DAS Procurement Services, Version 4.5 March 31, 2023 Page 1 of 29

STATE OF OREGON

COVER PAGE

OREGON HEALTH AUTHORITY

Is issuing this Request for Proposals (RFP) 6171 OregonBuys Bid Number # S-44300-00018176 for

MMIS CONTROLS AUDIT

Date of Issue: October 23, 2026 Opening Date and Time (Proposal Due Date):

November 23, 2026 at 3:00 PM (Pacific Time)

OregonBuys Electronic Response or Email Response. Per RFP Sections 3.2.3 and 4.5 below, Proposer must submit its Proposal electronically through OregonBuys (see the process for electronic submission at OregonBuys Supplier Bid Solicitation Response).

Note: The Public Opening described in Section 4.8, to provide the name of each Proposer, will be completed by posting an Amendment to OregonBuys Bid Number S-44300- 00018176.

Single Point of Contact (SPC): Terri Ruddell

Address: 500 Summer Street NE, E-30 City, State, Zip Salem, OR 97301 Phone (voice) 971-283-4879 E-mail: theresa.m.ruddell@odhsoha.oregon.gov https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf mailto:theresa.m.ruddell@odhsoha.oregon.gov

DAS Procurement Services, Version 4.5 March 31, 2023 Page 2 of 29

The State of Oregon promotes equal opportunity for all individuals without regard to age, color, disability, marital status, national origin, race, religion or creed, sex or gender, sexual orientation, or veteran status.

TABLE OF CONTENTS

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

1.2 SCHEDULE

1.3 SINGLE POINT OF CONTACT (SPC)

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

2.2 DEFINITION OF TERMS

2.3 OVERVIEW AND PURPOSE

2.4 SCOPE OF WORK

SECTION 3: PROCUREMENT REQUIREMENTS

3.1 MINIMUM QUALIFICATIONS

3.2 MINIMUM SUBMISSION REQUIREMENTS

3.3 PROPOSAL REQUIREMENTS

SECTION 4: SOLICITATION PROCESS

4.1 PUBLIC NOTICE

4.2 PRE-PROPOSAL CONFERENCE

4.3 QUESTIONS / REQUESTS FOR CLARIFICATIONS

4.4 SOLICITATION PROTESTS

4.5 PROPOSAL DELIVERY

4.7. PROPOSAL DUE

4.8. PUBLIC OPENING

4.9 PROPOSAL REJECTION

4.10 EVALUATION PROCESS

4.12 RANKING OF PROPOSERS

4.13 SCORING AND RANKING OF PROPOSERS FOR SUBSEQUENT ROUNDS

SECTION 5: AWARD AND NEGOTIATION

5.1 AWARD NOTIFICATION PROCESS

5.2 INTENT TO AWARD PROTEST

5.3 APPARENT SUCCESSFUL PROPOSER SUBMISSION REQUIREMENTS

5.4 CONTRACT NEGOTIATION

SECTION 6: ADDITIONAL INFORMATION

6.1 COMMITMENT TO DIVERSITY, EQUITY, AND INCLUSION

6.2 CERTIFIED FIRM PARTICIPATION

6.3 GOVERNING LAWS AND REGULATIONS

6.4 OWNERSHIP/PERMISSION TO USE MATERIALS

6.5 CANCELLATION OF RFP; REJECTION OF PROPOSAL; NO DAMAGES

6.6 COST OF SUBMITTING A PROPOSAL

6.7 STATEWIDE E-WASTE/RECOVERY PROCEDURE

6.8 RECYCLABLE PRODUCTS

6.9 CHECKLIST DISCLAIMER

DAS Procurement Services, Version 4.5 March 31, 2023 Page 3 of 29

LIST OF ATTACHMENTS

The following are posted in the Attachments for OregonBuys #S-44300-00018176:

ATTACHMENT A SAMPLE CONTRACT

ATTACHMENT B DISCLOSURE EXEMPTION AFFIDAVIT

ATTACHMENT C PROPOSER INFORMATION AND CERTIFICATION SHEET

ATTACHMENT D REFERENCES

ATTACHMENT E PRICE PROPOSAL FORM

ATTACHMENT F COBID CERTIFICATION / OUTREACH PLAN

ATTACHMENT G RESPONSIBILITY INQUIRY

DAS Procurement Services, Version 4.5 March 31, 2023 Page 4 of 29

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

The State of Oregon, acting by and through the Oregon Health Authority, (“OHA” or “Agency”), is issuing this Request for Proposal for an auditor to provide Agency with Medicaid Management Information System (MMIS) Controls Audit services consisting of System and Organizational Controls (“SOC”) Type 2 Reports* or “Controls Audits” in accordance with American Institute of Certified Public Accountants (AICPA) Auditing Standards Board (ASB) Statement on Standards for Attestation Engagements (SSAE) No. 18 for five fiscal year periods starting with State Fiscal Year (SFY) July 1, 2026 – June 30, 2027.

Agency expects the award of one Contract with an initial anticipated Contract term of 5 years with the options to extend for an additional 2 years for a total of 7 years, by written amendment to the Contract. Agency reserves the right to amend for more time and money, as needed.

As explained further in Section 2.4 Scope of Work below, OHA is seeking a SOC 2, Type 2 review and Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (ICFR) (SOC 2 Report), in accordance with the standards established by the AICPA for the portions of OHA’s MMIS designed, built, or operated by OHA’s MMIS Contractor (Gainwell, LLC). For the Oregon MMIS, the SOC 2, Type 2 review and Report to be provided by the Contractor pertains to the types of internal controls (including background checks and appropriate security roles) that OHA’s MMIS Contractor (Gainwell, LLC) uses with regard to financial transactions within MMIS as well as a number of other areas.

