8411A - Supplemental Internal Audit Services

Statewide Term Contract 8411A - Supplemental Internal Audit Services

Awarded Vendors and Contacts

State Agencies
Note: Please ensure all internal security data policies are followed by the agency.

On-Premises DIT Policy Cleared

1. California Creative Solutions dba CCS Global Tech
   James Easley | 214-709-2445
2. Cherry Bekeart LLC
   Denise Lippuner | 703-584-0274
3. CliftonLarsonAllen LLP
   Christopher Kessler | 239-226-9903 | Mobile: 239-488-0999
4. Deloitte Touche LLP
   Ethan Bailey | 803-626-8029
   Charles Carter | 828-974-1885
5. EAG Gulf Coast LLC
   Laura Soileu | 225-408-4431| Mobile: 901-326-4431
6. Experis US LLC dba Jefferson Wells
   Timothy Litz | 336-706-2030
   Deborah Cash | 336-391-3123
7. Kernutt Stokes LLP
   Trever Campbell | 541-749-4020
8. KPMG LLP
   Sarah Rodriguez | 615-840-2019
   Young Kim | 919-696-1015
9. Mauldin & Jenkins LLC
   Tim Lyons | 833-818-0406
10. McKinsey Company Inc.
    Todd D’Emidio | 202-662-3100 | Mobile: 202-662-0931
    Geoff Bradford | 202-662-0522
11. Plante Moran PLLC
    Troy Snyder | 248-223-3273 | Mobile: 248-770-4816
    Matthew Bohdan | 248-223-3619 | Mobile: 248-736-6285
12. RSM USA
    Clara Ewing | 321-751-6239
    Kristen Johnson | 321-421-8127
13. ThirdLine, Inc.
    David Osborn | 918-956-8673
14. Weaver & Tidwell LLP
    Alyssa Martin | 832-320-7975 | Mobile: 214-354-1337
    Todd Hoffman | 832-320-7975 | Mobile: 214-354-1337

Hosted DIT Policy Cleared
Note: For Hosted solutions, vendors must submit a current third-party security assessment (SOC 2 Type 2, ISO 27001, etc.) at time of response to agency solicitation, even if listed under this section.

1. Deloitte Touche LLP
   Ethan Bailey | 803-626-8029
   Charles Carter | 828-974-1885
2. Experis US LLC dba Jefferson Wells
   Timothy Litz | 336-706-2030
   Deborah Cash | 336-391-3123
3. Kernutt Stokes LLP
   Trever Campbell | 541-749-4020
4. KPMG LLP
   Adrian Savic | 919-801-8045
   Young Kim | 919-696-1015
5. Mauldin & Jenkins LLC
   Tim Lyons | 833-818-0406
6. Plante Moran PLLC
   Troy Snyder | 248-223-3273 | Mobile: 248-770-4816
   Matthew Bohdan | 248-223-3619 | Mobile: 248-736-6285
7. RSM USA
   Clara Ewing | 321-751-6239
   Kristen Johnson | 321-421-8127

Universities, Community Colleges, and All Non-Mandatory Entities
Note: Non-DIT Policy (use internal IT policy requirements)

1. California Creative Solutions
   James Easley | 214-709-2445
2. Cherry Bekeart LLP
   Denise Lippuner | 703-584-0274
3. CliftonLarsonAllen LLP
   Christopher Kessler | 239-226-9903 | Mobile: 239-488-0999
4. Deloitte Touche LLP
   Ethan Bailey | 803-626-8029
   Charles Carter | 828-974-1885
5. EAG Gulf Coast LLC
   Laura Soileu | 225-408-4431| Mobile: 901-326-4431
6. Experis US LLC dba Jefferson Wells
   Timothy Litz | 336-706-2030
   Deborah Cash | 336-391-3123
7. Kernutt Stokes LLP
   Trever Campbell | 541-749-4020
8. KPMG LLP
   Adrian Savic | 919-801-8045
   Young Kim | 919-696-1015
9. Mauldin & Jenkins LLC
   Tim Lyons | 833-818-0406
10. McKinsey Company Inc.
    Todd D’Emidio | 202-662-3100 | Mobile: 202-662-0931
    Geoff Bradford | 202-662-0522
11. Plante Moran PLLC
    Troy Snyder | 248-223-3273 | Mobile: 248-770-4816
    Matthew Bohdan | 248-223-3619 | Mobile: 248-736-6285
12. RSM USA
    Clara Ewing | 321-751-6239
    Kristen Johnson | 321-421-8127
13. ThirdLine, Inc.
    David Osborn | 918-956-8673
14. Weaver & Tidwell LLP
    Alyssa Martin | 832-320-7975 | Mobile: 214-354-1337
    Todd Hoffman | 832-320-7975 | Mobile: 214-354-1337

