internal audit request for proposal for... · web vieworacle work order management release1 ......

Northeast Ohio Regional Sewer District

Internal Audit Request for Proposal

2013-2016

2013-2016Internal Audit Department Services Request

The Northeast Ohio Regional Sewer District (NEORSD) solicits partners to provide assistance to its Internal Audit Department. NEORSD seeks to leverage the talents of its existing staff with its partners to achieve the strategic business objectives outlined in the Audit Department 2013-2016 Audit Plans.

NEORSD requests interested firms to dedicate professionals having the requisite experience and knowledge to support various projects and services requested by the NEORSD.

Services Requested

The types of engagements are anticipated to include both specific project engagements and general services along three audit tracks:

Audit Engagement Tracks

Track 1 Internal Audit Management Projects and SupportTrack 2 Information Technology Projects and SupportTrack 3 Construction Services

The Audit Tracks include both projects and general support services. Projects are fairly strictly defined audits with a developed audit plan, goals and objectives, and a general timeframe for the project. General services are requests by NEORSD for knowledgeable external resources available at a certain price, over a certain period of time, to support the skills needed by NEORSD and to supplement its Internal Audit staff.

The roles and responsibilities of NEORSD project partners include, but are not limited to:

Identify and dedicate the appropriate project team and staffing Provide overall quality assurance for engagement Assume responsibility for finalizing work plans, managing professionals during

fieldwork, and reviewing work papers and reports with NEORSD Internal Audit management

Monitor and communicate progress.

Timing

The objective of this proposal is to cover all audit-related engagement issues through June 2016. Individual projects or assignments will not require all levels of support.

- 2 -


Projects have specific time allotments as well as specific Scopes of Work. Professional staff assigned may vary depending upon the specifics of the engagement, the concerns and needs of NEORSD, and the expected deliverables. An example of the types of staffing provided in the engagements is as follows:

Professional TypeEngagement ManagerIT SpecialistProcess AnalystStaff Professional

Technology Systems and Background

Below is a brief outline of NEORSD’s Information Systems environment:

ApplicationsKronos Version 5.2 SP18 (current project to 6.3.6) Oracle HR Version 11.5.10 (current project to R12.1.3)Oracle Financials 11.5.10 (current project to R12.1.3)Noetix WebQuery 5.5Discoverer 10gADP Connections 2005.4.2.0ADP 5.3 SP2Lablynx 6.20 SP 1.0.1Oracle Work Order Management Release1.9.0.4.6GIS ESRI ArcGIS ver 10.0ODMS 3.5IAS 3.0 Track-IT Information Technology 10.5Track-IT Admin Services 7.0.2 (current project to 10.5)

DatabasesOracle 9i, 10g and 11g

NetworkThe District’s business network utilizes Novell Netware 6.5 SP8 for network services such asauthorization, file, print, and desktop management. Windows 2003/2008 servers are used forweb/application servers and SQL Server database servers. Linux servers are used as databaseservers running Oracle, and for special purpose applications. VMware ESX 3.5 and ESXi 4.1servers run virtual servers for production, test, and disaster recovery. The physical servers utilize the HP DL380 platform and HP BladeSystem c7000 Enclosure with HP BL460c Server Blades. For centralized storage the District has implemented a Dell Compellent SAN at the GJM and EMSC locations.

The District's desktop configuration is typically 2GB to 4GB RAM with a processor speed of

- 3 -


2GHz to 3Ghz running Windows XP SP3 and Windows 7 SP1. Standard applications include the Novell Client, MS Office 2007, Norton Antivirus, Outlook email client and Adobe Reader. The District uses Novell ZCM 11 for user and workstation policy management, desktop imaging, and desktop management, and application deployment.

Generally, the District’s five main locations are connected via gigabit Ethernet links in a ringtopology through the use of AT&T’s GigaMAN. GJM and EMSC are used asdisaster recovery sites for each other. The Cisco core and edge switches at all sites have gigabit Ethernet ports and support for PoE.

Process to Determine Engagement Partner

Each proposal submitted for a particular project or engagement will be reviewed for responsiveness. If necessary, NEORSD will schedule an interview with firms deemed competitive. NEORSD may or may not conduct formal interviews for a particular project or projects at the District’s discretion.

Prior to the submission of responses, NEORSD will schedule a pre-response meeting with interested firms. The purpose of this meeting would be to expound on the information provided to all participants and to clarify elements of the services both projects and allowances to be provided. A combination of audit and client representatives will make the selection.

