Internal Auditing RFP Q and A.pdf

Illinois Department of Central Management Services JPMC Internal Auditing RFP

26-416CMS-BOSS4-B-51694

Questions and Answers

Q1. May services be performed remotely, or is onsite presence at participating governmental unit locations required? If onsite work is anticipated, does the State expect it to be continuous for the duration of an engagement or limited to specific phases such as entrance conferences and fieldwork?

A1. The RFP does not prescribe a specific remote or onsite work requirement. Services will be performed as requested by the participating governmental unit based on the needs and requirements of the requested services. The governmental unit may determine the appropriate location and method of service delivery, including remote, onsite, or a combination thereof.

Q2. Section G, Type of Pricing, states "Pricing pursuant to this contract is" without a designation. Please confirm whether pricing is firm or estimated.

A2. Pricing pursuant to this contract is estimated, as stated in Section F.5.2 of the RFP.

Q3. Section G states "Expenses allowed." Please clarify whether travel and other direct expenses are reimbursable in addition to the proposed hourly rates, or whether all such costs must be included within the hourly rates. If reimbursable, please identify the applicable travel reimbursement policy or rate schedule.

A3. Expenses are not allowed under this solicitation. Section F.5.3 states that expenses are not allowed. Offerors should therefore include all costs associated with providing the required services in their proposed hourly rates, consistent with the terms of the solicitation.

Q4. Must an Offeror hold an Illinois certified public accounting firm license or registration to perform the internal audit services described in this solicitation, or is licensure in the Offeror's home state sufficient for services that do not constitute attest engagements?

A4. The RFP does not require the Offeror to hold an Illinois certified public accounting firm license or registration solely to perform the internal audit services contemplated by this solicitation. Section F.1.2 requires personnel assigned to an engagement to possess the qualifications, education, experience, technical expertise, certifications, licenses, or professional designations necessary to perform the applicable services. The specific credentials required will depend on the nature of the services being performed and applicable professional standards and requirements.

Q5. Section F.2 does not reference a peer review report. Please confirm whether a current peer review report is required or requested as part of the proposal.

A5. A current peer review report is not identified as a mandatory proposal submission in Section F.2. The mandatory requirement in Section F.2.1 requires Offerors to describe their internal quality assurance and quality control processes, including internal review and supervision, review of audit workpapers and reports, compliance with professional standards, resolution of findings or review exceptions, and independence and ethical safeguards.

Q6. Does the State accept a reciprocal minority business certification issued by another jurisdiction — for example a Virginia Department of Small and Supplier Diversity SWaM/MBE certification — toward BEP certification, or toward satisfaction of the 4% BEP goal? If reciprocity is available, please identify the accepted certifying entities and the process for recognition.

A6. To receive credit toward the established BEP goal, the business must meet the applicable Illinois Business Enterprise Program certification requirements. An out-of-state certification itself does not constitute Illinois BEP certification. Offerors should refer to the applicable BEP Utilization Plan and CEI guidance for requirements concerning eligible BEP-certified vendors and utilization.

Q7. What is the current typical processing time for a BEP certification application? Additionally, may a firm with a BEP application pending as of the proposal due date be identified on the prime Offeror’s Utilization Plan, or must certification be complete at the time of submission?

A7. The BEP Utilization Plan states that firms must be BEP-certified at the time of bid or offer submission. Accordingly, a firm whose BEP certification application remains pending as of the proposal due date may not be relied upon as a BEP-certified vendor for purposes of meeting the BEP goal at the time of submission. Offerors should refer to the applicable BEP Utilization Plan and CEI guidance for certification requirements and any applicable provisions concerning certification status or curable deficiencies. The State does not establish a guaranteed processing time for BEP certification applications through this solicitation.

Q8. The solicitation identifies NIGP 94620 - Auditing Services as the code used to establish the BEP goal. For purposes of receiving BEP participation credit, must a BEP subcontractor be certified specifically under NIGP 94620, or may an actively certified BEP vendor perform a commercially useful portion of the solicitation scope under another applicable certified NIGP code, such as management consulting or project management services?

