DQ EGBA 2026000520 _CBMS Audit Services_ V2.pdf

Documented Quote DQ EGBA 2026000520

"CBMS Audit Services"

All questions and inquiries regarding this solicitation must be sent to:

Sole Point of Contact: Mike Whalen

Email: Mike.Whalen@state.co.us

Schedule of Activities

Activity Time Date

Solicitation Publication (VSS) 3:30pm 8/5/2026

Written Inquiry Deadline 1:30pm 8/11/2026

State Response to Written Inquiries 1:30pm 8/13/2026

Vendor Response Submission Deadline 1:30pm 8/19/2026

Please submit to the following address: http://www.bidnetdirect.com//oit

Attachments

Attachment A - Cost Proposal Workbook, DQ 2026000520 http://www.bidnetdirect.com//oit

Table of Contents

Schedule of Activities 2 Table of Contents 3 Section 1 Solicitation Information 4

1.1. Introduction 4

1.2. Background, Overview and Goals 4

1.3. Anticipated Term 5

1.4. Respondent Inquiries 5

Section 2 Scope of Work/Specification and Requirements 6

2.1. General Information 6

2.2. SOC 1 Type II Audit 6

2.3. Performance Standards Reporting Requirements 7

Section 3 Vendor Response Criteria 8

3.1. Mandatory Solicitation Requirements 8

3.2. Scope of Work/Specifications: 8

3.3. Organization Experience 9

Section 4 Quote Submission Information 10

4.1. Quote Submission Instruction 10

4.2. Timeliness Of Quote Submission 10

4.3. Quote Format and Content 10

4.4. Pricing 10

Section 5 Award 11

5.1. Award (See Procurement Rule R-24-103-204-01) 11

5.2. Negotiations 11

5.3. Single Quote 11

5.4. Colorado Business Registration 11

5.5. Notice of Award 12

5.6. Documents After Awards 12

Section 6 General Administrative Information 13

6.1. Terms and Conditions of agreement 13

6.2. Colorado Offeror Self Service and Registration 13

6.3. Video Surveillance and Telecommunications Prohibition 13

6.4. Colorado Vendor Self Service 14

6.5. Modifications and/or Supplemental Information To The Solicitation 14

6.6. News Releases and Announcements 14

6.7. Response Material Ownership 14

6.8. Submission of Confidential or Proprietary Information 14

Section 1 Solicitation Information

1.1. Introduction

On behalf of the State of Colorado, the Office of Information Technology (OIT) in partnership with The Colorado Department of Health Care Policy and Finance is soliciting competitive responsive proposals from experienced organizations to perform Type II Soc Auditor for the department.

1.2. Background, Overview and Goals

The Department serves as the Medicaid Single State Agency as defined by 45 C.F.R.

§205.100. The Department develops and implements policy and financing for

Medicaid and the Children’s Health Insurance Program, called Child Health Plan

Plus (CHP+) in Colorado, as well as a variety of other publicly funded health care programs for Coloradans who qualify. For more information about the Department, visit www.Colorado.gov/HCPF.

The Department is a Covered Entity under the Health Insurance Portability and

Accountability Act of 1996 (HIPAA) (42 U.S.C. §§1320d – 1320d8) and its implementing regulations. The Department operates the Colorado Medicaid

Program, known as Health First Colorado, in accordance with the Colorado Medical

Assistance Act (§§25.5-4-104, et seq., C.R.S.) and Title XIX of the Social Security

Act. Colorado Medicaid is annually funded from appropriations authorized by the

Colorado General Assembly and matched by federal funds.

a. Project Background

The Awarded Contractor shall perform a System and Organization Controls

(SOC) 1 Type II audit within the Colorado Benefits Management System (CBMS), Program Eligibility & Application Kit (PEAK) and related applications to assess the operating effectiveness of controls relevant to the Department's financial reporting as required for compliance with the Colorado Office of the State

Controller requirements.

CBMS is the statewide database system through which all food, cash, and medical assistance applications and eligibility determinations are processed.

PEAK is the online service for Coloradans to screen and apply for medical, food, http://www.colorado.gov/HCPF and cash assistance programs. The Contractor shall comply with all reporting, auditing, and other requirements of 2 CFR Part 200.

