ESBD_387539_1734731180015_RFQ No. 781-5-03287 IT Audit Services.pdf

TEXAS HIGHER EDUCATION

COORDINATING BOARD

Request for Qualifications (RFQ)

Information Technology Audit and Advisory Services

Texas Higher Education Coordinating Board 1801 N. Congress Ave., Suite 12.200

Austin, Texas 78701

RFQ No. 781-5-03287

Solicitation Post Date: December 20th, 2024 Written Questions Deadline: January 3rd, 2025, by 11:30 p.m. CST/CDT

Proposal Deadline: January 21st, 2025, by 11:30 p.m. CST/CDT

NIGP Code(s):

918-04 Accounting, Auditing, Budget Consulting 920-65 System Requirements Quality Assurance Review 920-76 Testing of Systems Infrastructure, Components or Software, IT Services 946-20 Audit Services 946-31 Certified Public Accountants (CPA) Services

Table of Contents

1. INTRODUCTION

1.1 SUMMARY

1.2 DEFINITIONS

2. MINIMUM ELIGIBILITY CRITERIA

2.1 EXPERIENCE

2.2 QUALIFICATIONS

3. SCOPE OF WORK

4. PAYMENT AND PRICING TERMS

4.1 PRICING

4.2 PAYMENT TERMS AND AWARD SUMMARY

4.3 INVOICES

5. CONTRACT TERM AND TERMINATION

6. TERMS AND CONDITIONS

7. ADDITIONAL TERMS AND CONDITIONS

7.1 AWARDED RESPONDENT RESPONSIBILITIES

7.2 FERPA CONFIDENTIALITY AND DATA GOVERNANCE PROVISIONS

7.3 TECHNICAL DOCUMENTS

7.4 PUBLIC INFORMATION ACT DISCLOSURES

7.5 PROVISIONS RELATING TO THE STATE AUDITOR’S OFFICE

8. ANTICIPATED SCHEDULE OF ACTIVITIES

8.1 DUE DATE FOR PROPOSALS

8.2 CALENDAR OF EVENTS

8.3 POINT OF CONTACT

9. PROPOSAL FORMAT AND CONTENT (REQUIRED)

9.1 RFQ ATTACHMENTS

9.2 SUBMISSION REQUIREMENTS

9.3 ORGANIZATION OF THE PROPOSAL FOR SUBMISSION

10. PROPOSAL EVALUATION

10.1 EVALUATION AND AWARD OF CONTRACT

10.2 MULTIPLE AWARDS

11. ADDITIONAL INSTRUCTIONS

11.1 ACCURACY OF THE PROPOSAL

11.2 COST OF SUBMITTING THE PROPOSAL

11.3 IRREVOCABILITY OF THE PROPOSAL

11.4 CONFLICTING RFQ LANGUAGE

1. Introduction

1.1 Summary

The Texas Higher Education Coordinating Board (THECB or the Board) is a state agency that provides leadership and coordination for higher education in the state of Texas.

THECB’s Internal Audit Division (IA) is seeking Contractor(s) to provide information technology (IT) audit and advisory services. THECB may award audit or advisory service contracts under this RFQ. Upon execution of a master service contract awarded under this RFQ, THECB will issue work by Work Orders (i.e., Project Plan Template, or similar document, as referenced in Attachment E), as needed.

THECB has the authority to enter into a contract awarded under this RFQ pursuant to Texas Education Code § 61.067. THECB and Respondents shall comply with all applicable procurement laws of the state of Texas.

Responses to this RFQ must be received in the format specified in this RFQ no later than the deadline set forth in Section 8.2.

1.2 Definitions

As used in this RFQ, unless the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below:

“Addendum” means a written clarification or revision to this Solicitation issued by THECB.

“Awarded Respondent” means the entity selected to provide the goods or services to the State under any awarded Contract.

“Contract” means the signature document, along with any attachments, amendments, purchase orders, or work orders that may be issued by THECB, to be incorporated by reference for all purposes.

“ESBD” means the Electronic State Business Daily, the electronic marketplace where State of Texas bid opportunities over $25,000 are posted.

“HUB” means Historically Underutilized Business, as defined by Chapter 2161 of the Texas Government Code.

“Respondent” means the entity responding to this Solicitation.

“RFQ” means Request for Qualifications.

“Solicitation” means this Request for Qualifications including any Exhibits and Addenda, if any.

