REQUEST FOR QUOTES

EXTERNAL QUALITY ASSURANCE REVIEW

GENERAL SPECIFICATIONS

Purpose and Scope: The New York State Unified Court System (UCS) is soliciting written quotes under this Request for Quotes (RFQ) for the purpose of awarding and establishing a term contract for an external quality assurance review of UCS internal audit operations (Services).

The UCS reserves the right to reject any and all quotes that do not meet the requirements of this RFQ or if otherwise considered in the best interest of the UCS to do so.

I. Term of the contract - The term of the contract will be on/about October 26, 2026 through March 31, 2027, with an option to extend for 30 days upon written notification from

UCS.

II. Quotes

A. Quotes submitted in response to this RFQ will constitute agreement to contract by the respective bidder.

B. Quoted prices are to include all Services described herein.

C. Signed, written quotes must be received on or before October 23, 2026 at:

NYS Unified Court System Office of Court Administration Division of Internal Audit Services 224 Harrison St, Suite 504 Syracuse, New York 13202 Attn: Carol Jones, CPA, CIA

D. All quotes submitted in response to this RFQ will remain valid until such time as an award is made or the bidder withdraws their quote (in writing), whichever occurs first.

III. Method of Award - A single contract will be awarded to the responsive and responsible bidder offering the best value, as determined to be in compliance with the RFQ. Best value is defined as the combination of price, and qualifications and experience of the bidder, with consideration given to the total evaluated cost of all estimated Services to be performed under the contract.

IV. References - Upon request, bidders must provide the names of at least three (3) clients (including contact persons and phone numbers) for whom specified services have been provided within the past six (6) months.

V. Information Request - The UCS may request any and all additional information of the bidder deemed necessary for proper analysis and award determination, including but not limited to, documentation as to the financial stability of the bidder.

VI. Appendix A Standard UCS Contract Terms - Bidders should carefully examine the “NYS/UCS Standard Clauses for all New York State Contracts - Appendix A” attached to this RFQ, which will be included as an appendix to the contract to be entered into between the selected firm and UCS.

VII. Ownership of Reports - Any and all reports and findings rendered to UCS by the awarded contractor shall be the exclusive property of UCS and subject to UCS’s exclusive use and control.

The awarded contractor waives any and all rights to such reports and findings, and the control thereof.

VIII. Confidentiality

A. The awarded contractor shall acknowledge that any and all information, records, files, documents, or reports contained in any media format provided to it by UCS in the performance of the Services, or which may be otherwise encountered, is extremely confidential and shall be handled accordingly at all times (together with the awarded contractor’s reports and findings, the “UCS Confidential Information”).

B. Neither the awarded contractor, nor any of its employees, servants, subcontractors, agents, or volunteers, shall at any time be permitted to utilize or disclose the UCS Confidential Information for any purpose outside the scope of Services without the express prior written authorization of the UCS.

C. The awarded contractor shall use, and require its employees, servants, subcontractors, agents, or volunteers to use, at least the same degree of care to secure and protect UCS Confidential Information that it exercises to secure and protect its own similar confidential information.

D. The awarded contractor is prohibited from maintaining UCS Confidential

Information provided to or generated by the awarded contractor in connection with the performance of the Services in a mobile or portable device. Awarded contractor’s remote access to the UCS Confidential Information is prohibited unless such access complies with New York State Information Technology Standard No. NYS-S14-010, as issued by the New York State Office of Information Technology Services, or any successor standards or other similar protocols as approved by UCS in its sole discretion, including two-factor user authentication (e.g., SSL, VPN).

E. The awarded contractor shall comply with the data security and confidentiality requirements of other government agencies that supply data to UCS.

F. The awarded contractor shall provide notice of any actual or potential security breach involving the UCS Confidential Information to UCS within 24 hours and also as required by the New York State Information Security Breach and Notification Act.

G. Any breach of this confidentiality provision by the awarded contractor, or by any of its employees, servants, subcontractors, agents, or volunteers, may result in the immediate termination of the awarded contract by the UCS and may subject the awarded contractor to further penalties.

H. The awarded contractor’s confidentiality obligations as described in this provision shall survive the termination of the awarded contract.

IX. Termination of the Awarded Contract – UCS may terminate the awarded contract for convenience on thirty (30) days’ notice to the awarded contractor, or immediately upon notice for cause.

DETAILED SPECIFICATIONS

It is the intention of the UCS to contract the Services of an independent firm for the purpose of conducting an external quality assurance review of UCS’ Division of Internal Audit Services and Staff.

The scope of such review will be as prescribed by the Comptroller General of the United States in the Government Accountability Office publication titled, Government Auditing Standards (2024 Revision). Some of the relevant provisions of Chapter Five of the Government Auditing Standards that the selected firm is required to comply with when performing Services are summarized below:

Each audit organization conducting engagements in accordance with GAGAS must obtain an external peer review at least once every three years conducted by reviewers independent of the audit organization being reviewed. The peer review should be sufficient in scope to provide a reasonable basis for determining whether, for the period under review, (1) the reviewed audit organization’s system of quality control was suitably designed and (2) the organization is complying with its quality control system so that it has reasonable assurance that it is performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects.

Assessment of Peer Review Risk The peer review team should perform an assessment of peer review risk to help determine the number and types of engagements to select for review. Based on the risk assessment, the peer review team should select engagements that provide a reasonable cross section of all types of work subject to the reviewed audit organization’s quality control system, including one or more engagements conducted in accordance with GAGAS.

