rfp no.: 11-0011 request for proposal - Citizens Property Insurance

RFP NO.: 11-0011REQUEST FOR PROPOSAL (RFP)FORCO-SOURCING INTERNAL AUDIT AND ENTERPRISE RISKMANAGEMENT SERVICESRefer ALL Inquiries to Procurement OfficerPatty Davis, Procurement OfficerPurchasing DepartmentCitizens Property Insurance Corporation2101 Maryland CircleTallahassee, Florida 32303Phone: (850) 521-8321E-Mail: bids@citizensfla.comTABLE OF CONTENTSSECTION 1 – INTRODUCTORY MATERIAL1.1 STATEMENT OF PURPOSE1.2 CITIZENS’ BACKGROUND1.3 CONTRACT TERM1.4 CALENDAR OF EVENTS1.5 PROCUREMENT OFFICER AND CONTACT INFORMATION1.6 NO CONTACT OR LOBBYINGSECTION 2 – PROCUREMENT INSTRUCTIONS2.1 DEFINITIONS – SOLICITATION SPECIFIC2.2 QUESTIONS2.3 SUBMISSION OF PROPOSAL2.4 FORMAT AND CONTENTS2.5 REVIEW AND EVALUATION PROCESSSECTION 3 – SCOPE OF SERVICES3.1 PROJECT BACKGROUND3.2 STANDARD REQUIREMENTS AND SPECIFICATIONSRFP No.: 11-0011 July 28, 2011Section 1 – Introductory Material Page 1 of 16

SECTION 1INTRODUCTORY MATERIAL1.1 STATEMENT OF PURPOSE1.2 CITIZENS’ BACKGROUND1.3 CONTRACT TERM1.4 CALENDAR OF EVENTS1.5 PROCUREMENT OFFICER AND CONTACT INFORMATION1.6 NO CONTACT OR LOBBYING1.1 STATEMENT OF PURPOSE: Citizens Property Insurance Corporation(Citizens) is seeking responses from qualified Vendor(s) to provide co-sourcingservices for the Office of the Internal Auditor and/or Enterprise Risk Managementthrough periodic assistance with risk assessments, internal audits, investigations,management advisory services, and other audit related projects. Theseassessments, audits, and projects could be related to financial, operational,compliance, technological, or administrative areas within Citizens. Vendors willbe selected for each of the following project areas:Project Area 1Project Area 2Project Area 3Financial/Operational/Compliance Audit Resources;Information Technology Audit Resources; andEnterprise Risk Management Co-Sourcing.All Vendors shall familiarize themselves with the general requirements beforesubmitting a Response.1.2 CITIZENS’ BACKGROUND: In 2002, the Florida Legislature created Citizens, anot-for-profit government entity, whose public purpose is to provide propertyinsurance to applicants who are not able to purchase coverage in the privateinsurance market.Citizens is governed by Section 627.351(6) Florida Statutes and operatespursuant to a Plan of Operation that is approved by the Financial ServicesCommission of the State of Florida. Citizens operations are supervised by aBoard of Governors comprised of eight (8) members who are appointed by theGovernor, CFO, President of the Senate and Speaker of the House. Additionalinformation about Citizens is available at Citizens website:https://www.citizensfla.com.1.3 CONTRACT TERM: The contract term is anticipated to be for three (3) years.and, at the discretion of Citizens’ have two (2), 1-year renewals.1.4 CALENDAR OF EVENTS: Listed below are this solicitations important eventsand the corresponding dates and times. These timeframes are subject to changeat Citizens’ sole discretion. It is a Vendor’s responsibility to comply withthese timeframes and to monitor Citizens website for any changes.RFP No.: 11-0011 July 28, 2011Section 1 – Introductory Material Page 3 of 16