*Note re: SOC 2 Reports, Types 2: from this AICPA article: SOC for Service Organizations: Information for Service Organizations:

SOC for Service Organizations reports are designed to help service organizations that provide services to other entities, build trust and confidence in the service performed and controls related to the services through a report by an independent CPA. Each type of SOC for Service Organizations report is designed to help service organizations meet specific user needs:

SOC 2 Report, Types 2– SOC for Service Organization: ICFR Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting

These reports, prepared in accordance with Attestation Standards – Clarified (AT- C) Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting, are specifically https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/serviceorganization-smanagement.html https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/serviceorganization-smanagement.html

DAS Procurement Services, Version 4.5 March 31, 2023 Page 5 of 29 intended to meet the needs of entities that use service organizations (user entities) and the Certified Public Accountants (CPA) that audit the user entities’ financial statements (user auditors), in evaluating the effect of the controls at the service organization on the user entities’ financial statements.

There are two types of reports for these engagements:

• Type 2 - report on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives included in the description throughout a specified period.

• Type 1 – report on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design of the controls to achieve the related control objectives included in the description as of a specified date.

Use of these reports is restricted to the management of the service organization, user entities, and user auditors.”

Source: https://www.aicpa-cima.com/resources/landing/cpe-learning-page?utm_source=google&utm_medium=psearch&utm_campaign=aai_q126_general_store &utm_term=na&utm_content=store&cid=sem-ppc:google:23725858939:www%20aicpa%20org:e&gad_source=1&gad_campaignid=23725 858939&gclid=EAIaIQobChMInanZ4ePLlwMVATdECB0NrSXVEAAYASAAEgIiovD_BwE

Additional details on the Scope of the goods or services or both are included in the Section 2.4 Scope of Work.

1.2 SCHEDULE

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change. N/A denotes that event is not applicable to this RFP.

https://www.aicpa-cima.com/resources/landing/cpe-learning-page?utm_source=google&utm_medium=psearch&utm_campaign=aai_q126_general_store&utm_term=na&utm_content=store&cid=sem-ppc:google:23725858939:www%20aicpa%20org:e&gad_source=1&gad_campaignid=23725858939&gclid=EAIaIQobChMInanZ4ePLlwMVATdECB0NrSXVEAAYASAAEgIiovD_BwE https://www.aicpa-cima.com/resources/landing/cpe-learning-page?utm_source=google&utm_medium=psearch&utm_campaign=aai_q126_general_store&utm_term=na&utm_content=store&cid=sem-ppc:google:23725858939:www%20aicpa%20org:e&gad_source=1&gad_campaignid=23725858939&gclid=EAIaIQobChMInanZ4ePLlwMVATdECB0NrSXVEAAYASAAEgIiovD_BwE https://www.aicpa-cima.com/resources/landing/cpe-learning-page?utm_source=google&utm_medium=psearch&utm_campaign=aai_q126_general_store&utm_term=na&utm_content=store&cid=sem-ppc:google:23725858939:www%20aicpa%20org:e&gad_source=1&gad_campaignid=23725858939&gclid=EAIaIQobChMInanZ4ePLlwMVATdECB0NrSXVEAAYASAAEgIiovD_BwE https://www.aicpa-cima.com/resources/landing/cpe-learning-page?utm_source=google&utm_medium=psearch&utm_campaign=aai_q126_general_store&utm_term=na&utm_content=store&cid=sem-ppc:google:23725858939:www%20aicpa%20org:e&gad_source=1&gad_campaignid=23725858939&gclid=EAIaIQobChMInanZ4ePLlwMVATdECB0NrSXVEAAYASAAEgIiovD_BwE https://www.aicpa-cima.com/resources/landing/cpe-learning-page?utm_source=google&utm_medium=psearch&utm_campaign=aai_q126_general_store&utm_term=na&utm_content=store&cid=sem-ppc:google:23725858939:www%20aicpa%20org:e&gad_source=1&gad_campaignid=23725858939&gclid=EAIaIQobChMInanZ4ePLlwMVATdECB0NrSXVEAAYASAAEgIiovD_BwE https://www.aicpa-cima.com/resources/landing/cpe-learning-page?utm_source=google&utm_medium=psearch&utm_campaign=aai_q126_general_store&utm_term=na&utm_content=store&cid=sem-ppc:google:23725858939:www%20aicpa%20org:e&gad_source=1&gad_campaignid=23725858939&gclid=EAIaIQobChMInanZ4ePLlwMVATdECB0NrSXVEAAYASAAEgIiovD_BwE

DAS Procurement Services, Version 4.5 March 31, 2023 Page 6 of 29

Event Date & Time (if applicable)

Questions / Requests for Clarification Due October 30, 2026, 5pm

Answers to Questions / Requests for Clarification Issued (approx.)

November 06, 2026

RFP Protest Period Ends 7 calendar days prior to RFP Closing

Closing (Proposal Due) See RFP cover page

Opening of Proposal November 24, 2026

Issuance of Notice of Intent to Award (approx.) December 10, 2026

Award Protest Period Ends 7 calendar days after Notice of Intent to Award

1.3 SINGLE POINT OF CONTACT (SPC)

The SPC for this RFP is identified on the Cover Page, along with the SPC’s contact information. Proposer shall direct all communications related to any provision of the RFP only to the SPC, whether about the technical requirements of the RFP, contractual requirements, the RFP process, or any other provision.

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

Agency is issuing this RFP pursuant to its authority under ORS 413.033.

Agency is using the Competitive Sealed Proposal method, pursuant to ORS 279B.060 and OAR 137-047-0260. Agency may use a combination of methods for Competitive Sealed Proposals, including optional procedures: a) Competitive Range; b) Discussions and Revised Proposals; c) Revised Rounds of Negotiations; d) Negotiations; e) Best and Final Offers; and f) Multistep Sealed Proposals.

