Internal Audit Services
Personalized Service. Enterprise Depth.
Built for the League.
Ready for Day One.
EisnerAmper brings 30+ years of sports and entertainment expertise, deep NFL business model fluency, and a partner-led team designed to deliver across all seven audit verticals simultaneously.
Our Understanding
The NFL isn't looking for an internal auditor. It's looking for a partner that understands the League and shows up that way every single day.
What the NFL Is Asking For
The NFL is seeking a qualified internal audit partner to serve as the operational backbone of a complex, multi-vertical audit program covering approximately 50 to 55 engagements annually. The selected firm must demonstrate not just technical audit competence, but a deep understanding of the NFL's unique business model: the economics of a 32-franchise private league, revenue sharing mechanics, and the operational rhythms of a year-round sports enterprise.
7 Audit Verticals
League Office Operational
~11 to 12 engagements per year
Member Club Audits
~10 engagements per year
IT & Cybersecurity
~20 engagements per year
Consumer Products Licensing
~50 engagements per year
Advisory & ERM
~250 days per year
Third-Party Compliance
2 to 3 engagements per year
Investigative Services
~25 days per year
Why EisnerAmper
You will come to know your partners. They will know your business. The same team that wins this engagement closes it. Institutional knowledge compounds. We are here for that.
New York Is Where We Live
We are not a national firm with a New York outpost. We are a New York firm, 6th largest in this market, with deep roots in the city's sports, media, and financial communities. Our engagement leadership is minutes from 345 Park Avenue. When the NFL needs to meet, there is no flight to book.
The Right Scale
Multiple engagements across verticals demands a firm with depth for parallel workstreams, the expertise to move between a club financial review and a stadium cybersecurity assessment, and surge capacity to absorb scope changes. Named partners are personally accountable for every deliverable.
A Flagship Engagement
At the largest firms, a client like the NFL is managed. At EisnerAmper, it is served. Our Sports & Entertainment, Risk & Compliance, Royalty Audit, and IT Risk professionals treat serving you as our priority.
Recognized. Trusted. Recommended.
Most Recommended Accounting Firm, USA Today, two consecutive years. Best Firm for Technology, Accounting Today, 2025. Not self-assessments. The judgments of clients and peers who have compared us against every firm in this market.
Enterprise Scale. Partner Attention.
IT & Cybersecurity
- NIST-framework club IT audits
- DHS stadium cybersecurity reviews
- 1-week on-site per engagement
- Comparable reporting across all clubs
Royalty & Licensing
- Consumer products: apparel, footwear, hardlines
- Digital & technology licensing
- Brand & trademark compliance
- Volume audit methodology
Advisory & ERM
- Risk advisory aligned to NFL strategic objectives
- KPI tracking & international game readiness
- ERM program: COSO & ISO 31000
- Ad hoc management request support
Investigative Services
- CFE-credentialed forensic professionals
- eDiscovery & digital forensics
- Fact-gathering, documentation review & interviews
- Loss quantification & remediation support
Our Approach
Methodology, operating models, and an NFL-organization-aware delivery framework designed to manage complex, multi-workstream engagements holistically.
Engagement Portfolio Approach
We apply a centralized engagement portfolio management approach that aligns scope, timelines, risks, and stakeholder communications across all activities, supported by standardized reporting, issue escalation protocols, and integrated milestone tracking.
Our approach begins by developing a deep understanding of the organization (its operating model, governance structure, objectives, and risk tolerance) to ensure all work is grounded in how the business actually functions. Across all workstreams, our methodology emphasizes proactive risk management, clear ownership, and continuous communication.
01 Leverage proven NFL experience, including SOC-related reviews, to drive effective transitions
02 Anticipate risks, documentation gaps, and stakeholder dependencies before they impact execution
03 Bring leading practices from other national sports leagues and complex organizations
04 Design governance, controls, reporting, and communications that work in practice
05 Tailor best practices to fit the NFL's unique operating environment
Approach by Audit Vertical
Corporate & Third-Party Internal Audit
Define Risk Universe & Assess
- Understand organization and environment
- Perform risk assessment
Define Scope
- Define scope, roles, responsibilities
- Establish communication cadence
Develop Audit Plan
- Develop a risk-based internal audit plan
- Establish expectations and timeline
Execute Audit Program
- Develop audit programs supporting goals
- Meet with management to align
- Execute internal audit
- Continuously communicate progress
Communicate Results
- Timely draft report of results
- Host formal exit meeting
- Establish follow-up timeline
Follow-up on Findings
- Follow-up on recommendations
- Document responses
- Foster continuous improvement
Risk Assessment Framework
Reputation / Perception Risk
How the company is viewed by the general public. Tone at the top, company partnerships.