July 28, 2011CALENDAR OF EVENTSDATE: TIME: ACTIONS:August 12, 2011August 19, 2011September 29, 2011September 29, 20115:00 PM ET2:00PM ET5:00PM ETSolicitation ReleasedQuestions Deadline: Deadline forsubmitted written Questions (asspecified in Section 2.2) to Citizens.Answers Posted: Answers toQuestions Posted on Citizens’Website.Proposal Deadline: Deadline for allProposals to be submitted toCitizens.Reference Deadline: Deadline forall References to be submitted toCitizens.1.5 PROCUREMENT OFFICER AND CONTACT INFORMATION: TheProcurement Officer for this solicitation is:Patty DavisProcurement OfficerPurchasing DepartmentCitizens Property Insurance Corporation2101 Maryland CircleTallahassee, Florida 32303(850) 521-8321 PhoneE-mail: bids@citizensfla.com1.6 NO CONTACT OR LOBBYING: Vendors shall not contact, directly or indirectly,any employee, representative, or Board of Governors member for the purposesof influencing or attempting to influence an award or other final decision. AVendor may, as an exception to this prohibition, contact the named ProcurementOfficer or their designee. The provisions of this section shall begin the date thissolicitation is released and continue until the earlier of: the Board rendering anaward for this solicitation, or the rejection of all proposals. Any contact prohibitedby this section may disqualify a Vendor from further consideration.RFP No.: 11-0011 July 28, 2011Section 1 – Introductory Material Page 4 of 16

SECTION 2PROCUREMENT INSTRUCTIONSCONTENTS2.1 DEFINITIONS – SOLICITATION SPECIFIC2.2 QUESTIONS2.3 SUBMISSION OF PROPOSAL2.4 FORMAT AND CONTENTS2.5 REVIEW AND EVALUATION PROCESS2.1 DEFINITIONS – SOLICITATION SPECIFIC:• “ACL” – means Audit Command Language;• “AS/NZ 4630” – means Australia/New Zealand 4360 ERM Framework;• “CFSA” – means Certified Financial Services Auditor;• “CGAP” – means Certified Government Auditing Professional;• “CGEIT” – means Certified in the Governance of Enterprise InformationTechnology;• “CIA” – means Certified Internal Auditor;• “CISA” – means Certified Information Systems Auditor;• “CISM” – means Certified Information Security Manager;• “CISSP” – means Certified Information Systems Security Professional;• “Citizens” - means Citizens Property Insurance Corporation;• “COBIT” – means Control Objectives for Information and relatedTechnology;• “COSO” – means Committee of Sponsoring Organizations of theTreadway Commission;• “CPA” – means Certified Public Accountant;• “CRISC” – means Certified in Risk and Information Systems Control;• “ERM” - means Enterprise Risk Management;• “EWP” – means Electronic Work Papers;• “GAAP” – means Generally Accepted Accounting Principles;• “ITIL” – means Information Technology Infrastructure Library;• “NIST” – means National Institute of Standards and Technology;• “OIA” - means Citizens’ Office of the Internal Auditor; and• “Resource(s)” - means individual staff members provided by theprospective vendor.RFP No.: 11-0011 July 28, 2011Section 2 – Procurement Instructions Page 5 of 16

2.2 QUESTIONS: During the open question period, which ends on the date and timespecified in Section 1.4, Calendar of Events, Vendors may submit writtenquestions to the Procurement Officer related to this solicitation.If a Vendor seeks any modification or removal of any Standard Terms andConditions or requirements of this solicitation, such request shall be submitted inthe form of a question during the open question period. If a Vendor does notsubmit any questions regarding the Standard Terms and Conditions and / orrequirements of this solicitation, then any disputes are deemed to be waived.Citizens will post answers to the Questions on Citizens website in accordancewith the Calendar of Events so all questions and answers are available at thesame time to all potential Vendors. Vendors should continue to monitor Citizens’website.2.3 SUBMISSION OF PROPOSAL: The purpose of the Vendor’s Proposal is todemonstrate their qualifications, competence and capacity to provide services inconformity with the requirements as outlined by this solicitation.The Vendor shall submit:• One (1) original signed hard copy of the Proposal.The Vendor should also submit:• A total of five (5) additional hard copies of the Proposal;• One (1) compact disk (CD) of the Proposal. The CD should be identicalto what is on the original hardcopy Proposal). Failure to provide aCD containing your Proposal will disqualify your submission; and• If applicable the Vendor shall submit one (1) version of the Proposal on acompact disk (CD) redacted of all information that the Vendor deemsexempt from Florida’s Public record laws. The CD should be labeled theRedacted Proposal. If Citizens receives a Public Record Request forVendor’s Proposal the redacted version will used to respond. If Vendorhas not included a Redacted Proposal then Citizens will provide theunredacted Proposal.• Proposal Delivery Requirements: All Proposals must be in a sealedpackage that clearly shows on the outside marked “RFP No.: 11-0011,Co-Sourcing Internal Audit and Enterprise Risk Management Services.”Proposals must be sent to the following address:Patty Davis, Procurement OfficerCitizens Property Insurance2101 Maryland CircleTallahassee, Florida 32303PROPOSALS SHALL BE RECEIVED AT THIS ADDRESS BY CITIZENSON OR BEFORE THE PROPOSAL DEADLINE OR THE PROPOSALWILL BE REJECTED AS UNTIMELY.RFP No.: 11-0011 July 28, 2011Section 2 – Procurement Instructions Page 6 of 16

