ASRS Internal Audit Services

The Arizona State Retirement System (ASRS) is seeking qualified companies to establish one or more firm-fixed price contracts for Internal Audit Services on an as-needed basis. Governed by the Arizona Procurement Code, the scope of work involves evaluating operational and technical environments, specifically focusing on pension plan accounting audits, investment risk assessments, and comprehensive IT and cybersecurity audits. The selected contractor must ensure compliance with various professional standards, including GASB pronouncements, NIST CSF 2.0, ISO/IEC 27001/27002, COBIT, and ISACA's ITAF. Key deliverables include maturity assessments for network security and incident response, recurring testing of IT General Controls and System Development Life Cycle practices, and the verification of fiscal rule compliance. The contract features an initial term of twelve months with the possibility of extensions up to a maximum aggregate term of five years. Awards will be granted to the most advantageous offerors based on a weighted evaluation of experience and qualifications, methodology and administrative capability, and the competitiveness of proposed fees. Mandatory requirements for offerors include GovRAMP, FedRAMP, or AZRAMP certification and adherence to AZDOHS Information Security Program standards. All proposals must be submitted via the Arizona Procurement Portal, including specific attachments for pricing, exceptions, and confidentiality designations. Personnel assigned to IT positions are subject to security clearances and background checks, including fingerprinting.