OSA Inquiries & Responses, Sports Betting RFP Oct 16 2026.pdf

1375 Sherman Street, 5th Floor ● Denver, Colorado 80203-2246 ● 303.869.2800 ● osa.ga@coleg.gov ● www.colorado.gov/auditor

Office of the State Auditor

Kerri L. Hunter, CPA, CFE

State Auditor

October 16, 2026

A Request for Proposals for a Financial and Compliance Audit of Colorado Sports Betting, Fiscal Year 2026

Responses to Prospective Bidder Inquiries

1. Schedule A lists the Division of Gaming introductory meeting and the start of fieldwork as

11/7/2026. That is a Saturday. Is that date firm, or should we propose a business day (for example, Monday 11/9) for both?

OSA Response: The OSA estimates November 5, 2026 for the contract’s execution date and seeks an initial planning meeting between the OSA staff and the Contractor within the first business days of the contract. The introductory meeting with the Division of Gaming may happen the same business day, or shortly thereafter, as the initial planning meeting with the

OSA. These dates can be adjusted as needed. Yes, you can propose a business day for these meetings.

2. The RFP says OSA will hand over documentation collected from the Division during its July–

September 2026 planning work. Which materials should we expect (planning memo, data requests, workpapers, Division documentation)? Will they be available at the 11/5 planning meeting, so we can build the work plan and budget around them?

OSA Response: The OSA in-house team has compiled approximately 400 documents during initial audit planning. These include statutes, regulations, and Division policies, procedures, and forms and checklists used for the processes this audit will review. It includes interview work papers with Division management and staff, and Commissioners; Division organizational chart, contact information, and strategic planning/performance measures; and Sports Betting Fund data extracted from the State’s accounting system. It also includes the Division’s monthly tax filing summary reports for the 21 licensed operators, staff tracking tools for investigations and inspections, and examples of completed tax reconciliations, inspections and investigations. The

OSA anticipates the information and data compiled will allow the Contractor to expedite its planning work, including its approach to sampling and analysis methodologies.

Colorado Office of the State Auditor 2

The OSA will begin providing the information collected during the initial Planning Meeting with

OSA. Any confidential information from the Division will not be shared until the Contractor satisfies the requirements for conducting background checks/fingerprinting and ensuring personnel are versed in applicable privacy and information security laws and standards.

3. Can you confirm whether staff assigned to the engagement can be added after award?

OSA Response: Proposals must identify the audit team, detail their relevant experience and areas of expertise. Exhibit A, Section C, Sub-parts B and C, of the OSA standard contract provide that the key personnel identified by the Contractor in the Contractor’s Proposal are deemed to be essential to the work being performed under the contract. The Contractor must notify the OSA immediately if any key personnel will no longer be assigned to the Contract and must submit justification for the change, including any proposed personnel substitutions, subject to the OSA’s written consent to the change.

4. Is any budget range or prior cost available?

OSA Response: The OSA has not established a budget or estimated cost for the audit.

5. What access will the contractor have to the Division's operator activity data and tax submission documentation? Will access be provisioned through a secure portal at contract start, or does it depend on completing the privacy and security training first?

OSA Response: All data for this project will be extracted and provided by Division staff upon request and after any necessary background checks and security training requirements are satisfied. If it is needed, data security training will be conducted during the initial Planning

Meeting with the OSA contractor and in-house staff.

6. The RFP requires background checks and fingerprinting for all assigned personnel, and no billable work can begin before the contract effective date (about Nov 5). Can we start the fingerprinting and background check process before award so it's complete by a Nov 5 start? If not, may personnel begin work while results are pending, and what turnaround should we assume?

OSA Response: The timing of when the background and fingerprint checks occur is up to the discretion of the Contractor, within OSA parameters. We consider this to be related to staff qualifications as noted in the RFP. Our requirement is that the background and fingerprint check must be completed and the results communicated to the OSA before a staff member can work on this audit engagement. If staff have already undergone a background and fingerprint check previously, and those results are still valid, you can provide those to us. Please also see response to #5.

Colorado Office of the State Auditor 3

7. Sections I(B) Background Information and I(C) Services Required (p. 3–9 of 21): Does

OSA intend to make available its relevant workpapers or deliverables from the 2022 audit to the selected Contractor?

