Consultant Services for Independent Validation of Internal Audit Quality Self-Assessment

Questions and Answers for RFP:

External Validation of Internal Audit Quality Assurance Self-Assessment

RFP Response Deadline Extension:

To provide respondents with additional time to review the information provided in this Q&A and prepare their proposals, the submission deadline for this RFP has been extended from 5:00PM ET on August 18, 2026, to 5:00PM ET on August 21, 2026. All proposals must be received by the revised deadline to be considered.

Solicitation/Proposal

In performing your internal self-assessment, were there any areas of concern identified that would suggest you were not in compliance with the IIA Standards? If so, are these well documented and supported?

Response: We are currently completing the self-assessment, which is expected to be finalized by August 31, 2026. Based on our review to date, we have not identified any indications of nonconformance or significant concerns. Throughout the process, we are documenting opportunities for enhancements that can be shared with the validator upon commencement of the engagement.

The RFP suggest that all supporting data that was used to review for the self-assessment will be provided. Will we have access to the results of the assessment and the underlying data?

Response: Yes, we will share the self-assessment report and relevant working papers with the validator. We utilized the templates included in the IIA Quality Assessment Manual, 2024 Edition and will provide the completed templates, relevant supporting documents, and samples reviewed.

The self-assessment indicated that interviews were performed, so will we have access to the interview notes and results?

Response: Yes, interview notes and/or survey results will be provided to the validator.

Were the results of any previous Assessments considered in the current assessment? If so, were there any remediation items that were addressed?

Response: The previous external assessment was conducted in FY2021 and was based on the 2017 International Standards for the Professional Practice of Internal Auditing. Because the current assessment period spans two sets of standards, we will consider the results of the FY2021 assessment to the extent they remain relevant and applicable under the new Global Internal Audit Standards.

Does FHI 360 intend to engage an individual consultant or will proposals from consulting firms be considered, provided a qualified lead validator meeting the stated credential requirements is designated for the engagement?

Response: The external validation proposal may be from a firm/company or an individual consultant.

Does FHI 360 have a budget or not to exceed amount? If so, please share.

Response: We respectfully decline to provide the budget information for the independent validation.

Has FHI 360 previously undergone an External Assessment or Self-Assessment with Independent Validation? If so, can FHI 360 provide the successful proposer with a copy of the most recent report, executive summary, or resulting improvement plan to help respondents understand the Internal Audit function's quality improvement journey?

Response: The last Independent Validation of Internal Audit Quality Assurance Self-Assessment was conducted in September 2021. The self-assessment was performed by FHI 360 Internal Audit, and the results were independently validated by an external organization. FHI 360 will provide the successful proposer with relevant prior assessment materials, as appropriate, along with the current self-assessment materials when available.

The RFP identifies the quality self-assessment review period as FY2021 through FY2025. Does FHI 360 expect the validation to assess the entire review period against the 2024 Global Internal Audit Standards, or should the validator consider the prior IIA Standards for periods before the effective date of the 2024 Global Internal Audit Standards?

Response: The self-assessment is being conducted using the 2024 Global Internal Audit Standards and the templates included in the IIA Quality Assessment Manual, 2024 Edition. Because the review period spans FY2021 through FY2025, the validator should consider the applicable IIA Standards in effect during the relevant periods, including the prior IIA Standards for activity (e.g. performance of specific engagements) occurring before the effective date of the 2024 Global Internal Audit Standards. The validation should also consider the Internal Audit function's current alignment with the 2024 Global Internal Audit Standards and identify improvement opportunities, as applicable.

Has the self-assessment been completed or is it currently in progress?

Response: The self-assessment for the FY2021 to FY2025 period is currently in progress and is expected to be completed by August 31, 2026.

Was the self-assessment performed using the 2024 Global Internal Audit Standards?

