Expression of interest

(A Premier Public Sector Bank) Expression of interest Empanelment of Auditors/ Audit Organizations for conducting Audit of Bank s Data Center, Applications, IT Network, Independent Assurance of the IS Audit function and other Information Systems Audits. EOI No. - IAD/ISA/91/01/2017 Dated 11.10.2017 Price of EOI Document : Rs. 5,000/- (Rupees Five Thousand only) IS Audit Cell, Inspection & Audit Division Head Office, Corporation Bank Mangaladevi Temple Road Mangaluru 575 001 Phone: 0824-2861483; 2861492 Website: www.corpbank.com 1

Table of Contents Invitation to Response... 3 Schedule of Events... 5 Section-1... 6 Scope of Work... 6 Section-2... 8 Empanelment Evaluation Criteria... 9 Section-3... 11 Response to EOI... 11 Annexure A: Information to be provided... 12 Annexure B: Letter for Responding to EOI... 14 Section-4... 16 Other Terms and Conditions... 16 2

Invitation to Response Corporation Bank, a premier public sector Bank, having its Head Office at Mangaluru- 575001, Karnataka, India (hereinafter referred to as the "Bank'), hereby invites responses only from established and eligible entities (hereinafter referred to as "Auditor or Audit Organization") Empaneled and Listed by Computer Emergency Response Team-India (CERT-IN) for Information Technology Audits in accordance with the terms and conditions described herein. The Information Technology Audit comprises Audit of Bank s Data Center, Applications, IT Network and any other Information System Audits including Forensic Investigation. In addition to the above, Independent Assurance of IS Audit Function may also be incorporated in the scope of Audits. Exclusion: Bank shall not entertain Expression of Interest/ Proposals from organizations or their subsidiaries who have provided relevant consultancy, supplying of the systems, system development, and maintenance and/ or integration related to IT or networking services or have rendered such services during the preceding 36 months to the Bank. Established in 1906 & nationalized in 1980, Corporation Bank today has a network of 2520 Branches working on CBS, 3127 ATMs and 4484 Branchless Banking Units. The 18000 strong workforce of the Bank is providing satisfactory service to nearly 25 million customers across India. Our Bank is galvanized to take the high growth path through effective use of its existing human resources and IT systems at hand. The efficient utilization of people, process and technology is imperative for achieving the said objectives. The IS audit function at the Bank has been working towards identification of areas for improvement in the domains like Data Centers, Applications and IT Network. This calls for seeking independent review of these domains through an external agency of repute so as to seek services of specialized audit professionals in these domains. An independent review of the said domain requires professionally competent external auditors specialized in domains including areas like Vulnerability Assessment/ Penetration Testing, Backup and Storage Management, Network Architecture Assessment, Cyber Security, IT Incident Management, Performance Audit, Capacity Planning, Application Management etc. The Bank desires to engage the services of reputed IS Audit organization to conduct Comprehensive Audit of Bank s Data Center, Applications, IT Network, 3

