Enterprise Risk Management and Internal Audit Services

Issuance of RFP: March 6th, 2026

Deadline to Submit Written Questions on Bonfire: March 20th, 2026

Proposal Due Date: March 26th, 2026

Short List Interviews, if requested: April 1st-3rd, 2026

Notice of Intent: April 10th, 2026

Anticipated Contract Award: Week of April 20th, 2026

Phase 1 (Enterprise Risk Assessment): Months 1-3

Phase 2 (Internal Audit Plan Development): Months 4-6

Phase 3 (Internal Audit Execution): Months 7-9

Phase 4 (Corrective Action Implementation Support & Risk Refresh Framework): Months 10-12

Engagement Close-Out Report: Month 12

The government authority in New York seeks a qualified vendor to provide comprehensive enterprise risk management and internal audit services. The selected firm will conduct a thorough organizational assessment to understand the agency’s mission, strategic objectives, governance structure, staffing, and operational environment.

Responsibilities include reviewing and analyzing all capital project–level Risk Registers to assess broader organizational implications, identifying interdependencies, and determining risk overlap. The firm will facilitate structured interviews, workshops, and document reviews with executive management and key staff to evaluate the agency's risk environment and risk appetite. Evaluation of existing internal controls must be performed, with recommendations offered to strengthen or modify controls where necessary.

Additional tasks involve developing an internal audit plan, conducting an independent review of the Risk Register, and supporting corrective action implementation. The firm is also responsible for providing a framework for refreshing the agency's risk assessment as organizational conditions evolve.