Colorado Office of the State Auditor 1

A Request for Proposals for an Agreed Upon Procedures and Compilation Engagement for the

Disaster Emergency Fund for the

Fiscal Years Ended June 30, 2025 and June 30, 2026

May 7, 2026

Table of Contents

Section I Administrative Information

Section II Required Information

Section III Proposal Evaluation Process

Section IV Supplemental Information

Colorado Office of the State Auditor 3

Section I Administrative Information

A. Issuing Office

This request for proposal (RFP) is issued by the Colorado Office of the State Auditor (OSA).

The terms OSA, State Auditor, State, and State of Colorado are used interchangeably throughout this RFP.

As an agency within Colorado’s Legislative Branch, the OSA and this solicitation are exempt from the State Procurement Code and State Procurement Rules [see Section 24-101-105(1)(a), C.R.S.].

All communications regarding this RFP must take place directly with the OSA’s assigned contract monitor listed in Section I(E)–Inquiries and Section I(F)–Submission of Proposals.

B. Background Information

The OSA is soliciting proposals from qualified organizations to conduct an agreed upon procedures and compilation engagement of the State of Colorado’s Disaster Emergency Fund

(DEF). State statute [Section 24-33.5-706(8), C.R.S.] requires the State Auditor to conduct this engagement of the DEF for the two most recently completed fiscal years and complete the report on or before December 1, 2026. The DEF was created by the General Assembly in 1992 through Senate Bill 92-036, and outlines the intent of the DEF in statute: “It is the intent of the general assembly and declared to be the policy of the state that funds to meet disaster emergencies always be available.” [Section 24-33.5-706(1), C.R.S.]. Because of this, the

Governor’s Office of State Planning and Budget (OSPB) is responsible for ensuring that there is sufficient money in the DEF to cover known costs and future estimates for disasters the State is responding to, and that federal reimbursements are transferred back to the DEF or other originating fund. Therefore, OSPB is required by statute to report on DEF expenditures each quarter in accordance with statute [Section 24-33.5-706(7), C.R.S.].

Statute further states that, in order to respond to and recover from emergencies, “It is the legislative intent that first recourse be to money regularly appropriated to state and local agencies. If the Governor finds that the demands placed upon this money in coping with a particular disaster are unreasonably great, the Governor may make money available from the disaster emergency fund.” [Section 24-33.5-706(4)(a), C.R.S.]. Thus, if a disaster depletes and exceeds local resources, the local agencies request help from the State by submitting a resource mobilization request to the Department of Public Safety’s Division of Homeland Security &

Emergency Management (DPS). If DPS approves the request, then it goes to the Governor for review, and the Governor determines whether to declare a disaster and issue an executive order.

Pursuant to statute, the Governor is responsible for addressing the dangers to the State and its

4 Colorado Office of the State Auditor people caused by disasters by declaring a disaster emergency through an executive order [Section

24-33.5-704, C.R.S.].

The DEF balance comprises all revenue transferred into the DEF (including federal reimbursements), less any disaster expenses paid for with DEF money, and any DEF money transferred out of the DEF by the Office of the Governor (GO) or General Assembly.

C. Services Required

The OSA is soliciting proposals from qualified organizations to conduct an agreed upon procedures engagement of the DEF, pursuant to Section 24-33.5-706(8), C.R.S. for the fiscal years ending June 30, 2025 and June 30, 2026.

1. Accounting and Attestation Standards

The agreed upon procedures engagement shall be performed in accordance with attestation standards promulgated by the American Institute of Certified Public Accountants in Statements on Standards for Attestation Engagements, the standards for attestation engagements contained in Government Auditing Standards—2024 Revision issued by the Comptroller General of the United

States, and Fiscal Rules promulgated by the State Controller.

The compilation engagement shall be performed in accordance with Statements on Standards for Accounting and Review Services promulgated by the Accounting and Review Services

Committee of the American Institute of Certified Public Accountants.

2. Agreed Upon Procedures Scope

Agreed upon procedures work to be performed for the fiscal years ending June 30, 2025 and

June 30, 2026, consists of the following:

Performance of the following agreed upon procedures on the DEF:

1. Hold an entrance conference with the Office of the State Auditor (OSA), Governor’s Office of State Planning and Budgeting (OSPB), and the Department of Public Safety (DPS)

[including staff within the Division of Homeland Security and Emergency Management

(DHSEM) and the Division of Fire Prevention and Control (DFPC)] on or before August

13, 2026.

2. Gain an understanding of the departments’ internal controls for accurately and completely tracking disaster spending in the State during Fiscal Year 2025 (FY25) and Fiscal Year 2026

(FY26).

a. Develop an understanding of internal controls over this area through:

Colorado Office of the State Auditor 5

i. Inquiry

ii. Process Documentation

b. Identify the population of Executive Orders (EO) related to the State’s Governor-declared disasters that were effective in FY25 and FY26 and test for completeness and accuracy when compared to what was recorded in the State’s accounting system –

Colorado Operations Resource Engine (CORE) - (e.g.., spending authority, encumbrances, etc.) and OSPB’s quarterly DEF reports.

