ESBD_524777_1782928808418_Question and Answers.pdf

State Office of Administrative Hearings Request for Qualifications – 360-26-001

Internal Audit Services Question and Answers

1) On-site presence expectations. The Cost Proposal in Attachment C must include all travel to Austin and to SOAH's seven field offices within a fixed annual amount. To help respondents estimate level of effort and travel accurately, approximately how much of the audit fieldwork does SOAH expect to be performed on-site versus remotely, and is on-site work generally concentrated at the Austin headquarters, or are visits to the field offices typically required for the audits conducted under the annual plan?

Audits are typically conducted virtually. Any onsite visits would be based on the risk assessment.

2) Scope and cost against the annual cap. Does the $45,000 per fiscal year cap in Section 3.12 include all tasks listed in Attachment C (risk assessment, audit plan, two audits, annual audit report, and reporting to oversight entities), plus travel?

Yes

3) Are the additional or special audits described in Section 5.9 excluded from that cap, and where in the response should respondents provide the hourly rate schedule referenced in Section 5.9, given that Attachment C captures only task-level totals?

Yes, they are excluded. Any additional audits outside of the annual internal audit would be agreed to between the agency and selected vendor.

4) Pricing across renewal and extension years. Section 2.9 states that pricing agreed in the Contract shall be firm and remain constant through the life of the Contract, while Section 3.9 provides that renewals and the optional extension may be exercised at the Contract rate or rates as modified during the term. May respondents propose annual rate escalation for the renewal and extension years in Attachment C, or must the Year 1 rates hold across all renewal and extension periods?

No

5) Audit area selection for the FY 2027 plan. Section 5.5 provides that the Successful Respondent develops the annual audit plan using risk assessment techniques. For purposes of scoping and pricing the two audits per fiscal year reflected in Attachment C, does SOAH have specific priority areas or major systems it expects the FY 2027 plan to cover, or will audit area selection be driven by the incoming auditor's risk assessment? We would also appreciate confirmation of whether SOAH expects coverage to rotate to areas not audited in recent fiscal years.

The plan would be based on the incoming auditor’s risk assessment. SOAH expects areas to rotate.

6) VetHUB subcontracting plan for self-performed work. The VetHUB subcontracting plan (Attachment D) is a pass/fail requirement. For a professional services engagement of this size performed by the firm's own licensed staff, will a plan indicating no subcontracting satisfy the good faith effort requirement, or does SOAH expect subcontracting in the identified classes

A passing response may include that the potential vendor would conduct the work themselves and not have subcontractors. This would satisfy the pass/fail requirement.

7) Section 1.2 – Purpose (Pg. 6–7): Can SOAH provide more detail on the typical scope, frequency, or historical volume of “additional” or “special audits” that may be requested outside the annual audit plan?

In the past ten years, the agency has only requested and negotiated one special audit outside of the annual internal audit.

8) Section 2.5 – Response Format & Contents, 2. Section-by-Section Response to the RFQ (Page 12): Can you please clarify if you want firms to restate all sections of the RFQ or where sections do not require a response to just state our understanding of that section of the RFQ.

The respondent does not need to restate all of the sections but must include in their summary that they will be able to meet all the requirements of the

RFQ.

9) Section 2.8 – Proposal Evaluation and Contract Award (Pg. 16–17): Can SOAH provide additional detail on how qualitative evaluation factors (e.g., competence, quality, and timeliness) will be assessed beyond the scoring matrix?

10)Section 2.8 – Proposal Evaluation and Contract Award (Pg. 14): Can SOAH clarify whether oral presentations will be required for all Respondents or only a subset, and whether such presentations will be conducted in person or virtually?

No oral presentations will be required.

11) Section 3.12 – Contract Amount and Funding (Pg. 19): Can SOAH clarify how the “number of audits agreed upon” will be determined during contract negotiations, and whether Respondents should assume any baseline audit volume when developing pricing within the stated funding cap?

The baseline would be at least one internal audit annually.

12) Section 4.7 – Financial Solvency, 2. (Pg. 25) it states, “Each Respondent shall provide evidence of financial responsibility and stability based on any/or all the following.” CLA is a private company and does not have audited financial statements, would our company’s balance sheets suffice for other proof of financial assurance.

Yes, the company’s balance sheets would be fine.

13) Section 5.1 – Background and General Information (Pg. 26–27): Can SOAH provide additional detail on the expected number of audits and estimated level of effort (e.g., hours or audit complexity) anticipated annually under the internal audit program?

The agency anticipates at least one internal audit of a subject area annually.

