EAUF90126_Audit_Services_Exhibits.pdf

State Controller’s Office RFP Number EAUF90126

Exhibit A

SCOPE OF WORK

A. Description of Services

The Contractor shall provide the State Controller’s Office (SCO), Division of Audits, with Staff Augmentation Model and Independent Audit Model Auditing services. By combining staff augmentation and independent audit execution models, SCO shall be able to effectively address high-risk areas, enhance oversight of public funds, and deliver high-quality audits that drive accountability and improve government performance. Supporting audits may include high-profile program audits/reviews and expedited, sensitive, high-impact audits/reviews.

Audit services will include analyzing documentary evidence and records, interviewing people, obtaining and securing physical evidence, preparing analysis of evidence in a standard working paper format, summarizing results of the audit, and preparing summaries, draft, and final reports in a standardized format. The audit services will also include conducting reviews of applicable laws, regulations and the contract requirements; tests of accounting and other records; and other audit and review procedures considered necessary to meet audit or review objectives.

Examples of audits and reviews that SCO may request, but are not limited to are:

1. Audits/reviews of state agencies for critical payments

2. Local government and local education agency audits

3. Financial and compliance audits of cities, counties, and special districts

4. Audits of local education agencies that include topics such as attendance reporting, funding allocations, internal controls, potential fraud, waste, abuse, etc.

5. Reviews/audits of local funds

6. State and local government financial and performance audits

7. Operational audits assessing efficiency, effectiveness, and economy of programs

8. Evaluations of internal controls, fraud risk, and program outcomes

9. Identification of systemic vulnerabilities and recommendations for improvement

Agreement Term

The term of this agreement will be for three years with the option to execute one two-year extension.

The rates on Exhibit B, Attachment 1, Cost Worksheet will not change as a result of any amendment to this agreement. This agreement may be terminated by SCO with 30 days’ written notice to the Contractor.

The Contractor is cautioned that no work shall begin until the Agreement has been fully executed. If work is performed prior to agreement approval, and the Contractor for any reason is not approved, all previous work performed by the Contractor is considered donated to SCO and no payment shall be made for that work.

Agreement Amount

The Contractor and SCO Contract Manager (CM) are responsible for monitoring the agreement cost to ensure it does not exceed the maximum amount of the Agreement without an executed amendment.

The Agreement Amount for the initial three-year term and optional two-year extension is $10,000,000.00.

Service Hours

Services shall be provided during SCO normal working hours of 8:00 a.m. to 5:00 p.m. Pacific Time (PT), Monday through Friday, except holidays. A list of holidays which are observed by SCO may be found at the following link: http://www.calhr.ca.gov/employees/pages/state-holidays.aspx.

B. Contractor’s Roles and Responsibilities

1. The Contractor shall perform Staff Augmentation Model audits, which will be SCO directed audits in which the Contractor will function as an extension of SCO audit teams. The Contractor responsibilities for Staff Augmentation Model audits are as follows:

a. Perform audit fieldwork including planning, testing, and documentation in accordance with SCO methodologies.

b. Execute audit procedures designed by SCO audit leads.

c. Assist in data analysis, sampling, and transaction testing.

d. Provide monthly updates and attended standing meetings as needed.

e. Prepare working papers consistent with Generally Accepted Government Auditing Standards (GAGAS) commonly known as Yellow Book.

f. Participate in and/or audit findings and written reports.

g. Contractor staff report directly to SCO Designee.

2. The Contractor shall perform Independent Audit Model audits which will be executed with SCO’s oversight. Under this model, the Contractor will conduct engagements of high-profile and sensitive audits. In addition, the Contractor may be required to conduct some expedited, sensitive, high-impact audits or reviews. The Contractor’s responsibilities for Independent Audit Model audits are as follows:

a. Develop detailed audit plans based on SCO-approved objectives.

b. Obtain SCO written approval of detailed audit plan. Refer to Exhibit A, Attachment 1, Deliverable Expectations Document (DED) and Deliverable Acceptance Document (DAD).

c. Conduct fieldwork, testing, and analysis.

d. Provide monthly updates and attend standing meetings as needed.

e. Identify findings, risks, and control deficiencies.

f. Prepare draft and final audit reports, including recommendations.

g. Participate in entrance and exit conferences with audited entities.

3. If legal or other procedures arise as a result of this contract, the Contractor shall perform additional follow-up work at the stated hourly billing rate in the Cost Proposal as detailed in Exhibit B, Rates.

Additional services after the issuance of the final audit/examination report, includes, but are not limited to:

a. Conducting post audit work, if necessary, due to changed circumstances.

b. Participating in meetings with decision-makers and stakeholders.

c. Testifying as an expert witness in hearings.

d. Responding to questions and disputes from audited entities.

e. Meeting with audited entities and/or SCO legal staff.

f. Providing copies of records supporting audit findings.

4. The Contractor shall complete all deliverables as defined in Exhibit A, Scope of Work, Section D, Deliverables, Specifications, Requirements, Results and Duties of All Parties.