3. Agree OSPB’s quarterly reports required by Section 24-33.5-706(7), C.R.S. for the 2 most recent fiscal years (FY25 and FY26) to the information recorded in CORE, to assist the users of the report in determining whether the OSPB’s reports to the General Assembly on the DEF are accurate, complete, and in compliance with statutory requirements.

4. Obtain a DEF trial balance from OSPB for FY25 and FY26 showing activity and balances of accounts included in the DEF for each fiscal year.

5. Compile a summary schedule of revenues and expenditures and changes in fund balance

(Schedule) for the DEF for the fiscal years ended June 30, 2025 and June 30, 2026. The

Schedule will be presented in accordance with the requirements of Section 24-33.5-706, C.R.S. and is not intended to be a presentation in accordance with accounting principles generally accepted in the United States of America (GAAP).

6. Evaluate DPS’s and OSPB’s internal controls in place during FY25 and FY26 over the

DEF’s revenues, expenses, transfers, and related account balances. This should include internal controls over reimbursements to, and from, the DEF in accordance with statute.

a. Develop an understanding of internal controls over DEF revenues, expenses, transfers, and reimbursements through:

i. Inquiry

ii. Process Documentation

7. Select a sample of amounts transferred out of the DEF into other State funds during FY 25 and FY26.

a. For the selected transactions in the sample, conduct testing to assist the users of the report in determining whether the transactions are properly supported, accurately recorded in the fund, recorded in the appropriate fiscal year, and in compliance with

Section 24-33.5-706, C.R.S. and other applicable statutes.

6 Colorado Office of the State Auditor

8. Select a sample of amounts transferred into the DEF, including Governor’s Office

Executive Order transactions from the State Emergency Reserve (SER), or other sources, and reimbursements from other departments.

9. For the selected transactions in the sample, conduct testing to assist the users of the report in determining whether the transactions are properly supported, accurately recorded in the fund, recorded in the appropriate fiscal year, and in compliance with Section 24-33.5-706, C.R.S. and other applicable statues.

10. Hold an exit conference with the OSA, OSPB, and DPS on or before November 12, 2026 to discuss the results of procedures and any findings.

Such work will result in the issuance of a final combined agreed upon procedures and compilation report on November 19, 2026 with a brief description of the DEF, including a summary schedule of the DEF’s revenues, expenses, and changes in fund balance as of the fiscal years ended June 30, 2025 and June 30, 2026. In addition, this report will include an

Independent Accountant’s Report on Applying Agreed Upon Procedures and a Compilation

Report of Independent Accountants. The report should also include the results of the procedures conducted as part of the review and findings, as appropriate. A draft report shall be provided to the OSA and approved by the OSA prior to submission to DPS or OSPB, and DPS and OSPB.

3. Deliverables and Timelines

A draft report with any draft findings should be completed by October 8, 2026. The final report, including final findings and DPS, GO, and OSPB (departments) responses, must be delivered to the State Auditor by November 19, 2026.

The OSA expects the Contractor to satisfy the project deliverables and timelines outlined in this

RFP to meet a December 2026 Legislative Audit Committee hearing date, at which point the agreed upon procedures report will be publicly released.

Work for this project is estimated to commence in July 2026. However, work could begin sooner or later depending on how long it takes to route and execute the contract after selection of the successful proposal. No billable work can begin on this project until the effective date of the contract.

a. Work Location

Depending on the needs of the engagement or the nature of the work being performed, some work for this engagement may be able to be completed using email, phone, and other virtual file-sharing and remote meeting technologies. However, some amount of in-person or on-site work at the departments may also be required.

Colorado Office of the State Auditor 7

b. Findings Development and Report Review

The OSA has a rigorous findings development and report review process, which includes review and revisions at multiple levels of the organization as well as review and comment by the departments. Prospective bidders should take this into consideration when preparing a proposed calendar and budget. The findings must adhere to the OSA’s standards as described in “Exhibit G–Developing and Presenting Findings” of the

OSA’s standard contract. The final report must adhere to the OSA’s standards as described in “Exhibit H–Reporting Requirements and Format for Separately Issued

Reports” of the OSA’s standard contract. The final report must also be in compliance with the accessibility standards required by Section 24-34-802(1)(c), C.R.S., and Section

H5. of the OSA’s standard contract.

Section IV–Supplemental Information also includes a link to the prior engagement report for the DEF issued by the OSA. Prospective bidders should review that report to gain an understanding of the OSA’s high expectations in terms of form and presentation.

c. Oral Presentation

The Contractor may be required to testify in person for about two hours before the

Legislative Audit Committee. This testimony will be an oral summary of the written report with questions by Committee members and verbal responses from the Contractor and from the departments. Upon notification by the OSA, the Contractor shall make an oral presentation to one other legislative committee.

If the final engagement report will be presented with a hearing to the Legislative Audit

Committee, then the Contractor must be present in person at the hearing at the end of the engagement when the report is publicly released. The OSA will make the determination in November if the report will be presented with a hearing.

In addition, the Contractor is expected to provide oral presentations to the departments at the commencement and conclusion of the engagement.

Various other meetings with the OSA and departments’ personnel will be required to communicate requirements, expectations, issues, and results, to ensure a smooth and timely completion.