2.4 FORMAT AND CONTENTS: This section prescribes the format in which theProposals are to be submitted. Any information deemed appropriate by theVendor may be included, but is required to be placed within the pertinentsections.Citizens is under no obligation to look for responsive information contained inincorrectly tabbed sections or that is not organized according to theseProcurement Instructions. All Proposals shall contain the sections outlinedbelow. All Proposals submitted should provide numbered tab sheets clearlyseparating and identifying each tabbed section as indicated below.For this solicitation the information provided should be included in one of the five(5) tabbed sections identified below:2.4.1 TAB 1 – REQUIRED FORMS AND DOCUMENTS (PASS / FAIL): TheVendor shall submit behind Tab 1 the following forms and documents,completed:A. Standard Document No.: 01, Vendor Conflict of Interest DisclosureForm (Form No.: 501b)B. Standard Document No.: 13, Litigation, Claims or Regulatory ActionForm2.4.2 TAB 2 – PRICING (MAXIMUM 25 POINTS): The Vendor shall submit acompleted Attachment “B”, Price Sheet, behind Tab 2. Vendor shall onlycomplete the sections for the services in which they are responding andsubmitting a Proposal for as indicated on Attachment “B”, Price Sheet.Pricing will be stated as hourly rates inclusive of administrative costs andexcluding travel expenses. All travel related expenses will be paid inaccordance with Standard Document No.: 15, Citizens Travel and TravelReimbursement Policy for Non Citizens Employees and must bepreviously authorized by Citizens in writing.2.4.3 TAB 3 – BUSINESS / CORPORATE QUALIFICATIONS (MAXIMUM 10POINTS): The Vendor should provide behind Tab 3, the followinginformation:A. Attachment “C”, Reference Request: Vendor should provide thisfor a minimum of five (5) business / corporate references.References should return the completed form directly to Citizensper the instructions on the form. If Citizens does not receive allreferences by the date which is reflected on Attachment “C”,Reference Request, the Vendor will receive no points for this area;B. Standard Document No.: 03, Corporate Background Form: Acompleted Corporate Background Form.C. Corporate Change: See Standard Document No.: 05, CompetitiveSolicitation General Conditions, Section 4, Corporate Change forfurther details, if applicable.RFP No.: 11-0011 July 28, 2011Section 2 – Procurement Instructions Page 7 of 16