OSA Response: The OSA does not anticipate that workpapers from the 2022 audit will be relevant or necessary, based on this audit’s scope and objectives. As warranted, the OSA

Contract Monitor will coordinate with the Contractor if information is needed to supplement the public status report for the 2022 audit, which is linked in the RFP (p20) and on the OSA’s website.

8. Section I(C) Services Required, Schedule A—Planning Meeting and

Introductory/Transition Meeting (p. 9 of 21): Would OSA provide additional information regarding the extent of work already completed by the OSA audit team, to include responses to the following:

A. Has the OSA team developed a detailed audit program with specific procedure steps the

Contractor will be expected to carry out?

B. What data or documentation has already been obtained for each objective?

C. To what extent has any testing or analysis been completed, including data reliability assessments, sample selection, development of testing sheets, or completion of initial testing?

D. Has OSA developed or pretested any survey questionnaires or obtained contact information for survey respondents?

OSA Response: Please also see response to #2. The OSA has not developed the audit plan details queried here, selected any samples, conducted any testing, or developed survey questionnaires. The Contractor will be responsible for planning and conducting the audit to obtain sufficient, appropriate evidence to support its work and any findings.

9. Section I(C) Services Required, Schedule A—Planning Meeting and

Introductory/Transition Meeting (p. 9 of 21): During the planning work that OSA has already completed, did OSA encounter any delays in responsiveness from the auditee?

OSA Response: No, the OSA has not encountered any delays in responsiveness from the auditee.

10. Section I(C) Services Required, Schedule A—Planning Meeting and

Introductory/Transition Meeting (p. 9 of 21): Would OSA please confirm whether the

November 5 and November 7 dates are fixed requirements or target dates that may be adjusted based on the contract effective date?

Colorado Office of the State Auditor 4

OSA Response: Please see response to #1.

11. Section I(C) Services Required, Schedule A—Draft Written Findings (p. 9 of 21): We have historically encountered delayed responses from auditees during the holiday season. Given that the majority of fieldwork must be completed during this time, would OSA be open to considering a staggered time frame for delivering the initial audit findings by objective that is designed to ensure that approved findings are still able to be submitted to the Division by

February 19?

OSA Response: The OSA has a rigorous findings review process that includes review and revision at multiple levels; prospective bidders should take this into consideration when preparing a proposed calendar and budget. The OSA Contract Monitor will help the Contractor coordinate findings revisions to meet deadlines, including using rolling or staggered findings delivery and review if needed.

12. Section I(C) Services Required, Audit Objectives, Scope, and Methodology (p. 6–8 of 21):

Would OSA please specify the beginning and ending scope periods for analysis of the Division’s compliance inspections, complaints, background investigations, and Hold Harmless Fund activity?

OSA Response: For compliance inspections and complaint and background investigations

(Objective 2), as well as Division reconciliation of monthly taxes from operators (Objective 1) the scope period is July 1, 2025 through September 30, 2026 (i.e., Fiscal Year 2026 and Quarter 1 of Fiscal Year 2027). For the Hold Harmless Fund (Objective 3), all activity since the Fund’s inception in 2021 should be reviewed. Note that as discussed in the RFP (p. 4), it is the OSA’s understanding that no disbursements have been made from this Fund, as of September 2026, since its inception.

13. Section I(C) Services Required, Work Location (p. 6 and 8 of 21): Would OSA please clarify any geographic-work restrictions and any restrictions or approval requirements for analytics tools?

OSA Response: At this time, the OSA expects that most of the work for this audit can be done remotely and that any travel within/to Colorado would be limited. The Contractor must ensure, for any analytics tools used, that all security requirements and standards are maintained and the tools used are disclosed to the OSA, and may need to be disclosed in the audit report.

14. Section I(C) Services Required and Section II(A)(5) Qualifications of Assigned

Personnel (p. 6 and 17 of 21): In light of the short audit time frames (11 weeks from initiation on November 5 to preliminary findings on January 22), would OSA please clarify the estimated processing time for staff onboarding (including background checks and fingerprinting) and

Colorado Office of the State Auditor 5 confirm whether personnel may begin non-data-access planning work while those clearances are pending?