“THECB” means the Texas Higher Education Coordinating Board, its officers, employees or authorized agents.

2. Minimum Eligibility Criteria

2.1 Experience

Respondents must have a minimum of five (5) years’ experience providing information technology audits and advisory services to state, local, or federal government entities.

Respondents must have had an external quality review (i.e. external peer review) within the past three years. Respondents who do not meet this requirement are not eligible for an award.

THECB encourages Historically Underutilized Businesses to compete for this award.

2.2 Qualifications

Respondents must be a firm licensed by the Texas State Board of Public Accountancy (TSBPA) with extensive knowledge and expertise in providing IT audit and advisory services in accordance with professional audit standards and frameworks, including Generally Accepted Government Auditing Standards (“GAGAS”), the International Professional Practices Framework (“IPPF”), Committee on Sponsoring Organizations (“COSO”) Internal Control – Integrated Framework, National Institute of Standards and Technology (“NIST”) Cybersecurity framework, Texas Cybersecurity Framework, and Control Objectives for Information and Related Technology (“COBIT”), and others as applicable. Respondents’ employees and/or subcontractors must have the appropriate background experience to perform the work required under this RFQ. Respondents must submit a Company Profile that outlines their experience and expertise in the area(s) of IT audit and advisory services, including their capability to perform the required services as described in Section 3.

Relevant examples may be summarized or included in the Company Profile that reference or demonstrate Respondent’s expertise and capability to perform the required services.

The following should be included with the Company Profile:

• Organization Chart;

• Management team resumes;

• Key personnel resumes, illustrating the qualifications of each individual, including experience and expertise as described above to perform the services described in this

RFQ;

• Experience working on projects focused on similar user populations; and

• If subcontractors will be utilized, key personnel resumes, illustrating the qualifications of each subcontracted individual to perform the services described in this RFQ.

3. Scope of Work

THECB will issue work by Work Orders (i.e., Project Plan Template as referenced in Attachment E), as needed. All Work Orders shall be in writing, signed by both parties, and shall include a scope of services, list of tasks to be performed, a time schedule, a list of deliverables, and such other information or special conditions as may be necessary for the work requested. THECB makes no guarantee of volume, usage, or total consumption to be paid to the successful Respondent under this awarded Contract, if any, resulting from this Solicitation.

IT audit and advisory engagements may consider a wide variety of objectives, such as evaluating IT general controls, evaluating information technology general controls (e.g., access, security, physical controls, service/support processes, change management, etc.), assessing application controls, and reviewing IT project processes (e.g., planning, acquisition, implementation, post-implementation), evaluating cybersecurity incident response, privacy incident response, portable and remote computing, etc. in accordance with applicable laws, regulations, contract provisions, and best practices (e.g., NIST, Cybersecurity framework, Texas Cybersecurity Framework, and COBIT).

The IT audits shall consist of an objective and systematic examination of evidence to provide an independent assessment of the performance and management of a program or function against objective criteria. The audit findings, conclusions, and recommendations will be summarized in a final report consistent and acceptable to THECB IA’s standards. Upon request, THECB IA will be provided with working papers to support the findings, conclusions, and recommendations contained within the report. Presentations to the THECB Board or agency management may be requested.

4. Payment and Pricing Terms

4.1 Pricing

Respondents must provide pricing rates in a separate PDF attachment to be titled “Mandatory Price Sheet.” Pricing should be all-inclusive, covering all services listed in Section 3. above, including personnel costs and all other estimated necessary expenses required in the performance of the engagement.

4.2 Payment Terms and Award Summary

To the extent the Awarded Respondent is not a Texas state agency, THECB will make payments for services in accordance with the Texas Prompt Payment Laws, Texas Government Code §§ 2251.001-.055. If the Awarded Respondent is a Texas state agency, THECB will make payments for services in accordance with the Interagency Cooperation Act, Texas Government Code §§ 771.001-.010.

Upon execution of a Contract resulting from this RFQ, the term “Respondent” shall have the same meaning as “Contractor.”

Awarded Respondent agrees not to begin or provide any services until issuance of an approved work order by THECB pursuant to an executed Contract. THECB does not guarantee specific compensation to the Awarded Respondent throughout the term of the Contract. The Awarded Respondent is not guaranteed minimum compensation.

THECB will not apply for credit nor will THECB prepay. THECB shall pay, subject to the terms of the Texas Prompt Payment Laws, upon the receipt of a properly submitted invoice after all goods and services have been received.