Proposal Format and Required Information

For all proposals

Each candidate shall submit one original and one electronic version of the proposal, readable in .docx or .pdf format.

A Scope of Work will be created for the specific projects. The Scope of Work will set forth the scope, deliverables, and activities, formalize pricing, and timing for each project. Services are to be quoted on a time and expense basis with a not to exceed limitation.

Proposals shall address scopes as presented. Proposals may contain additions or alternatives to the proposed scopes, each to be detailed and quoted separately.

A preliminary schedule showing the activities and anticipated milestone dates necessary to complete the projects in the timeframe allotted.

The location(s) of the office(s) where the various project services are to be performed. NEORSD expects the proposed Project Manager and key members of

- 4 -


the project team to be readily accessible throughout the course of this project.

Hours and costs should be identified such that the proposal clearly defines where and when work is to be performed. This will allow for proper tracking of project milestones. NEORSD will also use this information to assist in evaluation of the proposals. NEORSD reserves the right to request additional information.

Proposal project costs cannot be escalated for additional contingency factors or inflation adjustments during the contract period.

Reasonable and customary out-of-pocket expenses shall be billed by the consultant at actual cost and with no mark-up for handling. Payment for lodging and meal expenses will be in accordance with NEORSD’s Travel Expense Reimbursement Policy. Mileage charges shall be at the current District rate, but will not exceed the current Internal Revenue Service rate. Applicable expenses will be subject to and included against “Not to Exceed” limits.

A statement of the consultant’s qualifications, including a brief overview of no more than three recent similar projects or engagements by the involved staff conducted by the consultant, including descriptions and references.

Résumés of key staff members and/or sub consultants proposed to work on the project. NEORSD fully expects that personnel included in the proposal will be assigned to the project. Any personnel added to the project team or changes of personnel in significant roles shall be subject to advance approval by NEORSD.

A completed Equal Employment Opportunity form. A blank form will be provided with a proposed contract form.

Statements confirming that no personal or organizational conflicts of interest are known to exist.

A schedule of hourly rates for the types of expertise anticipated as necessary in conducting various engagements.

Submission of Proposals

Responses to Proposals will be received by the Manager of Purchasing of the Northeast Ohio Regional Sewer District, 3900 Euclid Ave., Cleveland, Ohio 44115, until 4:00 p.m. official local time on the date indicated below.

- 5 -


Due Date: Thursday, June 13, 2013

Pre-Proposal Meeting: Wednesday, June 5, 2013 at 9:00 AM

Environmental and Maintenance Services Center (EMSC)4747 East 49th StreetCuyahoga Heights, OH 44125

Transfer of Records

The consultant shall be responsible for maintaining a complete project library and master files of all contract actions and reports.

All records (graphics originals, calculations, electronic files including model input and output files, etc.) collected and generated by the project shall be the property of NEORSD and shall be turned over to NEORSD upon completion or as directed.

All deliverables produced during an engagement are for the sole use of NEORSD’s management. For each project requested by NEORSD, a Scope of Work will act as an addendum to this proposal. The Scope will set forth the scope, deliverables, activities, and general timing for the engagement.

Legal Language to be Included in RFP’s

Insurance. Consultant will be required to demonstrate evidence of coverage for commercial general liability and property damage insurance in an amount sufficient to cover any damages caused by the Consultant. The Consultant must also maintain insurance to protect itself from claims arising out of the performance of professional services caused by any errors, omissions or negligent acts for which it may be legally liable. Consultant shall provide copies of such policies to the District before commencing any portion of the work. In the event that policies are not available, the consultant must provide a certificate of insurance including an additional insured endorsement. Consultant must provide an exact copy of such policies in the event that the District intends to submit a claim under the policies.

Indemnification. Consultant will be required to indemnify the District against any damages caused by the tortuous actions of the Consultant. The District is prohibited under Ohio law from indemnifying a private entity.

- 6 -


Choice of Law and Jurisdiction. Any engagement between Consultant and the District shall be governed by the laws of the State of Ohio, the ordinances of the City of Cleveland, and the Rules and Regulations of the District. Any disputes related to the

agreement shall be brought in any court of competent jurisdiction located in the City of Cleveland, County of Cuyahoga.

Audit Work Papers

The Internal Audit Department uses the TeamMate automated work paper system. All engagement documentation should be in an electronic format such that work papers, reports and other work product can be transferred into this tool.

