Orange County Employees Retirement System

Buyer seeks Information Technology Audit & Consulting services. The scope includes conducting IT General Controls and Cybersecurity audits, developing IT risk assessments, and creating a multi-year IT audit program. The consultant will work with the buyer's Internal Audit department to build audit policies, procedures, and risk control matrices. The project requires expertise in ITGC, Cybersecurity, and IT risk assessment methodologies.

• 11/1/2024 - RFP Questions Due
• 11/8/2024 - RFP Answers Posted
• 11/22/2024 - Proposal Due Date
• 12/20/2024 - Selection of Finalists

• Professional certifications such as CISA, CIA, CISSP, CRISC, or similar
• Minimum 7+ years of IT Audit experience
• Experience in conducting risk-based ITGC audits
• Experience conducting risk-based Cybersecurity audits
• Familiarity with NIST Cybersecurity Framework and CIS Controls
• Ability to develop control matrices and test plans
• Proven track record in delivering audit reports

• Conduct IT General Controls (ITGC) audits
• Perform Cybersecurity audits
• Develop IT risk assessment for Internal Audit
• Create multi-year IT audit program
• Build audit policies and procedures for ITGC and Cybersecurity
• Develop risk control matrices for ITGC and Cybersecurity
• Test design and operating effectiveness of controls
• Provide observations and recommendations for remediation
• Assist in developing 1-3 year Internal Audit IT plan
• Collaborate with OCERS management and external auditor