Attachment 1- Requirement Document -Audit Management System Requirements.pdf

Includes TM 8 23 comments, JM-40, SM, AR, JK, A. Requirements. The Contractor shall provide a Commercial Off the Shelf (COTS) product that meets the following requirements.

1 General Requirements

1.1 Commercial, off-the-shelf document management information system specifically designed to manage audits and reviews such as the type performed by the U.S. Federal government Offices of Inspectors General with proven audit usage within the past three years.

1.2 Must provide names and contact information for three current audit customers, preferably in the federal, state, or local government field.

1.3 User-friendly, intuitive graphical interface, preferably following a well-established modern click and attach, copy/paste, save, highlight, and link schema commonly used across industry in the United States.

1.4 Scalable from 50 to 250 users.

1.5 Must include ongoing support services including, but not limited to, security updates/patches, bug fixes, and updates/patches to address compatibility with operating systems, browsers, and complementary applications for the duration of the licensing period or agreement.

1.6 Must provide controls to prevent data loss when multiple users concurrently modify a document while working online.

1.7 Must provide the ability for users to work with project documentation offline when a network or VPN connection is not available, including ability to create write-ups and add attachments offline, add and utilize links, process to synchronize offline changes to the project, ability to review and resolve conflicts from offline production, save all created offline project documentation, and provide controls to prevent data loss while modified offline.

1.8 Ability to provide a read-only copy for use by computer that has never been connected to the network.

1.9 If the product relies upon third-party tools or applications, support for those tools or applications must extend throughout the support lifecycle of the product.

1.10 Must comply with Section 508 of the Rehabilitation Act of 1973, as amended

(29 U.S.C. § 794d).

1.11 Must provide Section 508 compliant visual indicators to indicate the signoff status (for 'Prepared', 'Reviewed', and 'Edited', at a minimum) of write-ups, recommendations, and attachments.

2 Infrastructure and Security Requirements

2.1 Ability to test prior to patch/upgrade installations in production environment.

2.2 Compatible with Windows 11 and higher.

2.3 Compatible with Microsoft Office 365 (O365), including Word and Excel; and, if the product requires O365 Click-to-Run versions to be installed, the solution must be compatible with both the 32-bit and 64-bit versions.

2.4 Support for and compatible with current and future Acrobat PDF files.

2.5 API and Azure Integration: The system must provide robust API capabilities for integration with other enterprise systems, and it should support native integration with Microsoft Azure services to enhance scalability, security, and global reach.

2.6 Compatible with latest OIG Windows Server build.

2.7 Ability for agency to produce audit performance metrics from system.

2.8 Support load balancing.

2.9 Perform well in Virtual Machines and/or Virtual Desktop Infrastructure (VDI).

2.10 Support for single user sign-on/PIV cards.

2.11 Ability to handle slow or latent connections through VPN or remote connections.

2.12 Ability to install client software with single installation package distributed via

System Center Configuration Manager (SCCM) or other widely used software deployment mechanisms.

2.13 Provides granular access control to include projects, user roles and security groups.

2.14 If the solution is hosted, the following requirements must be met:

a. The solution must be available for use 24 hours per day, 7 days per week, without disruption except during system updates which must be scheduled at least 6 weeks in advance and must occur on Saturdays, Sundays, and/or United States federal holidays, unless a newly identified security vulnerability is identified that requires immediate attention, in which case as much advance notice as possible must be provided.

b. Data must reside in United States.

c. Follow Federal Risk and Authorization Management Program (FedRAMP).

2.15 Comply with the following U.S. federal government security requirements when appropriate, at a minimum:

a. Federal Information Security Management Act (FISMA);

b. National Institute of Standards and Technology (NIST) Special Publication

800-53 REV5; and

c. Federal Information Processing Standards (FIPS) 199.

2.16 FIPS 140-3 Encryption Capable.

2.17 Advanced Encryption Protocols: Implement advanced encryption (e.g., Quantum-safe algorithms) for data in transit and at rest, specifically tailored to protect highly sensitive information on a global scale.

2.18 Time Zone Management: The system should automatically adjust deadlines, notifications, and scheduling based on the user’s local time zone.

2.19 Cross-Border Data Transfer Compliance: Ensure that any cross-border data transfers adhere to international standards and local laws, such as GDPR for Europe and CCPA for California.

2.20 Global Audit Trail: Provide a comprehensive, centralized, accessible audit trail for those with the role of Administrator that logs all user activities, changes, and accesses across different jurisdictions and regions. This includes the ability to perform logging/capture of user activity, including deletions.

2.21 Risk Management Integration: Implement a global risk management framework that supports risk assessments across multiple regions, integrating local risk factors and global risk trends.

2.22 Global Scalability: The system must support a scalable architecture that can handle the increased load from global operations, including high-traffic scenarios in specific regions.