OSA Response: Please see responses to #2, #5, and #6.

15. Section I(C) Services Required and Section II(A)(5) Qualifications of Assigned

Personnel (p. 6 and 17 of 21): Would OSA please provide the required attestation language and clarify how “member of their household” and “participate in sports betting activities” will be interpreted for assigned personnel, including whether passive investments, fantasy leagues or contests, or prediction markets are included?

OSA Response: The assigned personnel must each provide a signed statement of understanding to confirm that neither they, nor anyone living in their household, will participate in any sports betting during the duration of the contract, or activities that would threaten their independence, or give the appearance of a threat to their independence for this engagement.

Threats to independence, as well as the appearance of a threat to independence as outlined in generally accepted government auditing standards issued by the U.S. Comptroller General may apply to activities such as, but not limited to passive investments and fantasy league/contest and prediction market activities.

16. Section I(C) Services Required, Schedules A and B (p. 9–13 of 21): Would OSA provide the expected frequency and duration of Division briefings?

OSA Response: The OSA expects the Contractor to conduct Division briefings at a frequency and for a duration as is needed to proactively inform the Division of the Contractor’s audit work progress and results and obtain their input. The OSA typically works with the auditee to establish a schedule for the audit briefings, such as every 2 weeks during the fieldwork phase of the audit.

17. Section I(C) Services Required, Schedule B—Final Report and Legislative Audit

Committee Hearing (p. 12–13 of 21): Would OSA please clarify which Contractor team members must attend the in-person hearing and two practice sessions and confirm the expected location and anticipated duration of each session?

OSA Response: At the in-person hearing, any Contractor staff who will be presenting the audit report, including findings and recommendations, and responding to Legislative Audit

Committee questions related to the audit work must attend the hearing in person. The in-person hearings typically last 1 – 2 hours. Practice sessions of the Contractor’s presentation may be conducted virtually; these also typically last 1 – 2 hours each, depending on the number of findings.

18. Section II(A)(8) Compensation and Staff Hours (p. 18 of 21): Would OSA please provide any available estimate of the anticipated total level of effort or budget for the engagement, Colorado Office of the State Auditor 6 including expected hours by labor category or by audit objective, that offerors may use to assess the reasonableness of proposed staffing and fees?

OSA Response: The OSA does not have estimates of the anticipated level of effort or budget for the audit. Bidders should use their judgment to estimate the number of hours needed to complete the required audit objectives. Please also see response to #4.

19. Section II(A)(8) Compensation and Staff Hours (p. 18 of 21): Would OSA please confirm whether the maximum fee includes travel, printing, background checks, fingerprinting, secure technology, and other direct expenses, and clarify whether any such costs should be separately identified?

OSA Response: Contractor costs should be calculated and reported as directed in Section

II(A)(8) of the RFP. Additional costs will not be separately reimbursed.

20. Section II(A)(7) Contract Terms and Conditions (p. 17–18 of 21): Would OSA please confirm whether proposed exceptions and alternative language submitted with the proposal may be negotiated after selection without rendering the proposal nonresponsive?

OSA Response: Any proposed exceptions and/or alternative language to the OSA’s standard contract must be submitted with the proposal, as stated in Section II (A)(7) of the RFP, and will be considered as part of the proposal evaluation process, as stated in Section III(C) of the RFP.

The OSA will work with the selected contractor to finalize contract language after proposal selection.

21. Section I(C) Services Required, Objective 1—Sports Betting Taxes (p. 7 of 21): Would

OSA provide the number of Fiscal Year 2026 and 2027 tax submissions and reconciliations available for testing and clarify the expected sampling approach?

OSA Response: Please also see responses to #2 and #12. For Objective 1, the available data for Contractor sampling and/or other analyses will be based on monthly taxes submitted by 21 licensed Sports Betting operators (ep 5), for the period July 2025 through September 2026. The

Contractor is expected to plan audit test work and sampling approaches that are sufficient to address the audit objective.