Contract Covers

The following nine (9) categories of supplemental audit services include:

1. Operational/Performance Audit

An operational audit is a systematic and independent evaluation of organizational activities. Financial data may be used, but the primary sources of evidence are the operational policies and achievements related to organizational objectives. Internal controls and efficiencies may be evaluated during this type of review.

2. Investigative Audit

An investigative audit is an audit that takes place as a result of an allegation of unusual or suspicious activity on the part of an individual or agency. It is usually focused on specific aspects of the work of the individual or agency.

3. Compliance Audit

Note: Audits limited to meeting the Federal Single Audit requirements are not within the scope of this RFP.

A compliance audit is a comprehensive review of specific activities to determine whether performance conforms to predetermined contractual, regulatory, or statutory requirements. It may also include adherence to internal policies and procedures prescribed by the agency. Compliance audits may include examination of the agency’s vendors to ensure conformance with contract agreements or an agency’s sub-recipients to ensure adherence to grant requirements.

4. Informational Systems Audit

Note: Audits limited to an assessment of network vulnerabilities are not within the scope of this RFP (see GS 143B-1341 in SL 2015-241, requiring agencies to get State CIO approval).

An information systems audit, or information technology audit, is an examination of the management controls within an information technology infrastructure. The evaluation of obtained evidence determines if the information systems are safeguarding assets, maintaining data integrity, and operating effectively to achieve the organization's goals or objectives.

5. Data Analytics/Continuous Monitoring

Data analytics is a process by which insights are extracted from operational, financial, and other forms of electronic data internal or external to the organization. These insights can be historical, real-time, or predictive and can also be risk-focused (e.g., controls effectiveness, fraud, waste, abuse, policy/regulatory noncompliance) or performance-focused.

6. Risk Assessment and Audit Plan Development

The scope and objective of this assessment is to allocate limited internal audit resources to areas of the organization that are most critical to the success of the organization in reaching its goals. A well-developed risk assessment model will provide an efficient and systematic procedure to: determine the auditable areas of an entity; measure the risk of each unit and identify activities exposed to high risk; rank the units by risk; determine the time necessary to complete audits; distribute available resources in the most efficient manner; and develop an annual and/or long-term audit plans.

7. Financial Audit

Note: Independent financial statement audits to attest to the fairness and accuracy of financial statements (such as the Annual Comprehensive Financial Report) are not within the scope of this RFP.

A financial audit includes the verification of the financial statements, or a component of the financial statement, of a legal entity with a view to express an audit opinion. The audit opinion is intended to provide reasonable assurance that the financial statements are presented fairly, in all material respects, and/or give a true and fair view in accordance with the financial reporting framework. The purpose of an audit is to enhance the degree of confidence of intended users in the financial statements.

8. Accounting & Financial Services

These services include but are not limited to operational accounting, assisting full-time agency finance staff with month end financial closings, annual preparation and support of the Annual Comprehensive Financial Report (ACFR), trial balance preparation, Governmental Accounting Standards Board (GASB) implementation efforts, general ledger accounting transactions, cash management and related operational accounting functions.

9. Managerial Advisory Services – Consultant Services

Note: Consulting services are only utilized when no work, task or deliverables are associated with the needed service(s). Utilizing consultant services requires additional preliminary review and P&C/Governor’s Office approval for award.