D. Schedule

The following schedule will be followed with respect to this RFP:

1. RFP available to prospective bidders Thursday, May 7, 2026

2. Prospective bidders’ inquiry deadline (11:59 p.m.MT) Thursday, May 21, 2026

8 Colorado Office of the State Auditor

3. OSA response to inquiries deadline Thursday, June 4, 2026

4. Proposal submission deadline (11:59 p.m. MT) Thursday, June 18, 2026

5. Approximate bid selection date Thursday, July 2, 2026

6. Approximate contract date Thursday, July 9, 2026

E. Inquiries

Prospective bidders may make written inquiries concerning this RFP to obtain clarification of requirements. Inquiries must be submitted via email to John Kormos, Contract Monitor, at john.kormos@coleg.gov. No inquiries will be accepted after 11:59 p.m. MT on Thursday, May 21, 2026.

F. Submission of Proposals

Proposals must be submitted via email to John Kormos, Contract Monitor, at john.kormos@coleg.gov. No proposals will be accepted after 11:59 p.m. MT on Thursday, June 18, 2026.

All proposals become the property of the OSA upon receipt and will not be returned to the bidder. The OSA shall have the right to use all ideas, or adaptations of these ideas, contained in any proposal received in response to this RFP. Selection or rejection of the proposal will not affect this right.

G. Acceptance of Proposal

This RFP does not commit the OSA to award a contract, to pay any costs incurred in the preparation of a bid submitted in response to this request, or to procure or contract for services or supplies. The OSA reserves the right to accept or reject, in part or in its entirety, any or all bids received as a result of this RFP if the OSA determines that it is in the best interest of the

State to do so. The lowest cost proposal will not necessarily be selected. The OSA also reserves the right to engage in further negotiation of the engagement’s scope of work, price, and contract terms after selection of the Contractor if the OSA determines that it is in the best interest of the

State to do so.

H. Addendum or Supplement to Request for Proposals

The OSA reserves the right to issue amendments to this RFP prior to the closing date for submission of proposals. In the event that it becomes necessary to revise any part of this RFP, an addendum to this RFP will be provided to each known prospective bidder.

Colorado Office of the State Auditor 9

I. Award Without Discussion

The OSA reserves the right to make an award without further discussion of proposals received.

Therefore, proposals must be submitted in the most complete terms possible from both the technical and cost standpoint.

J. Award Information to Unsuccessful Firms

The OSA will notify all unsuccessful bidders after the award. No information will be released after the proposal submission deadline until an award has been made.

K. Joint Ventures

No joint venture proposals will be accepted. However, this requirement does not preclude the use of outside special consultants if deemed necessary by the Contractor.

L. Eligible Bidders

To be considered an eligible bidder, bidders must meet the following criteria:

1. Be a properly licensed certified public accounting firm authorized to practice in the State of

Colorado.

2. Have participated in a quality control review within the past 3 years.

3. Not have any past history of substandard work.

4. Be independent for this engagement.

M. OSA Contract Monitor

The OSA will assign a contract monitor to serve as the Contractor’s primary point of contact and liaison throughout the engagement. The contract monitor will attend all key department meetings during the engagement (e.g., entrance/exit conferences, findings clearing meetings, briefing meetings with management or boards/commissions, Legislative Audit Committee hearing); assist the Contractor in understanding the OSA’s requirements, processes, and expectations; and facilitate the OSA’s review of project deliverables, including providing guidance and feedback for revisions.

N. Award of Bid

The contract will be awarded to the bidder whose proposal the OSA determines to be the most advantageous to the State of Colorado, price and other factors considered. The successful bidder will be awarded a one-year contract.

10 Colorado Office of the State Auditor

O. Submission of Invoices

The Contractor can submit monthly invoices for engagement work completed. The OSA will withhold payment for 10 percent of the total contract amount pending satisfactory completion of the contract scope of work, which typically occurs after the Legislative Audit Committee hearing when the final report is publicly released.

Colorado Office of the State Auditor 11

Section II Required Information

A. Proposal Sections

Proposals must include the following information. Failure to provide all required information may result in disqualification of the proposal.

1. Title Page

Identify the RFP being responded to and the responding organization’s name, local address, telephone number, contact person, and date.

2. Table of Contents

List the material included in the proposal by section and page number.

3. Transmittal Letter

Include a transmittal letter to no more than two pages. The transmittal letter must include the names of the individual(s) authorized to make representations for the organization and their title(s), mailing address(es), email address(es), and telephone number(s).

4. Profile of the Organization

This section of the proposal must:

a. State whether the organization is local, national, or international.

b. Give the location(s) of the office from which the work will be done and number of partners, shareholders, and managers and other professional staff employed at that office.

c. Describe the range of activities performed by the office from which the work will be done, including descriptions of or links to prior work products that demonstrate experience and expertise providing the services described in this RFP. This should also include the numbers and classifications of personnel who will work on the engagement.

d. Affirm that the organization is a properly licensed certified accounting firm authorized to practice in the State of Colorado.

e. Describe any and all work that (i) is currently being performed for the departments or the State of Colorado, (ii) work that was performed for the departments or the State of

Colorado within the past 2 years (i.e., April 2024 through May 2026), and (iii) is planned

12 Colorado Office of the State Auditor for the departments or the State of Colorado (i.e., proposals submitted for work that has not yet been awarded or contracted).

f. Affirm that the organization is independent for this engagement.