22. Section I(B) Background Information, Sports Betting Operator Tax Revenue and

Section I(C) Objective 1—Sports Betting Taxes (p. 4 and 7 of 21): Would OSA identify the available systems, file formats, data dictionaries, and record-level fields and clarify whether access will be read-only or through secure extracts?

OSA Response: Please also see responses to #2 and #5. Data and other documentation are primarily MS Word and Excel, and Adobe files.

Colorado Office of the State Auditor 7

23. Section I(C) Services Required, Objective 1—Prediction Markets (p. 7 of 21): Would OSA please clarify the expected methodology and level of assurance for quantifying the effect of operators shifting to prediction-market offerings, particularly where operator-specific revenue or customer migration data may not be available to the State?

OSA Response: The number of licensed operators in Colorado has decreased from 39 in 2022 to 21 currently, and the Division indicated operators may have left state-regulated sports betting to become prediction markets (RFP p5). Work for this objective may include confirming how many, if any, formerly licensed operators now offer prediction markets for sports betting. The

RFP recognizes there may be data limitations with quantifying the impact of these changes on

Colorado’s sports betting tax revenue.

24. Section I(C) Services Required, Objective 1—Sports Betting Tax Verification (p. 7 of 21):

Would OSA please confirm whether the Contractor will receive operator-level source records supporting wagers, payouts, voids, cancellations, resettlements, free bets, adjustments, and loss carryforwards, and whether operator-submitted records may be obtained directly from selected operators when Division files are incomplete?

OSA Response: Operators submit daily and monthly reports to the Division to support tax calculations. All documentation and data for this audit will be from the Division; no information will be requested directly from operators.

25. Section I(C) Services Required, Objective 2—New Patron Protection Requirements (p.

6–7 of 21): Because Senate Bill 26-131 became effective in August 2026, would OSA please clarify whether the Contractor is expected to assess implementation design, early operating effectiveness, or both for the credit-card prohibition, push-notification prohibition, and daily deposit cap?

OSA Response: Within the context of the objective, the Contractor should expect to assess the extent to which the Division has designed and implemented regulatory activities that account for the new requirements in Senate Bill 26-131.

26. Section I(B) Background Information and Section I(C) Services Required, Objective 2—

Follow-Up on the 2022 Audit (p. 5–7 of 21): Does OSA intend to provide its implementation-status review and supporting validation for the 2022 recommendations to the Contractor?

OSA Response: Please see response to #7.

27. Section I(C) Services Required, Objective 2—Background Investigations (p. 7 of 21):

Would OSA please identify how many of the 21 currently licensed operators or related principals involve foreign ownership, operations, or regulatory history, and whether translated records, foreign-regulator inquiries, third-party investigative reports, and other international-source documentation will be available for Contractor review?

Colorado Office of the State Auditor 8

OSA Response: The OSA does not have this information but does not anticipate it will be necessary to address the audit objective work necessary to confirm whether the Division has completed a background investigation for each operator.

28. Section I(C) Services Required, Objective 3—Hold Harmless Fund (p. 7–8 of 21): Would

OSA please identify the estimated number and categories of potential beneficiaries to be surveyed and clarify whether OSA expects a census or sample, a minimum response rate, and any required survey platform or approval process?

OSA Response: Potential beneficiaries are categorized in statute. The OSA in-house audit team will provide the Contractor information on entities included within the statutory language that the Contractor may use for developing its audit plan testing and work approaches, including determining how to conduct the survey of potential beneficiaries.

29. Section I(C) Services Required, Objective 3—Hold Harmless Fund (p. 7–8 of 21): Would

OSA please provide the annual number of applicants for the Hold Harmless Fund since its establishment?

OSA Response: Please also see response to #12. It is the OSA’s understanding that as of

September 2026, there have been no applications, and no disbursements have been made from the Hold Harmless Fund.

30. Bidder review. Bond Bookkeeping & Advisory is a newly established audit organization and has not yet reached the due date for its first external peer review under Government Auditing

Standards. Our principal has more than 14 years of experience leading GAGAS performance audits under firms that maintain current peer reviews. Will a proposal from a firm whose first peer review is not yet due be considered responsive? If so, what documentation of our system of quality management would the OSA like us to include in its place?