Project partners will be asked to participate throughout the audit using the TeamMate product as follows:

Continuous use of TeamMate throughout engagement Include and approve the work product as needed during the audit. This is

managed and coordinated by NEORSD

In addition, the audit plan and audit report templates are to be generated by NEORSD for use on all engagements.

- 7 -


Engagement Table of Contents

Start Date

Track 1 Internal Audit Management Projects and Support

a) Payroll and Benefits Review.........................................................Q2 2014b) Stormwater Accounting Compliance Review...............................Q4 2014c) Financial Strategic Process Review..............................................Q3 2014d) Vendor Management – Accounts Payable……………………….Q4 2015e) Enterprise Risk Management…………………………………….Q4 2013f) Additional Internal Audit Support.................................................TBD

Track 2 Information Technology Projects and Support

a) Network Infrastructure Follow-up Review...................................Q4 2013b) IT Risk Assessment......................................................................Q3 2014c) IT Software License Valuation…….………………….……..…..Q3 2015d) Additional Information Technology Support..............................TBD

Track 3 Construction Audit Support

a) Construction and Engineering Process Reviews and Support…..TBD

8


Track 1Payroll and Benefits Review

Objectives

Assess compliance of Payroll, Human Resources, outsourcing agent (ADP), and Finance operations with NEORSD policies, practices and procedures and applicable payroll laws

Determine whether benefits are being adequately verified prior to adding individuals to District employee benefits packages.

Determine whether adequate controls exist to ensure employee benefits are coordinated between Human Resources and Payroll

Ensure that the Financial transactions for payroll and benefits are properly accounted for in the general ledger.

Scope

Audit period is 2012- 2013 Obtain relevant payroll and benefit policies, procedures and practices Review entry and managerial review of information into and from Oracle HR Review all interface application program rights and responsibilities

P Procedures

Review timekeeping process through Kronos from entry of time to its transfer to payroll and identify key controls.

Walkthrough employee processes, setup of new hire, and other changes, transfers and terminations and identify key controls.

Walkthrough the processing of employee benefit additions and changes through payroll processing, including benefit deductions and NEORSD matching benefits

Walkthrough transfer of employees and time to ADP and identify key controls over data integrity

Review the handling of cash and checks and the transfer of payroll accounting entries between NEORSD and ADP per policies and procedures.

Trace a representative sample of transactions from

9


the source documents through the general ledger and related reports

Requested Hours and Start Date

150-200 hoursQ2 2014Not to exceed $30,000

10


Track 1 Stormwater Accounting Compliance Review

OBJECTIVES

Ensure compliance with Title V Stormwater Management Code as to Stormwater Fees, Credits and Community Share Programs

Ensure the accurate accounting and tracking of Stormwater revenue, and the appropriate cash application and distribution of Community Credits

Review revenue and cash accounting rules and controls Review billing and collection business processes

SCOPE

The audit period is from January 1, 2013 to present Obtain documentation of the Stormwater Financial processes within the District. Distinguish between billings performed by Cleveland Water Department (CWD) and

internal billings by the District Detail the related interaction with Third Parties. Perform testing procedures on documented cycles to validate identified controls are

in place and operating effectively at the District. Based upon documentation and testing procedures provide suggested enhancements

to the control environment at the District to process, monitor and manage the Stormwater financial processes

PROCEDURES

Conduct interviews with various members of the identified processes regarding each of the critical areas identified within the revenue management cycle.

In conjunction with these interviews, document the risks, controls, and potential procedural improvements associated with these processes

Gain and document an understanding of the revenue tracking process to ensure all revenue is properly recorded and subsequent disbursement of revenue credits can be identified to the community level

Identify, document and understand controls within each of the tracking processes

11


and how those controls are recorded When applicable identify potential enhancements to the documented processes to

help increase efficiencies and effectiveness of the revenue related activities as it relates to the District Stormwater program


250 to 300 HoursEstimated Start Time: Q4 2014 Not to exceed $40,000

12


Track 1 Financial Controls Process Review

Objectives

Determine and evaluate the District’s Financial management process and internal controls over key financial processes (similar to a Sarbanes Oxley-SOX review)

Evaluate the overall detailed documentation of key financial processes, identified financial risks and offsetting controls to mitigate those risks

Adjust and scale the controls assessment in a manner that accounts for risk, not legislative mandates

Scope

Obtain the District Financial organization charts and job descriptions of key employees

Obtain key department process flows, policies and procedures to guide key financial processes

