ESBD_493477_1773340710230_Addendum#2_332-RFP26-1002 Audit Services - Q and A_final 3-12-26.pdf

Generated on Mar 12, 2026 1:20 PM CDT - Cheryl Mathis

Addendum#2 RFP#332-RFP26-1002 Audit Services Q & A Responses

GASB standards

Received Mar 09, 2026 12:59 PM CDT

Question#1 - Are there any new GASB standards adopted or expected to be adopted during the contract period (or future standards) that proposers should explicitly address in scope and pricing?

Response: GASB Statement No. 104, Disclosure of Certain Capital Assets and GASB Statement No. 103, Financial Reporting Model Improvements are effective for fiscal year 2026.

Internal Audit Function

Question#2 - Does TDHCA have an internal audit function, and if so, is coordination or reliance on internal audit work anticipated or permitted?

Response: TDHCA does have an internal audit function. However, the financial statement audits are done by the external auditors, with internal audit helping to coordinate as necessary.

Prior Findings

Question#3 - Will proposers be provided with access to prior year audit findings, management letters, or corrective action plans to better assess engagement risk and effort?

Response: There were no recent findings related to financial audits, however, findings from the Statewide Single Audit are available on the State Auditor’s Office website.

IT Systems

Received Mar 09, 2026 1:00 PM CDT

Question#4 - Briefly describe IT systems, SOC reports availability, and data access protocols.

Response: TDHCA’s IT environment consists of a combination of enterprise applications, cloud-based platforms, and supporting infrastructure used to support state and federal programs, financial and all other operations, reporting, and internal and external controls. Core systems include financial management systems, operational applications, and integrated third-party SaaS solutions. These systems are managed through centralized IT governance with established policies for change management, security, system monitoring, and data protection.

Where applicable, key service providers maintain independent assurance reports, including SOC 2 reports, which are made available to auditors upon request under appropriate confidentiality arrangements. Internal documentation regarding system controls and change management procedures can also be provided to support audit requests.

Access to systems and underlying data is governed through role-based access controls (RBAC), user authentication protocols, and least-privilege principles. Data extracts required for audit testing are provided through controlled processes coordinated by the Information Systems Division (ISD) and the appropriate programmatic division/team. Access to production environments is restricted. Typically, TDHCA provides transfers of reporting data, data extracts, and/or requested data for evidence of audit requests through secure file transfers. TDHCA staff are also available for virtual meetings (like Teams) and can walk auditors through agency systems so auditors can observe the system and any functionality relevant to the audit.

All data sharing follows established information security and data privacy protocols, including encrypted transfer methods and approval workflows to ensure that only the requested information is released for audit purposes.

TDHCA Major Systems

Centralized Accounting and Payroll/Personnel System (CAPPS) PeopleSoft Financials, Travel and Expense, and Assets

The organization utilizes PeopleSoft as its primary financial system for general ledger, accounts payable, accounts receivable, financial reporting, travel and expense, and asset management.

Financial transactions are processed through the comptroller, and supporting documentation is maintained in the system and in agency file servers. SOC 1 Type II reports are available for key third-party service providers, including PeopleSoft and CPA, and can be provided to the audit team upon request. Audit documentation and financial records will be shared through a secure file transfer portal (Serv-U), and read-only system access may be granted to auditors if required.

All data access is managed by the finance and IT teams in accordance with company security policies.

Microsoft Office 365 M3

The organization utilizes Microsoft Office 365 M3 as a secure enterprise productivity and collaboration platform to support communication, document management, data protection, and operational efficiency while aligning with state cybersecurity and regulatory requirements. The applications most utilized by TDHCA are the Office Suite (Outlook, Word, Excel, Power Point, and Access), Exchange, Teams, Share Point, One Drive, and Entra ID as well as many administration and security tools available in our subscription. TDHCA works with Microsoft and DIR to ensure that our configurations and settings follow best business practices and suggestions. SOC reports are produced annually by Microsoft and are available for download.

Central Database

The Central Database (CDB) suite of systems is comprised of several in-house custom-built Java applications which include Housing Contract System (HCS), Compliance Monitoring and Tracking System (CMTS), CMTS Property Reporting System (POX), Community Affairs Contract System (CACS), Help for Texans (HRC-IC), Manufactured Housing Database (MH Web), Public Information Request (PIR), and the Section 811 Application On-line System. The front-end applications for these custom systems are developed in Java and connect and store data in Oracle databases. TDHCA does not conduct SOC 2 audit reports for these in house systems. All applications and data are stored on TDHCA Linux and UNIX servers. TDHCA conducts annual penetration and web vulnerability scanning tests to ensure that any systems which are open to the external internet do not have any known vulnerabilities, are operating as expected, and securely processing and storing state of Texas data.

MH System (Exodus)

The Manufactured Housing (MH) System (Exodus) is an in-house custom-built PL/SQL application. The Exodus system contains various applications that help the department facilitate the regulation of the manufactured housing industry. This includes the issuance of titling and ownership records, the licensing of industry professionals, consumer protection, installations and safety standards, and compliance and enforcement. The front-end application for this custom system is developed in Oracle PL/SQL and connect and store data in Oracle databases. TDHCA does not conduct SOC 2 audit reports for this in house systems. All applications and data are stored on TDHCA Linux and UNIX servers. TDHCA conducts annual penetration and web vulnerability scanning tests to ensure that any systems which are open to the external internet do not have any known vulnerabilities, are operating as expected, and securely processing and storing state of Texas data.