2.2 DEFINITION OF TERMS

For the purposes of this RFP, capitalized words are defined in OAR 125-246-0110 or as defined below.

Agency means the Oregon Health Authority, Health Systems Division, MMIS Business Support Unit.

Audit means an Audit conducted according to the standards specified in the Generally Accepted Government Auditing Standards (GAGAS) issued by the Comptroller General

DAS Procurement Services, Version 4.5 March 31, 2023 Page 7 of 29 of the United States and includes SOC 1, Type 2 Reports or “Controls Audits” conducted in accordance with AICPA Auditing Standards Board (ASB) Statement on Standards for Attestation Engagements (SSAE) No. 18, as described in Section 2.4 Scope of Work.

CMS means Centers for Medicare & Medicaid Services.

Contract means the contract awarded from this RFP.

Contractor means the Proposer selected through this RFP to enter into a Contract with Agency to perform the Work described in the Scope of Work.

Key Person(s) or Key Personnel means the person or persons on the Proposer’s staff, and any subcontractors, to whom Proposer will assign the Work if Proposer is awarded a Price Agreement.

MMIS means the Department’s Medicaid Management Information System, the Oregon system used to enroll OHA and Department of Human Services (DHS) Medicaid clients, process Medicaid claims, and manage information about Medicaid beneficiaries and services.

Proposer means each individual or firm submitting a Proposal for this RFP.

RFP means this Request for Proposal #6171 issued by Agency for the acquisition of services from a Contractor.

SFY means State Fiscal Year (July 1st – June 30th).

Work means the required activities, tasks, reporting, invoicing and deliverables described in Section 2.4 Scope of Work.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 8 of 29

2.3 OVERVIEW AND PURPOSE

Oregon’s Secretary of State recommends that OHA obtain independent assurance over the reliability and accuracy of MMIS controls. Thus, OHA is seeking a Type 2 review and Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1 Report), in accordance with the standards established by the American Institute of Certified Public Accountants (AICPA) for the portions of OHA’s MMIS designed, built, or operated by a contractor.

The current MMIS operations and maintenance service provider is Gainwell LLC.

Gainwell LLC was also the contractor for the design, development and implementation of Oregon’s MMIS.

MMIS is a client-server-based system using Redhat Linux servers and Microsoft Windows., and the backend databases are Oracle. The application is developed in C# and .Net for the user interface and BusinessObjects is the software used for the datastore. The hardware and environments are located in Salem at the state data center. The vendor, Gainwell, LLC, utilizes approximately 85 employees to manage the system.

Gainwell, LLC is the service organization responsible for operating and maintaining Oregon’s MMIS (“MMIS Contractor”). No subservice organizations are relevant to the internal controls. Gainwell, LLC is required by contract to fully cooperate in these audits.

As the service organization, Gainwell, LLC will provide the management assertion and the specific controls for each control objective.

OHA has previously contracted SOC 2, type 2 audits for prior years for both the Drug Rebate sub-system and MMIS as a whole. This RFP will result in a report for the entire MMIS system administered by Gainwell, LLC, with an emphasis on including the drug rebate sub-system. The control objectives have remained the same from prior years.

Previous audits performed by Ernst & Young and by Talbot, Korvola & Warwick and are available upon request.

2.4 SCOPE OF WORK

2.4.1 Standard of Performance

The Contractor shall generally perform in accordance with and will complete each audit in accordance with the AICPA Auditing Standards Board (ASB) Statement on Standards for Attestation Engagements (SSAE) No. 18, Reporting on Controls at a Service Organization, including any updates or modifications to SSAE No. 18.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 9 of 29

In addition, pursuant to ORS 279B.060(2)(c), OHA requires that the Contractor meets the highest standards prevalent in the industry or business most closely involved in providing the appropriate goods or services.

2.4.2 Auditing Periods

Work to be performed by the Contractor under the Contract awarded from this RFP shall include the completion of SOC 2, Type 2 “controls audits” in accordance with (SSAE) No. 18 for the following five fiscal year periods:

• Fiscal Year July 1, 2026 – June 30, 2027

• Fiscal Year July 1, 2027 – June 30, 2028

• Fiscal Year July 1, 2028 – June 30, 2029

• Fiscal Year July 1, 2029 – June 30, 2030

• Fiscal Year July 1, 2030 – June 30, 2031

In addition, OHA reserves the right to amend the Contract to add up to two additional fiscal year audits, to reflect an alternative or updated auditing standard, or to include auditing of other segments of OHA’s infrastructure comprising or connected to the

MMIS.

• Fiscal Year July 1, 2032 – June 30, 2033

• Fiscal Year July 1, 2033 – June 30, 2034

2.4.3 Controls Audit

2.4.3.1 The SOC 2, Type 2 review must include all portions of the MMIS designed, developed, or operated by the MMIS contractor, including the Drug Rebate subsystem. The SOC 2, Type 2 reviews will not include activities performed by the Oregon Department of Human Services (ODHS) or OHA.

2.4.3.2 The portions of the MMIS designed, developed, or operated by the

MMIS Contractor are:

a. User Interface: Drug Rebate, Contract Management, Reference, Plan of Care, Service Authorization, Claims, Provider, Computer Output to Laser Disk (COLD), Managed Care, Third Party Recovery, Financial, Contact Tracking Management System (CTMS)/Member Services, Benefits Administration, and Client.

b. Input Methods: Electronic Document Management System (converting paper claims), Web Portal and OHA employee input.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 10 of 29

c. Batch Applications and Reports: Batch reports, updates, data extracts, check writing, Decision Support and Surveillance Utilization Review System (DSSURS) extracts, and COLD reports.

d. Drug Rebate Subsystem: Rebate calculation, invoicing, dispositioning

(receipting checks and attributing them to specific invoices), reconciling, allocating rebates between federal and state, and reporting.