D. Florida Small Business Enterprises: Citizens encouragesparticipation by Florida Small Business Enterprises (FSBE) asdefined in Standard Document No.: 04, Standard Term andConditions. Five (5) points will be awarded to each Vendor whoqualifies as an FSBE and provides a notarized Standard DocumentNo.: 08, FSBE, FBE & MBE Declaration Form.2.4.4 TAB 4 – COMPANY PROFILE (MAXIMUM 7 POINTS): The Vendorshould provide behind Tab 4, information requested below, that bestdescribes the Vendor’s profile:A. Describe the Vendor’s experience in providing Internal audit and/orenterprise risk management resources;B. Size, nature and length of time in business under the samecorporate or entity name;C. Describe the Vendor’s experience in internal auditing relevant toproperty insurance and/or governmental entities;D. Describe experience in risk based internal auditing;E. Describe the Vendor’s view on how Enterprise Risk Managementcan benefit an organization;F. Describe the Vendor’s specific knowledge of risk managementframeworks, concepts, principles, practices, strategies andphilosophies;G. Describe experience in providing internal audit and/or enterpriserisk management services to Citizens;H. Location of offices providing resources;I. Describe any potential limitations or restrictions on the Vendor’sability to provide consulting and advisory services to Citizens; andJ. Past performance will be considered and will include all similartypes of work performed.2.4.5 TAB 5 – KEY PERSONNEL (MAXIMUM 35 POINTS): The Vendorshould provide behind Tab 5, Attachment “A” – Resource ExperienceForm which should be used to document individual resources’qualifications and experience of Vendor’s proposed personnel, includingSub-Contractor(s) that will be performing the services contemplated in thissolicitation. Citizens’ expects that personnel provided in this solicitationwill perform the work as described. During the evaluation process, pointswill be allocated based on the area of expertise demonstrated in eachcategory.For each area of expertise, there are three experience levels:• Junior Consultant – 1 to 5 years relevant experienceRFP No.: 11-0011 July 28, 2011Section 2 – Procurement Instructions Page 8 of 16

• Consultant – 6 to 10 years relevant experience• Senior Consultant – 10+ years relevant experienceSubstitutions of personnel must be reviewed and approved by Citizens’ inadvance. The use of Sub-Contractors is acceptable however; subcontractorsmust be identified in the response and approved by Citizens.Any addition of sub-contractors after commencement of a contract mustbe approved by Citizens prior to the sub-contractor beginning any work.2.5 REVIEW AND EVALUATION PROCESS: Citizens shall conduct acomprehensive and impartial review and evaluation of all Proposals meeting therequirements of this solicitation. Please note that Citizens, at its sole discretion,reserves the right at any time during the process to reject all Proposals that arenot in the best interest of Citizens.Only timely submitted Proposals shall be reviewed and evaluated by staff todetermine if they comply with the required forms and documents and submissionrequirements listed in the solicitation. This will be a pass / fail review. Failure tomeet any of these requirements may render a Proposal to be a failing responseand result in rejection of the entire Proposal. Further evaluation will not beperformed.For the purpose of review, evaluation, scoring and ranking, review categorieshave been divided into multiple sections. The following reflects the Pass / Failcriteria and the maximum number of points that may be awarded by category:ITEMNO.EVALUATION CRITERIATABNO.1. Submission of All Required Forms and Documents 1&2MAXPOINTSPass /Fail2. Pricing 2 253. Business/Corporate Qualifications 3 104. Company Profile 4 75. Key Personnel 5 35SUBTOTAL: 77Project Areas: Proposals for each project area will be evaluated separately.Points for the section below will be combined with the subtotal above to derivethe total score for each project area proposed by a Vendor.6. Project Area Specific Experience: 4 23Maximum Points Per Proposed Project Area: 100Basis of Award: Citizens expects to issue either a single or multiple awards toresponsive and responsible Vendor(s) whose Response(s) offer the best value inone (1) or more Project Areas to Citizens. Citizens’ objective is to identify andRFP No.: 11-0011 July 28, 2011Section 2 – Procurement Instructions Page 9 of 16

pre-qualify either single or multiple vendors for each project area upon whichCitizens may call for Internal Audit and/or Enterprise Risk Management services.Citizens reserves the right to award as many contracts as it deems necessary tomeet its projected needs. Award of a contract qualifies a vendor to beconsidered as a service provider but does not guarantee that the vendor willreceive any particular level of business.Example: Vendor A submits a proposal for both Information Technology AuditResources and Enterprise Risk Management Co-Sourcing. The subtotal of theirscores for items 1-5 is 62.Project area scores are: Information Technology Resources = 15,Enterprise Risk Management Co-Sourcing = 20.Subtotal + Project Area Score = Total Score for Ranking Purposes62 + 15 = 77 (Information Technology Resources Score)62 + 20 = 82 (Enterprise Risk Management Score)Before award, Citizens reserves the right to seek clarifications and request anyinformation deemed necessary for evaluation of Proposals. Vendors may berequested to make a presentation, provide additional references, provide theopportunity for a site visit, etc. Citizens reserves the right to require attendanceby particular named representatives of the Vendor during this solicitationprocess. Any written summary of presentations or demonstrations shouldinclude a list of attendees, a copy of the agenda, and copies of any visuals orhandouts, and shall become part of the Vendor’s Proposal.Using the evaluation criteria specified above, Citizens shall evaluate and rankProposals and, at Citizens’ sole discretion, proceed to contract with the highestranked Vendor(s).RFP No.: 11-0011 July 28, 2011Section 2 – Procurement Instructions Page 10 of 16