Peer Review Report Ratings The peer review team should use professional judgment in deciding on the type of peer review rating to issue; the ratings are as follows:

a. Peer review rating of pass: A conclusion that the audit organization’s system of quality control has been suitably designed and complied with to provide the audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects.

b. Peer review rating of pass with deficiencies: A conclusion that the audit organization’s system of quality control has been suitably designed and complied with to provide the audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects with the exception of a certain deficiency or deficiencies described in the report.

c. Peer review rating of fail: A conclusion, based on the significant deficiencies described in the report, that the audit organization’s system of quality control is not suitably designed to provide the audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects, or that the audit organization has not complied with its system of quality control to provide the audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects.

The peer review team should determine the type of peer review rating to issue based on the observed matters’ importance to the audit organization’s system of quality control as a whole and the nature, causes, patterns, and pervasiveness of those matters. The matters should be assessed both alone and in aggregate. The peer review team should aggregate and systematically evaluate any observed matters (circumstances that warrant further consideration by the peer review team) and document its evaluation.

The peer review team should perform its evaluation and issue report ratings as follows:

a. If the peer review team’s evaluation of observed matters does not identify any findings (more than a remote possibility that the reviewed audit organization would not perform, report, or both in conformity with professional standards and applicable legal and regulatory requirements), or identifies findings that are not considered to be deficiencies, the peer review team issues a pass rating.

b. If the peer review team’s evaluation of findings identified deficiencies but did not identify any significant deficiencies, the peer review team issues a pass with deficiencies rating and communicates the deficiencies in its report.

c. If the peer review team’s evaluation of deficiencies identified significant deficiencies, the peer review team issues a fail rating and communicates the deficiencies and significant deficiencies in its report.

Availability of the Peer Review Report An internal audit organization that reports internally to management and those charged with governance should provide a copy of its peer review report to those charged with governance.

Because information in peer review reports may be relevant to decisions on procuring audit services, an audit organization seeking to enter into a contract to conduct an engagement in accordance with GAGAS should provide the following to the party contracting for such services when requested:

a. the audit organization’s most recent peer review report, and

b. any subsequent peer review reports received during the period of the contract.

Auditors who are using another audit organization’s work should request a copy of that organization’s most recent peer review report, and the organization should provide this document when it is requested.

Peer Review Scope The peer review team should include the following elements in the scope of the peer review:

a. review of the audit organization’s design of, and compliance with, quality control and related policies and procedures;

b. consideration of the adequacy and results of the audit organization’s internal monitoring procedures;

c. review of selected audit reports and related documentation and, if applicable, documentation related to selected terminated engagements prepared in accordance with paragraph 5.55c, if any terminated engagements are selected from the universe of engagements used for the peer review sample;

d. review of prior peer review reports, if applicable;

e. review of other documents necessary for assessing compliance with standards, for example, independence documentation, CPE records, and relevant human resource management files; and,

f. interviews with selected members of the audit organization’s personnel in various roles to assess their understanding of and compliance with relevant quality control policies and procedures.

Written Agreement for Peer Review The peer review team and the reviewed audit organization should incorporate their basic agreement on the peer review into a written agreement. The written agreement should be drafted by the peer review team, reviewed by the reviewed audit organization to ensure that it accurately describes the agreement between the parties, and signed by the authorized representatives of both the peer review team and the reviewed audit organization prior to the initiation of work under the agreement. The written agreement should state that the peer review will be conducted in accordance with GAGAS peer review requirements.

Peer Review team The peer review team should meet the following criteria:

a. The review team collectively has adequate professional competence and knowledge of GAGAS and government auditing;

b. The organization conducting the peer review and individual review team members are independent (as defined in GAGAS) of the audit organization being reviewed, its personnel, and the engagements selected for the peer review;

c. The review team collectively has sufficient knowledge to conduct a peer review.

Report Content The peer review team should prepare one or more written reports communicating the results of the peer review, which collectively include the following elements:

a. a description of the scope of the peer review, including any limitations;

b. a rating concluding whether the system of quality control of the reviewed audit organization was adequately designed and complied with during the period reviewed and would provide the audit organization with reasonable assurance that it conformed to professional standards and applicable legal and regulatory requirements;

c. specification of the professional standards and applicable legal and regulatory requirements to which the reviewed audit organization is being held;

d. reference to a separate written communication, if issued under the peer review program;

e. a statement that the peer review was conducted in accordance with GAGAS peer review requirements; and

f. a detailed description of the findings, conclusions, and recommendations related to any deficiencies or significant deficiencies identified in the review.

Audit Organization’s Response to the Peer Review Report If the reviewed audit organization receives a report with a peer review rating of pass with deficiencies or fail, the reviewed audit organization should respond in writing to the deficiencies or significant deficiencies and related recommendations identified in the report. With respect to each deficiency or significant deficiency in the report, the reviewed audit organization should describe in its letter of response the corrective actions already taken, target dates for planned corrective actions, or both.

The following information pertains to the UCS Division of Internal Audit Services internal audit staff:

Number of professional staff: 23

Albany 5 Buffalo 5 New York City 5 Rochester 3 Syracuse 5

Principal Office: Syracuse, New York Location of workpapers: Electronic

The proposed quote must at least include the following:

A) Number of firm staff to be assigned to perform the Services.

B) Senior staff member(s) name(s) and qualifications.

C) Junior staff member(s) name(s) and qualifications.

D) Applicable billing rates per hour for all assigned staff.

E) Proposed approach to performing the Services.

F) Estimated hours to perform the Services.

G) Total cost to perform the Services, excluding Travel Expenses as defined in G below.

H) Travel Expenses:

Only those necessary and documented per diem expenses shall be reimbursed and at such rates not to exceed those currently paid to non-judicial employees of the UCS. See UCS Per Diem rates: https://www.inside-ucs.org/oca/financial/pdfs/UCS-PerDiemRates.pdf. Travel expenses must be approved in advance by the Director of Internal Audit Services.