5. Upon the SCO CM’s request, the Contractor must submit its work plan(s), which includes, but not limited to, detailed tasks and procedures to accomplish the additional services, estimated time spent on each task and/or procedure, total estimated time to complete each additional service, and dates of milestones to the SCO CM for review and approval. Refer to Exhibit A, Attachment 1, Deliverable Expectations Document (DED) and Deliverable Acceptance Document (DAD).

6. The Contractor shall sign and complete tasks as defined in the Deliverable Expectations Document (DED) and Deliverable Acceptance Document (DAD), Exhibit A, Attachment 1 for each audit engagement.

7. The Contractor shall submit written Project Status Reports monthly or upon request to the SCO CM.

These reports shall include time usage detail, identified risks, project status and interim results, and project timeline updates.

8. The Contractor shall designate a Contract Manager (CM) to whom all project communications are addressed and who has the authority to act on all aspects of the services. This person will review the Agreement and associated agreement documents with SCO CM or their designee to ensure understanding of the responsibilities of the Contractor and SCO.

9. The Contractor shall adhere to all SCO requirements related to the identified deliverables.

10. The Contractor shall coordinate with the SCO CM or designee when preparing a work plan for each project and obtain the SCO CM’s approval.

11. The Contractor shall promote effective communication and performance with SCO Division of

Audits.

12. The Contractor shall communicate all issues and/or concerns through the process agreed upon by the Contractor and SCO.

13. The Contractor shall immediately notify the SCO CM of events or proposed changes that could affect the scope, budget, or work schedule under this agreement.

14. The Contractor shall attend in-person or virtual meetings as required.

15. The Contractor shall present information to stakeholders and the SCO in the frequency and format (email, in-person, virtual, etc.) with materials as required by the SCO.

16. The Contractor shall retain independence and avoid undue influence by any internal or external entity while working with SCO staff and management consistent with GAGAS.

17. The Contractor shall use the State-owned data only for State purposes under this agreement.

18. The Contractor shall store all project documents on an SCO server. All project documents are confidential and are the property of SCO.

19. The Contractor shall utilize SCO supplied laptops, which include SCO Security Software Suite, and Rivest–Shamir–Adleman (RSA) hard tokens for all services in this agreement. Each SCO issued laptop will be mailed to the laptop recipient(s) physical address or as determined by the SCO.

20. The Contractor shall return all SCO property, including laptops, RSA tokens, and security badges prior to the termination or end of this agreement.

21. The Contractor shall guarantee that there is no remote access to the SCO network from any non- SCO device. The Contractor and their staff are prohibited from using their own personal devices to access SCO systems, networks, and servers.

22. The Contractor staff shall strictly only perform services while physically located within the contiguous

United States unless prior written approval has been obtained from the SCO’s CM, Chief Information Officer, and Chief Information Security Officer.

23. The Contractor shall follow the guidelines pertaining to SCO laptop and network usage/access listed below:

a. Remote access to the SCO network will be available only over Virtual Private Network (VPN) with supplied SCO credentials on SCO issued laptops

b. Obtain consent from the SCO Chief Information Security Officer (CISO) or designated representative prior to installing all software

c. Software installations that are to be completed by the Contractor must receive prior authorization from SCO.

d. Provide a physical address, if necessary, to which the laptop and RSA hard token issued by SCO will separately ship, as well as a phone number and an email address for the laptop recipient.

e. Upon receipt of the SCO laptop and RSA hard token, Contractor shall contact the SCO CM listed in Section F to confirm the Contractor’s staff’s credentials and receipt in order for SCO CM to verify Contractor’s staff’s credentials and then be able to enable the laptop.

f. Be responsible for the care of the laptop and use it only for SCO-related business.

g. Connect only a Bluetooth mouse, keyboard, and other SCO-approved peripherals to the SCO laptop.

h. Do not attach any non-SCO personal computers, phones, tablets, laptops, universal serial bus (USB), external hard drive, any storage devices, or any electronic device to an SCO server or workstation without prior SCO written approval from the SCO CISO or designated representative. As necessary, SCO reserves the right to inspect and scan all devices for any malware that could pose a threat to server devices or network.

i. Ensure all staff performing services during the term of this agreement are subject to SCO security clearance requirements and complete and pass an SCO background check prior to performing any services.

j. Contact SCO CM at least 24 hours prior to returning laptops and equipment to SCO.

k. Ensure that each laptop has an internet connection that allows SCO to log in and remotely wipe the laptop memory prior to the Contractor packaging and shipping the laptop to SCO.

24. The Contractor shall comply with the following requirements to ensure the preservation, security, and integrity of state-owned data on portable computing devices and portable electronic storage media:

a. Encrypt all State-owned data stored on portable computing devices and portable electronic storage media using government-certified Advanced Encryption Stand (AES) cipher algorithm with a 256-bit or 128-bit encryption key to SCO data stored on every sector of a hard drive, including temp files, cached date, hibernation files, and ever unused disk space.

b. Date encryption shall use cryptographic technology that has been tested and approved against exacting standards, such as Federal Information and Information Systems (FIPS) 140-2 Security Requirements for Cryptographic Modules.

c. Encrypt, as described above, all State-owned data transmitted from one computing device or storage medium to another.

d. Maintain confidentiality of all State-owned data by limiting data sharing to those individuals contracted to provide services on behalf of the State, and limit use of State information assets for State purposes only.

e. Install and maintain current anti-virus software, security patches, and upgrades on all computing devices used during the course of the Agreement.

f. Notify the SCO CM immediately of any actual or attempted violations of security of State-owned data, including lost or stolen computing devices, files, or portable electronic storage media containing State-owned data.

g. Advise the owner of the State-owned data, the agency Information Security Officer, and the agency Chief Information Officer of vulnerabilities that may present a threat to the security of State-owned data and of specific means of protecting that State-owned data.