Review prior Internal and External audit reports effecting Finance Review existing ERM information from 2012 and 2013 Identify the process, Technology infrastructure and other elements as part of this

assessment

Procedures

Document management key business processes and controls that align with the department’s organization

Interview key department personnel to identify significant issues and concerns Determine that key business financial processes are documented and comment as to

the effectiveness of inter-department controls Review management responses to Internal/External audit reports and comment Establish framework for periodic reporting such as key metrics or KPI’s to measure

the performance of department goals and objectives Identify control objectives, ownership of controls and remediating actions


13


250 to 300 HoursEstimated Start Time: Q3 2014Not to exceed $45,000

Track 1 Vendor Management and Accounts Payable Review

Objectives

Evaluate the vendor management processes at NEORSD Evaluate the procure to pay process with a focus on internal controls over vendor

information, invoice processing and payment Assess fraud risk potential

Scope

2013, 2014, and 2015 through Q2 purchases Evaluate the consistency, disparity, and segregation of duties among the vendor

management processes Document the system of internal controls governing the purchasing process by

obtaining and reviewing all applicable written policies and procedures Review applicable prior Internal Audit reports and work papers Evaluate the vendor management, invoice processing systems and appropriate

approval of transactions throughout the procure to pay process

Procedures

Identify risks and key controls in the purchasing, vendor management and invoice processes

Test key controls in the vendor management process to determine their effectiveness Test new vendor set-up for proper approval Perform walk-throughs of vendor the management process from set-up through

payment of invoices, identifying system controls and weaknesses Provide recommendations to management to improve the efficiency and

effectiveness of vendor management and invoice processing activities



14


\

Track 1Enterprise Risk Management Assistance

Objectives

NEORSD has commenced an Enterprise Risk Management program Two assessments were completed using COSO standards and will be maintained Refresh the existing data, extend to the next level of risk and continue to establish

risk reporting standards to help link ERM financial and strategic resource allocation Further extend understanding of risk and risk response Facilitate development of metrics for risk management Develop framework for periodic risk reporting

Scope

Review existing ERM information from 2009 through 2012 Understand extension of ERM to audit planning development Understand strategic and budgetary drivers

Procedures

Refresh first level ERM data from original interviews and surveys Conduct or facilitate an assessment of the second level risks Extend the ERM process to deeper levels in other District processes Facilitate development of risk tolerance recognition and response activities

organization wide Facilitate development and implementation of initial risk monitoring and metric

activities at strategic and operational levels Establish framework for periodic reporting on the above


320 to 420 HoursEstimated Start Time: Q3 2013 through Q2 2015Not to exceed $100,000

15


Track 1 Internal Audit General Services

Objectives

Internal Audit seeks additional resources to supplement its staff. The resources will be used on specifically scoped projects which will be defined as the business needs arise. An example of an audit considered but not specifically scoped is a review of NEORSD’s record retention processes.

Internal Audit also seeks assistance with its reporting levels, staffing levels and client service expectations. This assistance shall take the form of concrete methods and benchmarks for Internal Audit to most effectively and efficiently communicate with its Board, management and audit clients. This assistance also should encompass helping Internal Audit on the path toward peer review status among audit departments of its size and in its industry.

Scope

The successful bidder will be capable of allocating additional resources beyond the scoped elements defined above. In addition, this bidder will have the background and the experience to provide the Internal Audit Department with advice and methods to assist in its reporting and organizational functions.

Requested Allowance and Duration

Allowance: $75,000Estimated Start Time: Q3 2013 and ongoing

16


Track 2Network Infrastructure Follow - Up Review

Objectives

Review NEORSD operational and business network management policies and procedures

Evaluate the overall network architecture and supporting documentation Determine and evaluate the safeguards and risks for the District’s network

management process Identify opportunities for business process improvement and recommend best

practices in the District’s network management practiceScope

Review network maps, the current operational and business network architecture and supporting documentation and previous IT network audit report

Obtain current network management policies, procedures, and standards to determine if they incorporate adequate security and control best practices given NEORSD’s industry, regulatory concerns, and business objectives

Obtain other IT security procedures including review of firewall and router configurations, appropriateness of user and administrator access, network user activity, and anti-virus protection

Procedures

Review previous audit reports and evaluate audit recommendation implementation activities by management

Review current NEORSD network infrastructure diagrams to ensure they align with the actual environment

Conduct external penetration testing of the NEORSD networks to validate that vulnerabilities exist which could be exploited by outside attackers or masked by internal resources

