ESBD_500130_1777576473866_Internal Audit Services Q&R - Final.pdf

TEXAS DEPARTMENT OF LICENSING AND

REGULATION

REQUEST FOR PROPOSALS FOR

INTERNAL AUDIT SERVICES

No. 452-2026-0005

RESPONSES TO PROPOSERS’

QUESTIONS

AND

AMENDMENT TO THE REQUEST FOR PROPOSALS

April 30, 2026

REQUEST FOR PROPOSALS

FOR

INTERNAL AUDIT SERVICES

RESPONSES TO PROPOSERS’

QUESTIONS

Note to All Prospective Proposers:

The following are responses of the Texas Department of Licensing and Regulation (“TDLR” or “department”) to the questions submitted in writing by the deadline established in the Request for Proposals (RFP).

Some answers may clarify the RFP or result in an RFP amendment, and every Prospective Proposer is on notice of each answer’s content. Answers apply only to the facts presented in each specific question.

Proposers shall review all sections of the RFP along with this document to ensure a complete understanding of the requirements. Any exceptions to the RFP shall be noted in the proposal, as required under Section 2.7.2 of the RFP.

Please note: Any questions and responses regarding the HUB Subcontracting Plan (HSP) are in a separate document that will be updated throughout the procurement process.

PRE-PROPOSAL CONFERENCE QUESTIONS AND RESPONSES APRIL

16, 2026.

No questions were received during the Pre-Proposal Conference.

WRITTEN QUESTIONS RECEIVED BY APRIL 23, 2026 at 4:00 P.M.

1. Annual Audit Plan: It looks like historically between TDLR and Texas Lottery there has been an average of 10-12 internal audits per year.

Question: Are you expecting to maintain this level of audits across TDLR? If not, approximately how many audits a year are you looking to include in the annual audit plan? Do you have a annual internal audit budget in mind that you can share?

RESPONSE: Section 6.4 of the RFP states the Successful Proposer shall develop an annual audit plan that identifies individual audits to be conducted during the next Fiscal Year and submit the plan for approval by the Commission.

The estimated annual internal audit budget is $458,720.

2. Financial Soundness: The RFQ requests Copies of audited financial statements and/or complete tax returns for each of the Proposer’s (and its parent corporation, if applicable, or joint venture member or affiliate, if applicable) two (2) most recently ended fiscal years; and/or If documentation under (a) is not available, the Proposer shall provide other proof of financial assurance.

Question: What proof of financial assurance would TDLR accept as evidence of financial soundness if we do not have our financial statements audited or complete tax returns?

RESPONSE: Refer to Section 4.6.2 of the RFP for information on financial resources to provide evidence of financial responsibility and stability.

3. RFP Section/Page Number 1.1.2; page 9 - Do CPAs licensed in states other than Texas satisfy the RFP requirement to meet the certification and licensing standards of the Texas State Board of Public Accountancy?

RESPONSE: CPAs licensed in states other than Texas shall meet certification and licensing requirements of the Texas State Board of Public Accountancy certified public accounting (CPA).

4. RFP Section/Page Number 2.16; page 19- Does TDLR anticipate requesting oral presentations or clarification responses from shortlisted proposers, and if so, when?

RESPONSE: TDLR does not anticipate any oral presentations at this time for this procurement. If clarification information is requested from a Proposer, the response date and time will be provided.

5. RFP Section/Page Number 4.6; pages 58-59- Can TDLR clarify what specific documentation or level of detail is required to demonstrate financial responsibility and stability for purposes of proposal evaluation and contract award (e.g., financial statements, years required, certifications, or alternative evidence)?

RESPONSE: Refer to the response for question No. 2.

6. RFP Section/Page Number 6.1.1; pages 68- What is the current (or expected) audit universe (major programs, functions, systems) that the Successful Proposer should assume for FY 2027 planning?

RESPONSE: Section 6.4 of the RFP states the Successful Proposer shall develop an annual audit plan that identifies individual audits to be conducted during the next Fiscal Year and submit the plan for approval by the Commission.

7. RFP Section/Page Number 6.1.1; pages 68- For “electronic data processing systems and controls,” which primary systems are in scope (e.g., financial, licensing/regulatory, lottery, HR/payroll, procurement, case management)? Will the contractor be granted direct system access, or will data be provided via extracts? If system access is permitted, lease describe the access method and applicable security requirements.