Financial Risk
Accuracy of financial reporting, sustainability, and viability. Financial close/reporting, cash/receivables, liquidity, accounts payable.
Operational Risk
Effectiveness in achieving organizational goals. System access/IT security, legal/risk management, HR, payroll/benefits.
Compliance Risk
Compliance with internal policies and external laws/regulations. Operating agreement, regulatory compliance, employment regulations.
Member Club Audits & Club Compliance
Planning & Engagement
- Confirm scope, objectives, timing with Head of Internal Audit and NFL Club & Labor Finance
- Review prior-year workpapers and findings
- Review League reporting requirements and club-specific risk factors
- Distribute preliminary PBC list in advance
Fieldwork
- Execute fieldwork and testing per current processes
- Revenue Sharing & Financial Reporting
- Box-Office Reporting
- League Policy Compliance testing
Reporting & Closing
- Draft report per NFL's standard format with executive summary
- Club management opportunity to respond
- Final report to club-level and League audiences
- Support agreed-upon procedures for external auditors
Club IT Audits & Stadium Cybersecurity Reviews
Planning
- Review prior audit results and policies
- Align with NFL IA on objectives, scope, key systems
- Optionally deploy pre-fieldwork cyber risk survey
- Develop risk-based audit program
- Kickoff with stakeholders
Fieldwork: On-Site
- On-site kickoff with Stadium/Club stakeholders
- In-person interviews and walkthroughs
- Testing of control design and effectiveness
- Real-time communication of observations
Fieldwork: Remote
- Follow-up interviews and targeted requests
- Remaining testing and sampling
- Finalize workpapers and begin report
Reporting
- Draft report per NIST domain vs. other clubs/stadiums
- Actionable recommendations
- Formal exit meeting
Consumer Products Licensing Audit
Planning
- Approach respecting NFL's contractual Licensee relationships
- Schedule interviews and questionnaires
- Review applicable agreements
- Review, recalculate, and reconcile royalty amounts
- Ensure Licensee reports consistent with agreements
Fieldwork
- Determine royalty basis per agreement
- Compare GL to invoice register for completeness
- Analyze marketing and promotional expenditures
- Conduct "false exclusion" tests
- Review irregular/close-out merchandise sales
- Real-time issue communication
Reporting & Settlement
- Detailed findings with supporting schedules
- Actionable findings with agreement citations
- Facilitate settlement and inform future negotiations
Advisory, ERM & Risk Support
Strategic Alignment
- Align ERM with NFL strategic objectives
- Risk advisory to NFL Departments for strategy sessions, KPI definition
Identify Risks
- International game readiness support
- Host Committee risk management
- Ad hoc management request services
Risk Rating & Assessment
- Rate risks by Probability, Impact, Management Readiness
- League-wide policy management
Reporting
- Heatmaps (Inherent vs. Residual risk)
- Clear recommendations for management action
Investigative Services
Every investigation is unique. We tailor our approach accordingly.
Evaluate & Assemble
- Clarify allegations, objectives, scope
- Preliminary evaluation with targeted analytics
- Assemble credentialed, case-specific team
Investigative Fieldwork
- Fact-gathering: analytical procedures, interviews
- eDiscovery and digital forensics
- Identify and quantify potential losses
Reporting
- Objective findings with clear documentation
- Final report with conclusions and loss estimates
Remediation
- Support prosecution/litigation decisions
- Training to strengthen internal controls
Delivery & Reporting
Flexible delivery models, a clear transition plan, and reporting frameworks that keep the NFL informed at every stage.
Delivery Models
Co-Sourcing / Project-Based
EisnerAmper provides some or all audit resources working alongside NFL Internal Audit Management. Work is presented on NFL letterhead; NFL assumes risk and responsibility.
- Flexible staffing: scale up or down by vertical
- NFL retains full control of findings & reporting
- Ideal for specialized audits & surge periods
- Seamless integration with NFL IA team
Full Outsourcing
EisnerAmper assumes full ownership of the audit function from planning through reporting.
- End-to-end program ownership & admin
- Audit committee reporting & issue follow-up
- Full vertical administration by EA partners
- Turnkey solution with maximum independence
Transition & Onboarding Plan
Day-one readiness with minimal disruption to the NFL's active audit portfolio.