A8. The 4% BEP goal for this solicitation was established using NIGP Code 94620 – Auditing Services. For purposes of receiving BEP participation credit, the proposed BEP-certified vendor must be certified for the applicable products/services or solicitation scope and must perform a commercially useful function consistent with the requirements of the BEP Program. Certification under an unrelated NIGP code would not, by itself, establish eligibility for participation credit. Offerors should verify the proposed BEP vendor's certification and applicable scope through the CEI Supplier Diversity Management Portal and applicable BEP guidance.

Q9. The RFP mentions, primary, secondary, and tertiary. Will be exactly three vendors, or more/fewer? How is work declined by the primary reassigned?

A9. The State may award to one or more responsive and responsible Offerors. If multiple awards are made, the Offeror receiving the highest overall score will be designated the primary vendor, the second-highest scoring Offeror will be designated the secondary vendor, and the third-highest scoring Offeror will be designated the tertiary vendor.

Work will first be offered to the primary vendor. If the primary vendor is unable or unwilling to perform the required services within the State's required timeframe or specifications, the State may offer the work to the secondary vendor and subsequently to the tertiary vendor, as applicable. The resulting contract is an indefinite-quantity joint purchase master contract, and no minimum or guaranteed volume of work is provided to any awarded vendor.

Q10. On an indefinite-quantity contract with no guaranteed volume, how is the 4% BEP goal measured and enforced — per engagement, per SOW, or over the contract lifetime — and how should Offerors reflect it in the Utilization Plan?

A10. The BEP goal applies to the resulting contract and applicable amendments and change orders in accordance with the BEP Utilization Plan and applicable BEP requirements. The Offeror's completed Utilization Plan will identify how the Offeror intends to meet the established 4% goal.

Because this is an indefinite-quantity master contract with no guaranteed volume, actual BEP participation will be based on eligible expenditures under the resulting contract. Awarded vendors will be responsible for maintaining and reporting BEP utilization in accordance with applicable CEI requirements, including applicable reporting requirements.

Q11. Are there page limits, formatting requirements, or a required template for the Technical Response and Commitment to Diversity submissions beyond the RFP sections?

A11. Offerors shall follow all submission instructions contained in the RFP and submit the required Technical Response, Commitment to Diversity, pricing, and other required documents through BidBuy. The RFP does not establish a general page limit for the Technical Response. Offerors should organize their responses according to the applicable sections of the solicitation and clearly identify the location of supporting information requested in Sections F.2 and F.3.

Q12. Are there any provisions in the Standard Terms and Conditions the State considers non-negotiable, particularly regarding rate adjustment, indemnification, or insurance?

A12. Offerors are required to comply with the applicable State of Illinois Standard Terms and Conditions incorporated into the solicitation and resulting contract. Offerors should review the applicable Standard Terms and Conditions in their entirety. Offerors should identify any requested exceptions in the manner specified by the solicitation. The State will evaluate and determine whether any proposed exceptions are acceptable. The State makes no representation that requested exceptions will be accepted.

Q13. Can the State provide historical or estimated annual hours, number of engagements, or anticipated spend under the contract, including estimates by service area (financial, compliance, performance, IT, cybersecurity, etc.)?

A13. The resulting contract is an as-needed, indefinite-quantity joint purchase master contract. The State does not guarantee any minimum number of engagements, minimum number of hours, or minimum expenditure under the contract. Participating governmental units will determine their individual needs and request services accordingly.

Q14. The RFP requires hourly rates to be proposed separately for Contract Years 1 through 7. Please confirm whether the rates proposed for each contract year will remain fixed for that year or whether any mechanism will exist for adjustments due to inflation, changes in labor costs, or other circumstances.

A14. Offerors are required to submit hourly rates separately for Contract Years 1 through 7 in accordance with Section F.5. The proposed rates will serve as the basis for compensation under the resulting contract. Offerors should submit rates for each contract year that reflect their anticipated costs for that year.

Q15. Section F.3.2 requests that Offerors describe workload management, surge capacity, and the ability to scale across multiple simultaneous engagements. Does the State have an anticipated minimum team size, expected number of concurrent engagements, or other capacity assumptions that Offerors should use in developing their staffing approach?