These services include, but are not limited to, organizational efficiencies, cost reductions, budget and revenue forecasting, economic forecasting, research, analysis of unmet demand for public services, strategic planning, project implementation, and front-line public customer facing improvements to further a public agency’s statutory mandates and directives.

Mandatory Contract

This is a mandatory Statewide Term Contract for state agencies, departments, institutions, universities, and community colleges - unless exempted by North Carolina General Statute. Additionally, non-mandatory entities including schools and local governments that are allowed by general statute may use this contract.

Special Notes

State Agencies – Mandatory Contract

State agencies with the need to acquire services covered by this contract are required to follow the established Department of Information Technology (DIT) policies.

IT Component Alert – This contract contains DIT policy-driven components that agencies are required to adhere to for data security. The awarded contracts DO NOT contain authorization of software or license agreements.

Data Security – Currently there are fourteen (14) awarded vendors offering services for projects that maintain data security using state infrastructure (fourteen (14) on-premise or seven (7) hosted).

Universities, Community Colleges, and All Non-Mandatory Entities – Convenience Contract

Entities should review and follow internal policies for the IT component of services.
Currently there are fourteen (14) awarded vendors offering services for projects not associated with state DIT policy requirements.

Agency Responsibilities

Agencies using this contract shall complete the Scope Statement Form and submit the form to at least two (2) qualified vendors in the requested category. The process is outlined as follows:

• The agency identifies the auditing needs and prepares a scope statement that describes the requirements for audit services, including location and travel.
• The agency should work with their agency’s Security Data Officer to ascertain data classification, in accordance with the DIT Statewide Data Classification & Handling Policy, designation of on-premise or hosted solution needs, and any additional DIT policy requirements (such as a Privacy Threshold Assessment – PTA).
• The agency should work with their agency’s procurement office to develop and issue the Request for Quote, containing the Scope of Work requirements, to the qualified vendors identified in the statewide term contract under the desired category. Agencies should ask for details around the qualifications of the auditors completing the project in the Request for Quote. Requests shall be submitted to awarded category vendors, via email, Ariba Sourcing Collaboration, or Ariba Sourcing Waiver of Competition process, giving the vendors a minimum of ten (10) days to respond.
• The vendors, if they choose to respond, will prepare a response to the solicitation document and submit it to the using agency in the format structure required by the agency, as described in the scope statement document. A vendor is not required to respond to all scope statements.
• After evaluating the vendors’ responses, the agency then prepares the award recommendation and makes the award. The agency must clearly document its internal business selection process. The documentation must include a written description of the selection process that describes how the vendor was selected, the number of alternative vendors considered, or the specific business reasons or criteria as to why the vendor was selected.
• The agency will issue the Notice of Award to all participating vendors and issue the executed contract to the awarded vendor. The using agency must encumber the funds in accordance with its agency’s policies and procedures. The using agency must notify the Office of State Budget and Management and the Division of Purchase & Contract of the award by submitting Part I of the Vendor Performance Evaluation Report, and to ensure quality of vendor’s work, Part II of the Vendor Performance Evaluation Report must be submitted quarterly.
• The using agency will manage all public record requests involved in the purchasing process in accordance with this contract and the agency’s retention policy.

For guidance and advice about this contract regarding supplemental internal audit service issues and concerns that pertain to their agency’s audit staffing needs, agencies are welcome to contact Barbara Baldwin, Office of State Budget and Management at (984) 236-0635 or Barbara.Baldwin@osbm.nc.gov.

Contract Pricing

eProcurement Help Desk

(888) 211-7440

Contract Attachments

• California Creative Solutions
• Cherry Bekaert LLP
• CliftonLarsonAllen LLP
• Deloitte Touche LLP
• EAG Gulf Coast LLC
• Experis US LLC dba Jefferson Wells
• Kernutt Strokes LLC
• KPMG LLP
• Mauldin & Jenkins LLC
• McKinsey Company Inc.
• Plante Moran PLLC
• RSM USA LLP
• ThirdLine, Inc.
• Weaver and Tidwell LLP

Contract Managers

Ian Fox | (984) 236-0211

Contract Addenda

02/13/2026: Contract Manager changed to Ian Fox