IT Audit RFP

We are in the process of sending RFPs for general IT audit and penetration testing. Two questions......1) who handles your RFP process for IT services? Internal Audit or your Director of IT? Does your Internal Audit Department have the IT expertise to decide which firm to engage? If Internal Audit does not handle the RFP process, do they at least have input of who to send the RFPs to even if they don't make the final decision? 2) Do you engage a CPA firm with IT specialists or do you engage a non-CPA firm that does IT consulting? THANKS!