RFP 6171 MMIS Controls Audit

The State of Oregon, acting by and through the Oregon Health Authority, ("OHA" or "Agency"), is issuing this Request for Proposal for an auditor to provide Agency with Medicaid Management Information System (MMIS) Controls Audit services consisting of System and Organizational Controls ("SOC") Type 2 Reports or "Controls Audits" in accordance with American Institute of Certified Public Accountants (AICPA) Auditing Standards Board (ASB) Statement on Standards for Attestation Engagements (SSAE) No. 18 for five fiscal year periods starting with State Fiscal Year (SFY) July 1, 2026 – June 30, 2027.

Agency expects the award of one Contract with an initial anticipated Contract term of 5 years with the options to extend for an additional 2 years for a total of 7 years, by written amendment to the Contract.

2.4.1 Standard of Performance

The Contractor shall generally perform in accordance with and will complete each audit in accordance with the AICPA Auditing Standards Board (ASB) Statement on Standards for Attestation Engagements (SSAE) No. 18, Reporting on Controls at a Service Organization, including any updates or modifications to SSAE No. 18.

2.4.2 Auditing Periods

Work to be performed by the Contractor under the Contract awarded from this RFP shall include the completion of SOC 2, Type 2 "controls audits" in accordance with (SSAE) No. 18 for the following five fiscal year periods:

• Fiscal Year July 1, 2026 – June 30, 2027
• Fiscal Year July 1, 2027 – June 30, 2028
• Fiscal Year July 1, 2028 – June 30, 2029
• Fiscal Year July 1, 2029 – June 30, 2030
• Fiscal Year July 1, 2030 – June 30, 2031

2.4.3 Controls Audit

The SOC 2, Type 2 review must include all portions of the MMIS designed, developed, or operated by the MMIS contractor, including the Drug Rebate subsystem. The SOC 2, Type 2 reviews will not include activities performed by the Oregon Department of Human Services (ODHS) or OHA.

2.4.5 Audit Process

• Designate an audit coordinator to coordinate communications and audit activities and serve as a point of contact for OHA.
• Coordinate an initial setup meeting with the OHA point of contact, MMIS staff and the MMIS Contractor.
• Complete the SOC 2, Type 2 review, in accordance with the schedule and objectives and controls for the specific audit period.
• Schedule a closing meeting with OHA and the coordinating auditor after the auditors have completed each review.
• Transmit a draft of the audit report to OHA approximately one month after the review has been completed. [...] OHA expects that a final report will be submitted to OHA by September 30 following each respective audit period.
• The Contractor shall deliver the final SOC 2, Type 2 report to OHA in electronic format as well as one printed copy. The final report for each audit period will constitute a Deliverable.

Submission

Proposer must submit its Proposal electronically through OregonBuys. Proposals are due **November 23, 2026 at 3:00 PM (Pacific Time)**.

All parts of Proposer's Proposal (including all attachments), except for the Price Proposal required by Section 3.3.4, shall be contained in a single Adobe Acrobat (pdf) file. Proposer's Price Proposal shall be submitted in a separate Adobe Acrobat (PDF) file. The total combined size of the electronic Proposal files submitted, including all required items, should not exceed 10 megabytes.

Minimum qualifications (required)

• Proposer's Key Person(s) must include a Certified Public Accountant (CPA) currently licensed to work in Oregon; and
• If Proposer is a public accounting firm, Proposer's firm must be currently licensed to perform audits in Oregon.

Contract term

Agency expects the award of one Contract with an initial anticipated Contract term of 5 years with the options to extend for an additional 2 years for a total of 7 years, by written amendment to the Contract.

Price Proposal

A total, all-inclusive fixed cost for each annual audit report, using *Price Proposal Form* (Attachment E).