1.3. Anticipated Term

a. The anticipated term of the Contract or Purchase Order resulting from the award of this solicitation is a single fiscal year. Though, the total duration of the Contract shall not exceed five years.

b. The State is not responsible for any goods delivered or services performed by the awarded Respondent without a State issued Contract, Purchase Order or related commitment voucher.

c. The State may, within its sole discretion, may choose not to exercise any option or extension term in the Contract for any reason. If the State chooses not to exercise any option or extension term, it may re-procure the goods and/or services

1.4. Respondent Inquiries

a. Respondents may submit written inquiries via email concerning this solicitation to obtain clarifications. The State, may not accept inquiries received after the date and time indicated in the Schedule of Activities. Send all inquiries to the

Procurement Contact. Inquiries must be marked with the DQ number and title.

Inquiries should include references to relevant Sections of this solicitation.

b. Responses to Respondent inquiries will be published on Colorado VSS collectively, as an amendment to the solicitation. Respondents shall not rely on any verbal statements that alter any specification or other term or condition of the solicitation. Such changes are valid only if provided in writing by the Procurement

Contact.

Section 2 Scope of Work/Specification and Requirements

2.1. General Information

The following describes the deliverables sought through this solicitation and the scope of what the awarded Offeror will be expected to offer through the contract resulting from this solicitation. The Statement of Work is intended to provide interested Offerors with sufficient basic information to submit a proposal. It is not intended to limit a proposal’s content or exclude any relevant or essential data.

It should be noted that all work shall be performed remotely, and will not require any in-person “Field Work” for contract completion. As a result no travel or “per diem costs” will be incurred nor considered as part of this contract.

2.2. SOC 1 Type II Audit

a. Contractor shall create an Audit Plan that includes the following:

● Project timeline

● Testing process

● Milestones

● Deliverables

b. Contractor shall deliver the Audit Plan for review and approval.

c. Contractor shall conduct a readiness assessment to evaluate control documentation and processes and identify any potential gaps prior to the SOC 1

Type II audit. Contractor shall create a Readiness Assessment

d. Report that includes but is not limited to the following:

● Date of the readiness assessment

● Description of the systems and processes reviewed

● What is being assessed

● Assessment results

● Identified risks

● Recommendations

e. Contractor shall deliver the Readiness Assessment Report to the Department for review and approval.

f. Contractor shall perform a SOC 1 Type II audit in accordance with the American

Institute of Certified Public Accountants (AICPA) Statement on Standards for

Attestation Engagements (SSAE 18) and related guidance.

g. Contractor shall create a SOC 1 Type II Audit Report that includes but is not limited to the following

● Audit dates

● Audit findings

● Risk assessment

● Recommendations

h. The submitted Draft SOC 1 Type II Audit Report to the Department will be reviewed for approval and approved as completeness is achieved.

i. Contractor shall incorporate Department feedback into the Draft SOC 1 Type II

Audit Report, and deliver a finalized Audit Report.

j. Post Audit Maintenance

From time to time after the finalized report is completed and delivered to leadership, it is of concern that errors or irregularities may be discovered. The

Awarded vendor shall have a service level design methodology to correct such instances post-engagement.

2.3. Performance Standards Reporting Requirements

The Contractor shall provide reports in the format directed by the Department with the information requested to be finalized at a later date, and in negotiation with the apparent successor to this engagement.

Section 3 Vendor Response Criteria

3.1. Mandatory Solicitation Requirements

a. Accessibility Requirements

All work performed must comply with all applicable provisions of §§24-85-101, C.R.S., et seq., and the Accessibility Standards for Individuals with a Disability, as established by the Office Of Information Technology pursuant to §24-85-103

(2.5), C.R.S. and 3) all State of Colorado technology standards related to technology accessibility and with Level AA of the most current version of the

Web Content Accessibility Guidelines (WCAG), incorporated in the State of

Colorado technology standards.

Vendor Response: Confirm your organization complies with all Requirements.

b. Insurance Requirements:

Proposals shall include certificate(s) of insurance coverage for the types and amounts of insurance required by the Insurance provision in Purchase Order

Terms and Conditions

Vendor Response: Ensure your organization Submits the requested documents.

3.2. Scope of Work/Specifications:

Offerros shall describe how their organizations propose to meet or exceed the requirements stated in Section 2 “Scope of Work” of this Solicitation.

a. Proposed Project Methodology

In accordance with the American Institute of Certified Public Accountants

(AICPA) Statement on Standards for Attestation Engagements (SSAE 18) and related guidance: Vendors shall submit a proposed methodology for completing the SOC 1 Type ii Audit. Proposed plans shall include (but are not limited to):

● Audit findings

● Risk assessment

● Recommendations

b. Proposed Audit Plan

Offers shall include their organizations proposed Audit Plan, The Proposed audit plan shall also include proposed readiness assessment and evaluation controls methodologies. The audit plan shall outlines the following at a minimum:

● Proposed project timeline

● Readiness Assessment Report

● Testing processed proposed to utilize

● Projected Milestones and Deliverables.

c. Post Audit Maintenance

Please discuss your firm's approach to correcting any discovered post-engagement irregularities and your team’s approach to remedying such instances.