25. The Contractor shall ensure that any agreement between the Contractor and its subcontractors shall require the Subcontractors to adhere to the same performance standards and other standards required of the Contractor including but not limited to clearing a Live Scan background check, as applicable to the Subcontractor’s service.

26. The Contractor shall ensure that all key staff read and/or complete standard SCO documents (i.e., Live Scan, Policy Acknowledgement, Technology Resources, Zero Tolerance for Discrimination, etc.), as required during the term of the Agreement. These additional documents will be presented to the Contractor’s staff by SCO.

27. The Contractor must have all staff that are accessing SCO Network and data sign the SCO Contractor/Contractor Confidentiality Statement and Non-Disclosure Acknowledgement form (ISO- 004b).

28. The Contractor shall Complete and submit a Prime Contractor’s Certification - DVBE Subcontractor Report (STD 817) to SCO within 60 days of expiration of the Agreement if the Contractor has a certified Disabled Veteran Business Enterprise (DVBE) perform an element of work for the Agreement.

29. The Contractor shall satisfy their Small Business (SB) Participation commitment as identified on the

Bidders Declaration (Written) submitted with the proposal response. Exhibit A, Attachment 7, Prime Contractor Certification – SB Subcontractor Report shall be submitted to the SCO Contact Manager identified in Section R. Contacts, Item 1. on January 31st and July 31st of each calendar year during the term of the Agreement.

C. Deliverables, Specifications, Requirements, Results and Duties of All Parties

1. GAGAS/Yellow Book Compliant

The Contractor’s auditor who performs engagements shall conduct audit engagements in accordance with GAGAS/Yellow Book published by the Comptroller General of the United States, as applicable.

2. Audit Services

a. The scope of audits or reviews will consist of such objectives, fieldwork, and reporting necessary and the SCO will determine whether the audit or review objectives have been met.

b. The Contractor shall conduct audits in accordance with the applicable requirements, GAGAS/Yellow Book, as agreed to by the contracting parties.

c. Services included in performing the audit will include analyzing documentary evidence and records, interviewing people, obtaining and securing physical evidence, preparing analysis of evidence in a standard working paper format, summarizing results of the audit, and preparing summaries, draft, and final reports. These services include conducting reviews of applicable laws, regulations and the contract requirements; tests of accounting and other records; and developing other audit and review procedures considered necessary to meet the audit or review objectives.

d. Audit Engagements will be properly planned and coordinated with SCO to ensure the project deliverables meet SCO’s requirements. The Contractor’s staff providing audit services shall have a thorough knowledge of the contractual matters and circumstances affecting the engagements.

e. The Contractor shall provide dedicated staff auditors to perform audits or review under this agreement. Each staff auditor shall at a minimum have following qualifications and experience:

i. A minimum of five years’ audit experience performing audit testing, documentation, analysis, and reporting.

ii. A minimum of three years’ audit experience with GAGAS standards.

iii. A bachelor’s degree in accounting, finance, or business.

iv. The SCO CM or their designee, at their sole option, may add specialized qualifications based on the nature of the specific audit engagement.

f. The Contractor shall provide resumes and degrees to the SCO CM upon request to validate staff auditor qualifications and experience.

g. The Contractor’s staff auditors shall clear a live scan background check prior to performing services.

h. The Contractor’s staff auditors shall work with the SCO CM to ensure SCO’s requirements are clearly identified.

i. The Deliverables under this contract shall consist of completed working papers in Teammate+ (SCO shall retain these for a period not less than five years after the conclusion of this contract), draft audit reports, and final audit reports documenting the completed audits reviewed and signed by the Contractor’s management and approved as to final form by the SCO CM.

j. The Audits will be properly planned and coordinated with SCO to ensure the work product meets the needs of SCO. The Contractor staff providing audit services shall have a thorough knowledge of the contractual matters and circumstances affecting the audit engagements. The Contractor staff shall perform duties including, but not limited to:

i. Conducting audit fieldwork

ii. Reviewing documentation

iii. Preparing audit workpapers

iv. Participating in meetings

v. Supporting SCO’s requested audit objectives

3. Performing Engagement Task Groups

a. General Requirements

The Contractor shall:

i. Submit each deliverable in an editable electronic format acceptable to SCO and by the due date established in the SCO-approved DED.

ii. Provide sufficient supporting documentation for SCO to evaluate the work performed, evidence obtained, analyses completed, and conclusions reached.

iii. Respond to SCO questions and comments and submit revised deliverables within the timeframe established by SCO.

iv. Do not implement a change to an SCO-approved objective, scope, methodology, sample, procedure, schedule, or deliverable without prior written approval from SCO.