Prior, current, or planned work disclosed pursuant to Item #4(e) may create a threat to independence. In affirming the organization’s independence for this engagement, the proposal must include explanation/analysis in accordance with the independence framework prescribed in Government Auditing Standards why this prior, current, or planned work would not impair the organization’s independence—or create the appearance thereof—in performing this engagement.

g. Affirm that the organization does not have any past history of substandard work (e.g., a prior engagement has been terminated for poor performance).

h. Provide information on any past, current, or anticipated claims (i.e., knowledge of pending claims) on respondent contracts; explain the litigation, the issue, and its outcome or anticipated outcome.

i. Affirm that the organization has participated in a quality control review within the past 3 years. A copy of the results of the organization’s most recent external peer review must be included in the proposal.

j. Provide no more than three references for similar work performed.

5. Qualifications of Assigned Personnel

Describe the proposed engagement team’s relevant experience and areas of expertise. The proposal must identify the principal staff (i.e., principals, managers, and supervisors/in-charges) who will work on the engagement, including any specialists or subcontractors, such as actuarial or investment valuation services, to be used. The proposal must include a resume of all principal staff highlighting their professional qualifications and similar engagement work that they have performed. Resumes must be included in an appendix.

The OSA may require that the Contractor provide the OSA with the results of background checks conducted pursuant to the organization’s standard employment practices on personnel assigned to the engagement. If background checks are not a standard employment practice for the Contractor, the OSA may require the Contractor to conduct a background check on personnel assigned to the engagement and provide the results to the OSA.

Colorado Office of the State Auditor 13

6. Organization’s Approach to the Agreed Upon Procedures and Compilation

Engagement

The proposal must include a description of the methodology, approach, tools, and resources to be used to conduct the engagement.

7. Contract Terms and Conditions

The OSA expects the successful bidder to execute and adhere to the terms and conditions in the OSA’s standard contract and its related exhibits (see Section IV–

Supplemental Information).

Bidders should not wait until after the OSA has made a contract award to consult with their legal team/advisor about the contract terms and conditions. Bidders must identify any issues with the terms and conditions in the OSA’s standard contract and its related exhibits as part of their proposal, including proposing alternative language if appropriate. The OSA will consider this information when evaluating proposals and making the contract award.

8. Compensation and Staff Hours

This section of the proposal must:

a. State the number of professional staff hours estimated to complete the engagement work by staff level, the associated hourly rate, and the resulting total cost. Travel costs incurred in the performance of engagements are reimbursable only as a part of the hourly rate and must be covered under said rate and will not be separately reimbursed.

b. State the total inclusive maximum fee for which the work requested will be done.

c. Affirm that all prices, terms, and conditions will be held firm for at least 90 days after the bid opening.

9. Delivery Schedule

Include a detailed proposed schedule of the engagement work to be performed and deliverable due dates for the project milestones discussed in Section I(C)–Services Required.

10. Additional Data

Include additional information that is considered essential to the proposal but has not otherwise been provided in response to a specific item in this section.

14 Colorado Office of the State Auditor

B. Separate Redacted Proposal for Proposals Containing Proprietary Information

All proposals submitted to the OSA in response to this RFP are subject to the Colorado Open

Records Act (CORA). In accordance with CORA, bidders may request that the OSA withhold proprietary information (i.e., trade secrets) in their proposals from public disclosure pursuant to a CORA request.

Bidders requesting that the OSA withhold proprietary information in their proposal from public disclosure pursuant to a CORA request must prepare and submit a separate redacted copy of their proposal to the OSA. In no event may an entire proposal be classified as proprietary information.

The OSA will review any designations of proprietary information for reasonableness and appropriateness as part of its review of proposals. If the OSA does not agree with the bidder’s designation of proprietary information, the bidder will be notified and asked to provide additional explanation and clarification and, if necessary, refine what is designated as proprietary information and submit a revised redacted proposal.

Colorado Office of the State Auditor 15

Section III Proposal Evaluation Process

A. General

An OSA evaluation team will judge the merits of proposals received in accordance with the general criteria defined below.

During the evaluation process, the evaluation team may, at its discretion, request any one or all bidders to make oral presentations or answer questions about their proposals. Not all bidders may be asked to make such oral presentations.

The OSA will select the bidder whose proposal is most responsive to the State’s needs while being within available resources. The specifications within this RFP represent the minimum performance necessary for response.

B. Mandatory Criteria

1. The organization must be licensed to practice as a certified public accounting firm in the

State of Colorado.

2. The organization must have had a quality control review completed within the past 3 years.

A copy of the review must be included in the proposal.

3. The organization is independent for the engagement.

C. General Criteria

1. Adequacy and completeness of the proposal with respect to the information required by

Section II of the RFP.

2. Experience and stability of the organization.

3. Qualifications and experience of personnel, including any subcontractors, specialists, or consultants to be assigned to the engagement team.