Note: Pharmacy Benefit Management Services are audited by a subcontract of the MMIS Contractor are therefore outside the scope of this RFP.

2.4.4 Controls Audit Objectives

The following are the draft control objectives for the SOC 2, Type 2 review. The control objectives for each audit period may be modified upon agreement by both OHA and the Contractor.

2.4.4.1 Controls provide reasonable assurance that access to the MMIS data is restricted to authorized personnel and programs.

2.4.4.2 Controls provide reasonable assurance that there is appropriate segregation of duties between transaction initiation, authorization of payment and record keeping/reporting functions.

2.4.4.3 Controls provide reasonable assurances that MMIS outputs are secure and routed to the appropriate users.

2.4.4.4 Controls provide reasonable assurance that MMIS processes are authorized, documented, tested, reviewed, and approved, and implemented.

2.4.4.5 Controls provide reasonable assurance that the MMIS and corresponding operating systems and applications software development, acquisition, and maintenance activities are authorized, documented, tested, reviewed, approved, and implemented.

2.4.4.6 Controls provide reasonable assurance that procedures and processes

(e.g., backup procedures) exist to minimize the effect of an MMIS malfunction, natural disaster, or other incident that may impact MMIS either data or processes.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 11 of 29

2.4.4.7 Controls provide reasonable assurance that inputs to the MMIS production environments are authorized and scheduled, and that deviations or production incidents are investigated and documented.

2.4.5 Audit Process

The Contractor shall complete the audit process in accordance with its methodology for project initiation, fieldwork, and report writing and presentation, which shall include the following:

2.4.5.1 Designate an audit coordinator to coordinate communications and audit activities and serve as a point of contact for OHA.

2.4.5.2 OHA will not provide a project manager to help the Contractor coordinate the audits but will designate an OHA point of contact.

2.4.5.3 Coordinate an initial setup meeting with the OHA point of contact, MMIS staff and the MMIS Contractor to:

a. User Interface: Drug Rebate, Contract Management, Reference, Plan of Care, Service Authorization, Claims, Provider, COLD, Managed Care, Third Party Recovery, Financial, CTMS/Member Services, Benefits Administration, and Client.

b. Input Methods: Electronic Document Management System (converting paper claims), Web Portal and OHA employee input.

c. Batch Applications and Reports: Batch reports, updates, data extracts, check writing, DSSURS extracts, and COLD reports.

d. Drug Rebate Subsystem: Rebate calculation, invoicing, dispositioning

(receipting checks and attributing them to specific invoices), reconciling, allocating rebates between federal and state, and reporting.

2.4.5.4 Complete the SOC 2, Type 2 review, in accordance with the schedule and objectives and controls for the specific audit period.

2.4.5.5 OHA documentation and materials necessary to complete the reviews will be provided to the Contractor through a secured protocol.

2.4.5.6 Schedule a closing meeting with OHA and the coordinating auditor after the auditors have completed each review.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 12 of 29

2.4.5.7 Transmit a draft of the audit report to OHA approximately one month after the review has been completed. OHA will review the audit report and respond with any comments no later than 20 business days of receipt.

OHA expects that a final report will be submitted to OHA by September 30 following each respective audit period. Reports shall be transmitted via email to the OHA Contract Administrator in MSWord, MS Excel or Adobe .pdf format.

2.4.5.8 The Contractor shall deliver the final SOC 2, Type 2 report to OHA in electronic format as well as one printed copy. The final report for each audit period will constitute a Deliverable.

2.4.5.9 All Work and Deliverables will be completed in accordance with the agreed-upon schedule for each specific audit period. Each audit report will be reviewed to determine if it contains all elements required in a SSAE No 18, SOC 2, Type 2 report; compliance with the elements required in the SOC 2, Type 2 report will be the basis for acceptance of the Deliverable.

Key Persons assigned to provide services under the resultant Contract must be qualified to perform the engagement under AICPA professional standards. OHA reserves the right to approve or deny additional, or replacement Key Persons submitted for review after award of the Contract.

SECTION 3: PROCUREMENT REQUIREMENTS

3.1 MINIMUM QUALIFICATIONS

Proposer must demonstrate and certify in the Statement of Minimum Qualifications attached to the Proposer Certification Sheet (Attachment C) and document in supporting Key Person resumes that Proposer meets all the qualification requirements listed below.

3.1.1 Proposer’s Key Person(s) must include a Certified Public Accountant (CPA) currently licensed to work in Oregon; and

3.1.2 If Proposer is a public accounting firm, Proposer’s firm must be currently licensed to perform audits in Oregon.

3.2 MINIMUM SUBMISSION REQUIREMENTS

3.2.1 Proposal Submissions

To be considered for evaluation, Proposal must contain each of the following elements (further detailed in Proposal Requirements section below):

DAS Procurement Services, Version 4.5 March 31, 2023 Page 13 of 29

Required item RFP Section link

• Technical Proposal Section 3.3.3

• Disclosure Exemption Affidavit (Attachment B) – submit 1 copy only

Section 3.2.3

• Proposer Information and Certification Sheet (Attachment C)

Section 2.1 & Section 3.3.1

• References (Attachment D) Section 3.3.2

• Price Proposal Form (Attachment E)

Section 3.3.4

• Responsibility Inquiry (Attachment G) - submit 1 copy only

See Attachment G

• Key Persons and Resumes Section 2.1 & Section 3.3.3.1.a.

Note: Attachment F is not a mandatory element of the Proposal but pursuant to RFP Section 6.1, OHA may require completion of that attachment prior to execution of the Contract.