v. Consider a task group complete only after SCO determines that its requirements have been satisfied and provides written acceptance of the associated deliverable.

b. Task Groups

Task Group Name Description Task Group 1 – Engagement Work Plan and Program

The Contractor shall provide an audit plan including, but not limited to, dates of milestones, adherence to GAGAS/Yellow Book standards (as applicable), and detailed audit procedures to the SCO CM for approval no later than two weeks after each assignment (DED) request is submitted to the Contractor. The engagement plan and program shall include, but not limited to the following:

1. A Detailed description of the Contractor’s approach and methodology for each deliverable

2. List of major activities, tasks and sub-tasks, and milestones for each deliverable

3. Discuss any challenges with meeting the requirements in the scope of work and how the Contractor plans to address these challenges

4. A detailed budget for each deliverable with estimates broken down by task and activity

5. List of resources and personnel necessary for each deliverable

Task Group 2 – Monthly Report on Engagement Status and any Deliverable

The Contractor shall provide the SCO CM with monthly written progress reports after the start of the engagement, updating the status of the engagement, achievements/progress made since last progress report, the issues/challenges encountered, potential findings, and the interim period and cumulative actual hours and costs incurred for each audit. The work plan and program shall include, but not limited to the following:

1. A Detailed description of the Contractor’s approach and methodology for each deliverable

2. List of major activities, tasks and sub-tasks, and milestones for each Deliverable

3. Discuss any challenges with meeting the requirements in the scope of work and how the Contractor plans to address these challenges

4. A detailed budget for each deliverable with estimates broken down by task and activity

5. List of resources and personnel necessary for each deliverable

Task Group 3 – Standing Meetings

The Contractor may coordinate and attend project coordination group meetings with the SCO staff, SCO CM, and other involved parties on as needed basis, at the request of the SCO CM, to discuss the status of tasks, critical items, vet methodological or data issues, resolve administrative and reporting matters concerning the contract, etc.

The update shall include progress, but not limited to, deliverables, summary of any issues, targets, and achievements. The SCO CM may also request optional standing meetings on as needed basis.

Task Group 4 – Preliminary Review Results

The Contractor shall:

1. Document the results of background research and preliminary interviews

2. Summarize the applicable laws, regulations, policies, grant requirements, contracts, and other criteria

3. Document the entity’s organizational structure and key personnel responsible for the audited activities

4. Describe significant business processes, information systems, funding sources, and financial flows

5. Identify significant internal controls and preliminary control gaps

6. Evaluate and document data reliability results

7. Document known audit findings, monitoring results, complaints, investigations, litigation, or other relevant issues

8. Summarize preliminary analytical procedures

9. Identify preliminary risks of fraud, waste, abuse, noncompliance, or operational inefficiency

10. Document how the preliminary review results affect the planned objectives, scope, methodology, and resource requirements

11. Prepare a conclusion summarizing whether the engagement should proceed as planned or be modified for discussion and approval by the SCO

Task Group 5 – Updated Detailed Objectives and Scope of the Audit

The Contractor shall:

1. Provide SCO with updated detailed audit objectives and scope identifying audit questions or sub-objectives, covered entities and activities, the audit period, exclusions, limitations, and the rationale for material changes

2. Proceed with any updated objectives and scopes once complete, internally consistent, supported by sufficient documentation, responsive to SCO comments, compliant with the applicable task requirements, and approved by SCO

Task Group 6 – Engagement Methodology

The Contractor shall provide SCO with an engagement methodology and objective-risk-based procedure matrix for each audit identifying criteria, evidence requirements, data sources, sampling or case-selection methods, planned procedures, and anticipated limitations.

The Contractor shall proceed with its methodology once complete, internally consistent, supported by sufficient documentation, responsive to SCO comments, compliant with the applicable task requirements, and approved by SCO

Task Group 7 – Survey of the Proposed Engagement

The Contractor shall provide an engagement survey report to SCO for each audit documenting process understanding, preliminary control assessment, data availability and reliability, potential issues, proposed fieldwork, staffing needs, milestones, and the recommendation to proceed.

Task Group 8 – Field Work

The Contractor shall complete and document all fieldwork, including indexed working papers, testing results, exception schedules, evidence supporting potential findings, fieldwork summaries by objective, and a closeout memorandum. Fieldwork shall include, but not limited to:

1. Detailed testing in accordance with the approved audit program and methodology

2. Testing the operating effectiveness of key internal controls

3. Data analysis and investigation of significant exceptions, anomalies, and unsupported transactions

4. Evaluation whether evidence obtained is sufficient, appropriate, relevant, and reliable

5. Development of potential findings, including condition, criteria, cause, effect or risk, and recommendations

6. Discussion of potential findings and factual matters with responsible officials throughout fieldwork

7. Documentation of any proposed deviations from the approved audit program and obtaining SCO approval before implementing material changes

8. Determining whether additional testing, scope modification, referral, or follow-up work is necessary

Task Group 9 – Draft Report (if applicable)

The Contractor shall present the audit conclusion and draft audit report to the SCO prior to the issuance to the audited entity. If the deliverable requires a draft report, the Contractor shall evaluate auditee’s responses, if any, to the draft report and incorporate the Contractor’s evaluation and rebuttals into each final audit report as necessary. The Contractor shall describe modifications made, if any, that are incorporated into the final audit report.