4. Comprehensiveness and appropriateness of the proposed work plan.

5. Proposed hours and cost.

6. Proposed time frame for meeting project milestones and completing the engagement.

7. Acceptance of the OSA’s standard contract and its related exhibits without significant revision.

16 Colorado Office of the State Auditor

Section IV Supplemental Information

Attached to this RFP is the following document:

1. Standard OSA contract and related exhibits. See Section II(7) of the RFP for discussion.

The following web links provide additional information to assist in preparing the proposal:

• Prior Engagement

◦ The Disaster Emergency Fund, Agreed Upon Procedures report for the fiscal years ended June 30, 2023 and June 30, 2024:

▪ https://content.leg.colorado.gov/content/disaster-emergency-fund-agreed-upon-procedures-fiscal-years-ended-june-30-2023-and-2024

▪ The departments’ Disaster Emergency Fund’s performance audit report for Fiscal Years

2018 through 2022 is available at https://leg.colorado.gov/audits/disaster-emergency-fund.

• Audit and engagement reports for prior years are available at: Search Audits | Colorado

General Assembly

• Colorado Office of the State Auditor Website: Office of the State Auditor https://content.leg.colorado.gov/content/disaster-emergency-fund-agreed-upon-procedures-fiscal-years-ended-june-30-2023-and-2024 https://content.leg.colorado.gov/content/disaster-emergency-fund-agreed-upon-procedures-fiscal-years-ended-june-30-2023-and-2024 https://leg.colorado.gov/audits/disaster-emergency-fund https://leg.colorado.gov/audits/disaster-emergency-fund https://content.leg.colorado.gov/audits-search https://content.leg.colorado.gov/audits-search https://leg.colorado.gov/agencies/office-of-the-state-auditor

Exhibit A – i

EXHIBIT A – STATEMENT OF WORK

A. GENERAL DESCRIPTION

The agreed upon procedures engagement shall be performed in accordance with attestation standards promulgated by the American Institute of Certified Public Accountants in Statements on Standards for Attestation Engagements, the standards for attestation engagements contained in Government Auditing Standards—2024 Revision issued by the Comptroller General of the

United States, and Fiscal Rules promulgated by the State Controller.

The compilation engagement shall be performed in accordance with Statements on Standards for Accounting and Review Services promulgated by the Accounting and Review Services

Committee of the American Institute of Certified Public Accountants.

B. Contractor’s Obligations

1. Scope of Work

a. The Work to be performed by Contractor includes the following:

Agreed upon procedures work to be performed for the fiscal years ending June 30, 2025 and June 30, 2026, consists of the following:

Performance of the following agreed upon procedures on the DEF:

1. Hold an entrance conference with the Office of the State Auditor (OSA), Governor’s

Office of State Planning and Budgeting (OSPB), and the Department of Public Safety

(DPS) [including staff within the Division of Homeland Security and Emergency

Management (DHSEM) and the Division of Fire Prevention and Control (DFPC)] on or before August 13, 2026.

2. Gain an understanding of the departments’ internal controls for accurately and completely tracking disaster spending in the State during Fiscal Year 2025 (FY25) and

Fiscal Year 2026 (FY26).

a. Develop an understanding of internal controls over this area through:

ii. Process Documentation

b. Identify the population of Executive Orders (EO) related to the State’s Governor-declared disasters that were effective in FY25 and FY26 and test for completeness and accuracy when compared to what was recorded in the State’s accounting system

Exhibit A – ii

– Colorado Operations Resource Engine (CORE) - (e.g.., spending authority, encumbrances, etc.) and OSPB’s quarterly DEF reports.

3. Agree OSPB’s quarterly reports required by Section 24-33.5-706(7), C.R.S. for the 2 most recent fiscal years (FY25 and FY26) to the information recorded in CORE, to assist the users of the report in determining whether the OSPB’s reports to the General

Assembly on the DEF are accurate, complete, and in compliance with statutory requirements.

4. Obtain a DEF trial balance from OSPB for FY25 and FY26 showing activity and balances of accounts included in the DEF for each fiscal year.

5. Compile a summary schedule of revenues and expenditures and changes in fund balance

(Schedule) for the DEF for the fiscal years ended June 30, 2025 and June 30, 2026. The

Schedule will be presented in accordance with the requirements of Section 24-33.5-706, C.R.S. and is not intended to be a presentation in accordance with accounting principles generally accepted in the United States of America (GAAP).

6. Evaluate DPS’s and OSPB’s internal controls in place during FY25 and FY26 over the

DEF’s revenues, expenses, transfers, and related account balances. This should include internal controls over reimbursements to, and from, the DEF in accordance with statute.

a. Develop an understanding of internal controls over DEF revenues, expenses, transfers, and reimbursements through:

ii. Process Documentation

7. Select a sample of amounts transferred out of the DEF into other State funds during FY

25 and FY26.

a. For the selected transactions in the sample, conduct testing to assist the users of the report in determining whether the transactions are properly supported, accurately

Section 24-33.5-706, C.R.S. and other applicable statutes.

8. Select a sample of amounts transferred into the DEF, including Governor’s Office

Executive Order transactions from the State Emergency Reserve (SER), or other sources, and reimbursements from other departments.