SOAH is a small state agency and the audits are typically not complex.

14) Section 5.3 – Deliverables (Pg. 30): Can SOAH clarify whether there are preferred templates, formatting standards, or specific reporting tools required for audit plans, risk assessments, audit reports, and required submissions to oversight entities, or if Respondents are expected to provide their own formats?

There is not. Respondents are expected to provide their own formats.

15) Section 5.5 – Development of the Annual Audit Plan (Pg. 29): Can SOAH clarify whether Respondents should propose a specific number of audits for the initial year, or if the scope and volume of audits will be finalized following completion of the risk assessment?

The scope and volume of audits will be finalized following completion of the risk assessment. Also, see question #13.

16) Section 5.6 – Implementation of the Annual Audit Plan (Pg. 29-30): Can SOAH clarify whether all audits included in the approved annual audit plan are expected to be completed within the fiscal year, or if there is flexibility to carry forward audits based on timing, prioritization, or resource availability?

All audits must be completed within the fiscal year.

17) Section 5.7 – Reporting and Related Services (Pg. 30): Can SOAH clarify the expected frequency and format for periodic audit status updates (e.g., written reports versus meetings), and whether a standard reporting template is preferred?

There is no standard reporting template. Periodic status updates can be written through email. In a typical fiscal year, the agency would get at least four status updates.

18) Is the incumbent allowed to propose on the opportunity?

19) Can you provide the fees paid for the internal audit services for the last three fiscal years?

Please see our public website where have listed our current and prior year purchase orders. Alternatively, you can submit an open record request here.

20) Does the SOAH have an expected number of internal audits to be performed on an annual basis?

See question #13.

21) Is there anything with the current internal audit process you would like to see changed?

22) Is there a specific due date for the annual audit plan and the subsequent submissions of the audit reports to the State Auditors?

November 1st. See sections 5.3 and 5.4.

https://www.soah.texas.gov/reports-and-publications#:%7E:text=Contract%20%26%20Purchase%20Order%20Information https://www.soah.texas.gov/open-records-request

23) Does the SOAH anticipate the work to be completed remotely, in person or hybrid?

See question #1.

24) Section 1.2 Purpose, Professional Certification and Development Requirements – Should respondents include copies of their most recent external quality assessment or peer review reports as part of their RFQ response or will a statement of compliance with applicable standards be sufficient?

A statement of compliance will meet the requirement.

25) Section 5.2 Internal Audit Standards – This section omits Generally Accepted Government Auditing Standards (GAGAS or Yellow Book) which is required by Section 2102.011 of the Texas Internal Auditing Act. Will a Successful Respondent be expected to follow GAGAS to comply and has that compliance been incorporated into the contract limitation of $45,000?

26) Section 5.3 Deliverables – SOAH only lists 4 known deliverables. Does SOAH have an anticipated number of projects or an estimate of hours it expects successful respondents to perform within the contract limitation of $45,000?

See question #13.

27) Section 5.7 1 Reporting and Related Services – States that the successful Respondent shall provide periodic written updates on on-going services.

Could SOAH define “periodic” for this purpose?

See question #17.

28) Section 5.9 Additional Audit Reports – Are the additional or special audits requested outside the approved annual audit plan included in the $45,000 annual contract limitation or will they be separately authorized and funded?

This would be a separate. See question #3.

29) Does SOAH anticipate that the annual audit plan will include a separate information technology audit or cyber security review, or is the expectation limited to evaluating IT risks as part of the risk assessment?

The risk assessment should include IT risks.

30) Does SOAH anticipate that internal audit services may be performed remotely, or is regular on-site presence required? If required, what is the expected frequency and will on-site be at the main office in Austin, Texas?

31) Will travel be required to satellite offices listed in the RFQ?

32) Will SOAH require successful respondent to perform all audit functions of SOAH using SOAH equipment/laptops?

No, selected vendor would use their own equipment.

33) Does SOAH expect the new auditor to maintain the current risk assessment methodology, or prior risk scoring model, or should the methodology be developed entirely independently?

The risk assessment should be developed independently.

34) Will SOAH provide access to relevant organizational, financial, and prior audit information immediately upon contract execution to facilitate completion of the initial FY 2027 risk assessment and audit plan by November 1st?

35) Will SOAH designate primary points of contact within each major functional area and establish time frames for management review and responses to ensure deadlines can be achieved?

36) Will the current internal audit service provider be required to transfer workpapers, risk assessments, audit plans, and historical audit documentation to the Successful Respondent?