Request for Qualifications 781-5-03287 Information Technology Audit and Advisory Services

The Texas Higher Education Coordinating Board (THECB) has issued Request for Qualifications (RFQ No. 781-5-03287) seeking Information Technology Audit and Advisory Services for its Internal Audit Division. The procurement aims to secure contractors to provide comprehensive IT audit services, including evaluating IT general controls, application controls, IT project processes, cybersecurity incident response, and privacy controls. Respondents must have a minimum of five years' experience providing IT audit services to government entities and must have completed an external quality review within the past three years. The evaluation criteria will weight Firm Experience at 25%, Staff Qualifications at 30%, and Project Approach at 45%. Written questions were due by January 3, 2025, with proposals due January 21, 2025, at 11:30 p.m. CST/CDT. The contract term will be one year with three optional one-year renewals, not to exceed four years total, with an anticipated start date of March 1, 2025. Firms must be licensed by the Texas State Board of Public Accountancy and submit pricing in a separate PDF titled "Mandatory Price Sheet" that is all-inclusive of personnel costs and necessary expenses.

The RFQ encourages participation from Historically Underutilized Businesses (HUBs) and requires submission of a HUB Subcontracting Plan with a 23.7% subcontracting goal, though utilization is not mandatory and will not impact bid scoring. Multiple contract awards may be made based on best value to the state across different NIGP code groups. Respondents must comply with various state regulations, including Texas Family Code and Government Code requirements regarding ownership disclosure and restrictions on hiring former state agency executives. The contract requires comprehensive insurance coverage, including workers' compensation, general liability, automobile liability, and cyber security insurance covering privacy violations, information theft, and network security claims. Contractors must maintain detailed documentation of services and comply with Texas accessibility requirements for electronic resources. While no specific budget is listed for the entire contract, budgets will be determined on a project-by-project basis once specific audit needs are identified. The THECB's current IT environment consists of 51 full-time equivalents across IT and Information Security teams, managing approximately 500 endpoints on primary and disaster recovery networks.