A15. The State has not established a minimum staffing level or a guaranteed number of concurrent engagements. Section F.3.2 requires Offerors to describe their organizational structure, staffing model, personnel qualifications, staffing allocation, workload management, and surge capacity. Offerors should propose a staffing approach that demonstrates their ability to support multiple engagements concurrently and scale resources as required by the needs of participating governmental units.

Q16. Section F.1.2 requires personnel assigned to FCIAA-related engagements to possess the qualifications necessary to perform such services in accordance with FCIAA. Can the State clarify the specific qualifications, experience, certifications, or other credentials it considers sufficient to satisfy this requirement?

A16. Section F.1.2 requires personnel assigned to engagements to possess the qualifications, education, experience, technical expertise, certifications, licenses, or professional designations necessary to perform the applicable services.

Examples identified in the RFP include CPA, CIA, CISA, and CFE certifications, as applicable. The RFP does not establish a single mandatory certification applicable to all FCIAA-related engagements. Qualifications will depend on the nature and complexity of the services requested and the applicable FCIAA and professional requirements. Upon request, the Vendor must provide documentation demonstrating that assigned personnel possess the qualifications necessary to perform the requested services.

Q17. Are there specific audit-management, data-analytics, secure file-transfer, collaboration, or other technology platforms that awarded vendors will be required to use when performing engagements?

A17. The RFP does not identify a single mandatory audit-management, data-analytics, secure file-transfer, or collaboration platform that all awarded vendors must use. Participating governmental units may establish engagement-specific requirements, including performance tracking tools, scorecards, milestone reporting mechanisms, data-security requirements, or other technology requirements. Vendors will be required to cooperate with such requirements. Any use of AI or automated technologies must also comply with the requirements identified in Section F.1.7, including disclosure and applicable agency AI policies.

Q18. Does the State have standard or representative templates for audit plans, workpapers, status reports, findings, recommendations, and final audit reports that awarded vendors will be expected to follow?

A18. The RFP does not establish a single statewide mandatory template for audit plans, workpapers, status reports, findings, recommendations, or final audit reports. Vendors are expected to provide deliverables consistent with the requirements of the applicable engagement and professional auditing standards. A participating governmental unit may provide engagement-specific templates, reporting formats, or other documentation requirements. Vendors will be expected to comply with such requirements when applicable.

Q19. Could the State please identify the composition of the evaluation team for this solicitation, including the state agencies, governmental units, and/or functional roles that will be represented?

A19. The RFP does not identify the specific individuals or organizational units comprising the evaluation team. The State will conduct the evaluation in accordance with the evaluation procedures and criteria established in Section D of the

RFP.

Q20. Does the State anticipate interviews or oral presentations as part of the evaluation? If so, when does the State expect these interviews or presentations to be scheduled?

A20. The RFP does not establish a guaranteed interview or oral presentation stage or a specific schedule for such activity.

Q21. Can CMS further define the anticipated scope of IT auditing services, including whether cybersecurity assessments, cloud reviews, ERP reviews, data analytics, vulnerability assessments, or other specialized IT audit services are expected? The RFP references information technology audits, COBIT, cybersecurity assessments, and data analytics, but it does not define the expected scope, depth, or anticipated volume of specialized IT services.

A21. The RFP contemplates a range of information technology audit and specialized audit services, including information technology reviews, IT auditing, cybersecurity assessments, data analytics, and services performed using applicable frameworks such as COBIT.

Q22. Can CMS provide additional information regarding how points will be allocated among the desirable elements and whether all listed subfactors are weighted equally within each evaluation category? The RFP assigns points to each major technical category, but it does not identify the weighting or scoring methodology for the individual subfactors listed within each category.

A22. The RFP provides 500 total points for Technical Requirements, with the Proposed Technical Solution – Desirable Elements comprising the scored technical portion. The individual F.3 categories have assigned point values as follows:

• F.3.1 Offeror Experience – 150 points

• F.3.2 Staff Qualifications and Capacity – 125 points

• F.3.3 Audit Methodology – 100 points

• F.3.4 Compliance and Quality Assurance – 50 points

• F.3.5 Project Management and Deliverables – 50 points

• F.3.6 Tools and Innovation – 25 points

The RFP does not establish separate point values for each individual bullet or subfactor within these categories.

Evaluation will be conducted based on the criteria and point allocations identified in the solicitation.