Co-Sourcing Internal Audit Services

The Vendor is required to provide internal audit co-sourcing services to help build on the accomplishments of the existing Internal Auditing Department by providing additional subject matter expertise or resources when needed.
- Internal Audit Plan and may include, but is not limited to, areas such as: Information Technology (I.T.) general controls, cybersecurity, construction audits, claims management, airport rental car agencies, and airport landside and airside tenant agreements.
- Firm's audit approach and methodology should be designed to align with the global internal auditing standards outlined by the institute of internal auditors and/or other recognized auditing standards such as generally accepted government auditing standards
- needed with each selected consultant upon their experience and workload capacity. Following is a general description of audit objectives for each category.
- Construction audits
• Perform audits of engineering and construction contracts, change orders, contract compliance
• Material substitution
• Costs and invoice review for accuracy, allow ability, and reasonableness for contractors, subcontractors, labor, consultants, fees, insurances, and other incurred costs
• Contract administration, change management
• Provide advisory services regarding best practices and process improvements General information technology (I.T.) controls
• Backup and recovery procedures, including offsite backup storage
• Access and encryption controls
• I.T. governance and risk management
• Physical, and logical security to data and programs are appropriate, approved, managed, maintained and supported
• Change management process review
• Inventory management
• Business continuity / disaster recovery process review
• Provide advisory services regarding best practices and process improvements
- Cybersecurity
• Infrastructure review including identifying vulnerabilities with security architecture
• Advanced penetration testing, including human-drive testing, not reliant on automated vulnerability assessment tools
• Determine impact of vulnerabilities and leveraging systems to gain control over other network systems
• Provide advisory services regarding best practices and process improvements
- Contract Period/Term: 3 years