Each draft report shall include, but is not limited to:

1. Transmittal letter

2. Executive Summary

3. Background

4. Audit Objective and Scope

5. Audit Methodology

6. Conclusion or Audit Results

7. Follow Up on Prior Audit Findings

8. Audit Findings and Recommendations

Task Group 10 – Final Report

The Contractor shall submit an electronic PDF copy of each final audit report to the SCO CM for review and approval at least 14 days before issuance of the final audit report. Each final audit report shall include, but is not limited to

1. Transmittal letter

2. Executive Summary

3. Background

4. Audit Objective and Scope

5. Audit Methodology

6. Conclusion or Audit Results

7. Follow Up on Prior Audit Findings

8. Audit Findings and Recommendations

9. Views of Responsible Officials

10. The Contractor’s Evaluation of Audited Entity’s Comments

Task Group 11 – Post Audit Work If applicable, any other post audit work as directed by the SCO.

6. Confidentiality

a. The Contactor and Contractors’ staff shall adhere to confidentiality requirements. Work papers, reports, documents, testimony and all other evidence shall be kept in secure storage when not in direct custody of the staff person working on the audits. Assigned staff shall comply with all confidentiality, privacy, and data protection requirements imposed by the Requesting Agency. These auditors shall work with the SCO CM to ensure requirements are clearly identified.

b. Audit details shall not be discussed with non-Contractor personnel, or with SCO personnel other than the SCO CM or authorized personnel, without specific approval from the SCO CM. Inquiries from outside parties for information on audits shall be referred to the SCO CM.

7. Performance Review and Acceptance Criteria

a. It shall be the sole determination of SCO as to whether the Contractor’s performance has been successfully completed and is acceptable to SCO.

b. Process

i. The Contractor shall complete assigned tasks and deliver any required documentation to SCO CM by the written agreed-upon date for review.

ii. SCO Division of Audits documentation review time shall not be more than 10 business days, except when there is a written mutually agreed-upon time frame.

iii. SCO Division of Audits shall provide written notification to the Contractor of any required revisions. The Contractor will review the SCO written response, make appropriate adjustments, and submit to SCO Division of Audits for acceptance within 10 business days of receiving revision requests.

iv. After considering the scope of the changes, SCO Division of Audits may, at their discretion, allow a period longer than 10 business days, which shall be confirmed in writing.

v. After receipt of the revised documents, SCO Division of Audits review time must not be more than 10 business days unless another written mutually agreed-upon time frame has been determined.

vi. The Contractor shall not change a report that has been accepted by SCO Division of Audits without SCO Division of Audits written approval.

8. Performance Not Meeting Requirements

a. Should the work performed, or the work product produced by the Contractor fail to meet the minimum state requirements or other applicable standards, specifications, or guidelines, the following resolution process will be employed except as superseded by other binding processes. Project documentation that does not meet agreement requirements will be returned to the Contractor as incomplete.

b. SCO must notify the Contractor in writing within 10 business days after receipt of the unsatisfactory work performed or work product produced, about any acceptance problems by identifying the specific inadequacies and/or failures in the services performed and/or the products produced by the

c. Within five business days after initial problem notification, the Contractor shall respond to SCO by submitting a detailed explanation that describes how the identified services and products adhere to and satisfy all applicable requirements, and/or a proposed corrective action plan to address the specific inadequacies or failures in the identified services or products. Failure by the Contractor to respond to SCO initial problem notification within the required time limits may result in payment delays, or immediate agreement termination. In the event of such termination, SCO must pay all amounts due to the Contractor at SCO’s direction for all work accepted prior to termination.

d. SCO shall, within five business days after receipt of the Contractor’s detailed explanation or proposed corrective action plan, notify the Contractor in writing whether they accept or reject the explanation and plan. If SCO rejects the explanation and plan, the Contractor will submit a revised corrective action plan within three business days of notification of rejection. Failure by the Contractor to respond to SCO’s notification of rejection by submitting a revised corrective action plan within the required time limits may result in immediate agreement termination. In the event of such termination, SCO shall pay all amounts due to the Contractor at SCO’s direction for all work accepted prior to termination.

e. SCO shall notify the Contractor in writing whether the revised corrective action plan proposed by the

Contractor is accepted or rejected, within five business days of receiving the revised plan. Rejection of the revised corrective action plan may result in immediate agreement termination. In the event of such termination, SCO must pay all amounts due to the Contractor at SCO’s direction for all work accepted prior to termination.

9. Kickoff Meeting

a. Within 15 business days of agreement execution, the Contractor shall conduct a kickoff meeting with the SCO to:

i. Review the details of the Scope of Work (SOW) to ensure a clear understanding of the goals and expectations.

ii. Review the roles and responsibilities of the Contractor and SCO staff.

iii. Review the tasks, the schedule, and coordinate a high-level review.

iv. Discuss critical factors that may impact workload.

v. Review administrative and reporting requirements.

vi. Discuss and agree upon the process for communicating issues, risks, and status.

vii. Discuss and agree upon the approach to tracking and managing performance and results.

