EGB FY26 CBMS REQ 12773568, DQ 2026000520 SOC Audit

The State of Colorado's Office of Information Technology, in partnership with the Colorado Department of Health Care Policy and Finance, is soliciting a documented quote for SOC 1 Type II audit services of the Colorado Benefits Management System (CBMS) and Program Eligibility & Application Kit (PEAK), with vendor responses due August 26, 2026 at 1:30 p.m.

The audit must assess control effectiveness relevant to the Department's financial reporting and compliance with Colorado Office of the State Controller requirements, conducted in accordance with AICPA Statement on Standards for Attestation Engagements (SSAE 18). All work is performed remotely without on-site field work. Key deliverables are an Audit Plan with project timeline and milestones, a Readiness Assessment Report evaluating control documentation and identifying gaps, a draft SOC 1 Type II audit report, and a finalized audit report incorporating departmental feedback. Responsive proposals must include a detailed proposed methodology, an organizational experience summary demonstrating relevant public sector projects of similar scope within the past three years, specific personnel assignments (Project Lead and IT Security/Controls Subject Matter Expert as minimum), proof of required insurance coverage, and compliance with Colorado law and Web Content Accessibility Guidelines (WCAG) Level AA. Pricing is submitted via the provided Cost Proposal Workbook and must include all labor, travel, overhead, and incidental expenses; firm fixed prices are required for each deliverable and hourly billing rates for key personnel.

The anticipated contract term is a single fiscal year with a maximum total duration not exceeding five years. The State may exercise option or extension terms at its sole discretion or choose to re-procure. Award will be made to the responsible vendor whose acceptable quote is determined most advantageous to the State, considering price alongside factors such as quality and lead time. Within ten business days of award notification, the selected vendor must register with the Colorado Secretary of State's Office and provide proof of good standing and insurance certificates. The written inquiry deadline was August 11, 2026.