Company-Wide Risk Assessment and Three-Year Internal Audit Plan

IFC invites qualified firms to submit technical and financial proposals to conduct a company-wide risk assessment and develop a risk-based three-year internal audit plan . The cost of preparing a proposal, attendance at any pre-proposal conference, meetings or oral presentations shall be borne by the firm, regardless of the conduct or outcome of the solicitation process. Proposals must offer Services for the total requirement; proposals offering only part of the Services will be rejected. All proposals shall remain valid and open for acceptance for a period of 150 calendar days after the date specified for receipt of proposals.

Scope of Work

The Description of Services will be incorporated into the final contract and used to assess the contractor’s performance. The Offeror’s proposal must address all activities and deliverables below.

I. Phase 1: Project Planning

High Level Key Activities Work product ¨ Mobilize team members ¨ Agree on objectives and milestones ¨ Establish a Steering Committee (SC) ¨ Project Charter ¨ Clear Project organization ¨ Minutes of SC meeting

II. Phase 2: Company-wide Risk Assessment

High-Level Key Activities

Deliverables

• Review company strategy, organizational structure, operations, financial information, policies, prior assurance work, and relevant regulatory requirements.
• Agree with management and the Internal Audit team the risk-assessment methodology, risk criteria, and rating scale.
• Conduct interviews with the Board, senior management, and key business and functional leaders.
• Identify and assess the full range of risks across the company, including strategic, governance, financial, operational, commercial, customer, market, liquidity, credit, legal, regulatory and compliance, health and safety, environmental and social, human resources, technology and cybersecurity, data privacy, fraud and corruption, business continuity and disaster recovery, third-party and supply-chain, asset and project management, reputational, geopolitical, climate-related, and other emerging risks.
• Develop an audit universe and map key risks to auditable entities, processes, systems, projects, and locations.
• Validate the results with management and present the final risk profile to the Board of Directors.
• Risk-assessment methodology and rating criteria
• Company-wide risk register and risk profile
• Risk heat map and prioritization of key risks
• Documented internal audit universe
• Final company-wide risk assessment report and presentation (along with the annual plan see next phase)

III. Phase 3: Three-Year Risk-Based Internal Audit Plan

High-Level Key Activities

Deliverables

• Develop a risk-based three-year internal audit plan linked to the approved risk assessment and audit universe.
• Prioritize proposed audit engagements across the three-year period, including rationale, objectives, indicative scope, timing, frequency, and dependencies.
• Estimate the skills, level of effort, and resources required to deliver the plan.
• Identify areas requiring specialist or co-sourced support.
• Present the draft plan to management and the Board, incorporate feedback, and submit the final plan for approval.
• Risk-based three-year internal audit plan
• Board and executive management presentation

Procurement number: 0002024348. Expressions of interest are submitted through the World Bank Group's eProcure (RFx Now) portal, which requires vendor registration.