3.2.1 Internal Audit Co-Sourcing: Consultants and/or contractors may benecessary to supplement the OIA staff or to provide specific expertise incompletion of certain projects. The uses of such consultants orcontractors to support internal audit activities are within the OIA budget asapproved annually by the Citizens’ Audit Committee.Each Vendor must be capable of providing Citizens with resources thathave the following qualifications:A. Financial/Operational/Compliance Audit Resources• Required:• Experience in auditing property and casualty insurancecompanies;• Experience in risk based auditing and integrated auditapproach;• Experience in using TeamMate EWP or similar electronicworkpaper products;• Understanding of the COSO control framework; and• Ability to travel within the State of Florida.• Preferred:• Applicable professional certification (CPA, CFSA, CIA,CGAP, etc.);• Experience with Citizen’s and/or the Florida propertyinsurance market;• General knowledge of GAAP and/or Statutoryaccounting;• Experience in auditing government entities;• Experience using Microsoft Visio; and• Experience in the use of ACL or other audit software.B. Information Technology Audit Resources• Required:• Experience in assessing risks and auditing in Unix,Windows, and/or AS400 environments; (familiarity withO/S configuration and controls.)• Experience in identifying, evaluating, and testing generalcomputer controls, application controls, informationsecurity, Databases, infrastructure, and/ortelecommunications;• Familiarity with the COBIT control framework;• Experience in using TeamMate EWP or similar electronicworkpaper products; and• Ability to travel within the State of Florida.RFP No.: 11-0011 July 28, 2011Section 3 – Scope of Services Page 12 of 16

• Preferred:• Applicable professional certification (CISA, CISM,CGEIT, CRISC, CISSP, etc.);• Familiarity with the ITIL and NIST Standards;• Ability to generally understand network diagrams; and• Experience using Microsoft Visio.C. Additional Specifications: Work may include, but may not be limitedto the following:• Assist in the development of assigned project scope;• Develop internal controls questionnaires;• Document and analyze control processes within theassigned areas;• Document risk analyses information within standardizedinternal audit risk templates based on inherent risks andcontrols;• Develop and execute appropriate control testing steps;• Apply appropriate sampling methodologies in accordancewith assigned areas;• Develop and appropriately communicate cost effectiverecommendations related to control deficiencies or processimprovements;• Document all work products using OIA’s electronicworkpaper system or other medium;• Conduct/participate in meetings with OIA staff, client staffand management as requested;• Execute agreed upon client assistance work in conjunctionwith Citizens’ external auditors or other external auditingentities;• Supervise internal audit staff in the completion of auditassignments (Senior and Manager only);• Travel within the State of Florida, as necessary, inconjunction with audit project assignments; and• Successfully meet all appropriate deadlines or milestones forassigned areas, within the allocated budgets.3.2.2 Enterprise Risk Management Co-Sourcing: Consultants and/or contractorsmay be necessary to supplement the ERM staff or to provide specificexpertise in completion of certain projects The uses of such consultantsor contractors to support ERM activities are within the approved annualoperating budget.Each Vendor must be capable of providing Citizens with resources thathave the following qualifications, as needed and requested by Citizens’management:A. Experience in developing, implementing and/or applying riskRFP No.: 11-0011 July 28, 2011Section 3 – Scope of Services Page 13 of 16