• COBID Certification / Outreach Plan (Attachment F) - submit 1 copy only

Section 6.1

3.2.2 Proposal Page Limits

There are no page limits for the Proposal except for the requirement in Section

3.3.3.1 a. that Key Person Resumes not exceed 2 pages per resume and the requirement that in the following section 3.2.3. that the total combined size of the electronic Proposal files submitted, including all required items, not exceed 10 megabytes.

3.2.3 Proposal Format and Quantity

The Proposal should follow the format and reference the sections listed in the Proposal Requirements section. Responses to each section and subsection should be labeled to indicate the item being addressed.

Additional formatting requirements are listed below.

The Proposer Information and Certification Sheet (Attachment C) must bear the Proposer’s authorized representative’s Signature. If Proposer believes any of its Proposal is exempt from disclosure under Oregon Public Records Law (ORS

DAS Procurement Services, Version 4.5 March 31, 2023 Page 14 of 29

192.311 through 192.478), Proposer shall complete and submit the Disclosure Exemption Affidavit (Attachment B) and Proposer shall submit a fully redacted version of its Proposal, clearly identified as the redacted version.

Proposers shall submit:

• 1 electronic copy of the Proposal electronically via email. See Section 4.5 Proposal Delivery Option

The total combined size of the electronic Proposal files submitted, including all required items, should not exceed 10 megabytes.

All parts of Proposer’s Proposal (including all attachments), except for the Price Proposal required by Section 3.3.4, * shall be contained in a single Adobe Acrobat (pdf) file. Proposer’s Price Proposal shall be submitted in a separate Adobe Acrobat (PDF) file.

3.2.4 Authorized Representative

Failure of the authorized representative to sign the Proposal may subject the Proposal to rejection by Agency.

3.3 PROPOSAL REQUIREMENTS

Proposal must address each of the items listed in this section and all other requirements set forth in this RFP. Proposer shall describe the Goods to be provided or the Services to be performed or both. A Proposal that merely offers to provide the goods or services as stated in this RFP will be considered non-Responsive to this RFP and will not be considered further.

Proposal should not include extensive artwork, unusual printing or other materials not essential to the utility and clarity of the Proposal. Do not include marketing or advertising material in the Proposal, unless requested. Proposal should be straightforward and address the requests of the RFP. Proposal containing unsolicited marketing or advertising material may receive a lower evaluation score if specific information is difficult to locate.

3.3.1 Proposer Information and Certification Sheet

Proposer shall complete and submit the Proposer Information and Certification Sheet (Attachment C).

Failure to demonstrate compliance with Oregon Tax Laws and sign the Proposer Information and Certification Sheet may result in a finding of non-Responsibility.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 15 of 29

3.3.2 References

Attachment D, provide at least 3 references from current or former client firms for similar projects performed for any clients within the last 3 years. References must be able to verify the quality of previous, related Work.

Agency may check to determine if references provided support Proposer’s ability to comply with the requirements of this RFP. Agency may use references to obtain additional information, or verify any information needed. Agency may contact any reference (submitted or not) to verify Proposer’s qualifications.

3.3.3 Technical Proposal

The Technical Proposal must include the following items in the order listed below.

Page limits are noted, when relevant. Unless otherwise specified, no particular form is required.

3.3.3.1 Key Persons:

a. Specify Key Persons to be assigned to this project and include a current resume (not to exceed 2 pages each) for each individual proposed to provide services.

b. Describe Key Persons qualifications and previous experience performing Work similar to the Scope of Work described in this

RFP.

c. Describe Key Persons’ availability to perform the services described in this RFP and how deliverable timelines will be met.

3.3.3.2 Project Implementation Plan:

Describe how Proposer would carry out the services described in the Scope of Work of this RFP and include a comprehensive management plan that Proposer intends to follow. Explain how Proposer’s plan will serve to coordinate and accomplish the Work.

3.3.4 Price Proposal

Using Attachment E, Proposers shall provide a detailed Price Proposal, in an Adobe Acrobat (PDF) file separate from the Technical Proposal that includes the following items:

A total, all-inclusive fixed cost for each annual audit report. The proposed cost must include all labor, benefits, travel, per diem, materials and any other expenses associated with conducting the audit and producing all draft and final deliverables as described in this RFP.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 16 of 29

Initial Contract Audit years:

• Fiscal Year July 1, 2026 – June 30, 2027

• Fiscal Year July 1, 2027 – June 30, 2028

• Fiscal Year July 1, 2028 – June 30, 2029

• Fiscal Year July 1, 2029 – June 30, 2030

• Fiscal Year July 1, 2030 – June 30, 2031

Options Audit years that may be added by Contract amendment:

• Fiscal Year July 1, 2031 – June 30, 2032

• Fiscal Year July 1, 2032 – June 30, 2033

SECTION 4: SOLICITATION PROCESS

4.1 PUBLIC NOTICE

The RFP and attachments are published in the State of Oregon’s electronic procurement system OregonBuys at https://oregonbuys.gov/. Documents will not be mailed to prospective Proposers.

Modifications, if any, to this RFP will be made by written Amendment(s) published in OregonBuys. Prospective Proposer is solely responsible for checking OregonBuys to determine whether or not any Amendment(s) have been issued. Amendment(s) are incorporated into the RFP by this reference.

4.2 PRE-PROPOSAL CONFERENCE

A Pre-Proposal conference will not be held for this RFP.

4.3 QUESTIONS / REQUESTS FOR CLARIFICATIONS

All inquiries, whether relating to the RFP process, administration, deadline or method of award, or to the intent or technical aspects of the RFP must:

• Be delivered to the SPC via email;

• Reference the RFP number;

• Identify Proposer’s name and contact information;

• Refer to the specific area of the RFP being questioned (i.e. page, section and paragraph number); and

• Be received by the due date and time for Questions/Requests for Clarification identified in the Schedule.

https://oregonbuys.gov/

DAS Procurement Services, Version 4.5 March 31, 2023 Page 17 of 29

4.4 SOLICITATION PROTESTS

4.4.1 Protests to RFP

Prospective Proposer may submit a Written protest of anything contained in this RFP, including but not limited to, the RFP process, Specifications, Scope of Work, and the proposed Sample Contract. This is prospective Proposer’s only opportunity to protest the provisions of the RFP, except that Proposer may protest Addenda as provided below and Proposer may take exception to the terms and conditions of the Sample Contract marked as negotiable as set forth in the Negotiations Section.