9. For the selected transactions in the sample, conduct testing to assist the users of the report in determining whether the transactions are properly supported, accurately

Exhibit A – iii

Section 24-33.5-706, C.R.S. and other applicable statues.

10. Hold an exit conference with the OSA, OSPB, and DPS on or before November 12, 2026 to discuss the results of procedures and any findings.

Such work will result in the issuance of a final combined agreed upon procedures and compilation report on November 19, 2026 with a brief description of the DEF, including a summary schedule of the DEF’s revenues, expenses, and changes in fund balance as of the fiscal years ended June 30, 2025 and June 30, 2026. In addition, this report will include an

Independent Accountant’s Report on Applying Agreed Upon Procedures and a Compilation

Report of Independent Accountants. The report should also include the results of the procedures conducted as part of the review. A draft report shall be provided to the OSA and approved by the OSA prior to submission to DPS or OSPB, and DPS and OSPB.

2. Review by State

During the performance of Services under this Contract and prior to completion of the

Work by the date specified in §F.1. of this Contract, the State has access to and the right to review Contractor’s Work and Work Product, whether in draft or final form, for acceptability and to provide guidance, direction, and feedback and suggest revisions.

Contractor may not submit written management letters, findings, or the Attestation Report, whether in draft or final form, to the Agency or Agencies until they are deemed acceptable and approved by the State. A draft Attestation Report, including findings and management letters, will be submitted to the State for review by October 8, 2026.

3. Availability

Contractor, upon the request of the State, shall furnish copies of Contractor’s work programs developed pursuant to this Contract and make all other workpapers available to the State for review or use in future audits at no additional charge to the State.

4. Reports

Contractor shall prepare and deliver the Attestation Report to the State on the due dates set forth in this Contract, as applicable. All Work will be completed no later than November 19, 2026, unless the State has approved an extension of time. If Contractor becomes aware that the due date for the Attestation Report cannot be met, Contractor shall notify the State in writing of the reasons for the delay and identify a specific date when the Attestation Report will be delivered. For a separately issued Attestation Report, Contractor shall deliver to the

State up to 50 copies of the bound report as determined by the State at the time of report finalization. Acceptable binding formats for the Attestation Report are limited to spiral, comb, or glued bindings; 3-ring bindings are not acceptable. Contractor shall also deliver to

Exhibit A – iv the State an electronic copy of the Attestation Report in unprotected Adobe PDF format or any other format prescribed by the State.

5. Oral Presentations

Upon the request of the State, Contractor shall make an oral presentation of the Attestation Report to the Legislative Audit Committee and, if applicable and upon notification by the State, one other legislative committee.

6. Entrance and Exit Conferences

The State shall participate in all entrance and exit conferences between the Agency or Agencies and Contractor, as well as other critical meetings, such as those dealing with findings.

7. Fraud

If Contractor becomes aware of fraud or indications of fraud affecting the Agency or Agencies, Contractor shall notify the State immediately. Contractor shall follow guidance contained in the applicable revision of Government Auditing Standards issued by the Comptroller General of the United States regarding the reporting of such fraud or indications of fraud.

C. Personnel

1. Contract Monitor

Contractor’s performance under this Contract shall be monitored by NAME OF

CONTRACT MONITORS, an employee or agent of the State, who is hereby designated as the Contract Monitor. The Contract Monitor shall review Contractor’s Work and Work

Product, attend key meetings (e.g. entrance and exit conferences), and act as a liaison between the OSA, Contractor, and the Agency or Agencies. With the exception of contract monitoring activities, and unless otherwise noted in this Contract, the State is not required to provide any additional staff time in connection with the Services provided or Work performed.

2. Other Key Personnel

The key personnel identified by Contractor in the Contractor’s Proposal are deemed to be essential to the Work being performed under the Contract.

3. Replacement

Contractor shall immediately notify the State if any key personnel cease to be employed by

Contractor. Before diverting any key personnel to other programs, Contractor shall give the

State fifteen (15) days advance notice and shall submit to the State justification, including proposed personnel substitutions, in sufficient detail to permit evaluation of the impact on

Exhibit A – v the Contractor’s performance of the Work. Contractor shall not divert any key personnel without the prior written consent of the State, which the State shall not unreasonably withhold. Contractor shall replace any key personnel with personnel of substantially equal or greater ability and qualifications to perform the Work.

D. Acceptance Criteria

If the State determines that the Work or Work Product is unacceptable (either before or after a draft or a final Attestation Report is issued) due to Contractor’s failure to comply with applicable auditing standards or satisfy any requirements included in this Contract, the State, at the State’s direction, may require Contractor to re-perform the Work at its own expense and submit a revised Work Product. The State’s right to reject Contractor’s draft or final Attestation Report because of the failure to comply and Contractor’s obligation to re-perform or revise extend throughout the term of this Contract and continue for one (1) full year after the termination of this Contract.

E. PAYMENTS

Payments shall be made in accordance with Exhibit F and any other applicable provisions of this Contract.

