Systems Assurance – Sourcing of Financial Statement IT Audit Services

⁠⁠⁠Overview

The Victorian Auditor-General's Office (VAGO) is inviting suitably qualified IT Audit Service Providers (ITASPs) to register their interest through this Expression of Interest (EOI) to support VAGO in delivering financial statement IT audit services across multiple audits for up to three years, from the financial year ending 30 June 2027 to the financial year ending 30 June 2029. ITASPs may include existing VAGO Audit Service Providers engaged under the VAGO Financial Audit Service Provider Agreement, or other IT Audit Service Providers willing to be engaged in accordance with applicable VAGO procurement requirements.

About

VAGO currently delivers IT audit services across a number of financial audits annually using a combination of in-house Systems Assurance resources and external IT Audit Service Providers. Future audit volumes and resourcing requirements may change due to audit and resourcing planning, and VAGO is seeking a flexible sourcing approach that can respond to business requirements across FY2027 to FY2029.

Purpose

The purpose of this EOI is to identify ITASPs that have the capability, capacity and interest to participate in a subsequent Request for Quotation (RFQ) process for eligible FY2027 to FY2029 financial statement IT audits. This EOI is not a request for detailed pricing and does not guarantee that any provider will be invited to quote or awarded work.

Scope

The scope includes:

• Planning, interim and year-end IT audit procedures in support of financial statement audits
• Delivery of services in accordance with VAGO's audit methodology and the requirements of ASA 315
• Understanding the audit environment and identifying and evaluating IT-related risks
• Designing appropriate audit responses to identified IT-related risks
• Effectively integrating with Financial Audit (FA) teams to support systems assurance optimisation initiatives

Contractor Requirements

Mandatory Requirements

• Public liability and professional indemnity insurance to cover liabilities in aggregate amounting to a minimum of $10,000,000
• Ability to comply with VAGO's confidentiality, privacy, data protection and intellectual property requirements
• Ability to satisfy VAGO's independence and conflict of interest requirements for both the firm and proposed resources
• Ability to comply with applicable Victorian Government procurement requirements, including Local Jobs First Policy where applicable
• All proposed resources must be employees of the supplier
• No subcontracting or third-party engagement is permitted for delivery of services
• All proposed resources must be able to satisfactorily complete relevant criminal checks
• Use of VAGO systems, methodology, templates and quality requirements
• Operate under VAGO oversight and direction
• Willingness to participate in subsequent RFQ processes

Indicative Resourcing Requirements

VAGO's preferred resourcing model, based on past experience, is outlined below; however, alternative approaches proposed by providers are welcomed.

• 1 x IT Audit Director/Partner-level resource
• 2 x IT Audit Manager-level resources with CISA certification and a minimum of 3 years' recent Financial IT Audit Manager level experience
• 3 x IT Auditor-level resources with a minimum of 12 months' recent Financial IT Audit Team Member level experience
• Providers should be able to provide backup and replacement resources where required, to deliver the assigned audit portfolio

Contract Terms and Conditions

• Approximate annual requirement: approximately 2,000 hours across approximately 22 audits with different levels of scope and involvement on each audit
• Potential annual range: initially estimated at 2,000 hours, with potential increases depending on audit volumes and approved extensions
• Contract structure: initial one-year term with two optional one-year extensions at VAGO's discretion and subject to approvals and business requirements

Indicative Annual Delivery Cycle

• Planning: mid-October to pre-Christmas shutdown
• Interim: post-Christmas to June
• Year-end: July to August

Indicative Effort Profile

• Year-end: approximately 20%
• Planning: 20 to 30%
• Interim: 50 to 60%

Information Requested

Interested ITASPs should complete the attached EOI Response Template and provide information covering:

• Organisational details
• Response to mandatory requirements
• Response to contract structure
• Response to resources, capacity and capability requirements
• Response to independence and conflict of interest questions
• Declaration

Instructions to Tenderers

EOI responses will be reviewed to determine suitable providers for a subsequent RFQ process. The review may consider mandatory compliance, resource capacity, availability and flexibility, audit portfolio coverage, independence and conflict of interest considerations, and interest in contract structure.

Following assessment of EOI responses, VAGO may issue an RFQ to suitable providers for selected eligible financial statement IT audits.

Conditions of EOI

• This EOI does not constitute an offer, contract or commitment by VAGO to procure services
• VAGO may amend, suspend or discontinue the EOI process at any time
• Submission of an EOI does not guarantee participation in a future RFQ process
• VAGO may request clarification, additional information or supporting evidence from respondents
• All information provided must be accurate, complete and authorised by the respondent
• Respondents are responsible for their own costs in preparing and submitting an EOI response

Lodgment Requirements

• Lodgment method: via email to the contact officers listed below
• Response document: completed EOI Response Template
• Supporting documents: none required at this stage, though VAGO may request clarification, additional information or supporting evidence from respondents
• Closing date and time: by close of business 21 August 2026
• Contact officer: Nizar Punjani (Senior Manager, Corporate, Systems Assurance), email Nizar.Punjani@audit.vic.gov.au
• Cc: Shirley Ang (Senior Manager, Corporate, Systems Assurance), email Shirley.Ang@audit.vic.gov.au; VAGO Finance Team, email Finance@audit.vic.gov.au

Enquiries

• Anh Ha (Chief Financial Officer), email Anh.Ha@audit.vic.gov.au
• Nizar Punjani (Technical), Office: +61 (03) 8601 7000, email Nizar.Punjani@audit.vic.gov.au
• Shirley Ang (Technical), Phone: +61 (03) 8601 7000, email Shirley.Ang@audit.vic.gov.au
• VAGO Finance Team (Contractual), Phone: +61 (03) 8601 7000, email Finance@audit.vic.gov.au