other Information System Audits and therefore invites eligible Audit organizations (CERT-IN Empanelled), to indicate their Expression of Interest in providing the desired services. The EOI Document may be obtained from the address mentioned hereunder or can be downloaded from Bank's Website www.corpbank.com and the response should be submitted to the office of: Assistant General Manager [IAD] Corporation Bank, Head Office Mangaladevi Temple Road, Pandeshwar, Mangaluru: 575001, KARNATAKA. Please note that all the desired information as per the document needs to be provided. Proposals with incomplete information will be rejected. Bank reserves the right to change the dates mentioned in this EOI document, which will be notified on the Bank s website. The information provided by the Audit organizations in response to this EOI document will become the property of the Bank and will not be returned. Bank reserves the right to amend, rescind or reissue this EOI at its discretion and all such amendments will be advised to the Audit organizations by listing them on Bank s website and such amendments will be binding on them. This Expression of Interest (EOI) is being issued to the Audit organizations that fulfill the eligibility criteria prescribed elsewhere in this EOI document. This EOI is not an offer by the Bank, but an invitation to respond to this EOI document. No contractual obligation on behalf of the Bank, whatsoever, shall arise from the EOI process. It may be noted that the issuance of EOI does not confer any right to be invited to participate further in the Bank s RFP process and the Bank shall have absolute rights in its decision regarding further participation in the same. The Audit organizations, by accepting this document, agree that any information contained herein may be superseded by any subsequent written information on the same subject made available to the recipient or to any of their authorized officer(s) including those, which are provided by the Bank on its web-site. It is also understood and agreed by the Audit Organization(s) that decision of the Bank regarding selection of the Audit Organization(s) for sending invitation for RFP shall be final and binding on all concerned. No communication in this regard, verbal or written, will be entertained. The Listed Empaneled Organisations will be approached for Closed Tendering Process of various Audits during the period of 3 years from the date of Empanelment. Consequent to this, the previous List of Empaneled Audit Organisations will be void. Subject to any law to the contrary, and to the maximum extent permitted by law, Corporation Bank and its Directors, Officers, Employees, Contractors, Agents, and Advisors disclaim all liability from any loss or damage suffered by any person acting or refraining from acting because of any information including forecasts, 4

statements, estimates, or projections contained in this EOI document or conduct ancillary to it whether or not the loss or damage arises in connection with any omission, default, lack of care or misrepresentation on the part of Bank or any of its Directors, Officers, Employees, Contractors, Agents or Advisors. Schedule of Events EOI Document Availability EOI document can be downloaded from Bank s website from 11-10-2017 to 31-10-2017 or Can be obtained from the Office address given below Last date for requesting clarification/s 24-10-2017 (optional), available only through email Last date and Time for submission 31-10-2017 (17:00 Hrs.) of EOI Date and Time for Opening of EOI 01-11-2017 (17:00 Hrs.) Responses Contact Details Address for Communication, Obtaining EOI document and submission of response Assistant General Manager [IAD] Corporation Bank, Head Office Mangaladevi Temple Road, Pandeshwar, Mangaluru: 575001 KARNATAKA Telephone +91-824-2861490 +91-824-2861492 +91-824-2861888[Ext.-492/483] All correspondence relating to this EOI should be sent to following email ID cia@corpbank.co.in In case scheduled dates falls on a public holiday, the same will be extended to the next working day. 5

Section-1 Scope of Work A brief overview of different audit engagements is mentioned below: Audit Domain Audit Objective High-Level Audit Scope Data Center Review the effectiveness DR Plan Review Audit of the process, Review Data Center Infrastructure infrastructure and Capacity Planning technology utilized for Backup and Storage Management data center management. Service Level Agreement Management Asset Inventory preparation Review of Asset Inventory provided by Functional Division Review AMC and Support Contracts (SLA) for Validity and Scope IT Application Review the application Access Management Management management activity at Change Management the bank to seek Incident Management including Service Level assurance that adequate Management degree of controls are in Data Processing i.e. Input/ Output Security assessment of Corporation Bank s place for authentication Internet, Intranet Sites and Mobile Phone Apps and data processing. Critical IT Applications Regulatory and Software License compliance Vulnerability Assessment/ Penetration Testing (CVSS-Base Core 4.0 or above or any other tool that provides Numeric Risk Grading is mandatory) Capacity Planning Review AMC and Support Contracts (SLA) for Validity and Scope IT Network Perform hygiene check on Network Architecture Assessment Audit IT Network Management Network Management Process Assessment contracts, infrastructure Network Performance Assessment and process to identify Vulnerability Assessment/ Penetration improvement areas. Testing(CVSS-Base Core 4.0 or above or any other tool that provides Numeric Risk Grading is mandatory) Capacity Planning Review AMC and Support Contracts (SLA) for Validity and Scope Independent Assurance of IS Audit Assess efficiency and effectiveness of IS Audit for current and future business goals Current IS Audit Scope review IS Audit Approach Review of IS Audit Reports 6