THE REST OF THIS PAGE INTENTIONALLY LEFT BLANK

Exhibit B – i

EXHIBIT B – REQUEST FOR PROPOSAL

Exhibit C – i

EXHIBIT C – MODIFICATIONS TO CONTRACTOR’S PROPOSAL

Exhibit D – i

EXHIBIT D – CONTRACTOR’S PROPOSAL

Exhibit E – i

EXHIBIT E – INFORMATION SECURITY POLICY FOR CONTRACTORS

A. Applicability

This policy applies to all OSA Contractors at all locations who are conducting audits or professional services on behalf of the OSA using State of Colorado information or any information, electronic or otherwise, obtained, utilized, or generated by an OSA Contractor while performing work on behalf of the OSA.

B. Definitions

Confidential information assets – are defined in paragraph 5. below.

OSA Contractor(s) or Contractor(s) – any business, company, corporation, partnership, or individual conducting business on behalf of or in cooperation with the OSA, whether via contract, purchase order, or other purchasing agreement. OSA Contractors include

Subcontractors and their employees.

Protected information assets - are defined in paragraph 4. below.

State of Colorado information, information or audit information – any information, whether in electronic or hard copy form, obtained, utilized, or generated by an OSA Contractor while performing work on behalf of the OSA.

C. State Auditor Authority and Responsibility

The State Auditor’s authority and responsibility for accessing and handling confidential information is set forth in the Colorado Revised Statutes. §2-3-107(2)(a), C.R.S., provides that the State Auditor or his or her designated representative “shall have access at all times... to all of the books, accounts, reports, vouchers, or other records or information in any department, institution, or agency, including records or information required to be kept confidential or exempt from public disclosure upon subpoena, search warrant, discovery proceedings, or otherwise.” Additionally, §2-3-103(3), C.R.S., provides that “work papers of the office of the

State Auditor shall be open to public inspection only upon approval of the majority of the members of the audit committee” and that “work papers that have not been specifically approved for disclosure by a majority vote of the committee shall remain confidential.” Finally, §§2-3-103.7 and 2-3-107(2)(b), C.R.S., prescribe penalties for willful or unlawful release of confidential information and prohibit the release of information required to be kept confidential pursuant to any law. The volume and availability of confidential information in electronic and hardcopy format, along with the risk to the OSA should confidential information be inadvertently released or breached, heightens the need for rigorous procedures governing the receipt, storage, and destruction of confidential data.

Exhibit E – ii

D. Policy Compliance

1. All OSA Contractors and their personnel who are performing the Work are required to understand and abide by this policy.

2. By signing an OSA contract or purchase order, an OSA Contractor agrees to abide by this policy and require its personnel performing the Work, including Subcontractors and their employees, to understand and abide by this policy.

E. Data Classification

3. Any State information asset whether in hardcopy or electronic form (e.g., data, databases, reports, communications, manuals, documentation for systems, procedures, and plans) that is used in the course of an audit on behalf of the OSA is considered either “Protected” or

“Confidential,” unless expressly stated otherwise in writing by the State Auditor.

4. “Protected information assets” are defined as information that: (i) is required by federal, state, or local laws and statutes to be protected; or (ii) would, in the event of a breach of confidentiality, loss of integrity, or lack of availability, seriously and adversely impact the

OSA or the State, up to and including physical harm to individuals, or cause significant hardship to the OSA, the State, or commercial entities that have entrusted the information to the OSA.

5. All OSA Contractor audit information not categorized as “Protected” are automatically classified as “Confidential.”

F. Use and Protection of Information Assets

6. Contractors must take reasonable and prudent measures to protect all OSA audit information and the systems that process, store, and transmit such information from unauthorized disclosure and modification regardless of where the OSA audit information and the systems are located.

7. All State information systems (e.g., networks, intranets, internet connections, telephones, fax, etc.) are the property of the State and are for State business use only. Contractor shall not use State information systems to knowingly access, store, or distribute offensive material, such as pornography. Contractors may not use State of Colorado systems to knowingly compromise other systems, networks or safeguards unless the OSA specifically authorizes them to do so in order to test the security of such systems, networks, or safeguards for legitimate State purposes.

8. Any unauthorized attempt to access information that is outside Contractor’s “need-to-know” for his/her operational purposes is prohibited.

Exhibit E – iii

9. Contractors must encrypt all “Protected” and “Confidential” information when stored on portable computers or removable media (e.g., laptops, external hard drives, CDs, USB drives.)

10. Contractors must, at all times, physically secure portable computers used in storing and processing audit information on behalf of the OSA through the use of cable locks or other security measures or, when physically securing a portable computer at a work site is not feasible, use encrypted devices or other security measures to ensure that theft of a portable computer does not result in the loss or disclosure of State Confidential Information or Work

Product.

11. Contractors shall not leave any portable computers, removable media (e.g., laptops, external hard drives, CDs, USB drives), or hard copy information containing “Protected” and

“Confidential” information unattended, such as in vehicles or in checked airport luggage.

G. Viruses and Malicious Code

12. Contractors must effectively deploy personal firewall security and up-to-date malicious code/virus protection software for all systems and devices used to access audit information or in carrying out official OSA business.

