AOA? If so, when was the most recent risk assessment?

Response: AOA develops its annual audit plan based on mandated requirements in Delaware Code, incorporating risk analysis from hotline submissions and state transaction reviews.

Question: Section 9.2.b states that “...the Firm must list other entities receiving similar services in the last three years.” Could you please clarify how many references you would like included in the proposal?

at least two (2) other entities receiving similar services in the last three (3) years. If only one

(1) qualifying engagement entity exists, the Firm may submit a single engagement.

Engagements must be ranked on the basis of total staff hours and must indicate the scope of work, date, engagement partners, total hours, and the name and telephone number of the

Question: Section 4.1 describes a number of services for the scope of work including attest and non-attest services. Is the AOA seeking an external audit team to attest on financial statements, internal auditors (i.e. consultants), or both?

the awarded firm.

Question: How many firms does the AOA anticipate awarding? Is this intended to be a vendor pool?

Response: We expect to select at least two firms

Question: The RFP mentions that the AOA is anticipating 3-4 projects per year. How will the selected firm(s) be notified of the 3-4 projects?

Response: The selected firm(s) will be notified of each anticipated engagement on a case-by-case basis. For every project, AOA will issue a Statement of Work (SOW) outlining the engagement details, including scope, objectives, deliverables, and deadlines.

This SOW will serve as the official notification and will guide collaboration between AOA and the firm in determining estimated hours and the maximum cost for the engagement.

Notifications will be provided through formal written communication, such as email or direct correspondence.

Question: Can the selected firm(s) respond to only projects related to the non-attest services within the scope of the RFP listed in section 4.1?

Response: Yes, if the firm prefers to focus only on non-attest services, it must explicitly state this preference in the proposal.

Question: Section 7.2 of the RFP states that “The Cost Section must contain all detailed cost information relative to performing the engagement as described in this RFP for each fiscal year presented in the schedule as outlined in Appendix A.” Question 7 of the FAQ state that “For each fiscal year, we estimate approximately 3 to 4 projects” Is the AOA seeking the proposer to submit hours and fees to perform 3 to 4 engagements in a fiscal year?

Response: No, engagements will be determined on a case-by-case basis with the awarded firm. For each engagement, the audit liaison will provide a statement of work and collaborate with the firm to determine the estimated hours required. Based on this collaboration, a maximum cost will be negotiated for each engagement.

Firms' cost proposals should only detail the hourly rate to be charged for each categorized level of staff, rather than providing a fixed price for multiple engagements.

Question: Are there any budget constraints or expectations we should consider when preparing our cost proposal? If so, could you please provide more information on the budget?

Response: Firms' cost proposals should only detail the hourly rate to be charged for each categorized level of staff. Budgets for individual engagements will be determined on a case-by-case basis.

Question: What prompted this project? Is this undertaken as a best practice or have there been events/deficiencies/or concerns that are driving this RFP?

Response: This RFP is primarily driven by the expiration of two existing contracts for audit services and audit review services, necessitating a continuation of these essential functions.

Question: Are there any specific process areas the AOA is anticipating/would like to scope in for the 3-4 projects per year?

Response: AOA has not identified specific process areas for the 3-4 projects per year at this time. The Firm should remain flexible and prepared to adapt to varying audit priorities based on AOA’s needs.

Question: Do all team members need to be a CPA?

Response: No. Supporting team members might have other relevant qualifications in auditing, accounting, or financial analysis without necessarily holding a CPA designation.

Question: Page 14 (9. Proprietary Section; 9.2.b Similar Engagements with Other Government Entities)

a. Are AOA’s expectations/preferences for the offeror to provide a contact for each entity, or are expectations/preferences to provide contacts for the top X engagements?

at least two (2) other entities receiving similar services in the last three (3) years. If only one

(1) qualifying engagement entity exists, the Firm may submit a single engagement.

Engagements must be ranked on the basis of total staff hours and must indicate the scope of work, date, engagement partners, total hours, and the name and telephone number of the

Question: Page 15 (9.2.d. Examples of GAGAS findings):

a. Are AOA’s expectations/preferences to only include “findings” from prior engagements, or can/should the offeror provide additional information including findings with associated risks, recommendations, and management action plans?

Response: When providing specific findings, the Firm may provide additional information including findings with associated risks, recommendations, and management action plans.

b. Is there a preference for the offeror to provide complete audit reports that include all audit information or specifically just findings?

Response: The Firm is expected to provide specific findings from audit reports rather than full reports containing all audit information in response to section 9.2d. The Firm must submit at least two (but no more than three) examples of findings that were issued under a GAGAS engagement.

Question: Page 15 (9.2.e. Other work product examples):

a. The prior section, 9.2.e., outlines findings examples. Based on AOA’s response to the above questions, may an offeror provide a complete report as part of product examples?