10. Contractor Key Staff Changes

a. The Contractor must commit to the continuing availability and participation of the qualified key staff filling key staff responsibilities, to the extent of the Contractor’s control for the duration of the Agreement. The Contractor shall not request the State’s mutual agreement for Contractor key staff changes for a period of 12 months after the Effective Date of this agreement.

b. SCO recognizes that the Contractor’s key staff may be unavailable due to circumstances beyond the Contractor’s control such as illness, an extended leave of absence, death, termination, resignation, or other factors beyond the Contractor’s control. However, the Contractor shall make its best efforts to ensure staff continuity throughout the term of the Agreement.

c. In the event the Contractor’s key staff are unable to perform his or her duties due to illness, resignation, or other factors beyond the Contractor’s control, the Contractor shall make every effort to provide suitable replacement key staff with equivalent knowledge, skill set and experience.

d. The Contractor shall remove and replace any key staff or subcontractors who, in the opinion of the State, have engaged in improper conduct.

e. In the event either party identifies a performance issue with a Contractor’s key staff, the identifying party must contact the other party within two business days. The identifying party must document the performance issues, discuss the issues with the other party, and together, they shall determine the best approach for resolving the issues.

f. Replacement or additional Contractor key staff must be the same category identified in this agreement.

g. Contractor Staff Additions and/or Replacements

i. SCO shall approve any changes to the Contractor's key staff before adding and/or replacing a key staff member. This includes any changes that occur between the submission of the Contractor's Bid and the initiation of the Agreement. The Contractor shall not add or replace a key staff member without prior notification to the SCO Contacts listed in Section F, Contract Representatives.

ii. The Contractor shall notify the SCO CM in writing within seven business days of the event and provide SCO with the proposed key staff candidate that meets or exceeds the experience and skill level that was presented by the Contractor.

iii. Within seven business days of the event, the Contractor shall submit the following items to the

SCO CM:

1) Personnel Change Order Request Form (Exhibit A, Attachment 4) and Personnel Change Key Staff Reference Form (Exhibit A, Attachment 5)

2) Resumes, licenses, certifications and/or degrees, and references to validate the replacement staff’s qualifications.

3) Proposed replacement key staff’s work email and direct phone number. This information is needed for the State to schedule the Live Scan

iv. SCO will assess the proposed key staff candidates based on the criteria set forth in Request for Proposal (RFP) EAUF90126. Replacement key staff must meet or exceed the qualifications and experience of the replaced key staff. Additional key staff shall meet the key staff minimum qualifications set forth in RFP EAUF90126.

v. Key staff may be required to read and/or complete standard SCO documents (e.g. Policy Acknowledgement, Technology Resources, Zero Tolerance for Discrimination, etc.)

within five days of starting work.

vi. Under no circumstances shall the Contractor add or replace key staff unless SCO agrees in writing to such change.

vii. SCO shall not compensate the Contractor for any time or effort required to prepare the new staff member for work on the Agreement.

viii. If SCO rejects the proposed key staff, the Contractor shall provide another viable key staff within seven business days.

ix. If a qualified key staff is not identified within seven business days of rejection, the

Contractor shall be in material breach of the Agreement unless the Contractor submits a written request for an extension and SCO provides written approval before the deadline.

x. SCO, for cause, reserves the right to require the Contractor to replace an assigned staff member at any time. SCO will notify the Contractor in writing when exercising that right, providing the Contractor with the cause. The Contractor, within seven business days of such notification, shall provide a replacement candidate who meets or exceeds the requirements as defined in Agreement CAUF90126.

11. Subcontractors

a. The Contractor may, with prior written permission from SCO, enter into subcontracts with third parties for the performance of any part of Contractor’s duties and obligations.

b. The Contractor is responsible and liable for the proper performance of, and the quality of any work performed by all subcontractors.

c. The State reserves the right to reject or refuse admission to any contractor or subcontractor staff whose workmanship, in the reasonable judgment of SCO, is deemed substandard.

d. In no event shall the existence of a subcontract operate to release or reduce the liability of the contractor to SCO for any breach in the performance of the Contractor’s duties.

e. In connection with a request to SCO to approve a subcontractor, the Contractor shall provide a copy of the Subcontractor’s Certificate of Good Standing issued by the CA Secretary of State and complete a Bidder Declaration (Written) GSPD-105-05.

f. Due to privity of agreement between the State and the prime contractor, it is the complete responsibility of the prime contractor to hold their subcontractors (permitted by SCO) subject to the applicable requirements of this agreement.

g. The Contractor agrees that all subcontracts shall include a provision that the Subcontractor shall indemnify and hold harmless the State to the extent described the General Terms and Conditions (GTC 2/2025), Section 5. Indemnification.

h. Any agreement between the Contractor and its subcontractors shall require the Subcontractors to adhere to the same performance standards and other standards required of the Contractor.

i. If the Contractor commits to subcontract with a Disabled Veteran Business Enterprise (DVBE), the Contractor shall complete and submit to the SCO CM a Prime Contractor’s Certification - DVBE Subcontracting Report (STD 817) within 60 days of expiration of the Agreement.

j. In accordance with CA GC Section 14837(d) and CA Military and Veterans Code Section 999, all

Small Business (SB) and DVBE contractors, subcontractors, and suppliers that bid on or participate in a State agreement, regardless of being an oral or written solicitation, shall perform a Commercially Useful Function (CUF).