At THECB’s sole discretion, THECB shall award the Contract to the most qualified Respondent(s) successfully meeting the criteria and conditions as outlined in this RFQ, subject to successful contract negotiations. Any award is contingent upon approval of the THECB commissioner or their designee.

4.3 Invoices

Upon completion of services based on the requirements set forth in this RFQ or any accompanying work orders, Awarded Respondent may submit an invoice to THECB setting forth amounts due in accordance with the terms and conditions of this RFQ and the anticipated contract.

To receive payment, Awarded Respondent must submit an invoice to accountspayable@highered.texas.gov and the designated THECB Contract Manager(s). The invoice must include the following minimum information:

1. Awarded Respondent’s mailing and e-mail (if applicable) addresses;

2. Awarded Respondent’s telephone number;

3. The name and telephone number of a person designated by Awarded Respondent to answer questions regarding the invoice;

4. THECB’s name, agency number (781), and delivery address;

5. The THECB purchase order number, if applicable;

6. The contract number or other reference number, if applicable;

7. A valid Texas identification number (TIN) issued by the comptroller;

8. A description of the goods or services, in sufficient detail to identify the order which relates to the invoice;

9. The unit numbers corresponding to the amount of the invoice, if applicable;

10. If submitting an invoice after receiving an assignment of a contract, the TIN of the original contractor and the TIN of the successor vendor; and

11. Other relevant information supporting and explaining the payment requested.

Prior to any payment being made, THECB shall certify that the goods and services being invoiced have been received and approved for payment by THECB. Payments will be made in accordance with Section 4.2 above.

5. Contract Term and Termination

THECB shall pay Awarded Respondent for the reasonable and approved costs incurred by Awarded Respondent in connection with the contract during the period beginning upon execution and ending one (1) year thereafter with the option for three (3) additional optional one (1) year renewals, at THECB's sole discretion. The term of the contract, including the optional renewals, may not exceed four (4) years, unless extended or terminated as otherwise provided for in the contract (Contract Term). Subject to proper approvals, the parties may amend the contract to extend the contract Term, provided both parties agree in writing to do so, prior to the expiration date. Any extensions shall have the same terms and conditions, plus any approved changes.

6. Terms and Conditions

See Attachment C, Anticipated Contract.

7. Additional Terms and Conditions

7.1 Awarded Respondent Responsibilities

THECB shall look solely to Awarded Respondent for compliance with all the requirements of this RFQ and the resulting contract. Awarded Respondent shall be the sole point of contract responsibility and shall not be relieved of non-compliance of any subcontractor.

Failure to meet service requirements and/or specifications authorizes THECB to procure services of this RFQ elsewhere and charge any increased costs for the services, including the cost of re-soliciting, to Awarded Respondent.

7.2 FERPA Confidentiality and Data Governance Provisions

FERPA. Awarded Respondent agrees to comply with the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and the implementing federal regulations, 34 C.F.R. Part 99;

the Children’s Online Privacy Protection Act (COPPA); and Individuals with Disabilities Education Act (IDEA). It is understood and agreed that Awarded Respondent shall not be required to access student level or any other FERPA confidential data in order to provide the services required under this RFQ, and THECB agrees not to knowingly provide Awarded Respondent with access to such information. Awarded Respondent shall not knowingly view, access, acquire, transfer, copy, or otherwise reproduce any student level or other FERPA confidential data.

Data Security. Awarded Respondent warrants that it has a sound data security program that, at a minimum, meets industry standards and protects both data at rest and data in transmission. Awarded Respondent shall ensure that proper information security controls are in place and shall comply with all requirements and security protocols found in Title 1, Texas Administrative Code, Chapter 202, Texas Cybersecurity Framework Standards, and other applicable laws, including FERPA. Awarded Respondent shall notify THECB of any data breach involving education records, Personally Identifiable Information (PII), or any other confidential or sensitive information not later than twenty-four (24) hours after discovery of a security incident that may constitute a data breach.

Awarded Respondent shall immediately mitigate any such breach and ensure that any disrupted services are timely, and without delay, brought back into service. Respondent shall be responsible for any data breach notifications and damages that are required by state or federal law and shall coordinate such notification with THECB. This section shall survive termination of the contract.