4.4.2 Protests to Addenda

Prospective Proposer may submit a Written protest of anything contained in the respective Addendum. Protests to Addenda, if issued, must be submitted by 5 p.m.

Pacific Time of the second Business Day or the date/time specified in the respective Addendum, or they will not be considered. Protests of matters not added or modified by the respective Addendum will not be considered.

4.4.3 All Protests must:

• Be delivered to the SPC via email;

• Reference the RFP number;

• Identify prospective Proposer’s name and contact information;

• Be sent by an authorized representative;

• State the reason for the protest, including:

o The grounds that demonstrate how the Procurement Process is contrary to law, Unnecessarily Restrictive, legally flawed, or improperly specifies a brand name; and o evidence or documentation that supports the grounds on which the protest is based

• State the proposed changes to the RFP provisions or other relief sought;

• Protests to the RFP must be received by the due date and time identified in the

Schedule; and

• Protests to Addenda must be received by the due date identified in the respective Addendum.

4.5 PROPOSAL DELIVERY

Proposer is solely responsible for ensuring its Proposal is received by the SPC in accordance with the RFP requirements before Opening. Agency is not responsible for any errors or delays in Proposal transmission, or for any mis-delivery for any reason. A Proposal submitted by any means not authorized below will be rejected.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 18 of 29

Important Tip: OHA strongly encourages Proposers to submit their Proposals early, well before the Proposal Due date, in order to allow themselves sufficient time to resolve any technical issues that may arise before Proposals are due.

The following delivery option is permitted for this RFP:

Delivery through OregonBuys: Detailed instructions on how to submit a Proposal can be found at this page: OregonBuys Vendor Formal Solicitation Response.pdf

Note re: OregonBuys Support: for any questions about using OregonBuys, Proposers should contact OregonBuys Supplier Support by phone call to 1-855-800-5046 or by email to support.oregonbuys@das.oregon.gov.

4.6. PROPOSAL MODIFICATION OR WITHDRAWAL

If a Proposer wishes to make modifications to a submitted Proposal it must submit its modification in one of the authorized methods listed in the Proposal Delivery Options section. To be effective the notice must include the RFP number and be submitted to the SPC prior to Closing.

If a Proposer wishes to withdraw a submitted Proposal, it must submit a Written notice signed by an authorized representative of its intent to withdraw to the SPC via email prior to closing in accordance with OAR 125-247-0440. To be effective the notice must include the RFP number.

4.7. PROPOSAL DUE

A Proposal (including all required submittal items) must be received by the SPC on or before Closing. All Proposal modifications or withdrawals must be received prior to Closing.

A Proposal received after Closing is considered LATE and will NOT be accepted for evaluation. A late Proposal will be returned to the Proposer or destroyed.

4.8. PUBLIC OPENING

Following the Closing of this RFP and in accordance with OAR 137-049-0330, “Opening and Recording”, Agency will post the name(s) of all Proposers on OregonBuys Opportunity # S-44300-00018176 in a Questions and Answers posting and no other information will be made available at that time. Proposals received will not be available for inspection until after the evaluation process has been completed and the notice of Intent to Award is issued pursuant to OAR 137-047-0630.

mailto:support.oregonbuys@das.oregon.gov

DAS Procurement Services, Version 4.5 March 31, 2023 Page 19 of 29

4.9 PROPOSAL REJECTION

Agency may reject a Proposal for any of the following reasons:

• Proposer fails to substantially comply with all prescribed RFP procedures and requirements, including but not limited to the requirement that Proposer’s authorized representative sign the Proposal.

• Proposer has liquidated and delinquent debt owed to the State or any department or agency of the State.

• Proposer fails to meet the responsibility requirements of ORS 279B.110.

• Proposer makes any contact regarding this RFP with State representatives such as

State employees or officials other than the SPC or those the SPC authorizes, or inappropriate contact with the SPC.

• Proposer attempts to influence a member of the Evaluation Committee.

• Proposal is conditioned on Agency’s acceptance of any other terms and conditions or rights to negotiate any alternative terms and conditions that are not reasonably related to those expressly authorized for negotiation in the RFP or Addenda.

4.10 EVALUATION PROCESS

4.10.1.1 Responsiveness determination

A Proposal received prior to Closing will be reviewed to determine if it is Responsive to all RFP requirements including compliance with Minimum Qualifications section and Minimum Submission Requirements section. If the Proposal is unclear, the SPC may request clarification from Proposer. However, clarifications may not be used to rehabilitate a non-Responsive proposal. If the SPC finds the Proposal non-Responsive, the Proposal may be rejected, however, Agency may waive mistakes in accordance with OAR 137-047-0470.

4.10.1.2 Responsibility determination

Agency will determine if an apparent successful Proposer is Responsible prior to award and execution of the Contract. Proposers shall submit a signed Responsibility Inquiry form (Attachment G) with Proposal.

At any time prior to award, Agency may reject a Proposer found to be not Responsible.

4.10.2 Evaluation Criteria

Each Proposal meeting all Responsiveness requirements will be independently evaluated by members of an Evaluation Committee. Evaluation Committee members may change and Agency may have additional or fewer evaluators for optional rounds of competition. Evaluators will assign a score for each

DAS Procurement Services, Version 4.5 March 31, 2023 Page 20 of 29 evaluation criterion listed below in this section up to the maximum points available in the Point and Score Calculation section as described in this section.