12. Subcontractor Changes

a. Contractor shall provide SCO 14 business days’ advance notice of subcontractor termination. The notice shall document the change, the reason for the change and the effective date of the change.

b. The Contractor shall obtain SCO approval to any subcontractor changes prior to the termination of the existing subcontractor(s) and retention of the new subcontractor(s). This also includes any changes made between submittal of the Final Offer and actual start of the Agreement.

c. All replacement subcontractors(s) shall meet all requirements of this agreement.

d. For DVBE subcontractor changes, the Contractor shall use another California certified DVBE subcontractor and shall perform a CUF.

e. For SB subcontractor changes, the Contractor shall use another CA certified SB subcontractor and shall perform a CUF.

f. SCO shall not compensate the Contractor for any of the Contractor’s time or effort to educate or otherwise make the new subcontractor(s) ready to begin work on the Agreement.

13. Requirement to File a Statement of Economic Interests

a. In accordance with Title 22, California Code of Regulations, Section 123000, the Contractor is required to complete a Statement of Economic Interests (Form 700) on an annual basis.

b. Upon award and prior to beginning work, the Contractor’s Project Manager and any professional-level employees and subcontractors engaged in performing the consulting tasks described in this agreement must submit a completed Form 700 to SCO.

c. On an annual basis during the term of this agreement, the Contractor and the same individual and any new professional-level personnel or subcontractors must complete and submit a new Form 700.

All subsequent forms must be received before the expiration of the initial Form 700. Noncompliance may be cause for termination of this agreement.

D. Background Checks

1. The Contractor’s staff shall be required to complete and pass a Live Scan background check prior to starting work and receiving an SCO asset and permission to access the SCO network. SCO provides all necessary background check forms and location information for each staff offered to complete the process. Contractor staff are only allowed to perform services while physically located within the contiguous United States unless prior written approval has been obtained.

a. If staff are located in the Sacramento area, they must be fingerprinted at SCO.

b. If staff are located outside the Sacramento area, but in California, they may go to a Live Scan location of their choosing.

c. If staff are located outside of California, they must go to a local law enforcement agency or to another entity licensed to roll fingerprints and request completion of a standard FBI applicant fingerprint card (FD-258), provided by SCO. Key staff shall mail the completed forms and FD-258 back to SCO via the United States Postal Service (USPS).

2. Background checks must be completed and passed prior to beginning work on the Agreement. If a

Contractor’s staff does not pass the Live Scan background check process, the Contractor must replace the proposed individual with a new candidate within seven business days that meets or exceeds all requirements stated in RFP EAUF90126 and this agreement. The Contractor and the offered staff will be held to the same background check standards as SCO employees.

3. The Contractor shall ensure that each staff under the Agreement is made aware of, understands, and complies with the provisions of SCO Live Scan background checks. Any additional or replacement individuals added to the Agreement will be subject to the same terms.

4. SCO shall not compensate the Contractor for any time or effort required to prepare the new staff member for work on the project. The Contractor shall recover and return any state-issued identification card or equipment provided to the Contractor’s employee(s) upon their departure or termination, if applicable.

E. SCO Roles and Responsibilities

1. SCO shall designate an SCO CM as the main point of contact for this agreement. The SCO CM will be authorized to act on and address all aspects of the services and communication with the

2. The SCO CM shall coordinate the schedule, deliverables, tasks, and activities with the Contractor to meet SCO objectives.

3. The SCO CM shall provide and arrange access to state documents, teams, and subject matter experts as necessary for the Contractor to complete the activities identified within the SOW.

4. The SCO CM shall regularly monitor the services provided to determine if the services meet the requirements of this agreement.

5. SCO will work closely with the Contractor on Staff Augmentation Model audits. SCO’s responsibilities for Staff Augmentation Model audits are as follows:

a. Retain full control over audit scope, methodology, and conclusions

b. Review and approve all deliverables

6. SCO shall work closely with the Contractor on Independent Audit Model audits. SCO’s responsibilities for Independent Audit Model audits are as follows:

a. Determine specific objectives, scopes, and key risks areas

b. May include topics such as determining whether costs are properly supported by specific criteria and are in compliance with such things as State, local and federal regulations, program outcomes, program efficiencies, etc.

c. Advise if these engagements are to be conducted in accordance with GAGAS as promulgated by the United States General Accounting Office

d. Provide ongoing oversight, quality assurance, and review of the audits

7. SCO shall coordinate with the Contractor to develop work plans for projects and provide approval/review of the work plans for each project.

8. The SCO CM may, at his/her sole discretion, require one or more additional services if Contractor’s audit findings warrant additional resolutions, such as resolving disputes with auditee or responding to inquiries from SCO CM. For each additional service required by the SCO CM, SCO CM will provide a minimum of five business day advance notice to the Contractor.