RESPONSE: TDLR will provide information about primary systems and access to the Successful Proposer.

8. RFP Section/Page Number 6.5.2.f; page 71- Can TDLR clarify whether economy and efficiency audits and program results audits are anticipated as part of the annual risk‑based audit plan, and if so, whether the agency has preferred standards, methodologies, or reporting formats for these audits?

RESPONSE: Refer to the response for question 6.

9. RFP Section/Page Number 6.6.1; page 71- Historically, how frequently has the Commission requested written updates on internal audits?

RESPONSE: TDLR will provide information about frequency to the Successful Proposer.

10. RFP Section/Page Number 6.6.7; pages 72- When requested by TDLR, are there established deadlines or expectations regarding the level of effort for follow‑up and monitoring of corrective and preventative action plans implemented to resolve internal audit findings and observations?

RESPONSE: TDLR will provide information about deadlines or expectations to

11. RFP Section/Page Number 6.9; pages 73–74- Approximately how many reports does TDLR receive annually through the ethics reporting system and the State Auditor’s Hotline combined?

RESPONSE: TDLR will provide information about reports to the Successful

12. RFP Section/Page Number 6.9; pages 73–75 -Of the reports referenced above in question 11, approximately how many are complaints directly related to the actions of the Executive Director?

RESPONSE: The question is outside the scope of the RFP.

13. RFP Section/Page Number 6.10; pages 73- In past fiscal years, what has been the typical scope and complexity of special audits or requests performed outside the approved annual audit plan (e.g., frequency per year, level of effort, subject matter areas, and typical duration)?

14. RFP Section/Page Number 4; page 56- Can we combine the numbering for sections required to be included in the proposal? Eg., Part 4.1.1-4.1.4 are all addressed in the proposal under Part 4.

RESPONSE: Yes.

15. RFP Section/Page Number 4; page 56- Do the sections have to be addressed/mentioned in sequential order? Eg., Part 4 must be addressed in the proposal prior to Part 6?

RESPONSE: Refer to Sections 2.5.3 and 2.6 of the RFP.

16. How does the Commission currently prioritize enterprise risks (e.g., financial, IT, vendor management, lottery integrity, contract compliance), and are there specific risk themes the Commission expects to see emphasized in the initial annual audit plan?

17. Can TDLR clarify the expected balance of audit effort between Texas Lottery Program activities versus broader TDLR agency operations?

RESPONSE: Refer to the response to question 6.

18. What level of depth does TDLR expect for audits of electronic data processing systems and IT controls, such as high-level governance vs. detailed ITGC testing aligned to frameworks such as NIST or COBIT?

RESPONSE: TDLR will provide information about electronic data processing systems and IT controls to the Successful Proposer.

19. How frequently does the Commission expect the internal auditor to present findings in person, and what level of detail is preferred in Commission presentations versus written reports?

RESPONSE: TDLR will provide information about presenting finding in person to

20. For the RFP, is there an anticipated budget and/or budget range that TDLR has been agreed upon?

RESPONSE: The estimated annual internal audit budget is $458,720.

21. Based on the prior three fiscal years’ audit plans, does TDLR anticipate a similar number and mix of assurance, follow-up, advisory, and special request engagements for FY 2027, or are there anticipated changes in scope or priorities?

RESPONSE: TDLR will provide information about number and mix of assurance, follow up, advisory, and special request engagements to the Successful

22. Are there specific risk areas, programs, or systems (e.g., Lottery operations, IT general controls, contract compliance, enforcement activities) the Commission expects to see emphasized in the initial FY 2027 risk assessment and audit plan?

RESPONSE: TDLR will provide information about risk areas, programs, or systems to the Successful Proposer.

23. Does TDLR have a target range for annual audit hours or not-to-exceed expectations based on historical experience that proposers should consider when developing pricing in Attachment H?

RESPONSE: No.

24. Historically, how frequently has TDLR requested special audits or advisory reviews outside the approved annual audit plan, and what has been the typical level of effort for those engagements?

RESPONSE: Refer to the response for question 12.

25. Can TDLR clarify the expected level of effort related to managing the third-party hotline/reporting system (volume of reports, investigation depth, and reporting expectations), and whether this effort should be assumed as steady-state work or variable demand?