Identify and evaluate key controls of the District’s network management processes Review processes for network security, procurement and change, and operations

management, including infrastructure-related patch management strategies Review change management processes to ensure they include steps to evaluate

proposed network changes for security, performance, and dependency impacts Evaluate security management processes to ensure they include steps to update

network infrastructure configurations to reflect industry and vendor best practices for the latest vulnerability updates

17


Evaluate the District’s IT Governance framework and supporting documentation for effectiveness with regard to the operational and business networks

Evaluate the District’s ongoing IT account maintenance processes to ensure proper user and administrator access control to safeguard against any unauthorized activity



18


Track 2 IT Risk Assessment

Objectives

Determine and evaluate the risks and risk response for the District’s information technology (IT) management process

Further extend understanding of IT Governance issues Utilize the District’s existing ERM framework to facilitate development of metrics

for IT risk management and incorporate them into the current ERM process Develop framework for periodic risk reporting in IT area

Scope

Review existing ERM information from 2012 and 2013 Obtain IT policy and procedures Review prior Internal Audits Obtain IT Governance protocols Review network maps, the current operational and business network architecture and

supporting documentation and previous IT network audit report Understand District’s IT strategic and budgetary drivers

Procedures

Conduct or facilitate an assessment of IT risks Identifying and obtaining a high-level understanding of the key business applications Establishing the main platforms on platforms on which existing applications reside

and identifying the key interfaces between them Facilitate development of IT risk profile and risk tolerance recognition and response

activities organization wide Recommending controls and procedures to be instituted to effectively manage

identified risks Facilitate development and implementation of IT risk monitoring and metric

activities at strategic and operational levels Establish framework for periodic reporting on the above



19


Track 2 IT Software License Valuation

Objectives

Confirm the inventory valuation of NEORSD’s licenses for technology related assets.

Review systems and processes used to monitor and maintain licensees Review cost and benefit processes used to evaluate licensing outlays technology

planning throughout the District

Scope

Obtain current listings of all IT licenses and related assets Evaluate IT software acquisition procedures Review previous audit report and evaluate audit recommendation implementation

activities by management Obtain list of present IT software and software license inventory Obtain IT asset policies and procedures

Procedures

Determine the completeness of the District license inventories Document and test controls to record and maintain license data Determine if other District software assets are administered outside of the IT

Departments control, and they are managed Ensure licenses are current and proper in number to accommodate user access Ensure the District is in compliance with applicable license agreements Provide reports on recommendations including best practices

Requested Hours and Duration

100-120 hoursAnticipated Start Date: Q3 2015Not to exceed $25,000

20


Track 2 Information Technology Services Support

Objectives

The services requested of the consultant include providing general information technology support to assist District staff in meeting the objectives of NEORSD’s Internal Audit Department.

Scope

The successful bidder will have the ability to provide knowledgeable staff with the requisite skills necessary to assist the Internal Audit department in the technology areas listed in the document above. Typical duties will include the following:

System configuration analysis and testing Business rule testing and analysis Review and testing of interfaces Detailed data extraction and query modeling

Special attention is to be paid to the detailed technology environment in systems and background above. In addition, staff members should also have a working knowledge of the MS Office Suite, including Word, Excel, and Access in order to communicate results with the standards of the Internal Audit department.


Allowance: $100,000For use through the end of 2nd quarter 2016

21

2013-2016Internal Audit Department Services RequestTrack 3 Construction Audit Support

NEORSD seeks expertise to assist its Internal Audit Department in the review of design and construction projects.

Objectives

Assist with the project selection process based on a comprehensive risk and control factor review

Determine that the District’s multi-million dollar portfolio of projects are managed in an effective and efficient manner

Evaluate project contract compliance and District Engineering and Construction processes, policies and procedures

Scope

The successful bidder will have the ability to provide knowledgeable staff and support with the requisite skills necessary to perform detailed and comprehensive audits of construction contracts and associated contracts including engineering, administration and testing. The level of expertise must be capable of detailed auditing.:

Planning – identifying project risk, valuation and projects to be selected for audit Examine engineering and construction processes such as:

o Bid, contract and application for payment reviewo Design and testingo CIP Management and Contract Administrationo Change order and Project close-out procedures

Reviews of field documentation Ability to assess contract conditions and change order language in overall project

environments


Allowance: $120,000For use through the end of 2nd quarter 2016

22

internal audit request for proposal for... · web vieworacle work order management release1 ......

Documents