Bias Audit RFP Questions for Auditor Selection

The Three Bids on Your Desk Look the Same

You sent the same request to three auditors. All three came back within a week. All three say they'll deliver a Local Law 144 bias audit, all three cite the four-fifths rule, and all three quote a timeline that sounds reasonable. On paper, they're nearly interchangeable — which is exactly the problem. A generic ask gets you a generic answer, and a generic answer tells you nothing about which of these three firms will actually stand behind its number if a candidate, a journalist, or the DCWP asks how it was calculated.

This is where a structured set of bias audit RFP questions earns its keep. The goal isn't to collect more paperwork — it's to force differentiation. Ask the right questions and the bids stop looking identical: one auditor has a real answer to an independence question, another's methodology section is three sentences of boilerplate, a third quotes a deliverable that doesn't match what the law actually requires you to post. By the end of this piece, you'll have the specific questions to send and a simple way to score the answers side by side, so auditor selection stops being a coin flip.

Why Independence Questions Come First

Local Law 144 doesn't just require an audit — it requires an audit performed by an independent auditor with no financial or employment relationship to your organization or to the vendor whose AEDT you're using (Crowell & Moring LLP, 2023). That's a structural requirement, not a nice-to-have, and it belongs at the top of every RFP you send.

Ask directly:

• Does your firm, or any parent or affiliate, have a commercial relationship with the AEDT vendor whose tool we're auditing — licensing, referral fees, reseller arrangements, anything?
• Has your firm ever built, sold, or consulted on the design of an AEDT similar to the one under review?
• Who owns your firm, and does that ownership create any tie to an AEDT vendor in this market?
• Will you disclose, in writing, any relationship that could reasonably be seen as a conflict — now or if one arises during the engagement?

A firm that answers these cleanly, in writing, without hedging, has done this before. A firm that gets vague or defensive about relationship disclosure is telling you something important before the engagement even starts. This is also the point in the process to pull in your own auditor-independence review — see our breakdown of bias auditor conflict of interest and independence for the full list of relationship types the law is trying to screen out.

Scope and Methodology Questions

Once independence is established, the RFP needs to pin down exactly what the auditor will measure and how. This is where the biggest quality gaps show up between bids.

Ask:

• Which AEDT-generated outcomes will you test, and how do those map to our actual hiring or promotion stages?
• What demographic categories will the impact-ratio analysis cover, and what happens where our applicant data has gaps?
• Will you calculate selection rates using the four-fifths rule — a selection rate for any group below 80% of the highest-selected group's rate may indicate adverse impact — or a different statistical test, and why (via Assessment Systems, 2024, summarizing the EEOC Uniform Guidelines)?
• How do you handle small sample sizes where a demographic category has too few candidates for a statistically meaningful rate?
• Will the audit examine the tool as configured for our specific use case, or run a generic assessment of the vendor's model?

This last question matters more than it looks. Independent research auditing published LL144 reports has found that many under-report disparities because of missing demographic data, opaque aggregation methods, or metrics that don't reflect how the tool is actually deployed in practice (ACM FAccT, "Auditing the Audits," 2025). An auditor who can't explain, specifically, how they'll avoid that trap in your engagement is a risk you're pricing into the bid whether you realize it or not. For the full anatomy of what a properly scoped engagement covers, see independent auditor engagement scope under Local Law 144.

Deliverables and Timeline Questions

The law is specific about what has to happen once the audit is done: a public summary posted on your website, alongside the AEDT's distribution date, and candidate or employee notice at least 10 business days before the tool is used, including how to request an alternative process or accommodation (Epstein Becker Green, 2023; Crowell & Moring LLP, 2023). Your RFP should confirm the auditor's deliverable actually supports those obligations — not just produces a report that sits in a drawer.

Ask:

• What exactly is included in your final deliverable — a summary suitable for public posting, a full technical report, both?
• Will the summary you provide contain the specific data points our public posting needs, or will we need to draft that ourselves from your findings?
• What is your standard turnaround from engagement start to final report, and what happens if our hiring data isn't clean on day one?
• Do you re-run the audit if we materially change how the tool is configured mid-year, and is that a new engagement or an amendment?

This is a good moment to remind everyone reading the RFP responses — including yourself — that none of this is legal advice. Whether a particular deliverable satisfies your specific posting and notice obligations is a determination for the auditor's methodology and, where questions remain, outside counsel or DCWP guidance. Workbook tooling and RFP templates help you run the process of getting a compliant, defensible answer; they don't replace that determination.

Cost and Contract Questions

Pricing for LL144 bias audits varies by auditor and by the complexity of your AEDT use case, and there's no single published rate card to benchmark against — treat any bid that arrives without a clear scope-to-price explanation as a flag, not a bargain. Our companion piece on how much a bias audit costs in NYC walks through the cost drivers in more detail; use it alongside the RFP responses to sanity-check what you're being quoted.

Ask:

• What's included in the quoted price, and what triggers an additional fee — data remediation, a second AEDT, a re-audit after configuration changes?
• What's your cancellation or non-completion policy if our hiring data turns out to be unusable?
• Do you carry professional liability insurance specific to audit engagements, and can you provide proof?
• What's your policy if DCWP or a third party challenges your findings after publication?

An RFP that never asks about post-publication support is an RFP that assumes nothing will ever go wrong with the audit findings. Something usually does.

Scoring the Answers Side by Side

Once the responses are in, resist the temptation to compare them narratively. Build a simple weighted grid instead: independence (pass/fail, non-negotiable), methodology specificity, deliverable-to-obligation fit, timeline realism, and cost transparency. Score each vendor 1–5 per category, weight independence and methodology heaviest, and let the numbers do the ranking instead of gut feel. The firm with the smoothest sales pitch is not automatically the firm with the most defensible audit.

It's worth remembering why this level of rigor matters. A 2025 Comptroller's audit review found DCWP's own compliance checks turned up minimal non-compliance among sampled AEDT users — far fewer than the 17 out of 32 companies the Comptroller's own auditors found deficient on that same sample (Office of the NY State Comptroller, 2025). Separately, a study of 391 employers found only 18 had posted audit reports and only 13 had posted transparency notices at all (ACM FAccT, Wright & Muenster et al., 2024). Weak enforcement doesn't make a weak audit less risky — it just means the risk shows up later, in a complaint, a lawsuit, or a reporter's spreadsheet, instead of in a regulator's inbox this quarter. Choosing the auditor carefully is the part of this process you actually control.

Put the Questions in Writing

None of this works as a mental checklist you run through during a sales call. It works as a document every bidder answers in the same format, so the comparison is apples to apples. That's what the Independent-Auditor Engagement RFP & Scoping Kit is built for — a structured RFP template with the independence, scope, deliverable, and cost questions above already organized into a scoring rubric you can send to every bidder and fill in side by side.

Download it, send it to your shortlist this week, and score the responses before you sign anything. If you haven't yet mapped where auditor selection fits into your broader Local Law 144 obligations, our NYC Local Law 144 compliance guide and our overview of what makes a bias auditor independent are the two pieces to read next.