H. Telecommunications Security and Information Transmission

13. Contractors are responsible for being aware of and protecting against current and potential telecommunications (e.g., telephones, voice mail, mobile phones, conference calls, instant messaging, and facsimile machines) security risks in their given environment.

14. Contractors are prohibited from connecting to any state networks in connection with the

Services hereunder without prior authorization from the OSA and the information security officer of the Agencies. In the case of executive branch agencies, Contractors should submit a request with their agency liaison to obtain permission through the Governor’s Office of

Information Technology access management team.

15. Contractors shall make every effort to ensure that all State of Colorado information is protected from inadvertent disclosure when being sent over the Internet or other non-State of Colorado networks.

16. Contractors shall not connect portable computers containing “Protected” or “Confidential” data to any public WiFi networks (e.g., internet cafes) without adequately protecting such information through the use of hard drive encryption and the use of an encrypted VPN tunnel.

Exhibit E – iv

17. Contractors must always consider information sensitivity and transmission security issues when selecting a transmission medium. “Protected” and “Confidential” data must only be transported or transmitted over a public network when protected by encryption.

18. When data is stored on electronic media or a mobile computing device, the data must be encrypted at all times during physical transport.

19. Transmission of Protected or Confidential data over a public network by unencrypted email is prohibited.

I. Information Storage and Disposal

20. Media or hard copy documents containing Protected or Confidential information are to be appropriately labeled as such and protected in accordance with this Exhibit E.

21. Contractors must maintain physical media security by using locking filing cabinets or drawers and locking them when left unattended. Media security may also be achieved by locking the door of a private office.

22. Personal computers, laptops, USB drives, mobile phones, personal digital assistants (PDAs), and other devices and media containing State of Colorado information must be secured by their users from loss, theft, and unauthorized use.

23. Contractors shall not leave unattended any device containing State of Colorado information unless a password-engaged screensaver is used. The screen saver must engage after no more than 2 minutes of inactivity unless Contractor has a policy that requires its employees and its

Subcontractors’ employees to manually lock the device when leaving it unattended.

24. Contractors must ensure that portable storage devices (e.g., external hard drives, CDs, USB drives) that will be leaving their effective control or are at the end of their useful lives, are cleaned and sanitized (i.e., cleared, purged, and destroyed) of all Protected or Confidential data in conformance with NIST Special Publication 800-88 or other standard procedures and requirements set by the U.S. Department of Defense, such as DoD 5220.22-M.

25. Hard copy documents containing Protected or Confidential information must be shredded prior to disposal.

26. Data storage devices (CDs, DVDs, and floppy disks) containing Protected data must be physically destroyed at the end of the audit. For thumb drives and portable hard drives, Contractor must either use an electronic shredding program to destroy the data or destroy the device at the end of the audit. A record of disposal is to be maintained in the workpapers by the Contractors. A record of disposal must contain the name of the individual disposing of the data, the method used to dispose of the data, identifying qualities of the data (such as

Exhibit E – v the serial number of the media on which it was stored, if applicable), and the date of disposal.

J. Incident Reporting

27. All suspected loss or compromise of OSA audit information as a result of the loss of a desktop, portable, or mobile computing device or removable storage device by any means

(e.g., theft, loss) used to store State of Colorado data shall be reported to the OSA Contract

Manager within 24 hours of discovery.

28. In the event of the suspected loss or compromise of OSA audit information under control of Contractor, Contractor is responsible for working with the State Auditor and the

Agencies with respect to recovery and remediation. Contractor is also responsible for working with the OSA and the Agencies to notify all Colorado residents and other affected parties whose sensitive data may have been compromised as a result of the breach.

Contractor will bear all reasonable associated costs.

K. Personnel Security

29. Contractor is responsible for performing background checks consistent with Contractor’s standard employment practices for Contractor personnel completing work on behalf of the

OSA.

L. Policy Enforcement

30. If Contractor is deemed to be in noncompliance of this policy by the State Auditor, the State

Auditor may unilaterally terminate the Contract.

31. Upon request by the State Auditor, Contractor agrees that it shall make available qualified individuals and a member of senior management responsible for security and data protection, for the purpose of discussing information technology controls, including those policies, procedures, and controls relevant to the provision of services and security obligations under this Contract.

Exhibit F – i

EXHIBIT F – COMPENSATION AND PROCEDURES FOR BILLING

A. Contractor shall submit all invoices for services to the State. Payment will be made from the

State Auditor’s appropriation. Contractor shall not request payment from the Agencies.

B. Contractor may render monthly interim bills to the State until completion of the Work, provided that the aggregate amount of all bills shall not exceed the maximum compensation set forth in

§C of this Exhibit F. The interim bills shall be promptly paid by the State except that the State reserves the right to withhold 10 percent of the total Contract amount until delivery and acceptance of the Attestation Report. Release of the Attestation Report by the Legislative Audit

Committee constitutes acceptance of the Attestation Report.

C. Total maximum compensation for the Work shall be $XXX,XXX:

Total 2026-2027*

Disaster Emergency Fund Agreed Upon Procedures and

Compilation

$xxx,xxx $xxx,xxx

Total Fee $xxx,xxx $xxx,xxx

* Paid from State’s budget period

Exhibit G – i

EXHIBIT G – REPORTING…