OSA Response: A copy of the results of the organization’s most recent external peer review is a minimum qualification requirement for this project (p17, #4-h Profile of the Organization).

31. Subcontractors. The RFP states that joint ventures will not be accepted. May the prime contractor use one or more subcontractors to perform audit work under its direction, with the prime retaining full responsibility for the engagement? If so, must subcontractors be identified, and their qualifications provided, in the proposal?

OSA Response: Proposals must identify the members of the audit team, including any subcontractors, and detail their relevant experience and areas of expertise (p17, #5

Qualifications of Assigned Personnel).

Colorado Office of the State Auditor 9

32. Estimated level of effort. Can the OSA share an estimated budget or range of hours for this engagement, or the cost of a comparable prior contracted audit, to help bidders scope their proposals?

OSA Response: Please see response to #4.

33. Onsite work. Apart from the Legislative Audit Committee hearing, does the OSA expect fieldwork at Division of Gaming offices, or may the work be done remotely?

OSA Response: Division data and documentation necessary for the audit are maintained electronically and as such, at this time, the OSA anticipates that fieldwork may be done remotely and does not need to occur in person at Division offices. However, if the need for in-person work becomes necessary, the Contractor will be expected to conduct that work on site.

34. Should the contractor evaluate the Division’s oversight processes, or also independently recalculate operator taxes and directly test operator compliance controls?

OSA Response: The audit focus is to assess the Division’s processes and oversight of the

Sports Betting program and fund. To conclude on the audit objectives, the Contractor should expect to review and assess tax reconciliation, investigation, and inspection processes and documentation maintained by Division staff, including the testing of a sample of completed

Division reconciliations and inspection and investigation reports.

35. What depth of analysis is expected for quantifying prediction-market impacts and assessing the

Hold Harmless Fund’s necessity?

OSA Response: The Contractor should use their experience to assess and describe in their proposal their approach to the engagement, for all 3 audit objectives.

36. Can you please confirm the review period for each objective and whether OSA has established minimum sample sizes or coverage expectations?

OSA Response: Please see responses to #2, #12, and #35.

37. Has OSA established a budget or anticipated fee range for this engagement?

OSA Response: Please see response to #4.

38. Section I(F) Submission of Proposals (p. 13 of 21): Would OSA please clarify how taking exceptions to the Terms & Conditions will affect scoring, and if OSA’s right to use proposal ideas will exclude proprietary material?

OSA Response: As stated in Section III(C) of the RFP, acceptance of the OSA’s standard contract and its related exhibits without significant revision is a factor that is considered in

Colorado Office of the State Auditor 10 scoring proposals. Please also see response to #20. The OSA’s right to use proposal ideas does not include proprietary material.

39. Section I(N) Submission of Invoices (p. 15 of 21): Would OSA please clarify if the 10% holdback will be released by a fixed date if the Committee hearing slips?

OSA Response: The OSA will withhold payment for 10 percent of the total contract amount pending satisfactory completion of the contract scope of work, which occurs after the

Legislative Audit Committee hearing when the final report is publicly released (RFP p5). The hearing will be held in June 2027.

40. Tax collection and review processes: Have there been previous audits of the Sports Betting

Fund?

OSA Response: The RFP describes and links to the OSA’s 2022 performance audit of Sports

Betting.

41. Tax collection and review processes: Have there been previous audits of operator payments to the Division in the past? If so, will they be available.

OSA Response: Please see response to #40.

42. Free bet deductions (House Bill 25-1311): What is the exact statutory language for the cap? The

RFP’s wording (“no more than 2 percent of total free bets placed”) could be read more than one way.

OSA Response: The RFP describes and links to the statutory language established in House Bill

25-1311.

43. Free bet deductions (House Bill 25-1311): What limits applied before July 2025? The RFP says the phase-out began in Fiscal Year 2025, but the listed caps start in Fiscal Year 2026.

OSA Response: Please see response to #42.

44. Background investigations: Are any operations running on temporary licenses, and has the 2022 audit’s temporary-license finding been corrected?

OSA Response: The RFP links to the 2022 performance audit status report, which includes information from the Division on its reported status of the audit recommendations. The RFP indicates that the contractor should evaluate the status of current sports betting operators, including confirming the Division can demonstrate that each operator has received a complete background investigation.