Response: Yes, the self-assessment is being conducted using the 2024 Global Internal Audit Standards and utilizing the templates included in the IIA Quality Assessment Manual, 2024 Edition. As the assessment period spans two sets of standards, the self-assessment and independent validation should consider both the prior IIA Standards and the 2024 Global Internal Audit Standards, as applicable to the FY2021 to FY2025 review period. For periods before the effective date of the 2024 Global Internal Audit Standards, the prior IIA Standards should be considered for activity (e.g. performance of specific engagements) occurring before the effective date of the 2024 Global Internal Audit Standards. The self-assessment is assessing the Internal Audit function's current alignment with the 2024 Global Internal Audit Standards and identifying related improvement opportunities.

Can FHI 360 provide additional information regarding the format and extent of the self-assessment documentation that will be available for validation (e.g., standards mapping, assessment workpapers, evidence repository, stakeholder survey analysis, and self-assessment report)?

Response: The self-assessment is being conducted using the 2024 Global Internal Audit Standards and the templates included in the IIA Quality Assessment Manual, 2024 Edition. We will provide the validator with completed templates, relevant supporting documents, and samples reviewed. The formats of these items will primarily be in Word, Excel, PowerPoint, and PDF formats.

Beyond the validation statement, does FHI 360 expect the independent validator to provide a formal conformance opinion, detailed recommendations, benchmarking observations, or other reporting deliverables?

Response: The primary formal deliverable expected from the independent validator is a validation statement. FHI 360 is not requesting a full external quality assessment report, detailed benchmarking report, or separate formal recommendations report. However, where applicable, FHI 360 welcomes discussion of observations, recommendations, or benchmarking insights that may support continuous improvement.

Approximately how many stakeholder interviews are anticipated as part of the validation process, and will FHI 360 identify the stakeholders to be interviewed?

Response: The external validator may decide on the exact number of interviews to be conducted. Our estimate based on previous experience is approximately 4 to 5 (internal audit management, internal audit staff, 2 to 3 stakeholders) interviews. FHI 360 will assist in identifying appropriate stakeholders for the validator's consideration.

Please share target dates for kickoff, fieldwork completion, draft report issuance, and final report delivery following contract award.

Response: FHI 360 expects the engagement to be performed approximately between September 14 and September 30, 2026. Specific dates for kickoff, fieldwork completion, draft review, and final validation statement delivery will be confirmed with the selected consultant. FHI 360 does not have an estimate of the number of hours or days required to complete the work.

Should the independent validation utilize the IIA's traditional conformance-rating framework, or does FHI 360 have a preferred reporting format for communicating conformance results and opportunities for improvement?

Response: The consultant/firm will be expected to utilize IIA's traditional conformance-rating framework. The final deliverable expected is a Validation Statement presented to the VP, Compliance and Internal Audit and the Chief Compliance Officer. See Appendix - Sample Validation Statement.

Have there been material changes to the Internal Audit Department since the prior EQA?

Response: Since the prior Quality Assessment, the Internal Audit function has experienced material changes in its operating environment, staffing model, and technology resources. These changes required the function to redesign certain processes, reprioritize activities, and identify alternative approaches to continue fulfilling its mandate. Relevant context will be made available to the selected validator as part of the engagement.

Does FHI 360 expect the independent validator to present final results to the Board, Audit Committee, executive leadership, or another governance body? If so, can FHI 360 provide the anticipated audience and target meeting date?

Response: No. The independent validator is expected to present its validation results and conclusion to the FHI 360's Office of Compliance & Internal Audit (OCIA) management. OCIA will report the results and conclusion to the relevant stakeholders, including the Audit Committee of the Board of Directors.

To clarify the expected scope of the independent validation, does FHI 360 expect the selected validator to independently reperform portions of the self-assessment procedures, review the evidence supporting the self-assessment conclusions, or perform a combination of both?

Response: Yes. An independent validator is expected to independently reperform select portions of the self-assessment procedures, as deemed necessary and review the evidence supporting the self-assessment conclusions.

What system or repository does FHI 360 use to maintain internal audit workpapers, reports, QAIP documentation, and self-assessment support, and how will access be provided to the selected validator?

Response: Audit files are maintained in electronic format in SharePoint document library. We will provide the validator limited/read-only access to the relevant document library.

Please confirm when you believe the SAIV results will be completed (estimate is fine), so I can put a timeline together for you.

Response: Our target completion date for the SAIV is August 31, 2026.