Audit Domain Audit Objective High-Level Audit Scope Function Determine value IS Audit Policy Review addition from IS Audit to the business units Skill Enhancement of IS Audit Function for Risk Assessment Benchmark, identify Technical Evaluation of available CAAT tools and recommend, and VA/PT tools successful practices of Internal Audit IS Roadmap 2018-21 Other Audit Perform Information Scope of Audit will be communicated based on Assignments Systems Audit based on the requirement of the Bank, in view of but not the requirement of the bank. limited to implementation of new application, change of application, change in Hardware and Network infrastructure etc. The above stated activities may primarily be performed at Bengaluru, Mangaluru, Mumbai, Chennai and Delhi-NCR. 7

Section-2 Eligibility Criteria: Audit Organization fulfilling the following criteria are only eligible to respond to this EOI document. The Audit organizations are required to submit authenticated proof in support of each of the item listed in the eligibility criteria. Sr. No. Criteria Qualification 1 General a) Should have been included in the latest panel of Information Systems Auditors maintained by Computer Emergency & Response Team, India [CERT-IN] as on date. b) Should not have been technically disqualified on the grounds of non-performance of contract, by Commercial Banks/ Public Sector Organisation/ Statutory Body/ Any Ministry or Department of Government of India or State Governments. c) Director of the firm/company should not be a member of the Bank s Board. d) Audit agency or its sister concern should not have undertaken statutory audit of the Bank during the past 36 months. e) Bank shall not entertain Expression of Interest/ Proposals from Organizations or their subsidiaries who have provided relevant consultancy, supplying of the systems, system development, and maintenance and/ or integration related to IT or networking services or have rendered such services during the preceding 36 months to the Bank. 2 Experience a) Should have conducted information System Audit of systems such as Finacle, ATM Switch, Internet Banking, Mobile Banking, DR Sites including Vulnerability Assessment & Penetration Testing etc. in at least one Commercial Bank/ Public Sector Organisation/ Statutory Body during the last 3 years. b) Should have minimum 3 year experience for conducting IS Audit including VA&PT. c) Company should be profit making in the last three years, i.e., 2014-15, 2015-16 & 2016-17. d) Should have taken up the audit assignments on their own without subcontracting the assignment. e) Should have minimum five qualified staff [CISA/CISSP/CISM]. 8

Empanelment Evaluation Criteria Audit organizations securing minimum marks in each category listed at S.No. 1 to 4 with an aggregate of 25 marks and confirming to the evaluation parameters listed at S.No. i to vii will be shortlisted for issuing RFP. The evaluation of the responses received will be done by a committee constituted for this purpose by the Bank. Sl. Evaluation Parameters Max. Marks Scoring Pattern 1. Should have conducted information Systems audit on their own without subcontracting, of at least one Commercial Bank/ Public Sector Organisation/ Statutory Body during the last 3 years. 2. Conducted IS audit of Finacle Environment, ATM Switches, Internet Banking setup, and Mobile Banking setup, Cyber Security and/or Forensic Audit. 3. Number of years of experience in conducting IS Audit including VA&PT 4. Number of skilled & qualified Staff [CISA/CISSP/CISM]. 20 1 Organisation = 5 (Min. Marks) 2-3 Organisations = 10 4-7 Organisations = 15 >7 Organisations = 20 15 1 Setup = 5 (Min Marks) 2 Setups = 10 >=3 Setups = 15 10 3-7 yrs. = 5(Min. Marks) >7 yrs. = 10 5 3-5 = 3(Min. Marks) 6-10 = 4 >10 = 5 Total 50 9

We declare the following: Format of Declaration by Audit Organisation i. None of the Directors of the firm/company is a member of the Bank s board. ii. iii. We/our sister concerns have not undertaken statutory audit of the Bank. We are not associated with the Bank by way of relevant consultancy, supplying of the systems, system development, and maintenance and/ or integration related to IT or networking services or have rendered such services during the preceding 36 months. iv. Our organization is a profit making organization for the last three years, i.e, 2014-15, 2015-16 & 2016-17. v. We have not have been technically disqualified on the grounds of non-performance of contract, by Commercial Banks/ Public Sector Organisation/ Statutory Body/ Any Ministry or Department of Government of India or State Governments. vi. We have not been blacklisted by any Commercial Banks/ Public Sector Organisation/ Statutory Body/ Any Ministry or Department of Government of India or State Governments. Seal of the Audit Organisation (Authorised Signatory) 10