Intranet

The agency intranet is an internal information hub that functions as a directory of agency divisions, employees, and division-specific resources. It provides staff with quick access to organizational information, contact details, and internal documents. Each division is responsible for maintaining and updating its own content, ensuring information remains accurate and relevant to its operations. The front-end applications for these custom systems are developed in Oracle PL/SQL and connect and store data in Oracle databases. TDHCA does not conduct SOC 2 audit reports for these in house systems. All applications and data are stored on TDHCA Linux and UNIX servers.

Mitas

The Mitas Group, architects trusted web automated business solutions for housing finance and community development agencies. TDHCA uses the MITAS system to manage loan closing and servicing functions for single-family and multifamily loan receivables and support the associated accounting functions for these loans and the Proprietary Fund. Mitas provides TDHCA SOC 2 reports and bridge letters annually and this information can be provided to the audit team upon request. Audit documentation and financial records will be shared through the secure Serv-U portal, and read-only system access may be granted to auditors if required. All data access is managed by the loan servicing, finance, and IT teams in accordance with company security policies.

Prior Year Hours

Received Mar 09, 2026 1:00 PM CDT

Question#5 - For reference in developing a realistic staffing plan, can TDHCA provide the total audit hours incurred by the prior year auditor (SAO), including a breakdown between the Reporting deliverables described in Section II Scope of Work in the RFP?

Response: The SAO established this aspect of the engagement. TDHCA deferred to the SAO regarding staffing and hours.

Specialist Hours

Received Mar 09, 2026 1:01 PM CDT

Question#6 - Did the prior year audit require the use of IT, actuarial, or other specialists, etc. and if so, approximately how many hours were attributable to specialist involvement?

Response: The State Auditor’s Office required IT general controls work as part of the engagement, and the hours for this work were incorporated into the total fixed-price cost.

Increase PY Hours

Received Mar 09, 2026 1:03 PM CDT

Question#7 Does TDHCA anticipate the prior year audit hours increased or decreased due to changes in programs, systems, reporting requirements, or audit expectations that proposers should consider?

Response: TDHCA expects audit hours to be consistent with prior year hours. TDHCA also expects efficiencies as the engagement matures.

Budgeted Fee Range

Received, Mar 09, 2026 1:03 PM CDT

Question#8 Does TDHCA have an established a budgeted fee range or not to exceed amount for the scope of services contemplated in this RFP?

Response: Pricing will be competitive with current market for audit services.

Success in First Year Audit

Received, Mar 09, 2026 1:04 PM CDT

Question#9 From TDHCA’s perspective, what does a successful first year audit engagement look like, beyond timely issuance and compliance?

Response: Success will be measured by the completion of services as outlined in the RFP and the final agreement.

Received, Mar 09, 2026 11:16 AM CDT

Question#10 - Is there anything specific you are looking for in the successor auditors?

Response: Please see RFP for requirements and requested services.

Question#11 - How many staff did the audit team consist of for both interim and year-end, and how many weeks did the auditor spend in the field?

Response: The SAO established this aspect of the engagement. TDHCA deferred to the SAO regarding staffing and hours.

Question#12 - How many audit hours did your current auditors propose under your existing contract?

Response: The prior audit engagement with the SAO was structured as a flat-fee arrangement.

Question#13 - What were the prior year’s total audit fees, and can you provide the breakdown by components?

Response: Please submit an open records request for prior year’s total audit fees.

Question#14 - Are there any significant changes in operations expected for FY 2025-26?

Response: No significant operational changes are expected for FY 2025-2026.

Question#15 - Were there any significant events in 2024-25?

Response: The closure or near completion of temporary COVID-19 grant programs has led to significant reductions in federal revenues and expenditures compared with prior years.

Question#16 - Will there be any significant events in FY 2025-26?

Response: The closure or near completion of temporary COVID-19 grant programs has led to significant reductions in federal revenues and expenditures compared with prior years.

Question#17 - Have there been any changes in your accounting system since last year or any planned changes in the future?

Response: There have not been any changes in the accounting system since last year. The state is planning to replace the legacy Uniform Statewide Accounting System (USAS) with a modern, cloud-based platform in the future.

Question#18 - Were there any new bond issues in the current year or any planned bond issuances in the coming years?

Response: There have been three bond issuances in the current year. Residential Mortgage Revenue and Refunding Bonds Series 2025D was issued September 17, 2025, in the amount of $250 million. Residential Mortgage Revenue and Refunding Bonds Series 2026A was issued February 17, 2026, in the amount of $250 million. The Gateway at Trinity Forest Series 2025 Multifamily Housing Revenue Bonds was issued on December 1, 2025, in the amount of $50 million.

Question#19 - How many leases and subscription arrangements does TDHCA have?

Response: TDHCA does not currently have any leases or subscription-based information technology arrangements.

Question#20 - How many post-closings journal entries did you have for FY 2024?

Response: The State Comptroller performed standard post-closing entries in the Texas FMX/USAS system for the Annual Comprehensive Financial Report (ACFR).

Question#21 - How many were proposed by the auditor?

Response: None.

Question#22 - Is there any litigation not included in the 2025 Financial Statements?

Response: No.

Question#23 - Did TDHCA have any layoffs, retirements, or replacements of key employees in the finance department?

Question#24 - Do you currently have vacant or frozen positions within finance?

Question#25 - Was the FY 2025 audit performed remotely? If so, is TDHCA open to continuing remote audits in the future?

Response: The FY 2025 audit was primarily remote, but some walkthroughs of processes were in person.

Question#26 - Will TDHCA accept emailed proposal submittals in lieu of hardcopies?

Response: See RFP Section 3.7 Submission of Offers for submittal instructions.

Question#27 - What is the desired timeline for the following:

a. Interim

Response: Early July

b. Field Work

Response: Early October

c. Draft Reports

Response: Early December

d. Final Reports

Response: December 15, 2026.