3.3. Organization Experience

a. The Department has determined that it desires specific experience and skills for an Offeror to possess in order for the Offeror to be able to complete the

Work efficiently while meeting the demands and deadlines of the Department.

The Department will evaluate the Offeror’s experience pertaining to relevant experience in the last 5 years.

Vendor Response: Detail your organization’s professional experience and relevant public projects of similar scope from the past three years, highlightling experiences of similar scope and size to this solicitation.

b. Provide details that demonstrate how Offeror meets all mandatory experience and/or qualification requirements. Offeror’s response should list each stated experience and/or qualification requirement separately and follow the listed requirement with the details that demonstrate how Offeror meets requirements. Provide a description of Offeror’s organizational experience related to the Work. Specifically, address:

c. Personnel Requirements: Provide a detailed explanation of how the Offeror will provide sufficient personnel to perform the proposed Work. Offerings should at a minimum include:

Project Lead: Shall be responsible for all of the following:

● Serving as Contractor’s primary point of contact for the Department.

● Ensuring the accuracy, timeliness and completion of all Work in accordance with the Contracts terms and conditions.

● Overseeing all other Key Personnel and Other Personnel and ensuring proper staffing levels throughout the term of the contract.

IT Security / Controls SME:

● Subject Matter Expert evaluating CBMS/PEAK system architecture, application controls, and IT general controls (ITGC).

3.4. Price Proposal Workbook

Complete Attachment A - Cost Proposal Workbook, DQ 2026000520.

Section 4 Quote Submission Information

4.1. Quote Submission Instruction

Quotes should be included as one or more attachments of commonly accessible file types. Respondents shall submit Quotes via Bidnet to the Procurement Point of

Contact, identified above. The Quote submission should include:

[Insert Respondent Name] for [Insert DQ number], [Insert DQ title]

4.2. Timeliness Of Quote Submission

Proposals received after the submission deadline shall be rejected without consideration.

4.3. Quote Format and Content

Vendors shall submit proposals via bidnet.com. Submissions shall at a minimum include the signed offering page, all requirements in Section 3, and the completed cost proposal workbook.

4.4. Pricing

a. Proposed pricing must remain firm during the initial term of the Contract

b. Pricing must include any fees associated with the delivery of goods or services, including, but not limited to, travel expenses, surcharges, shipping and installation. All related equipment, equipment maintenance, travel costs, etc.

shall be included within the submitted quote. Any costs not included as part of the Respondent’s quote, will be disallowed.

http://bidnet.com

Section 5 Award

5.1. Award (See Procurement Rule R-24-103-204-01)

a. This solicitation and the resulting Contract or Purchase Order will be awarded to the responsible vendor whose acceptable Quote is determined to be the most advantageous to the State, with price/cost being of consideration. Other considerations may include, but are not limited to, sample quality, and lead time for delivery.

b. “Acceptable” means that the goods or services submitted in the Respondent’s

Quote will meet the state’s needs, and that the price is fair and reasonable.

The determination of whether a Respondent’s Quote is acceptable, is solely within the State’s discretion.

c. Neither this DQ nor a Respondent’s proposal constitutes a legally binding offer.

5.2. Negotiations

The State may negotiate with any Respondent to clarify the Respondent’s Quote or to effect modifications that will make the Quote Acceptable or more advantageous to the State; however any requirements identified in this solicitation may not be negotiated. Reference Procurement Rule R-24-103-204-01(d).

5.3. Single Quote

If only one Quote is received in response to this solicitation, an award may be made to the single Respondent if the procurement official finds that the price submitted is fair and reasonable and that other prospective Respondents had reasonable opportunity to respond to the solicitation. If the price submitted is not fair and reasonable and there is not adequate time for re-solicitation, the procurement official may enter into competitive negotiations in accordance with

Procurement Rule R-24-103-208-02.

5.4. Colorado Business Registration

Within ten (10) business days of the notification of the award of a contract under this solicitation, the awarded Offeror must be properly registered with the

Colorado Secretary of State’s Office to do business in Colorado. The State may request that the awarded Offeror provide evidence of such registration, as well as other organizing documents such as Articles of Incorporation or By-laws.

