FY26 OSA_Disaster_Emergency_Fund_RFP_Inquiry_Responses_GGF (1).pdf

1375 Sherman Street, 5th Floor ● Denver, Colorado 80261 ● 303.869.2800 ● osa.ga@coleg.gov ● www.colorado.gov/auditor

Office of the State Auditor

Kerri L. Hunter, CPA, CFE

State Auditor

June 4, 2026

A Request for Proposals for an Agreed Upon Procedures and Compilation Engagement for the Disaster Emergency Fund for the Fiscal Years Ended June 30, 2025 and June 30, 2026.

Responses to Prospective Bidder Inquiries

1. What were the fees charged for the most recent similar engagement (Disaster Emergency Fund

AUP report for fiscal years ended June 30, 2023 and 2024) listed in the RFP?

OSA Response: The contract fee for the engagement for the Fiscal Years Ended June 30, 2023 and June 30, 2024 was $47,500.

2. Has there been a substantial change since previous years in the expected volume and complexity of transactions associated with DEF reimbursements, transfers, and expenditures for Fiscal Year

2025 and Fiscal Year 26 when comparing to the last similar engagement in Fiscal Year 2023 and

Fiscal Year 2024?

OSA Response: According to Colorado Department of Public Safety staff, there were no substantial changes in Fiscal Years 2025 and 2026.

According to the Office of the Governor staff, there has not been a substantial change in activity, volume, or complexity from prior years.

3. Approximately how many Executive Orders, disaster declarations, and related DEF transactions does the OSA anticipate will comprise the FY25 and FY26 populations subject to testing under this engagement?

OSA Response: According to Office of the Governor staff, there are approximately 50 active

Executive Orders (EOs) with about 10 more that have been closed the past two years.

According to Department of Public Safety staff, the following includes declared disasters that were effective during Fiscal Years 2025 and 2026:

Colorado Office of the State Auditor 2

Fiscal Year 2025

• Total Active Executive Orders - 48

• Total Closed - 13

• New Executive Orders – 10

• Disaster Emergency Fund Transactions – 18,446

Fiscal Year 2026

• Total Active Executive Orders - 46

• Total Closed - 2

• New Executive Orders – 11

• Disaster Emergency Fund Transactions – 25,635

4. Are there any known changes to DEF operations, statutory requirements, reporting processes, CORE functionality, or disaster funding activity during Fiscal Year 2025 or Fiscal Year 2026

OSA believes may materially affect the scope or complexity of this engagement compared to prior years?

OSA Response: According to Colorado Department of Public Safety staff, there have been no changes from the standard process.

According to Office of the Governor staff, there have been no major changes to DEF operations, CORE functionality, or disaster funding that would affect the scope of work of this

[engagement].

With that said, there have been some funding and reporting changes since the last [engagement].

• Interest earned on the deposit of money in the funds is deposited into the General Fund beginning July 1, 2025 per Senate Bill (SB) 25-317.

5. What is the typical time frame for the work to be completed as included in the RFP?

OSA Response: Engagement work can begin as soon as the OSA has a completed contract with the awarded firm, a signed engagement letter has been obtained from Departments’ management, and an entrance conference has been held with the Departments/contract auditor/OSA. The firm awarded the contract may contact the Departments to determine the best timing for performing engagement work. This timing is normally discussed during the entrance conference, but all deadlines indicated in the RFP must be met. All testing generally needs to be done based on the associated due dates as noted in the RFP.

• Work for this project is estimated to commence in July 2026, and the approximate contract date is July 9, 2026.

• Hold an entrance conference with the Departments and OSA on or before August 13, 2026.

Colorado Office of the State Auditor 3

• Hold an exit conference on or before November 12, 2026.

• A draft report with any drafted findings should be completed no later than October 8, 2026.

• Issuance of a final combined agreed upon procedures and compilation report on November

19, 2026. This is the date that the final report, including final findings, must be delivered to the OSA.

According to Department of Public Safety staff, July and August are extremely busy for the department due to year-end close and the Office of the State Controller (OSC) reporting

(exhibits, including exhibit K1 for single audit). Since the entrance conference is planned for mid-August, they don’t anticipate their year-end workload will delay contractors’ requests for information.

According to Office of the Governor staff, the Office of State Planning & Budgeting (OSPB) and the Governor’s Finance & Accounting Office (GOV Fi) are both involved with the management of the Disaster Emergency Fund and State Emergency Reserve Cash Fund. The

Office of State Planning & Budgeting will be involved in the drafting of the State Budget between July 21, 2026 and November 1, 2026. The Governor’s Finance & Accounting office prefers to pause, or significantly slow, requests for information between July 1st and mid-August due to Fiscal Year end.