Pursuant to Texas Government Code § 2054.138, to the extent that Awarded Respondent is authorized to access, transmit, use, or store THECB data, Awarded Respondent agrees to meet all security controls that THECB determines are proportionate with THECB’s risk under the contract based on the sensitivity of the THECB data.

7.3 Technical Documents

All technical documents developed or procured by Awarded Respondent shall not be proprietary in nature, such that THECB is limited in the use of such documents. If any such documents are proprietary, including training materials, Awarded Respondent must identify such documents and provide THECB with any technical support and training for use of such documents, prior to the transfer of such documents to THECB.

7.4 Public Information Act Disclosures

THECB is a government agency subject to the Texas Public Information Act (PIA), Texas Government Code §§ 552.001-.376.

The Application and other information submitted to THECB by Respondent are subject to release as public information. The Application and other submitted information shall be presumed to be subject to disclosure unless a specific exception applies to disclosure under the PIA. If it is necessary for Respondent to include proprietary or otherwise confidential information in its proposal or other submitted information, Respondent must clearly label that proprietary or confidential information and identify the specific PIA exception that applies to disclosure. Merely making a blanket claim that the entire proposal is protected from disclosure because it contains some proprietary information is not acceptable and shall make the entire proposal subject to release under the PIA.

In order to trigger the process of seeking an Attorney General Opinion on the release of proprietary or confidential information, the specific provisions of the proposal that are considered by Respondent to be proprietary or confidential must be clearly labeled as described above. Any information which is not clearly identified as proprietary or confidential shall be deemed to be subject to disclosure pursuant to the PIA. Respondent is required to make any information created or exchanged with the State pursuant to the solicitation or contract, and not otherwise excepted from disclosure under the PIA, available in a format that is accessible by the public at no additional charge to the State.

Respondent, by submitting qualifications, shall thereby be irrevocably deemed to have fully indemnified and agreed to defend THECB from any claim of infringement in the intellectual rights of Respondent or any third party for any materials appearing in the proposal.

7.5 Provisions Relating to the State Auditor’s Office

The State Auditor’s Office (SAO):

• Will receive a copy of the contract between the agency and Awarded Respondent;

• Will receive a copy of Awarded Respondent’s final report;

• Will have access to working papers related to procured services; and

• Will have access to all draft and final reports and memoranda of discussions with THECB management.

8. Anticipated Schedule of Activities

8.1 Due Date for Proposals

Respondents shall submit qualifications to THECB no later than the Proposal Due Date indicated in the Calendar of Events section below. Qualifications received after the Proposal Due Date will be rejected for being late and will not be considered for evaluation.

8.2 Calendar of Events

The solicitation process for this RFQ will proceed according to the schedule below. All dates in the Calendar of Events are tentative and THECB reserves the right to revise this schedule or any portion of this RFQ by published Addendum on the Electronic State Business Daily (ESBD) and THECB’s website.

EVENT DEADLINE

Publication of RFQ on the ESBD and THECB’s website

December 20, 2024

Last Day to Submit Written Questions January 3, 2025, by 11:30 p.m. CST/CDT

HUB Subcontracting Plan Pre-Bid Courtesy Review Please send to HUB@highered.texas.gov

January 8, 2025, by 11:30 p.m. CST/CDT

Anticipated Response to Written Questions January 10, 2025, by 11:30 p.m. CST/CDT

Proposal Due Date and Time January 21, 2025, by 11:30 p.m. CST/CDT

Post-Proposal Interviews/Presentations, if required

TBD

Anticipated Contract Start Date March 1, 2025

Respondent must notify the Point of Contact of any ambiguity, conflict, discrepancy, exclusionary specification, omission, or other error in the RFQ prior to the deadline described in the Calendar of Events. If Respondent fails to inform the Point of Contact, Respondent, whether awarded a contract or not, waives any claim of error or ambiguity in the Solicitation and any resulting contract; must not contest the interpretation of THECB of such provisions; and is not entitled to additional compensation, relief, or time.

THECB will only accept written questions and requests for clarification via email to the Point of Contact listed below. Questions and requests for clarification shall be submitted in a Word document. Inquiries and comments must reference RFQ No. 781-5-03287.

Respondents shall refer to the section of the RFQ that the question or request for clarification pertains to. THECB will post responses to written questions on the ESBD and THECB’s website. If the same or similar RFQ questions are submitted, a single consolidated answer may be posted on the ESBD.