45. Misc: What is the audit period for each objective?

Colorado Office of the State Auditor 11

OSA Response: Please see response to #12.

46. Misc: What confidential data (tax, patron, investigative) will be available, in what format, and under what handling restrictions?

OSA Response: Please see responses to #5 and #22.

47. Misc: What performance goals has the Division set for these functions under the SMART

Government Act?

OSA Response: Please also see response to #2. The Division does not publicly post information about its performance goals.

48. Can OSA confirm the period under scope of the performance audit?

OSA Response: Please see response to #12.

49. Will the Contractor have to travel to Colorado to complete the background check and fingerprinting?

OSA Response: No, the contractor does not have to complete these in Colorado; they can be completed wherever the contractor and/or staff choose. Please also see response to #6.

50. Except for the Legislative Audit Committee, does the Colorado Office of the State Auditor

(OSA) require any other meeting or conference to be held in person?

OSA Response: No. Please also see response to #33.

51. Could the OSA provide additional guidance on the types of non-audit or consulting services performed for the Department of Revenue that would impair independence or create the appearance of an impairment? Does the OSA assess potential threats at the Department-wide level, or primarily based on services performed for the Division of Gaming and the Sports

Betting Program?

OSA Response: Proposals must disclose any and all work performed for the Colorado

Department of Revenue as described in the RFP (p16). For any work disclosed, proposals must affirm the organization’s independence and include an explanation of why prior, current, or planned work does not impair independence or create the appearance of an impairment for this engagement (p17).

52. What planning work developed by the in-house audit team between July and September 2026

(e.g., interviews, process notes, risk assessments, preliminary analyses, draft work programs) will be shared with the selected contractor, and which portions may be relied upon as audit evidence?

Colorado Office of the State Auditor 12

OSA Response: Please see response to #2.

53. Will the selected contractor have access to workpapers and recommendation follow-up documentation from the 2022 Sports Betting audit, and does the OSA expect validation of the related corrective actions to be a significant part of the current scope?

OSA Response: Please see response to #7.

54. Can the OSA provide estimated populations, transaction volumes, and reporting periods for monthly tax reconciliations, compliance inspections, complaint investigations, and operator background investigations to help bidders estimate testing effort?

OSA Response: Please see responses to #2 and #35.

55. What level of access will the contractor receive to the Division of Gaming's Python database, operator submissions, automated reconciliation logic, investigative records, and personnel? Will direct access to Division or State systems be required, and are there known data-quality or access constraints?

OSA Response: Please also see response to #24. The Contractor is expected to work directly with Division management and staff, and as needed, members of the Commission. There are no known data-quality or access constraints.

56. What level of data reliability assessment does the OSA expect over the Division's data sources, including the Python database, before substantive testing is performed?

OSA Response: The Contractor should use its judgment and prior audit experience to determine the level of reliability assessment needed to complete the required audit work. Please also see response to #35.

57. For the assessment of former operators that have shifted to prediction markets, what level of evidence and analytical precision does the OSA expect when identifying operators and quantifying the potential effect on sports betting tax revenue?

OSA Response: Please see responses to #23 and 35.

58. For the Hold Harmless Fund objective, has the population of potential beneficiaries been defined, and will the OSA or Division provide contact information? Does the OSA have expectations regarding survey methodology or the response rate considered sufficient to support conclusions?

OSA Response: Please see responses to #28 and #35.

Colorado Office of the State Auditor 13

59. Exhibit G states fiscal impacts should be quantified when possible. Does the OSA expect specific objectives to include financial impact estimates (e.g., tax revenue or Hold Harmless

Fund impacts), or would a qualitative explanation be acceptable where the necessary data is unavailable?

OSA Response: Please also see response to #35. The OSA strives to include quantitative information when possible, and recognizes the ability to do so can be limited if the necessary data is not available.

60. What security environment, secure file transfer capabilities, required training, documentation

(e.g., SOC reports or security policies), and restrictions on local storage or analytical tools should bidders incorporate into their methodology, staffing, and pricing?

