Audit_Scope_of_Work.docx

1. Draft Scope of Work (Audit Services) Scope of Work The selected firm shall perform an Annual Financial and Compliance Audit for the fiscal year ending August 31, 2026, including all required reports, communications, and filings. The audit shall be conducted in accordance with all applicable professional, federal, and state requirements, including but not limited to:

· Generally Accepted Auditing Standards (GAAS)

· Government Auditing Standards

· Uniform Guidance (2 CFR Part 200)

· Texas Uniform Grant Management Standards (UGMS)

· State of Texas Single Audit Circular (if applicable)

· Guidelines for Annual Financial and Compliance Audits of Community MHMR Centers

· Generally Accepted Accounting Principles (GAAP) Required Services The auditor shall:

Financial Statement Audit

· Audit the Organization's annual financial statements and related disclosures.

· Express an opinion regarding whether the financial statements fairly present the financial position, results of operations, and cash flows in accordance with GAAP.

· Review and test significant accounting transactions and balances.

Single Audit / Compliance Audit

· Perform a Single Audit of federal and state awards, as applicable.

· Identify major programs and conduct testing required under Uniform Guidance and State requirements.

· Evaluate compliance with grant agreements, contracts, laws, regulations, and funding requirements.

· Report all findings, questioned costs, material weaknesses, significant deficiencies, and instances of noncompliance.

Internal Control Evaluation

· Obtain an understanding of internal controls over financial reporting and compliance.

· Perform risk assessments and testing of internal controls.

· Report any material weaknesses or significant deficiencies identified during the engagement.

Required Deliverables The auditor shall provide:

· Independent Auditor's Report

· Financial Statements and Notes

· Single Audit Report (if applicable)

· Schedule of Expenditures of Federal Awards (SEFA)

· Schedule of State Awards (if required)

· Report on Internal Control Over Financial Reporting

· Report on Compliance for Major Programs

· Schedule of Findings and Questioned Costs

· Auditor Communications Letter

· Management Letter with recommendations for process improvements

· Corrective Action Plan assistance (if findings occur) Presentation Requirements The auditor shall:

· Present preliminary audit results to management.

· Attend and present the final audit to the Board.

· Participate in follow-up meetings related to findings or audit recommendations.

Filing Requirements The auditor shall:

· Submit all required reports to the Federal Audit Clearinghouse.

· Assist with state and funding agency reporting requirements.

· Provide electronic copies of all reports in PDF format and editable formats upon request.

Workpapers

· Maintain audit workpapers in accordance with professional standards.

· Provide access to workpapers when requested by authorized federal, state, or oversight agencies.

Timeline Expectations At minimum:

· Final fieldwork completed no later than October/November.

· Draft audit report delivered by December 31.

· Final reports presented to the governing board no later than January.

2. Recommended Auditor Submission Requirements All respondents shall submit the following.

Firm Qualifications

1. Cover Letter

2. Firm Profile and organizational history.

3. Description of ownership structure.

4. Number of years in business.

5. Number of professional staff assigned to governmental audits.

6. Proof of licensure with the Texas State Board of Public Accountancy.

7. Confirmation that the firm is authorized to perform governmental audits.

Experience

1. Description of experience performing:

· Community MHMR Center audits

· Behavioral Health authority audits

· Local government audits

· Single Audits under Uniform Guidance

2. List of at least four comparable Texas clients audited within the past three years including:

· Organization name

· Contact person

· Phone number

· Years of service

3. Description of experience with:

· HHSC funded entities

· Federal grant compliance testing

· State Single Audit requirements Independence and Ethics

1. Independence statement.

2. Conflict of interest disclosure.

3. Disclosure of any relationships with board members, executives, or employees.

4. Statement regarding any disciplinary actions, investigations, sanctions, or reprimands within the last five years.

Audit Team

1. Proposed engagement partner.

2. Proposed audit manager.

3. Key audit staff assigned.

4. Résumés and qualifications of key personnel.

5. Relevant governmental auditing continuing education completed during the past two years.

Technical Approach

1. Audit methodology.

2. Risk assessment approach.

3. Internal controls testing approach.

4. Single Audit approach.

5. Technology utilized during the audit.

6. Cybersecurity and data protection protocols.

7. Proposed timeline and work plan.

Insurance

1. Evidence of Professional Liability (Errors & Omissions).

2. General Liability coverage.

3. Workers Compensation coverage.

References

1. Minimum of four references from governmental or quasi-governmental entities.

2. At least two references should be community mental health centers, behavioral health authorities, or similar organizations.

Cost Proposal Require a separate sealed pricing proposal that includes:

· Fixed fee for FY2026 audit

· Single Audit fee

· Out-of-pocket expenses

· Hourly rates by staff classification

· Pricing for optional future renewal years

· Pricing for additional services outside scope

Cybersecurity & Data Protection Requirements The proposer shall provide detailed responses to the following:

Information Security Program Describe your firm's information security program and governance structure.

Data Protection

1. Describe how client data is protected during:

· Transmission

· Storage

· Processing

· Disposal

2. Is encryption utilized for:

· Data at rest?

· Data in transit?

3. Describe the secure file transfer methods available to clients.

4. Explain how confidential and sensitive information is segregated and protected from unauthorized access.

Access Controls

1. Describe user access controls, including:

· Multi-factor authentication (MFA)

· Password requirements

· Role-based access controls

· Privileged account management

2. Describe procedures for onboarding and offboarding employees with access to client data.

Security Monitoring

1. Describe your firm's:

· Endpoint protection solution

· Antivirus/anti-malware tools

· Security monitoring processes

· Vulnerability management practices

2. How frequently are security patches and system updates applied?

Incident Response

1. Does your firm maintain a formal Incident Response Plan?

2. Describe your process for responding to a data breach or cybersecurity incident.

3. Within what timeframe would your firm notify the Organization of a security incident affecting Organization data?

4. Have you experienced a data breach, ransomware event, or other significant cybersecurity incident in the last five (5) years? If yes, provide details and corrective actions taken.