THECB will post additional information, responses to written questions, RFQ modifications, and addenda on the ESBD and THECB website. It is the responsibility of any interested party to periodically check the ESBD and THECB’s website for updates to the solicitation prior to submitting a response. Respondent’s failure to periodically check the ESBD and the THECB’s website will in no way release the selected contractor from “addenda or additional information” resulting in additional costs to meet the requirements of the RFQ.

All THECB responses must be in writing to be binding. Any information THECB deems to be important and of general interest or which modifies requirements of the RFQ shall be provided in the form of an addendum to the RFQ on the ESBD and THECB’s website.

8.3 Point of Contact

Respondents shall direct all inquiries, written questions, requests for clarification, and communications concerning this RFQ to the Point of Contact listed below.

Contact:

Miriam Hogans, MBA, CTCD, CTCM Contract Developer Texas Higher Education Coordinating Board eBids@highered.texas.gov

Please Note: Miriam Hogans is the only permitted point of contact. Contact or attempted contact with other THECB employees, including Commissioners and their staff, may result in a Respondent’s immediate disqualification. This restriction does not preclude discussions between affected parties for the purposes of conducting business unrelated to this RFQ.

9. Proposal Format and Content (Required)

9.1 RFQ Attachments

This RFQ includes the following attachments, which are posted on the ESBD and THECB’s website:

Attachment A: Execution of Proposal (Required), including the following:

1. Respondent Information

2. Texas Family Code § 231.006(c) mailto:eBids@highered.texas.gov

3. Texas Government Code § 669.003

4. Preferences

5. Exceptions to Terms and Conditions

6. Respondent Acknowledgement

7. Signature

Attachment B: HUB Subcontracting Plan (Required)

In compliance with Texas Government Code §§ 2161.001-.253, it is THECB’s policy to promote and encourage contract and subcontract opportunities for State of Texas certified Historically Underutilized Businesses in all contracts. Eligible Respondents are encouraged to become State of Texas HUB certified, applications may be found at:

https://comptroller.texas.gov/purchasing/vendor/hub/.

Definitions for State of Texas HUB certifiable businesses can be found in the Texas Administrative Code. 34 Tex. Admin. Code § 20.282.

A HUB Subcontracting Plan Form must be filled out and returned with the proposal to be considered responsive. If the proposal does not include a HUB Subcontracting Plan, it shall be rejected as a material failure to comply with advertised specifications. Please see the attached HUB Subcontracting Plan for further instructions which requires vendors to identify the specific areas intended for subcontracting.

Search the State of Texas HUB Database for HUB vendors by the NIGP class and item here. Additional minority and women owned business association resources are available for subcontracting notices are available on the Texas Comptroller’s website.

Additional information and training regarding how to complete a HUB Subcontracting Plan can be found here.

Please note you must allow HUBs at least seven (7) working days to respond to your notice prior to your bid response submission to THECB.

Attachment C: Anticipated Contract (for reference only)

Attachment D: Conflict of Interest Disclosure Statement (Required)

The Conflict of Interest Disclosure Statement is required and must be attested to by an unsworn declaration. Respondents shall be neutral and impartial, shall not advocate specific positions to THECB. Respondents shall identify the extent, nature, and length of these relationships or engagements. Entities having a conflict of interest, as determined by THECB, will not be eligible for a contract award.

This Conflict of Interest Disclosure Statement shall be signed by the highest-ranking officer of Respondent’s entity having responsibility for vetting corporate conflicts of interest, e.g., a corporate Executive Vice President rather than the head of an operating or regional unit of the firm.

THECB will determine whether a conflict of interest or the perception of a conflict of interest exists from the perspective of a reasonable person uninvolved in the matters https://comptroller.texas.gov/purchasing/vendor/hub/ https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=282 https://mycpa.cpa.state.tx.us/tpasscmblsearch/tpasscmblsearch.do https://comptroller.texas.gov/purchasing/vendor/hub/ https://comptroller.texas.gov/purchasing/vendor/hub/forms.php covered by the resulting contract. THECB is the sole arbiter of whether a conflict or the appearance of a conflict of interest exists.

THECB encourages Respondents to provide complete disclosure of matters that might be considered a conflict of interest. Completeness of disclosure may be a factor in evaluating qualifications.

Each Respondent must also address how Respondent intends to ensure that no conflict of interest arises or may potentially arise as a result of its activities or those of its parent, affiliate, or other related entity shall conflict with Respondent’s duty should it be selected to provide these services.