Section-3 Response to EOI 1. Interested audit organizations, which fulfill the eligibility criteria as per Section-2, are required to submit their response to EOI in a closed cover, as per the format given in Annexure A and B along with the prescribed EOI document fee through a Demand Draft favouring Corporation Bank and payable at Mangaluru/Mangalore, in order to participate in the qualification process. The EOI response document should be in printed form duly authenticated by the Authorized Official. 2. The Bank reserves the right to seek more information in due course, if considered necessary. It may also be noted that issuance of EOI does not confer any right to be invited to participate further in the Bank s RFP process and the Bank shall have absolute rights in its decision regarding further participation in the same. 11

Annexure A: Information to be provided Details filled in this form must be accompanied by sufficient documentary evidence, in order to verify the correctness of the information. S. No Item Details 1. Name of the Company 2. Constitution 3. Complete Postal Address 4. Telephone, Mobile and Fax Numbers 5. Email Address 6. Name and address of the directors 7. Name, Designation and Contact Details of the person, authorised to deal with the Bank 8. Year of Incorporation 9. Experience in conducting audits in four audit domains as stated below: Data Center Audit Software Application Audits IT Network Audit Independent Assurance of IS Audit Function Information Systems Audit including forensic investigation Sl. Evaluation Parameters Details 1. Should have conducted information Systems audit on their own without subcontracting, of at least one Commercial Bank/ Public Sector Organisation/ Statutory Body during the last 3 years. 2. Conducted IS audit of Finacle Environment, ATM Switches, Internet Banking setup, and Mobile Banking setup, Cyber Security and/or Forensic Audit. 3. Number of years of experience in conducting IS Audit including VA&PT 4. Number of skilled & qualified Staff [CISA/CISSP/CISM]. 12

We declare the following: DECLARATION BY THE AUDIT ORGANISATION i. None of the Directors of the firm/company is a member of the Bank s board. ii. iii. We/our sister concerns have not undertaken statutory audit of the Bank. We are not associated with the Bank by way of relevant consultancy, supplying of the systems, system development, and maintenance and/ or integration related to IT or networking services or have rendered such services during the preceding 36 months. iv. Our organization is a profit making organization for the last three years, i.e, 2014-15, 2015-16 & 2016-17. v. We have not been technically disqualified on the grounds of non-performance of contract, by Commercial Banks/ Public Sector Organisation/ Statutory Body/ Any Ministry or Department of Government of India or State Governments. vi. We have not been blacklisted by any Commercial Banks/ Public Sector Organisation/ Statutory Body/ Any Ministry or Department of Government of India or State Governments. Place : Date : Authorized Signatory (Audit Organization) 13

Annexure B: Letter for Responding to EOI To, The Assistant General Manager [IAD] Corporation Bank, Head Office Mangaluru (Karnataka)-575001. Date: Sir, Subject - Response to Bank's Invitation for Expression of Interest for Empanelment of IS Audit Organisations. Ref- Corporation Bank EOI IAD/ISA/91/01/2017 Dated-XX-XX-2017. 1. With reference to the above EOI, having examined and understood the instructions forming part of the EOI, we hereby enclose our submission. We declare that we are interested in the Audit, should the Bank select us for this purpose. 2. If selected, we understand that it would be on the basis of the Eligibility & Evaluation criteria as specified under Section 2 of the EOI document. 3. We understand that Bank is not bound to accept any or all responses received with regard to the captioned EOI. We also understand and accept that it does not confer any right with regard to participation in any manner whatsoever and Bank at all times will have absolute right in its decision and is authorised to suspend our candidature without assigning any reason. 4. We declare that we have neither entered into nor are party to (whether by conduct or by acquiescence) any restrictive trade practice or sub-contracting arrangement or collective arrangement with any other person or entity including the other Applicants for the audit, in connection with the preparation and/or submission of our responses. 5. We understand that Bank may de-empanel our Organisation in case our Organisation ceases to be on CERT-IN Empaneled list. 6. We declare that we have not been technically disqualified on the grounds of nonperformance of contract, by Commercial Banks/ Public Sector Organisation/ Statutory Body/ Any Ministry or Department of Government of India or State Governments. 7. We have not been blacklisted by any Commercial Banks/ Public Sector Organisation/ Statutory Body/ Any Ministry or Department of Government of India or State Governments. 14