For scoring of the Technical portion of the proposal, a numeric rating (0 through

5) will be assigned by each evaluator based on the rating description in Table 1.

below. The numeric rating, as a ratio of the maximum rating of 5, will then be multiplied by the criterion weighting factor set forth in Table 2. below to determine the score for that criterion. For example, if an evaluation criterion has a weighting factor of forty (40) points, if the evaluator rates the response for that criterion as 4/5 using the rubric from Table 1., the score for that criterion is 4/5 x40 which equals 32.

The offeror’s total technical score will be determined by adding together the offeror’s score for each evaluation criterion.

SPC may request further clarification to assist the Evaluation Committee in gaining additional understanding of Proposal. A response to a clarification request must be to clarify or explain portions of the already submitted Proposal and may not contain new information not included in the original Proposal.

Table 1. Scoring Rubric

Numeric Rating

Description

0 Fails to meet minimum requirements; e.g., no demonstrated capacity, major deficiencies which are not correctable; offeror did not address the factor.

1 Marginally meets minimum requirements; major deficiencies which may be correctable.

2 Marginally meets minimum requirements; minor deficiencies which may be correctable.

3 Meets requirements; no deficiencies.

4 Meets requirements and exceeds some requirements; no deficiencies.

5 Exceeds most, if not all requirements; no deficiencies.

Table 2. Technical Evaluation Criteria

Technical proposals will be evaluated based on the criteria set forth below in this Table 2.

Maximum Weight Possible

Key Person Experience 20

Project 50

DAS Procurement Services, Version 4.5 March 31, 2023 Page 21 of 29

4.10.2.1 TECHNICAL PROPOSAL EVALUATION ITEM 1:

Key Persons (Maximum Score: 20 points):

How well has the Proposer demonstrated that Key Persons proposed to perform the Work possess the knowledge, understanding and experience required to successfully perform the Work?

Did Proposer identify Key personnel to be assigned to the project and include resume(s) that demonstrate qualifications and experience necessary for performing the Work described in this RFP?

4.10.2.2 TECHNICAL PROPOSAL EVALUATION ITEM 2:

Project Implementation Plan (Maximum Score: 50 points):

How well has the Proposer described Proposer’s approach and outlined a work plan for carrying out the Scope of Work described in Section 2.4 (Maximum Score: 25 points).

How well has the Proposer demonstrated that the plan will serve to coordinate and accomplish the Work in a realistic and timely manner?

(Maximum Score: 25 points).

4.10.3 PRICE EVALUATION (Maximum Score: 20 points):

The SPC will conduct the price evaluation. The SPC will award a price score to each Price Proposal based upon the percentage of the proposed price as compared to the lowest Proposer’s price using the following formula:

lowest price of all Proposers

X 20 (maximum price points possible) price score price being scored Evaluated price will be based on the Price Proposal attachment that is uploaded as a separate attachment in OregonBuys.

Implementation Plan (2 parts @ 25 each)

Price Proposal 20

References 10

DAS Procurement Services, Version 4.5 March 31, 2023 Page 22 of 29

4.10.4 REFERENCES (Maximum Score: 10 points)

Attachment D, provide at least 3 references from current or former client firms for similar projects performed for any clients within the last 3 years. References must be able to verify the quality of previous, related Work.

Agency may check to determine if references provided support Proposer’s ability to comply with the requirements of this RFP. Agency may use references to obtain additional information, or verify any information needed. Agency may contact any reference (submitted or not) to verify Proposer’s qualifications.

4.10.5 PREFERENCES

4.10.5.1 Reciprocal Preference

For evaluation purposes per OAR 125-246-0310, Agency shall add a percent increase to each out-of-state Proposer's Proposal price that is equal to the percent preference, if any, given to a Resident Proposer in the Proposer's state.

4.10.5.2 Recycled Materials

In comparing Goods from two or more Proposers, if at least one Proposer offers Goods manufactured with Recycled Materials, and at least one Proposer does not, Agency will select the Proposer offering Goods manufactured from Recycled Materials if each of the conditions specified in ORS 279A.125 (2) exists following any adjustments made to the price of the Goods according to any applicable reciprocal preference.

4.10.5.3 Tiebreakers

If Agency receives Proposals identical in price, fitness, availability and quality and chooses to award a Contract, Agency shall award the Contract in accordance with the procedures outlined in OAR 125-246-0300.

4.11 POINT AND SCORE CALCULATIONS

Points are the total possible for each section as listed in the table below.

EVALUATION CRITERIA Maximum Points Possible

Key Person Experience 20

Project Implementation Plan 50

References 10

Price 20

Total: 100 https://www.naspo.org/reciprocity1 https://www.naspo.org/reciprocity1

DAS Procurement Services, Version 4.5 March 31, 2023 Page 23 of 29

4.12 RANKING OF PROPOSERS

The SPC will average the scores for each Proposal in a given round of competition (calculated by totaling the points awarded by each Evaluation Committee member and dividing by the number of members).

Agency will rank all Proposers at the conclusion of the evaluation and scoring and may, in Agency’s sole discretion, determine an apparent successful Proposer with no additional rounds of competition. If additional rounds are conducted, Agency will rank advancing Proposers at the conclusion of each subsequent round and may determine an apparent successful Proposer at any time during the solicitation process.

The SPC will combine the average score for each Proposal with Proposer’s price score. After any applicable preference has been applied, SPC will describe the rank order for each Proposer, with the highest score receiving the highest rank, and successive rank order determined by the next highest score.