Mobilization
Kick-off with NFL IA. Execute NDAs & system access. Assign engagement team. Receive prior-year workpapers.
Knowledge Transfer
Shadow sessions with departing provider. Review historical reports. Map entity/org structure. Calibrate NIST/DHS standards.
Plan & Tooling
Draft Year 1 audit plan. Configure tech stack & analytics. Build licensing templates. Finalize staffing model.
Go-Live
Begin first-priority engagements. Deliver Week 1 status report. Activate quarterly analytics. Full portfolio execution.
Zero lapse in audit coverage
NFL season timing respected
Named team from Day 1
Data security active at kickoff
Flexibility & Staffing
Rapid Redeployment
We staff NFL engagements from a unified pool of Assurance and Advisory professionals. When scope expands, we redeploy credentialed senior professionals within days, not weeks.
Built-In Scope Flexibility
Fixed-fee engagements structured with clearly defined change-order thresholds, giving the NFL cost certainty without being locked in.
Specialty On-Demand
Cybersecurity, forensics, licensing compliance, ERM: when an engagement requires a specialist, we bring them in from the same integrated team. One accountable firm.
Sample Report Deliverables
Below are representative examples of the reporting deliverables EisnerAmper provides across the NFL Internal Audit Program.
✓ Completed walkthroughs: payroll system access controls and segregation of duties (8 interviews)
✓ Tested 25-item sample of payroll transactions — results documented in workpapers WP-04
✓ Obtained and indexed PBC items 12–18 (benefits reconciliation, termination checklists)
○ HR system user access review — in progress, expected June 12
○ Control testing for overtime approval — scheduled week of June 16
| ID | Request | Owner | Due |
|---|---|---|---|
| PBC-07 | Vendor master change log (FY25 Q3–Q4) | NFL Finance | Jun 10 |
| PBC-11 | Off-cycle payroll approval emails | NFL HR | Jun 12 |
| PBC-14 | Terminated employee access revocation log | NFL IT | Jun 8 |
| PBC-19 | Benefits reconciliation — Q1 2026 | NFL Finance | Jun 15 |
Terminated employee access not revoked within 24-hr policy window — 3 of 25 tested items (12%) reflect delays of 3–7 business days.
Control gap; management notified June 9.
Overtime approval documentation inconsistent — 4 instances where approver email not retained per policy.
Recommendation to formalize digital workflow.
Vendor master list last reconciled Q2 2025; no formal change management log in place.
This audit examined payroll and compensation controls for the NFL League Office covering ~1,100 employees across salary, bonus, and benefits for Q1 2026.
✓ Payroll transactions (n=25)
✓ Benefits reconciliation — Q1 2026
✓ Terminated employee access (n=18)
✓ Overtime & off-cycle workflow
✕ Contractor/vendor payroll
✕ Executive compensation
VP, Human Resources
EVP, Operations
League Chief Financial Officer
Head of Internal Audit
F-01 Terminated Employee System Access — Delayed Revocation
Condition: 3 of 18 tested terminations (17%) had system access active 3–7 business days beyond the 24-hour requirement.
Criteria: NFL Information Security Policy §4.2
Risk: Unauthorized data access; potential payroll fraud or data exfiltration.
Recommendation: Automate access revocation from HRIS termination workflow; implement weekly exception report to IT Security.
Management Response: Pending — due July 23, 2026
F-02 Overtime Approval Documentation — Retention Gap
Condition: 4 of 25 tested overtime transactions lacked required written approval.
Criteria: NFL HR Policy §7.1
Risk: Policy non-compliance; reduced audit trail.
Recommendation: Implement digital approval workflow in HRIS; 90-day remediation timeline.
Management Response: Pending — due July 23, 2026
F-03 Vendor Master Reconciliation — Annual Process Gap
Condition: No change management log maintained; last reconciliation was Q2 2025.
Criteria: NFL Procurement Policy §2.3
Risk: Undetected phantom vendors or unauthorized payment routing.
Recommendation: Semi-annual reconciliation; LogicGate workflow for change approvals.