8. We declare and confirm that directors of the company are not members of the Bank s Board. 9. We declare and confirm that our company or its sister concern did not undertake statutory audit of the Bank. 10. We declare and confirm that our company or its sister concern has not been involved in any unlawful activity as per the laws of the land. 11. We are not associated with the Bank by way of relevant consultancy, supplying of the systems, system development, and maintenance and/ or integration related to IT or networking services or have rendered such services during the preceding 36 months. 12. We understand and agree that Bank may maintain a cooling period at its discretion in case of audit of same IT setup by the audit organization in past 36 months. 13. We undertake that, in competing for and, if we are selected, in executing the Agreements, we will strictly observe the laws against fraud and corruption in force in India namely "Prevention of Corruption Act 1988". 14. We note to certify that the person who is going to conduct the audit is on our rolls and we note to mention the length of his/her service with us. 15. We submit herewith, authenticated copies of the company's Memorandum, Articles of Association, audited balance sheet for the last three years along with other details/documents as required in Annexure A of this EOI. 16. We declare that we have disclosed all material information, facts and circumstances to the Bank. 17. We acknowledge and understand that in the event that the Bank discovers anything contrary to our above declarations; it is empowered to forthwith disqualify us from further participation in the process. Yours faithfully, Authorised Signatory Name& Title of Signatory Name of Applicant: Address: Direct Telephone Number Fax Number Mobile Number of Contact person Email ld 15

Section-4 Other Terms and Conditions Language of EOI: All EOI and supporting documentation shall be submitted in English. Bank reserves the right to accept or reject any or all EOIs without assigning any reason thereof and Bank s decision in this regard will be treated as final. EOIs may be accepted or rejected in total or any part or items thereof. No contractual obligation whatsoever shall arise from the EOI process. Any EOI not containing sufficient information, in the view of the Bank, to permit a thorough analysis may be rejected. The Bank shall have the right to reject the EOIs not submitted in the prescribed format or incomplete in any manner. Bank is not responsible for non-receipt of EOIs within the specified date and time due to any reason including postal delays or holidays. The Bank also reserves the right to alter/ modify any/ some/ all of the requirements, as it may deem necessary, and notify the same on its website www.corpbank.com before the last date for submission of response under this EOI. The Audit Organization(s) should be agreeable for the same. Bank shall have the right to cancel the EOI process at any time, without thereby incurring any liabilities to the affected Audit Organization(s). Reasons for cancellation, as determined by the Bank in its sole discretion include but are not limited to, the following: Services Contemplated are no longer required or not required immediately Scope of work was not adequately or clearly defined due to unforeseen circumstance and/or factors and/or new developments The Audit is not in the best interest of the Bank Any other reason Bank reserves the right to verify the validity of EOI information and to reject any EOI where the contents appear to be incorrect, inaccurate or inappropriate at any time during the process of EOI. No commercial bid / indication is to be submitted with EOI Audit organizations shortlisted in this process will be issued RFP and the terms and conditions set out in the RFP will be binding on them. The audit organization finally selected (after RFP process) will be required to sign confidentiality agreement /Non-Disclosure Agreement with the Bank. Payment to the Audit organizations will be linked to milestone completed as per the terms of reference more specifically described in the RFP. 16