OSA Response: Federal and Colorado privacy and information security laws and standards, and generally accepted government auditing standards issued by the U.S. Comptroller General apply to all documents, data, and information compiled for this engagement. Please also see Exhibit E of the OSA’s standard contract related to Information Security Policy for Contractors and response to #35.

61. Beyond the Legislative Audit Committee hearing, are there any milestones, meetings, or phases of fieldwork for which the OSA anticipates the contractor's physical presence in Colorado?

OSA Response: No. Please also see response to #33.

62. Exhibit A notes that additional audit work may lead to an expanded scope. Has the OSA identified any such areas, and how should bidders reflect potential scope adjustments or additional review iterations in the proposed maximum fee and delivery schedule?

OSA Response: Please also see response to #35. The OSA has not identified any areas that would expand the audit objectives, scope, and methodologies described in this RFP. The April

30, 2027 deadline to produce a final report that adheres to standards outlined in Exhibit H of the OSA’s standard contract, is required by statute and is non-negotiable.

63. Exhibit F states 10 percent of the contract amount will be withheld until the Audit Report is delivered and accepted. Can the OSA confirm whether acceptance occurs upon release at the

Legislative Audit Committee hearing or earlier in the reporting process?

OSA Response: As stated in Exhibit F of the OSA’s standard contract, release of the audit report by the Legislative Audit Committee constitutes acceptance of the audit report.

64. Has the OSA established an anticipated budget or funding range for this engagement? If so, would the OSA please provide that range to assist bidders in aligning the proposed approach, level of effort, and staffing model with the OSA's expectations?

Colorado Office of the State Auditor 14

OSA Response: Please see response to #4.

65. Is the prior incumbent that performed the previous audit eligible to submit a proposal in response to this RFQ? If so, are there any specific qualifications, differentiators, or value-added attributes that the OSA expects proposers to demonstrate beyond prior experience with the program or subject matter?

OSA Response: The 2022 performance audit was conducted by an OSA in-house audit team.

66. Will the Division provide complete, analysis-ready exports from the relevant systems, as applicable or will the contractor be responsible for extracting, combining, or preparing the information for analysis? To help with estimating preparation effort, please describe file formats, approximate volumes, consistency of layouts and identifiers, and known data-quality issues.

OSA Response: Please also see responses to #22 and #24. Based on the initial planning information and documentation collected by the OSA’s in-house team and this project’s objectives, we anticipate that Division data exports and reports will generally be ready for the

Contractor’s data reliability assessments and fieldwork analyses.

67. Section I(C) requires the Contractor to conduct background checks, fingerprinting and attestations for all personnel assigned to the engagement and provide the results to OSA. Please clarify when these requirements must be completed and the results submitted: with the proposal, before contract execution, before personnel begin engagement work, or before they access confidential or protected information. Is OSA review and clearance required before assigned personnel may begin work? Are there specified forms/documentation needing completed for the fingerprinting?

OSA Response: The timing of when the background and fingerprint checks occur is up to the discretion of the contractor, within OSA parameters. We consider this to be related to staff qualifications as noted in the RFP. Our requirement is that the background and fingerprint check must be completed and the results communicated to the OSA before a staff member can work on this audit engagement. If staff have already undergone a background and fingerprint check previously, and those results are still valid, you can provide those to us. We do not have specific forms that should be used, this would be determined by the jurisdiction completed the fingerprint check. Please also see responses to #2, #6, and #15.

68. What supporting transition records, monthly operator-level tax revenue and activity data, and existing analyses will be available to the contractor to assess the associated tax-revenue impact, where possible?

OSA Response: Please see response to #2.

Colorado Office of the State Auditor 15

69. Please provide a brief overview of OSA’s initial planning work and the information collected to date that will be transferred to the contractor, including any available notes from the July 7 entrance conference and subsequent meetings. Are there outstanding information requests or known access limitations that bidders should consider when preparing their work plan and schedule?

OSA Response: Please also see response to #2. There are no known access limitations.

70. What review periods should bidders use for testing the Division’s manual and automated tax-review processes, compliance inspections, and complaint investigations?

OSA Response: Please see response to #12.

71. Has OSA identified required supporting evidence that is not maintained by the Division and would need to be obtained directly from operators? If so, please describe the records, any access restrictions, and the arrangements available to facilitate contractor access?