9. SCO will provide designated office space for Contractor and their staff at SCO locations for in-person meetings for the duration of the Agreement. Office space will include desks, chairs, tables, printer access, Internet connection, and a facility in which to conduct any necessary meetings.

10. SCO will meet with Contractor as needed to discuss audit service progress and billings.

11. SCO will coordinate the return date of the laptop and all equipment that was provided to the Contractor. Upon receiving the 24-hour notification from the Contractor, SCO will be responsible for wiping the laptop clean.

12. SCO CM will review DADs and if approved, sign the DADs within 14 business days. If SCO rejects the deliverable, SCO will annotate on the coversheet the reasons why the deliverable was rejected.

13. SCO will schedule and coordinate with Contractor’s staff to pick up SCO provided encrypted laptops and RSA hard tokens from 300 Capitol Mall, Sacramento, CA 95814 as necessary.

14. SCO shall provide Contractor with laptops, which include SCO Security Software Suite, and RSA hard tokens for all services in this agreement. Each SCO issued laptop will be mailed to the laptop recipient(s) physical address if Contractor staff cannot pick up equipment from the SCO office.

15. SCO shall provide the Contractor with standard SCO documents (i.e., Live Scan, Policy Acknowledgement, Technology Resources, Zero Tolerance for Discrimination, etc.).

F. Contract Representatives

1. Direct all Contract Manager inquiries to:

Division of Audits

Contractor

Name: Name:

Address: Address:

Phone: Phone:

Email: Email:

2. Direct all agreement inquiries to:

3. Contacts may be changed upon written notice to either party without need of agreement amendment.

Contracts and Procurement Office

Contractor

Name: Name:

Address: Address:

Phone: Phone:

Email: Email:

Exhibit A, Attachment 1

DELIVERABLE EXPECTATIONS DOCUMENT (DED) AND DELIVERABLE

ACCEPTANCE DOCUMENT (DAD)

A. Deliverable Expectation Document (DED)

1. Each DED shall consist of all tasks, activities, and deliverables required by the Contractor and any areas agreed upon subsequently through meetings and planning sessions with SCO. The DED will be signed by the SCO CM and the Contractor to confirm mutual agreement of the expectations and acceptance criteria. The DED form provided in Exhibit A, Attachment 2, Deliverable Expectation Document (DED) (Sample) is only a sample and may be modified by SCO after agreement award.

2. All DEDs must be in writing prior to beginning work and signed by the Contractor and the SCO CM. SCO will outline the expectations, completion date, and acceptance criteria in the DED. Then the Contractor and SCO CM will review, update and agree on deliverable expectations in the DED prior to signing the document.

3. The Contractor must complete each deliverable by the due date specified unless SCO has granted written permission on the DED to deviate from the schedule.

4. Below are steps in developing the DED:

a. The SCO CM will identify the work to be completed and map it to the deliverable(s).

b. The SCO CM will contact the Contractor to determine the tasks required for the DED. The SCO

Representatives identified in Exhibit A, Scope of Work, Section F. Contract Representatives will review and approve the tasks and criteria for completion.

c. The SCO CM will populate the DED and send it to the Contractor for signature.

d. Upon receipt of the Contractor signed DED, the SCO CM will then sign the DED and ensure that the

Contractor receives a finalized copy of the document.

5. SCO has the right to require the Contractor to stop or suspend work on any DED.

6. DED amendments must follow the procedure below:

i. If the Contractor determines that additional tasks are required for a DED, the Contractor will immediately notify SCO in writing.

ii. Upon receipt of such notification, SCO may amend the DED with the additional tasks and then route for initials and dates.

B. Deliverable Acceptance Document (DAD)

It shall be the sole determination of SCO as to whether a project deliverable identified in this agreement or in a supplemental DED, Exhibit A, Attachment 2, Deliverable Expectation Document (DED) (Sample) has been successfully completed and acceptable to SCO. Acceptance criteria shall consist of the following:

1. The approval process outlined in Section C. Review of Deliverables.

2. A signed DAD is required for each deliverable identified in a DED.

C. Review of Deliverables

1. The Contractor shall submit a DAD, Exhibit A, Attachment 3, Deliverable Acceptance Document (DAD) (Sample) to the SCO CM for review and signature upon completion of the work defined in the approved DED or Work Authorization. Exhibit A, Attachment 3, Deliverable Acceptance Document (DAD) (Sample) is only a sample and may be modified after agreement award.

2. SCO shall review deliverables within five business days of acknowledging the receipt of the DAD. If the

SCO CM determines the submitted deliverables require more than five business days to review, the SCO CM will coordinate with the Contractor to determine an alternate turnaround period and memorialize the collaborative decision in writing, based on the size, complexity, and number of deliverables currently in review.

3. The DAD will be approved if the deliverables submitted meet the requirements mutually agreed upon in the signed DED. An acceptable work product will be one which:

a. Meets the expectations as depicted in the DED or Work Authorization and the Agreement.

b. Is submitted per the Deliverable Timeline on the approved DED.

4. A formal walkthrough session will be conducted to review all submitted deliverables within the five-business day review of the deliverable. SCO will identify the reviewers required to attend these walkthrough sessions. The walkthrough sessions will be organized and scheduled by the Contractor and the SCO CM.