Internal Audit, Risk and Advisory Services

The supplier will be required to undertake Internal Audit reviews and advisory projects, following the Institute of Internal Audit’s professional standards and Network Rail Internal Audit’s Methodology and will support R&A to successfully deliver the annual audit plan. The supplier will be required to provide specialist technical expertise to assist Internal Audit reviews and advisory projects, following the professional standards and Network Rail Internal Audit Methodology. Network Rail will require staff from the supplier to support the Internal Audit team and be flexible to work on individual audit projects lasting 5-8 weeks and longer-term projects consisting of several audit engagements for up to 12 months. The Statement of Work will outline the individual’s roles and responsibilities for delivering the audit. In addition to this, for specific audit and advisory projects that require specialist skills, Network Rail will require the supplier to deliver the requirement in its entirety. Such instances will be scoped and agreed within the Statement of Work (SoW). The outputs of entirely outsourced requirements will be quality checked by NRIA.

The objective of this Lot is to provide support in conducting comprehensive technology audits and advisory projects, following the Network Rail Internal Audit methodology. The appointed service provider will support Network Rail in evaluating the effectiveness of technology controls and risk management processes. They will support in identifying potential vulnerabilities and recommend remediation strategies to enhance the quality and relevancy of audit and advisory project results. The scope includes the following: • Delivering technology and systems audits, including a review of hardware, software, data management, network security, and other relevant areas. • Develop relationships with Network Rail’s technology specialists to understand the technology and systems risk landscape. • Utilising the Network Rail Internal Audit methodology unless otherwise agreed. • Providing comprehensive subject matter expertise and support, including advisory assistance, temporary resources, and specialised advice as needed.