I am assuming 3 key stakeholder interviews of 30 minutes in length. Let me know if that aligns with your thinking?

Response: The independent validator may determine the exact number of interviews needed. Based on prior experience, FHI 360 estimates approximately 4 to 5 interviews, including internal audit management, internal audit staff, and 2 to 3 stakeholders. FHI 360 will help identify appropriate stakeholders for the validator's consideration.

Have all open items from the last review been completed? If not, what has been the challenge to closure?

Response: We are still assessing if open items from prior reviews are still relevant under the 2024 Global Internal Audit standards.

Do you have any current areas of focus or concern that you want to make sure are addressed?

Response: We have not identified any specific areas of concern at this time. The self-assessment is focused on evaluating readiness for conformance with the 2024 Global Internal Audit Standards and identifying opportunities for enhancement.

I can provide 3 references. However, they have requested that their information not be included in the proposal document itself. Is it acceptable to provide directly outside of the document?

Response: Yes, you may send the information separately via email to .

Has Internal Audit previously had an external assessment?

Response: FHI 360 has previously completed Self-Assessments with Independent Validation in 2016 and 2021. FHI 360 has not undergone a full external quality assessment separate from the SAIV approach. The most recent Internal Audit Quality Assurance Self-Assessment was conducted in 2021, and the results were independently validated by an external organization.

In addition to the 8-10 audits mentioned in your RFP, how many internal audit advisory engagements are performed annually, on average?

Response: On average, the Internal Audit function completes approximately one advisory engagement for every 8 to 10 audit engagements.

Your RFP states the quality self-assessment review period is FY 2021- FY 2025. Will internal audit be assessing its conformance with both the 2017 internal audit standards, as well as the Global Internal Auditing Standards, as the scope period would include both sets of standards as being applicable?

Response: Please see the response above regarding the applicable IIA Standards for the FY2021 to FY2025 review period.

Do you use a software tool for workpapers / are they stored in a central location?

Response: Audit files are maintained electronically in SharePoint document library. The selected validator will be provided limited, read-only access to the relevant document library.

Are there compliance/legal requirements that must be met in each of the locations FHI360 operates in that impacts your internal audit plan?

Response: FHI 360 considers relevant legal, regulatory, donor, contractual, and organizational requirements when developing and executing its internal audit plan. We are not aware of any specific country-level legal requirement that would materially affect the scope of this SAIV engagement.

Do you use data analytics? If so, what tool(s) do you use?

Response: Primarily MS Excel.

How do you plan to perform your self-assessment? (using the IIA's QAM vs some other method?)

Response: We are utilizing the templates included in the IIA Quality Assessment Manual, 2024 Edition.

[What is] the population of total engagements conducted during the review period?

Response: The population of total engagements conducted during the review period is 39.

Appendix: Sample Validation Statement

___________________ conducted an independent validation of FHI 360 Office of Compliance and Internal Audit (OCIA) Internal Audit unit's self-assessment. The primary objective of the validation was to verify the assertions made in the attached self-assessment report concerning adequate fulfillment of FHI 360 OCIA's basic expectations of internal audit activity and its conformity to The Institute of Internal Auditors' (IIA's) International Standards for the Professional Practice of Internal Auditing (Standards). Other matters that might have been covered in a full external assessment, such as an in-depth analysis of successful practices, governance, consulting services, and use of advanced technology, were not included in the scope of this independent validation but best practices were discussed with the management.

In acting as validator, we are fully independent of FHI 360 OCIA and have the necessary knowledge and skills to undertake this engagement. The validation, conducted during the period September XX-XX, 2026, consisted primarily of a review and test of the procedures and results of the self-assessment. In addition, interviews were conducted with __________ [as applicable, FHI 360's Senior Management representatives, an Audit Committee Member of the FHI 360 Board of Directors, FHI 360's External Auditors].

We concur fully with FHI 360 OCIA Internal Audit's conclusions in the self-assessment report attached. Implementation of the recommendations contained in the self-assessment report will improve the effectiveness and enhance the value of the internal audit activity and support conformity to the Standards.

___________________

Name of Validator

__________________

Date