4.12.1 NEXT STEP DETERMINATION

At the conclusion of a round of competition, Agency may choose to conduct additional round(s) of competition if in the best interest of the State. Additional rounds of competition may consist of, but will not be limited to:

• Interviews

• Presentations/Demonstrations/Additional Submittal Items

• Discussions and submittal of revised Proposals

• Serial or simultaneous negotiations

• Best and Final Offers

4.12.2 Competitive Range Determination

If Agency, in its sole discretion, determines that one or more additional rounds of competition is necessary, it will select a Competitive Range to indicate the Proposers that will be invited to participate in a subsequent round. The Competitive Range may include all, or at Agency’s sole discretion, some (based primarily on a natural break in the distribution of scores), of the Proposers from a previous round. Agency will post a notice in ORPIN of its Competitive Range Determination and provide details about the process and schedule for the subsequent round.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 24 of 29

4.13 SCORING AND RANKING OF PROPOSERS FOR SUBSEQUENT ROUNDS

If Agency conducts two or more rounds of competition, the SPC will determine the cumulative score for Proposers advancing through all rounds of competition by adding the scores from each completed round. The Proposer with the highest cumulative score will receive the highest final ranking.

SECTION 5: AWARD AND NEGOTIATION

5.1 AWARD NOTIFICATION PROCESS

5.1.1 Award Consideration

Agency, if it awards a Contract, shall award a Contract to the highest-ranking Responsible Proposer(s) based upon the scoring methodology and process described in Section 4. Agency may award less than the full Scope defined in this

RFP.

Intent to Award Notice

Agency will notify all Proposers in Writing that Agency intends to award a Contract to the selected Proposer(s) subject to successful negotiation of any negotiable provisions.

5.2 INTENT TO AWARD PROTEST

5.2.1 Protest Submission

An Affected Proposer shall have 7 calendar days from the date of the Intent to Award notice to file a Written protest.

A Proposer is an Affected Proposer only if the Proposer would be eligible for Contract award in the event the protest was successful and is protesting for one or more of the following reasons as specified in ORS 279B.410:

• All higher ranked Proposals are non-Responsive.

• Agency has failed to conduct an evaluation of Proposals in accordance with the criteria or process described in the RFP.

• Agency abused its discretion in rejecting the protestor’s Proposal as non-

Responsive.

• Agency’s evaluation of Proposal or determination of award otherwise violates

ORS Chapter 279B or ORS Chapter 279A.

If Agency receives only one Proposal, Agency may dispense with the evaluation process and Intent to Award protest period and proceed with Contract Negotiations and award.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 25 of 29

5.2.1.1 Protests must:

• Be delivered to the SPC via email

• Reference the OregonBuys bid number;

• Identify Proposer’s name and contact information;

• Be signed by an authorized representative of Proposer;

• Specify the grounds for the protest; and

• Be received within 7 calendar days of the Intent to Award notice.

5.2.2 Response to Protest

Agency will address all timely submitted protests within a reasonable time and will issue a Written decision to the respective Proposer. Protests that do not include the required information may not be considered by Agency.

5.3 APPARENT SUCCESSFUL PROPOSER SUBMISSION REQUIREMENTS

The Proposer who is selected for a Contract award under this RFP will be required to submit additional information and comply with the following:

5.3.1 Insurance

Prior to award, Proposer shall secure and demonstrate to Agency proof of insurance as required in this RFP or as negotiated. Insurance Requirements are found in Exhibit B of Attachment A.

5.3.2 Taxpayer Identification Number

Proposer shall provide its Taxpayer Identification Number (TIN) and backup withholding status on a completed W-9 form when requested by Agency or when the backup withholding status or any other relevant information of Proposer has changed since the last submitted W-9 form, if any.

5.3.3 Business Registry

If selected for award, Proposer shall be duly authorized by the State of Oregon to transact business in the State of Oregon before executing the Contract. Visit http://sos.oregon.gov/business/pages/register.aspx for Oregon Business Registry information.

5.3.4 Responsibility Inquiry

Prior to award, Proposer shall be required to complete and submit Attachment G — Responsibility Inquiry.

Pay Equity Certification http://sos.oregon.gov/business/pages/register.aspx

DAS Procurement Services, Version 4.5 March 31, 2023 Page 26 of 29

If selected for award and the Contract value exceeds $500,000 and Proposer employs 50 or more full-time workers, Proposer shall submit to Agency a true and correct copy of an unexpired Pay Equity Compliance Certificate, issued to the Proposer by the Oregon Department of Administrative Services. For instructions on how to obtain the Certificate, visit https://www.oregon.gov/das/Procurement/Pages/PayEquity.aspx.

ORS 279B.110(2)(f) requires that Proposer provide this prior to execution of the Contract.

5.3.5 Nondiscrimination in Employment

As a condition of receiving the award of a Contract under this RFP, Proposer must certify by their Signature on Attachment C - Proposer Information and Certification Sheet, in accordance with ORS 279A.112, that it has in place a policy and practice of preventing sexual harassment, sexual assault, and discrimination against employees who are members of a protected class. The policy and practice must include giving employees a written notice of a policy that both prohibits, and prescribes disciplinary measures for, conduct that constitutes sexual harassment, sexual assault, or unlawful discrimination.

5.3.6 Pay Equity Compliance

As required by ORS 279B.235, Contractor shall comply with ORS 652.220 and shall not discriminate against any of Contractor’s employees in the payment of wages or other compensation for work of comparable character, the performance of which requires comparable skills, or pay any employee at a rate less than another for comparable work, based on an employee’s membership in a protected class.

Commencing on January 1, 2019, Contractor must comply with ORS 652.220 as amended and shall not unlawfully discriminate against any of Contractor’s employees in the payment of wages or other compensation for work of comparable character on the basis of an employee’s membership in a protected class. “Protected class” means a group of persons distinguished by race, color, religion, sex, sexual orientation, national origin, marital status, veteran status, disability or age.