Audit committee approves RFP to outsource Buncombe County internal-audit function

The Buncombe County Audit Committee voted to direct staff to issue a request for proposals to outsource the county's internal-audit function, the committee decided during its regular meeting.

Avril Pender, who addressed the committee about the vacancy in the internal-audit role after Rob's recent departure, recommended outsourcing the function rather than trying to recruit and rebuild the office in-house. "I would like to recommend that we outsource the internal audit function instead of going and filling that position again and starting this process over again," Pender said, and described the proposal as an RFP process similar to the county's external-auditor selection.

The committee approved a motion to accept that recommendation; a member moved the motion and it was seconded, and the committee approved it by voice vote. The motion directs staff to prepare an RFP that would seek a full-service internal-audit contractor and return recommendations to the committee for selection and contract award.

Committee members and staff discussed why outsourcing was under consideration. Pender said the county has had five internal-audit directors in six years and that a contracted firm can provide continuity and deeper subject-matter capacity across IT, construction and other audit specialties. She cited a municipal model using a three-year contract and noted that the selected firm would work with staff and the audit committee to perform risk assessments and develop an annual audit plan. "They develop the audit plan with partnerships with the staff and with the audit committee, and then they start doing those audits throughout the year," Pender said.

Members pressed several practical matters the RFP will need to address: contract length and price; who will manage the contract inside county government; how the firm will preserve internal-audit independence; reporting frequency to the audit committee; and transition planning so the county can build internal capacity if desired. The committee discussed a 30-to-90-day procurement timeline; the county procurement manager said a 45-to-90-day window is typical, while some committee members urged a shorter solicitation period (30-60 days) if possible.

On oversight and independence, Pender said the external-auditor contract is managed through Finance without compromising auditor independence and suggested the same structure could work for internal-audit contract management. Committee members asked whether the hotline and anonymous reporting would continue to be routed appropriately; staff said the county's hotline currently routes alleged fraud, conflict of interest and policy-violation reports to internal audit and routes personnel issues to human resources, and that the legal director presently receives hotline items in the short term. The committee requested a follow-up report identifying which office will manage hotline intake and how those reports will be shared with the committee.

Several committee members raised staffing and budget questions tied to contract management. Pender said the county already has budgeted dollars associated with the vacant internal-audit position and suggested that part-time staff or a designated contract manager in Risk or Finance could serve as a liaison. Committee members emphasized that any decision about department assignment (for example, managing the contract in Finance, Risk or Legal) should preserve the functional independence of internal audit and be explicit in the RFP and in organizational reporting lines.

The RFP scope the committee asked staff to include will be broad: risk assessment, development of an audit plan in coordination with staff and the committee, performance of audits (including procurement cards and vehicle/fuel audits that were mentioned as examples), and reporting and software/system updates. Committee members also asked the RFP to specify the contractor's required meeting cadence with the committee (the group discussed quarterly reporting as a minimum and more frequent updates if issues arise).

The committee discussed budget signals raised in the meeting. Pender described municipal examples that used three-year contracts; during discussion she referenced a cited municipal contract that the committee recorded in conversation as in the low six figures per year (figures discussed varied between roughly $115,000 and $150,000 annually in the example). Committee members asked staff to include realistic budget scenarios in the RFP materials and to return with recommended options, including whether a part-time county FTE to manage the contract should be requested in the upcoming budget.

The committee agreed to schedule a special meeting to review RFP responses and to invite staff to bring the top firms in for interviews. Staff said it will circulate draft RFP documents to the committee for input once the procurement timeline and draft scope are ready.

The committee also recorded a routine procedural action earlier in the meeting approving the minutes of Sept. 18, 2025.

The decision to seek an outsourced internal-audit contract is intended to provide continuity while the county considers longer-term staffing and organizational arrangements; staff will return to the committee with draft RFP language, proposed timelines and recommendations for contract management and reporting once proposals are received and evaluated.