management concepts, tools or techniques in the property &casualty industry and/or government entities;B. Experience using ERM frameworks, especially the AS/NZ 4360ERM Framework; andC. Ability to travel within the State of Florida;D. Additional Specifications: Work may include, but may not be limitedto assistance with the following:• Interviewing and/or surveying multiple key personnel;• Identification and measurement of subjective and objectiverisks and related exposures (i.e. likelihood and impact);• Identification of triggers for each identified exposure;• Identification of potential treatment strategies and mitigationtactics for each identified exposure;• Measurement of the residual risk associated with eachidentified exposure (i.e. post treatment/mitigation), and• Production or review of reports highlighting risks.3.2.3 Insurance Requirements: The Vendor shall provide proof of the followinginsurance in the form of valid Certificates of Insurance. Certificates ofInsurance must be kept updated and on file with Citizens’ throughout theterm of the contract. The Vendor shall provide copies of its policies uponrequest by Citizens. Citizens’ reserves the right to reasonably amendthese insurance requirements in the final contract documents:• Worker’s Compensation: coverage to Vendor’s employees,regardless of the state of hire, in at least the minimum statutorylimits required by the State of Florida, and Employers’ Liability withlimits of $1,000,000;• Commercial General Liability: coverage of $1,000,000 peroccurrence (to include contractual liability on a blanket basis) and$2,000,000 in the aggregate;• Commercial Automobile Liability: combined single limits of not lessthan $1,000,000 per accident; and• Errors and Omissions: minimum limit of $1,000,000 per occurrenceand $2,000,000 in the aggregate.The Commercial General Liability and Commercial Automobile Liabilitypolicies will include Citizens as an additional insured. All policiesreferenced above will be primary and will include provisions that theinsurers waive the rights of recovery or subrogation against Citizens.3.3 TASK ORDERS: Citizens will create a scope of work each time they desire topurchase from the contract. The scope of work will be incorporated into a TaskOrder which will be issued to the selected vendor(s). Each Task Order willinclude at a minimum the following items:RFP No.: 11-0011 July 28, 2011Section 3 – Scope of Services Page 14 of 16

• Detailed Scope of Work for the assignment;• Performance Measures;• Deliverables;• Deliverables Schedule;• Reports; and• Payment Schedule.Upon receipt of the task order, the Vendor shall sign and return two (2) originalcopies of the Task Order to the Citizens Contract Manager along with theproposed candidate information including, but not limited to:• Previous experience related to Scope of Work for the assignment;• Professional Certifications; and• Knowledge, skills and abilities specifically related to the assignment.The Task Order will then be routed for Citizens’ signature and a fully executedoriginal will be returned to the Vendor. A Vendor shall not deliver or furnishServices until Citizens transmits an executed Task Order. All Task Orders shallconform to the requirements of the solicitation and shall be deemed toincorporate by reference the Contract terms and conditions. Any discrepancybetween the Contract terms and the terms stated on a Vendor’s order form,confirmation, or acknowledgement shall be resolved in favor of terms mostfavorable to Citizens.3.4 TIMEKEEPING AND BILLING:3.4.1 Timekeeping: Each assigned resource will submit a weekly time record tothe OIA or ERM administration, depending on their assigned project. Thistime will be reconciled to the respective vendor invoice. If there are anydifferences in hours worked between the weekly timesheets and theinvoice, the amount paid will be based on the time record.3.4.2 Billing: Vendors are required to submit invoices either monthly or biweekly.Invoices must include: the Task Order number (if applicable),name of the resource, period covered, hours worked, and the total fee forthose hours including vendor administrative costs. Hourly fees must be inagreement with the respective Task Order, unless otherwise approved inwriting by the appropriate Citizens management. Reimbursement of travelrelated expenses must be listed separately on the invoice, and theresource incurring those expenses and the time period covering thoseexpenses must be identified. Reimbursement of travel related expenseswill be in accordance with “Standard Document No.: 15, Citizens Traveland Travel Reimbursement Policy for Non Citizens Employees” and mustbe previously authorized by Citizens in writing. Invoices must be senteither electronically or via U.S. Mail to the designated OIA or ERMmanager for review and approval.RFP No.: 11-0011 July 28, 2011Section 3 – Scope of Services Page 15 of 16