THECB may not enter into a contract with a person it has been employed within the past twelve (12) months. Persons who have been employed by THECB or by another state agency in Texas more than twelve (12) months but fewer than twenty-four (24) months ago shall disclose in the proposal the nature of previous employment with the state agency and the date the employment ended.

If Respondent does not have any known or potential conflicts of interest, the proposal should include such a statement. Failure to provide either a signed statement on potential conflicts of interest or a signed statement that no potential conflicts exist shall automatically disqualify Respondent. Proposal should not modify or replace Attachment D.

Attachment E: Project Plan Template (for reference only)

9.2 Submission Requirements

Respondents should focus on the instructions and requirements of the RFQ. Proposals must be submitted to the Point of Contact by an authorized representative via email to eBids@highered.texas.gov and received by THECB prior to the deadline in Section 8.2. The subject line of the email should be entitled “Proposal Submitted for RFQ No. 781-5-03287.

THECB recommends a limit of 75 MB for each attachment.

Proposals shall include all required attachments and certifications and be in the format described herein. THECB will not accept attachments and certifications submitted after the proposal deadline. Failure to submit all the required information may make the proposal nonresponsive and thus disqualified from consideration.

THECB shall not be responsible for proposals that are captured, blocked, filtered, quarantined, or otherwise prevented from reaching the proper destination server by THECB or Respondent’s anti-virus or other security software.

Respondents are solely responsible for thoroughly understanding this RFQ and its attachments. Any questions concerning this RFQ should be directed to the Point of Contact by the Deadline for Submitting Questions identified in Section 8.2.

Respondents are cautioned to pay particular attention to the clarity and completeness of their proposal. Respondents are solely responsible for their proposals and all documentation submitted. Respondents shall be as precise, accurate, and succinct as possible. Respondents shall provide detailed descriptions of how they will fulfill each requirement. The clarity and completeness of a proposal may be considered by the THECB evaluators.

No mailed, hand-delivered, or faxed proposals will be accepted.

THECB is under no obligation to resolve inconsistencies and may make its scoring and selection decisions accordingly. THECB reserves the right to waive any minor or immaterial proposal requirement noted in the submission process. Submission of proposals confers no legal rights upon any Respondent.

9.3 Organization of the Proposal for Submission

The proposal shall contain two files, as described below.

The following are part of the THECB’s administrative review. Failure to submit any items or submitting incomplete items may result in deeming the proposal unresponsive.

The first PDF shall contain responses to the following:

1. Scope of Work under Section 3. and all subsections of Section 3.;

2. Experience and Qualifications, as described in Section 2.;

3. Pricing, as described in Section 4.1;

4. References.

Each Respondent shall provide at least three references, including contact information. THECB prefers references from clients for whom Respondent has performed similar work, including other state agencies. Do not use THECB or any individuals employed by THECB as a reference.

The second PDF shall contain the following:

1. Attachment A: Execution of Proposal – All information on Attachment A is required to be completed.

2. Attachment B: HUB Subcontracting Plan – All information on Attachment B is required to be completed.

3. Attachment D: Conflict of Interest Disclosure Statement.

4. Transmittal Letter:

Respondent shall provide a Transmittal Letter addressed to the Point of Contact that identifies the person or entity submitting the proposal and includes a commitment by that person or entity to provide the services required by THECB through this RFQ and the Anticipated Contract.

The Transmittal Letter must be signed by a person legally authorized to bind Respondent. The letter must specifically identify that the proposal is in reference to THECB’s RFQ for [Information Technology and Audit Services]. The letter should state, “The proposal enclosed is binding and valid at the discretion of THECB.”

The Transmittal Letter should include the following language:

• “The enclosed proposal is binding and valid at the discretion of THECB.”

• “The enclosed proposal is good for ninety (90) days.”

• Regarding Terms and Conditions Acceptance/Exceptions o “Full acceptance of the terms and conditions described in this Request for Qualifications and all attachments,” or o Provide a list of exceptions to the terms and conditions in Respondent’s Transmittal Letter. Any exceptions to this RFQ must be specifically noted in the letter. If Respondent takes any exceptions to any provision of this RFQ, these exceptions must be specifically and clearly identified by section and Respondent’s proposed alternative must also be provided. Please note as an agency of the state of Texas, THECB is bound to comply with all applicable state procurement and contract laws. Exceptions to required terms and conditions may disqualify the proposal from further consideration. Respondent cannot take a “blanket exception” to the entire RFQ. If any Respondent takes a “blanket exception” to this entire RFQ or does not provide proposed alternative language, the proposal may be disqualified from further consideration.