6. With respect to the Agreed-Upon Procedures (AUP) scope and the requirement that AUP engagements are subject to specific professional standards regarding the nature and wording of procedures and related reporting. Certain activities described in the scope of work may require refinement to align with permissible AUP procedure language under applicable standards, and some activities may be more appropriately addressed as project support tasks rather within the formal AUP procedures.

Would OSA prefer respondents:

• Include proposed revisions/refinements to AUP procedure wording as part of the proposal response, or

• Reserve detailed procedure language revisions for contract negotiations and final scope development with the selected vendor?

Additionally, would OSA be open to distinguishing between procedures intended to be included within the formal AUP report and other related scope activities to support the engagement but may not constitute reportable AUP procedures under professional standards?

OSA Response: The OSA prefers that proposed revisions/refinements to the AUP procedures be included in the proposal response. The proposal should also include any proposed

Colorado Office of the State Auditor 4 distinctions between procedures intended to be included within the formal AUP report and other related scope activities to support the engagement, but may not constitute reportable AUP procedures under professional standards.

7. Rather than granting system access to CORE or other State systems, will the selected firm be provided with a direct point of contact at each applicable department/agency or will a member of the OSA coordinate information and documentation requests (i.e., will there be a designed

PoC at the Office of the Governor’s Office of State Planning and Budgeting (OSPB), Department of Public Safety (DPS), Division of Homeland Security and Emergency

Management (DHSEM), Division of Fire Prevention and Control (DFPC), and other stakeholders during planning and fieldwork)?

OSA Response: The OSA monitors the contract, and does not coordinate document requests with departments. The contract auditor is responsible for working with the departments to obtain information related to the engagement.

According to Colorado Department of Public Safety staff, they can grant system access to

CORE or other State systems as needed, or provide required information from CORE to the contractor. Additionally, DHSEM and DFPC are divisions within DPS, and points of contact can be provided.

According to the Office of the Governor staff, the Governor’s Finance & Accounting office will provide the required information from CORE upon the contractors’ request. Additionally, point of contacts will be provided for the OSPB and the Governor’s Finance & Accounting Office

(GOV Fi).

8. Does the OSA anticipate onsite work to be required during this engagement, and if so, approximately how many onsite visits or days should firms anticipate when preparing pricing and staffing assumptions?

OSA Response: Engagement work can be completed in a remote or hybrid capacity. The firm awarded the contract may contact the departments to determine the best method for performing the engagement work.

According to Colorado Department of Public Safety staff, no onsite work is expected. All files are saved electronically.

According to the Office of the Governor staff, they do not anticipate the need for onsite work.

Colorado Office of the State Auditor 5

9. Beyond the requirements outlined in Exhibit E and Exhibit H, does the OSA maintain any additional policies or restrictions related to the use of artificial intelligence tools, automated analytics platforms, or cloud-based collaboration technologies in performing procedures, documentation, or report drafting?

OSA Response: Contractors may use artificial intelligence (AI)-assisted tools to support data analysis functions; however, the contractor may not use these AI tools for any information that is protected from public disclosure, such as the Internal Revenue Service Publication 1075. Such tools can be used to assist in evaluation of data, identification of patterns, and generating analytical outputs. While such tools are designed to enhance efficiency and accuracy, the contractor should not rely solely on AI-generated outputs and is required to apply human review, judgement, and oversight prior to reliance in business decision-making. The contractor is required to maintain full professional responsibility for all work performed and ensure confidentiality and similar standards for such tools that it utilizes for similar work on the contractor’s own work and processes.

10. What information, if any, is expected to be classified as “Protected” and “Confidential” and subject to the encryption standards outlined in Exhibit E? Specifically, with which encryption standards will the selected firm be expected to comply (e.g., NIST Special Publication 800-88 or other standard procedures and requirements set by the U.S. Department of Defense, such as

DoD 5220.22-M)?

OSA Response: Section 2-3-103(3), C.R.S., and the contract’s Exhibit E specify that the engagement documentation and report drafts are classified as confidential. Based on the following department responses, we are not aware of a specific encryption standard that the contractor will be required to comply with. Therefore, data storage and transmission encryption protocols should comply with industry-leading best practices, such as those found in NIST

Special Publication 800-175.

According to Colorado Department of Public Safety staff, no protected information is expected.

According to the Office of the Governor staff, the Office does not anticipate any financial documentation to be classified as protected.

11. Within Exhibit E, “audit” is referenced throughout (such as “locations who are conducting audits” within A.) instead of attestation. Confirming this Exhibit is applicable with the understanding this is for the attestation and compilation procedures?

OSA Response: The OSA’s Exhibit E that is referenced throughout the RFP is applicable to the attestation and compilation procedures. This Exhibit E language will be updated to

“engagement” prior to the contract being sent for signature.