Request for Proposal (Secondary) Audit Services

The State Controller's Office, Division of Audits, in California is requesting proposals for secondary audit services under RFP EAUF90126, with proposals due September 25, 2026. The contract is a three-year initial term with an option for one two-year extension, with a maximum contract value of $10 million for the initial term and optional extension combined.

The scope encompasses financial and compliance audits, operational audits, fraud and abuse reviews, and evaluations of internal controls and program outcomes for state agencies, local governments, local education agencies, and special districts. Services are structured under two models: a Staff Augmentation Model in which contractors function as extensions of SCO audit teams under SCO direction, and an Independent Audit Model in which contractors execute high-profile and sensitive audits with SCO oversight. All work must comply with Generally Accepted Government Auditing Standards (GAGAS/Yellow Book). Services are provided during SCO normal working hours of 8:00 a.m. to 5:00 p.m. Pacific Time, Monday through Friday.

Firm Minimum Qualifications require an active CPA license in good standing, a Sacramento-region office location, at least five years of audit experience within the last eight years performing the services described in the scope of work, and a peer review completed within the last three years with a passing rating. Proposers must demonstrate a minimum of five years of experience conducting state government, local government, special districts, or local education agency audits in accordance with GAGAS, preferably in California or similar regulatory environments. Desirable qualifications include experience with large payment datasets (Medi-Cal, CalFresh), analytics tools (Arbutus, IDEA, SQL, Python), and fraud detection or forensic audit experience.

Key staff requirements vary by position. Engagement Partners/Project Directors must have 10 years of audit experience in target government entities, 5 years managing audit teams on complex public programs, an active CPA license, and a bachelor's degree in accounting, finance, or business. Audit Managers (up to three) require 7 years of audit experience in similar entities, 5 years supervising audit teams on complex public programs, an active CPA license, and a bachelor's degree. All staff auditors must have a minimum of five years of audit experience, three years with GAGAS standards, and a bachelor's degree in accounting, finance, or business.

Pricing is established through hourly billing rates detailed in the Cost Worksheet. The contractor must maintain commercial general liability insurance of not less than $1 million per occurrence with $2 million annual aggregate, workers' compensation and employer's liability insurance, and professional liability insurance of not less than $1 million per claim and $2 million aggregate. All staff must pass a Live Scan background check prior to performing services. Contractors must use SCO-supplied encrypted laptops and RSA hard tokens, store all project documents on SCO servers, and comply with extensive data security and confidentiality requirements. Small Business and Disabled Veteran Business Enterprise subcontractor participation commitments must be tracked and reported semi-annually and within 60 days of agreement expiration.