Response: Yes, a Firm may provide a complete report as part of the product examples.

However, the offeror must also provide at least two findings separately to ensure they meet the specific requirements outlined.

Question: Can you provide a list of audits that were outsourced under the previous contract and their associated budgets?

Response: Outsourced audit and review services have included:

Engagement Authorized Positions Unit Count Max Student Ratio Office of Secretary of Treasury Lenape Tribe Elections Paramedics Dual Employment Dept of Labor Unemployment Insurance Town of Ellendale Court of Chancery Distressed Cemeteries City of Dover

The total associated costs for both audit and review services billed for actual hours performed were as follows:

FY22 – $33,567.30 FY24 – $143,692.73

FY23 – $81,140.28 FY25 – $34,582.25

Question: How much of the work is expected to be onsite versus remote?

Response: The majority of services should be able to be performed remotely for the various engagements, but may vary significantly from entity to entity and based upon the required engagement.

Question: Our firm does not hold a CPA license directly with the State of Delaware, but we are licensed to do business in the State and in good standing. We understand the AOA will allow individual CPAs to participate who have licenses from a substantially equivalent jurisdiction as defined by the Uniform Accountancy Act (“UAA”). Will the AOA also accept firm licensing through reciprocity with other states as allowed by the Delaware Board of Accountancy?

Response: AOA will adhere to Delaware Code, Delaware Administrative Code, and the Board of Accountancy’s professional regulations in determining licensing and audit requirements. Firms should ensure compliance with these standards when submitting proposals and engaging in audit assignments.

Question: The term “Audit” can be used in a broad sense and include various types and services.

Section 4.1 of the RFP lists 9 categories of audit services. Some of these services are typically performed under the standards noted in section 4.2 (Generally accepted auditing standards & Government Auditing Standards) including a - financial audit services, b- internal control audits and c- Compliance audits. Others, notably e - Forensic audit investigations, f- IT audits and h- Special investigations, are typically performed under AICPA consulting standards.

Will the AOA accept RFP responses from firms that propose to perform certain services under audit standards, as noted above, and certain other services under consulting standards?

Response: Yes. Firms should clearly specify which services they are qualified to perform and which services they do not offer within their proposal.

Question: Our firm provides professional services under two closely related entities – one that performs consulting services and another, a CPA firm, that performs traditional audits under the audit standards. Should the answer to the prior Question be “yes”, can separate contracts with the consulting services firm and the audit firm be executed?

Response: Separate contracts may be executed if AOA determines that doing so is in the best interest of the State of Delaware. This decision would be based on regulatory requirements, operational needs, and compliance considerations.

Question: Should our firm be selected, will we contract directly with the AOA to serve as an overall agreement? Will our engagement letters for each audit then be executed between us and the state entity?

Response: If selected, the firm will contract directly with AOA under an overall agreement governing audit engagements. For each specific audit, an engagement letter will be executed between the firm and the state entity receiving the audit services.

Question: Section 4.1 b speaks to QC reviews for audits and investigations. Are these QC reviews those that the selected firm would perform or be subject to? What other firms or audit shops might be subject to those QC reviews? How are these different than peer reviews of the

AOA?

Response: QC Reviews will focus on individual audits and investigations, ensuring compliance with audit methodologies, documentation, and reporting standards. QC reviews may be requested on a case-by-case basis for engagements performed by AOA when resources are constrained. This approach allows AOA to ensure audit quality and compliance while balancing workload demands.

Question: Section 7.2 refers to Appendix A as an example of how to present our proposed fees and shows the estimated hours, by task, and hourly rates. Estimating the number of hours for a yet to be determined engagement/client is virtually impossible without knowing the nuances of the type of agency and client. Additionally, Appendix A portrays a total fee, which seems to contradict to the last sentence under section 4.1 which states “Each engagement cost will be based on actual hours worked and is not a fixed price”.

Can proposing firms simply present their pricing by providing hourly rates by position? Please clarify how we are to present pricing.

Response: Firms' cost proposals should detail the hourly rate to be charged for each categorized level of staff, rather than providing a fixed price for engagements.

Question: Our firm includes a Standard Terms and Conditions section of its engagement letters regarding limitations, conditions, consents, and use of non – U.S. personnel. Would the AOA and the State Agencies we would audit be open to such terms and conditions being part of the engagement letters?

Response: AOA may review such terms on a case-by-case basis to determine whether they align with Delaware Code, Government Auditing Standards (GAGAS), and other applicable regulations.

Question: relating to Section 4.1 – Are there any specific agencies, departments or organizations that have already been selected for these audits.

Response: At this time, no agencies, departments, or organizations have been selected for audits under Section 4.1. However, audit assignments are typically determined based on risk assessments, regulatory mandates, and resource availability.