OSA Response: Please see response to #24.

72. Has the Division or OSA identified formerly licensed operators that shifted to prediction-market offerings, and are supporting transition records and operator-level historical tax revenue available to the contractor? Please identify any existing analysis available for this portion of the audit.

OSA Response: Please see response to #2.

73. The mandatory criteria prohibit the organization and assigned personnel from serving as counsel, consultant, representative, or agent of Colorado sports-betting operators. Does this restriction also encompass sports-betting services to affiliated entities and/or parent entities operating in other jurisdictions? Additionally, does this restriction encompass services to non-sports-betting licensees?

OSA Response: Assigned personnel that offer sports betting services to affiliated entities and/or parent entities operating in other jurisdictions and/or services to non-sports betting licensees should be disclosed in the proposal.

74. Schedule B requires up to 50 bound printed reports, while Exhibit A provides for up to 100.

Please confirm the maximum quantity bidders should include in their proposed fee.

OSA Response: The OSA typically requires contractors to provide 50 bound reports, but this number could increase, up to 100, depending on the report and is subject to the OSA’s determination at the time of report finalization.

Colorado Office of the State Auditor 16

75. For Objective 2, does OSA have minimum testing expectations for compliance inspections, complaint investigations, and background investigations, including anticipated populations or sample sizes? Will the contractor have access to confidential licensing, complaint, investigative, and background investigation files needed to complete Objective 2?

OSA Response: Please see responses to #2 and #35.

76. Approximately how many monthly operator tax filings are in scope for Fiscal Year 2026 and

Fiscal Year 2027-to-date?

OSA Response: Please see responses to #2 and #12.

77. How many operators does OSA expect to include in tax testing, and does OSA anticipate testing each operator or a selection of operators?

OSA Response: Please see response to #35.

78. Approximately how many compliance inspections, complaints, complaint investigations, and background investigations are available for testing for the audit period?

OSA Response: Please also see responses to #2 and #12. There are 21 licensed operators who are required to receive at least one compliance inspection each year. Total populations of work the Division has conducted during the audit review periods are confidential.

79. Does OSA expect the contractor to test the design and operation of automated tax reconciliation controls, independently validate system calculations, or both?

OSA Response: Please also see response to #35. Within the context of the objective, the

Contractor should expect to obtain sufficient, appropriate audit evidence to assess the extent to which the Division’s processes for reconciling monthly tax submissions for accuracy are adequate

80. Regarding the Hold Harmless Fund: a. What information will be available to the contractor regarding potential Hold Harmless Fund beneficiaries, including any beneficiary lists or contact information, historical limited-gaming revenue distributions, and financial reports already maintained by the Division or collected by OSA? Has OSA developed any draft survey questions during initial planning, or should bidders plan to develop the survey instrument? Are there minimum expectations for the survey, including the population to be surveyed, or response-rate expectations? b. Will OSA or the Division provide a complete list of potential

Hold Harmless Fund beneficiaries and current contact information for survey administration? c.

Are prior inquiries, applications, denials, beneficiary communications, outreach materials, financial analyses, or legislative studies concerning the Fund available for review? d. Does OSA expect the financial trend analysis to cover all potential beneficiary classes, and what specific

Colorado Office of the State Auditor 17 revenue measures or comparison periods should bidders assume? e. Will OSA assist with survey outreach or follow-up if response rates are insufficient to support conclusions?

OSA Response: Please see responses to #2, #12, #28, #29, and #35. The OSA Contract

Monitor will assist with facilitating audit communication and logistics to ensure the project progresses but will not assist with any fieldwork activities.

81. Is there any flexibility in the proposed timeline for contract award and execution, or should respondents assume the dates included in the RFP are firm?

OSA Response: Please see responses to #1 and #62.

82. Does the OSA have a required file-transfer or collaboration platform or will that be determined by the contractor?

OSA Response: Secure file transfer will be coordinated by the Contractor, OSA Contract

Monitor, and Division.

83. Can OSA provide an anticipated budget range, ceiling, or historical level of effort for this engagement to help bidders align staffing and scope assumptions?

OSA Response: Please see response #4.