5.5. Notice of Award

A Notice of Intent to Award will be announced on Colorado VSS.

5.6. Documents After Awards

Prior to Contract or Purchase Order execution, the awarded Respondent must provide the State with proof of Good Standing with the Colorado Secretary of State and an insurance certificate documenting coverage as required by the Contract or

Purchase Order.

Section 6 General Administrative Information

6.1. Terms and Conditions of agreement

The terms and conditions of the resulting agreement shall be pursuant to the State of Colorado Purchase Order terms and conditions.

6.2. Colorado Offeror Self Service and Registration

The State uses the Colorado Operations Resource Engine (CORE), Vendor Self

Service (VSS) and BIDNET to publicly post solicitations:

https://www.bidnetdirect.com/colorado/oit.

Solicitation details for goods and services, as well as construction notices, are publicly available without registration on VSS. Any addendum or modification to this solicitation will be published using Colorado VSS and BIDNET. Offerors should check VSS on a regular basis. Vendors that are registered on VSS may choose to receive notifications of any new information regarding this solicitation.

An Offeror must have a current registration on BidNet and VSS in order to be awarded under this solicitation. There is no cost to register on Colorado VSS. To become a registered supplier on VSS, please visit www.colorado.gov/vss.

To become a registered supplier on BidNet, please visit:

https://www.bidnetdirect.com/colorado/oit.

6.3. Video Surveillance and Telecommunications Prohibition

Per FAR 52.204-24 through 26, FAR 4.2105(a), and Policy Alert # 20-124 “Section 2 –

Merchant Representation”: Prohibition on Contracting for Certain

Telecommunications and Video Surveillance Services or Equipment: Video surveillance and Telecommunications equipment produced by (or any subsidiary or affiliate of such entities) below, is strictly prohibited:

● Huawei Technologies Company

● ZTE Corporation

● Hytera Communications Corporation

● Hangzhou Hikvision Digital Technology Company

● Dahua Technology Company

Agencies shall not solicit offers from, award contracts to renew, place new orders with, or otherwise extend the duration of current contracts, or consent to https://www.bidnetdirect.com/colorado/oit subcontracts. Moreover, any proposals including commodities or services from the above mentioned vendors (or subsidiaries) will be eliminated from consideration.

6.4. Colorado Vendor Self Service

This DQ is being published on the Colorado Vendor Self Service page (Colorado VSS) at www.colorado.gov/vss, so that Respondents who have an interest may submit a response in accordance with the terms of this DQ.

6.5. Modifications and/or Supplemental Information To The Solicitation

a. Any modifications, amendments or supplemental information to the solicitation will be published on Colorado VSS. A modification notice will be published on

Colorado VSS in the event that it becomes necessary to revise any part of this solicitation.

b. It is the Respondent’s sole responsibility to check Colorado VSS on a regular basis, prior to the Quote submission deadline, as this is the primary means for communicating any clarifications or changes to solicitation content, timeline and/or requirements.

6.6. News Releases and Announcements

Respondents shall not issue news releases, communications or announcements pertaining to this solicitation, without prior written approval by the State.

6.7. Response Material Ownership

All material submitted in response to this DQ becomes the property of the State.

6.8. Submission of Confidential or Proprietary Information

a. A Respondent may submit, as a part of its Response, a written request for classification of certain portions of the response as a trade secret or other confidential or proprietary information. Material for which the Respondent is requesting confidentiality shall be readily identifiable and separated from other portions of the response to facilitate public inspection of the non-confidential portion of the response. Commingling of confidential and non-confidential information is not acceptable. Neither price information nor any information that will be included in a resulting Contract or purchase order will be confidential.

b. The Respondent must include the rationale for any request to classify portions as a trade secret or confidential or proprietary, including references to the authority that allows for such treatment.

c. A complete redacted response should also be included along with an unredacted Response and confidentiality justification.

d. Except as provided in Section 1.2 above, in no event shall an entire response be classified as confidential. The Procurement Official or his or her designee shall determine if the information identified in the Respondent’s request is exempt from disclosure in accordance with §24-72-204, C.R.S., and shall inform the

Respondent in writing of his or her determination. If the Respondent does not agree with the determination, the Respondent may protest the determination in accordance with article 109 of the Colorado Procurement Code and the terms of this solicitation. Reference Procurement Rule R-24-101-401-03.

Schedule of Activities