QUESTIONS AND ANSWERS TO REQUEST FOR PROPOSALS INTERNAL AUDIT SERVICES

Size: px

Start display at page:

Download "QUESTIONS AND ANSWERS TO REQUEST FOR PROPOSALS INTERNAL AUDIT SERVICES"

Patrick Quinn
5 years ago
Views:

1 QUESTIONS AND ANSWERS TO REQUEST FOR PROPOSALS INTERNAL AUDIT SERVICES DATE ISSUED: MAY 22, 2018

2 Question 1: Do you currently have a developed control environment, including risk and control matrix, flowchart and narratives that are available for review and reference? If not, we assume the development of these documents would need to be scoped into our procedures. Is this a fair assumption? While the Finance Authority maintains a myriad of controls, co-development of risk and control matrices, flowcharts and narratives should be included in the scope of the procedures. Question 2: Has there been internal audits performed in prior years? Do prior year scoping, risk assessments, and audit plans exist? Would these be available for review and reference? The Finance Authority contracted with RSM to conduct internal audits since Internal audit materials which are the property of the Finance Authority will be available for review and reference by the selected firm. Question 3: What are some of the key and related IT systems used in the organization s major processes and sub-processes? The Finance Authority currently uses the following commercial software systems: o Abila accounting software; o EnABLE loan servicing software; o MITAS loan servicing software; o DBC loan origination; o Clearwater Analytics underwriting; o Paychex payroll processing; o Tyler Analytics underwriting; o Basecamp document sharing; and o Docuware document repository. The Finance Authority is currently converting its loan servicing platform to EnABLE from MITAS. The Finance Authority also currently uses a proprietary timesheet system created and supported internally.

3 Question 4: Please clarify the reference in the RFP to substantive testwork. Is there specific substantive work that is required for the external auditors? There is no specific substantive work required for the external auditors. The selected firm will determine the frequency and scope of any substantive testing. Question 5: Is it required that our company be registered with the PCAOB and AICPA in order to provide your organization with an outsourced Internal Audit function? Does the absence of third party reviews count negatively in the evaluation? Registration with PCAOB and/or AICPA is not required. While third party reviews provide one method for the Finance Authority to assess the quality of the firm s work, the absence of such reviews does not disqualify an Offeror. In the event an Offeror does not undergo third party reviews, the Finance Authority will assess work quality through alternative methods. Question 6: Have the internal controls at the New Mexico Finance Authority previously been assessed for operating effectiveness? If yes, are you willing to share the last year the controls were assessed and the results of the assessment? Since 2014, the Finance Authority has contracted with RSM to provide internal audit services. Included in the scope of the internal audit services provided by RSM are assessments of the internal controls in each functional area reviewed. Internal audit materials that are the property of the Finance Authority will be available for reference by the selected firm. The Finance Authority undergoes an annual external audit in accordance with auditing standards generally accepted in the United States and the standards applicable to financial audits contained in Governing Auditing Standards issued by the Comptroller General of the United States. The Fiscal Year 2017 external audit was conducted by Moss Adams, LLP. Moss Adams, LLP will conduct the external audit for Fiscal Year Copies of the Finance Authority s Audited Financial statements can be located at:

4 Question 7: Is the current control framework Committee of Sponsoring Organizations of the Treadway Commissions (COSO) 2013? If not, what framework has been utilized? The Finance Authority undergoes an annual external audit in accordance with auditing standards generally accepted in the United States and the standards applicable to financial audits contained in Governing Auditing Standards issued by the Comptroller General of the United States. Question 8: What is the target contract start date for vendor after selection? The Finance Authority wishes internal audit services to commence as soon as practicable after selection, with a target date of July 15, Question 9: To further assist with the controls scoping, please provide: - Number of in-scope business processes/sub-processes - Listing of systems relevant for the audit - Number of key controls identified and tested in the previous fiscal year, if applicable. The Finance Authority currently finances projects through 10 separate programs. Each program is subject to enacting statutes and regulations with varying complexity. Each program includes in-scope business processes focusing on loan/grant eligibility and underwriting, loan/grant origination, and loan/grant servicing. The Finance Authority issues bonds, the business processes for which are in-scope. Finally, the operational business processes conducted in accounting, legal, IT, compliance and human resources are also within the scope. The Finance Authority maintains numerous controls for each business process and sub-process but has not quantified the controls identified and tested in the previous fiscal year. Please see the response to Question 3 for a list of the relevant systems used by the Finance Authority. Question 10: Can you please provide the previous fiscal year internal audit plan? An internal audit plan was not prepared for Fiscal Year Internal Audits conducted include review of the Finance Authority s loan servicing platform conversion, Water and Private Lending Programs.

5 Question 11: In section I.D.2.1 Internal Risk Assessment, NMFA indicates that the internal auditor must evaluate the results and assigns a low, moderate, or high risk rating to the individual business processes. a. Does NMFA have an expected frequency for planned/additional risk assessments that should be included in the planned fees for this three-year proposal as a discrete project? Does NMFA expect those fees to be included as part of the project and fee detail? An initial organization-wide risk assessment is included in the scope of work. Additional assessments or updates may be requested during the three-year proposal period. Offerors are encouraged to include in the proposed fee schedule the initial assessment, any subsequent assessments and periodic updates. Question 12: In section I.C.4.1 NMFA has request that the internal audit plan be executed in compliance with the International Professional Practices Framework (IPPF). a. Does NMFA require only the IPPF standards or would another industryaccepted standard (i.e. AICPA consulting standards) be allowed? Industry-accepted standards, such as the AICPA consulting standards, are acceptable. Please state which standard(s) the Offeror intends to follow. Question 13: In section I.D.1.7, NMFA states that staff that provide internal audit services must be members of the IIA and remain constant for the duration of the contract. a. Does this apply to all Offeror employees that would perform work on the engagement? For example, would this apply to technical subject matter advisors? Project Team leads and Key Persons (as defined in Appendix C) should be and remain IIA Certified. Technical subject matter advisors and staff directly supervised by an IIA member may perform work on the engagement.

EMPLOYEE BENEFIT PLANS FOR NFPs. Bertha Minnihan, Partner, Moss Adams LLP Brad Wall, Partner, Moss Adams LLP

EMPLOYEE BENEFIT PLANS FOR NFPs Bertha Minnihan, Partner, Moss Adams LLP Brad Wall, Partner, Moss Adams LLP 1 BERTHA MINNIHAN Bertha has nearly 20 years of experience in public accounting and serves as