RESPONSE: TDLR will provide information about managing the third party hotline/reporting system to the Successful Proposer.

26. How many Commission or audit committee meetings does internal audit typically attend or present at annually, and should proposers assume in-person, virtual, or hybrid participation?

RESPONSE: TDLR will provide information about meeting attendance or presentations to the Successful Proposer.

27. Does TDLR have preferred audit tools, data analytics platforms, or reporting formats currently in use, or should proposers assume responsibility for providing their own audit technology and dashboards?

RESPONSE: No. The Successful Proposer is responsible for providing its own audit technology and dashboards.

28. If a new vendor is selected, what level of transition support and knowledge transfer is expected from the outgoing auditor, and is this transition effort expected to be included in the base price?

RESPONSE: Refer to Section 3.14.4 of the RFP.

29. What is the expected number of audits per year?

30. What is the estimated hours or budget range?

RESPONSE: Refer to the response to question 20.

31. What audit tools or systems are currently used?

32. What are the on-site vs remote expectations?

RESPONSE: TDLR will provide information about on-site vs remote expectations to the Successful Proposer.

33. Is there an incumbent vendor?

RESPONSE: Yes.

34. What have been the key strengths and areas for improvement observed in TDLR’s current or past providers of internal audit services?

35. Are there specific internal audit tools, templates, or reporting systems currently in use by TDLR, or is the agency open to proposers leveraging their own audit technologies, tools, and methodologies?

RESPONSE: TDLR is open to Proposers leveraging its own audit technologies, tools, and methodologies.

36. What is the total annual budget allocated for internal audit services, or the total budget associated with this contract as a whole?

RESPONSE: Refer to the response to question 20.

37. Approximately how many reports are received annually through the Internet- and telephone-based reporting system described in Section 6.9.1?

RESPONSE: TDLR will provide information about how many reports are received annually through the Internet and telephone-based reporting system to the Successful Proposer.

38. Section 4.5 (Conflicts of Interest) requires disclosure of personal or business relationships involving the Lottery’s vendors with contracts exceeding $100,000. Does this requirement apply only to Lottery vendors, or does it also extend to vendors of the Texas Department of Licensing and Regulation with contracts over $100,000?

RESPONSE: The requirement also extends to vendors of the Texas Department of Licensing and Regulation with contracts over $100,000.

39. Section 4.1 (Experience of Proposer) requires proposers to provide evidence of CPA or CIA certification as part of the proposal submission. Please clarify whether this requirement applies to all members of the proposed engagement team or solely to the engagement lead.

RESPONSE: The requirement applies to all members of the proposed engagement team who will be providing internal audit services.

40. The Department issued a Request for Proposal (RFP) for Internal Audit Services in Fiscal Year 2025, what are the reasons for issuing an RFP in fiscal year 2026?

41. Is the previous internal auditor eligible to participate in the current RFP process?

RESPONSE: The question is unclear. TDLR is unable to answer the question.

42. Will the scope of the Internal Audit Services include the Texas Lottery?

43. Has the Texas Lottery been included in the most recent Risk Assessment and Audit Plan of the TDLR?

RESPONSE: TDLR will provide information about the most recent risk assessment and audit plan to the Successful Proposer.

AMENDMENT TO THE RFP

The following has been adopted by Amendment to the RFP, as permitted by Section 2.12 of the RFP. The following section has been replaced in its entirety.

Amendment No. 1

4.7 Background Investigations

4.7.1 4.7.4 Apparent Successful Proposer. If requested by the Texas Lottery Texas Department of Licensing and Regulation, the Apparent Successful Proposer may be required to complete and return the following forms within ten (10) Working Days, or as otherwise directed by the Texas Lottery TDLR, after the written Announcement of the Apparent Successful Proposer is issued.

a. Vendor Background Investigation Form (Attachment E).

b. Certified List of Vendor Principals Form (Attachment E-1).

c. Certified List of Contractually Defined Vendor Principals Form

(Attachment E-2).

d. Consent to Background Investigation and Release of Personal Information

Form (Attachment E-4). A separate form shall be completed for each vendor principal included on Attachment E-2 Certified List of Contractually Defined Vendor Principals Form and each vendor/Subcontractor employee included on Attachment E-3 Vendor Employee Background Investigation List.

e. Vendor Employee Background Investigation List (Attachment E-3).