Lottery SOC 1 Type 2 Audit

The Colorado Department of Revenue's Lottery division is soliciting proposals under RFP 2027000044 for a SOC 1 Type 2 audit of its Central Gaming System, its Multi-State Lottery Association (MUSL) mandated internal control system, and related Lottery controls, with proposals due December 16, 2026 at 11:59 p.m. Mountain Time. Offerors must be independent CPA firms licensed to do business in Colorado with MUSL participating lottery or equivalent lottery industry experience. They cannot have contracted with Brightstar Lottery, Scientific Games, Inc., Spectra Systems, or Intralot for audit services within the past year or current year, and any attestation or non-audit services provided to those entities require safeguards that eliminate conflicts or reduce them to acceptable levels.

The audit identifies operational processes, assesses risks, and documents and tests control adequacy, producing two reports. The Central Gaming System report goes to contractor Brightstar Lottery and the Lottery, and the MUSL internal control report goes to the Lottery. Preferred qualifications include at least three completed SOC 1 Type 2 or cybersecurity audits and a minimum of three experienced personnel, including one CPA, one Certified Information Systems Security Professional (CISSP), and one Certified Information Systems Auditor (CISA). All personnel must pass background checks under C.R.S. 44-40-106, including criminal history, fingerprint-based records, tax, and reference checks. Transaction testing runs July 1 through March 31, with final acceptance of the audit report by June 1.

Offerors submit a total firm, fixed price for the initial term and a single blended hourly rate for additional services. The initial term begins upon execution and ends June 30, 2028, with an anticipated start date of July 1, 2027. The State may renew for up to four one-year periods, not to exceed five years total. Pricing is firm during the initial term, and any extension increase is capped at three percent, subject to written justification and State approval at least 60 days before expiration. Evaluation considers experience, scope of work approach, and cost. Offerors must disclose any performance or subcontracting outside Colorado or the United States and justify it, and SDVOSB offerors must submit U.S. Small Business Administration certification documentation.

Proposals are submitted only through Colorado Vendor Self Service as a single zip folder emailed to the designated address, and hard copies are not accepted. Written questions go by email to the Sole Point of Contact, and answers are published as amendments on Colorado VSS. The public opening is virtual on December 17, 2026 at 10:00 a.m. Mountain Time, and the anticipated Intent to Award date is January 21, 2027. The sample contract requires general liability, professional liability, protected information liability, and crime coverage at $1,000,000 per occurrence each, and the awardee must provide proof of good standing with the Colorado Secretary of State before execution. The Colorado Special Provisions in the sample contract are non-negotiable.