Any terms and conditions attached to a proposal will not be considered unless specifically referred to in this RFQ and Respondent’s attachment of such terms and conditions to a proposal may disqualify the proposal.

NOTE: THECB, as a state agency, is prevented by the Texas Constitution from indemnifying a Respondent. Respondent is discouraged from including a term in its proposal that requires THECB to indemnify it. Such a term may result in the proposal being deemed nonresponsive.

Respondents are strongly encouraged to submit written questions during the inquiry period regarding any terms and conditions of this RFQ.

10. Proposal Evaluation

10.1 Evaluation and Award of Contract

Proposals will be evaluated by THECB employees and, if applicable, by other non- THECB employees who may be invited to assist as evaluators. Each evaluated proposal will be reviewed and scored according to the table set out below. The relative weight of each criterion is indicated in the right-hand column. THECB may consider both the final weighted score as well as the average ranking when making vendor selection(s). THECB may request oral presentations.

Evaluation Criteria Weight Firm Experience

• Contractor’s firm history and structure, experience with providing IT audit and advisory services to public sector clients.

25%

Staff Qualifications

• Qualifications of staff to be assigned to Internal

Audit for projects, particularly regarding relevant experience with public sector clients.

30%

Project Approach

• Ability of the Respondent to provide the requested services as explained in this Solicitation.

45%

Total 100%

THECB will consider best value for the state, as directed by Texas Government Code § 2254, when selecting a Respondent, in addition to the evaluation criteria above.

THECB will be the sole judge of best value. Best value criteria may include, but is not limited to:

1) The proposal that best meets the goals and objective as stated in this RFQ;

2) Quality, conciseness, clarity, and completeness of the proposal;

3) The proposal that indicates Respondent’s ability to reliably perform the required tasks/deliverables described in this RFQ;

4) The Respondent’s ability to adhere to the schedule and delivery terms (if applicable);

5) Respondent’s experience in providing services in this RFQ;

6) Past vendor performance: In accordance with Texas Government Code §§

2155.074 and 2262.055, vendor performance may be used as a factor in the award (if applicable); and

7) Other factors relevant to determining the best value for the state in context of this particular purchase (i.e., certifications/licensure, reference checks, pricing, etc.). Other factors may also include notices of termination, cure notices, assessments of liquidated damages, litigation, audit reports, and non-renewals of Contracts. Such sources of vendor performance may include any governmental entity, whether an agency or political subdivision of the State of Texas, another state, or the Federal government. Further, THECB may initiate such examinations of vendor performance based upon media reports. Any such investigations shall be at the sole discretion of THECB, and any negative findings, as determined by THECB, may result in non-award to the Respondent.

10.2 Multiple Awards

THECB may award multiple Contracts from this solicitation. Respondents providing the best value to the State for each NIGP group description may be chosen as the State’s primary or “best value vendor” for that group. Additional Respondents may be awarded Contracts at the sole discretion of THECB in order to provide alternate resources for meeting the requirements of the requested services.

11. Additional Instructions

11.1 Accuracy of the Proposal

Respondent’s proposal shall be true and correct and shall contain no cause for claim of omission or error. Proposals may be withdrawn in writing at any time prior to the submittal deadline.

11.2 Cost of Submitting the Proposal

THECB will not reimburse Respondent for any cost related to its proposal.

Respondent is responsible for any expense related to the preparation and submission of its proposal.

11.3 Irrevocability of the Proposal

The proposal is irrevocable for ninety (90) calendar days following the proposal opening date and time identified in this RFQ. This period may be extended at THECB’s request with Respondent’s written agreement.

11.4 Conflicting RFQ Language

If language contained in a particular section of the RFQ is found to be in conflict with language in another section, the most stringent requirement(s) shall prevail. Any irregularities or lack of clarity in this RFQ should be brought to the attention of the Point of Contact listed in Section 8.3 as soon as possible so corrective addenda may be furnished to prospective Respondents.

Award Notice. If the RFQ is awarded, THECB will post a Notice of Award on the ESBD.

However, there is no guarantee that a Contract or any purchase order will result from this RFQ. THECB will not respond to inquiries regarding procurement status.