Management Response: Pending — due July 23, 2026
League Office Ops — Q2: 3 | YTD: 9/12
Member Club Audits — Q2: 2 | YTD: 6/10
IT & Cybersecurity — Q2: 4 | YTD: 10/20
3rd Party/Licensing — Q2: 12 | YTD: 20/50
Advisory & ERM — Q2: 0 | YTD: 3 (ongoing)
Investigative Svcs — Q2: 1 | YTD: 2 (as needed)
Terminated employee access revocation delays (League Office — Payroll Audit)
Unpatched critical vulnerabilities across 2 club IT environments
Revenue sharing exception — unreported deductions (Member Club Audit)
4 findings — Documentation and workflow gaps across 3 engagements
2 findings — Vendor master reconciliation and change management gaps
78%
82%
88%
91%
Football Operations Audit — Aug
Stadium Cyber Reviews (x3) — Jul–Sep
Member Club Audits (x3) — Aug–Sep
Licensing Audits (x15) — ongoing
Annual Financial Controls — Sep
| Dimension | Score |
|---|---|
| Communication Quality | 4.5 |
| Report Quality & Clarity | 4.4 |
| Timeliness | 4.1 |
| Team Expertise | 4.6 |
| Responsiveness | 4.2 |
| Overall Value | 4.1 |
Target: ≥ 4.0 all dimensions ✓ | No dimension below 3.5 ✓
| Engagement | Score |
|---|---|
| Payroll & Compensation Audit | 4.2 |
| Club IT Audit — Team A | 4.5 |
| Stadium Cyber — Venue A | 4.4 |
| 3rd Party Contract Audit | 3.9 |
| Member Club Audit — Club B | 4.1 |
Q8 Standard: Draft ≤ 15 days | Final ≤ 30 days from fieldwork end
| Engagement | FW End | Draft | Final | Status |
|---|---|---|---|---|
| Payroll & Comp | Jun 20 | 12d | — | ON TIME |
| Club IT — Team A | May 28 | 9d | 22d | ON TIME |
| Stadium Cyber | May 15 | 11d | 24d | ON TIME |
| 3rd Party Contract | Apr 30 | 8d | 19d | ON TIME |
| Member Club — B | Jun 12 | 16d | — | LATE |
| Licensing Batch Q2 | May 5 | 7d | 18d | ON TIME |
| Engagement | Audit Days | Duration |
|---|---|---|
| Payroll Audit | 48 / 55d | 32 / 40d |
| Club IT — Team A | 31 / 32d | 28 / 35d |
| Stadium Cyber | 29 / 32d | 31 / 35d |
| 3rd Party Contract | 36 / 38d | 22 / 30d |
| Member Club — B | 53 / 50d | 38 / 45d |
22 of 28 findings closed YTD | Target ≥ 75% ✓
68%
72%
75%
78%
Industry Experience
Serving clients at the intersection of sports, entertainment, media, and licensing for over three decades.
NBA Revenue Sharing & Licensing
- 17-year relationship
- All 30 teams audited annually
- ~35 licensing audits per year
- Owner due diligence
NHL Audit, Tax & Revenue Sharing
- 23-year relationship
- 10 to 12 teams per year
- Auditors to NY Islanders
- Owner due diligence
MLS League & Club Auditors
- 10+ year relationship
- MLS league office auditors
- Philadelphia Union auditors
- Owner due diligence
NFL Current Franchise Client
- NFL Club Team: auditors & tax advisors
- NFL Gridiron Platform SOC 2
- Deep franchise financial fluency
- League policy expertise
Cyber Risk Experience with Athletic Operations
Athletic Facilities Network Security
Network audits across athletic buildings, football operations, and 100,000-seat stadiums.
Stadium Physical Security
Physical security control audits at major athletic facilities including access controls and monitoring.
Athlete Data Protection
Cybersecurity audits evaluating security, privacy, and protection of athlete data.
HIPAA Compliance for Athletics
Assessment of HIPAA privacy, security, and breach notification for athletics operations.
PCI DSS for Athletics
PCI DSS compliance for ticketing, parking, and concessions payment card data.
Case Study: University of Texas Athletics
IT Audit Co-Source Partner Since 2019
7+ YEAR RELATIONSHIPEisnerAmper has served large collegiate athletic programs since 2019, including IT audit co-source services to the University of Texas at Austin.
Cybersecurity & Network
Cybersecurity audits, wireless network assessments, and PCI compliance.
HIPAA & Athlete Data
HIPAA compliance assessments protecting student-athlete health records.
Data Governance
Data Governance Committee support, establishing controls for athletic data assets.
Our Team
The team you meet in this proposal is the team in the room at every Audit Committee presentation. Year one, year two, and beyond.
Staff & Project Oversight