2.23 Performance Optimization for Remote Locations: The system should optimize performance for auditors operating in remote or bandwidth-constrained environments globally.

2.24 Compliance with International Standards. ISO/IEC 27001 Compliance: Ensure the system adheres to international standards for information security management systems.

2.25 Anti-Bribery and Anti-Corruption Compliance: Include features that support compliance with international anti-bribery and anti-corruption laws, such as the Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act.

2.26 Global Collaboration Tools: Incorporate tools that enable real-time collaboration and communication among teams across different regions, including secure messaging, video conferencing, and document sharing.

2.27 Knowledge Management System: Implement a global knowledge management system that allows for the sharing of audit best practices, lessons learned, and guidance documents across regions.

2.28 Global Disaster Recovery Plan: Develop a robust disaster recovery plan that ensures business continuity in the event of natural disasters, cyber-attacks, or other crises affecting global operations.

2.29 Data Redundancy Across Regions: Ensure data redundancy across multiple geographic locations to safeguard against data loss due to regional outages.

2.30 Region-Specific User Interfaces: Design user interfaces that are customizable for different regions, accommodating local preferences and practices while maintaining a consistent user experience globally.

2.31 Accessibility Compliance Globally: Ensure that the system complies with accessibility standards not just in the U.S. (e.g., Section 508) but also in other regions, such as the European Accessibility Act (EAA).

3 System Configurability and Centralized Administration

3.1 Role of 'Administrator' (or similar) with privileges to

add/edit/approve/delete projects, configure application settings, create/remove/enable/disable/update user accounts, and perform other administrative tasks.

3.2 Ability for users with Administrator role to see history/audit trail to project status.

3.3 Ability for users with Administrator role to create, update, and archive multiple project templates to ensure new projects include predefined project structure and content including all required steps, based on the project type.

3.4 Ability for users with Administrator role to create and assign permissions based on custom user roles such as admin, director, manager, independent referencer, reviewer, preparer, or combination of roles.

3.5 Ability for users with Administrator role to add/edit/remove projects.

3.6 Ability to limit project view based on user roles/permissions defined by the those with Administrator role.

3.7 Ability to assign users to different projects at any phase with role permissions specific to each project.

3.8 Centralized software policy management including user preferences and project settings.

3.9 Ability to create workflows.

3.10 Ability to copy existing projects as new projects and write-ups as new write-ups.

3.11 Configurable fields and labels for project information, recommendations, attachments, write-ups, etc.

3.12 Ability to generate standard and custom data reports across entire database in MS Word, MS Excel, and/or Adobe PDF formats (as appropriate) and within specific projects on current, real-time data for the purposes of resource management, project management, and recommendation tracking, at a minimum.

3.13 Ability to create data reports for tracking milestones - initial and revised dates compared to actual - and ability to capture number of days spent in each milestone.

3.14 Ability to automate creation of regularly produced reports.

3.15 Ability to create data reports for tracking recommendation status - initial and revised dates compared to actual, recommendations resolved in a date range, recommendations opened and closed in a date range.

3.16 Ability to generate time and expense reports based on criteria such as time charged by user, project, or specified groups, specified time frames, specified milestones, etc.

3.17 Ability to generate reports on any database field, including entities.

3.18 Ability to create ad hoc reports and queries, with data limits guided by user role.

3.19 Ability to identify content such as Controlled Unclassified Information (CUI).

3.20 Ability to add identifying information beyond title to each attachment.

3.21 Ability to support Agency records management requirements of retention and destruction.

3.22 Ability for users to access completed and closed projects by other teams based on role defined by users with Administrator role.

3.23 Ability for users with Administrator role to grant users read-only access to projects after project closeout.

3.24 Ability for each project to maintain a status of “Open”, “suspended,”

“cancelled”, or “Closed.”

3.25 Ability to limit re-open a project (in other words, reverting a project with a

'Status' of "Suspended", "Cancelled", or "Closed" back to "Open") to those with the 'Administrator' role to ensure the integrity of project records.

3.26 Once a project is suspended, closed, cancelled, or suspended, all project fields and data entry changed to ‘read only’.

3.27 Controls to require project approval before work can begin.

3.28 Ability to train in simulated production environment using previous work.

3.29 Robust training for administrators.

3.30 Train the trainers option available.

3.31 Extensive training documentation.

3.32 Detailed reference materials for system support.

4. Project Management Requirements

4.1 Self-contained projects with unique permissions and roles (including custom roles such as read only roles).

4.2 Custom fields for individual projects, minimally 15 project-level fields available which can be edited throughout the project duration for limited roles.

4.3 Unique identifier for each project.

4.4 Ability to establish, monitor, revise, and track unlimited number of administrator defined milestones for each project.

4.5 Milestones tracker for each project must capture three date fields - initial, revised, and actual dates.

4.6 Revised milestone date field must allow for multiple revisions.

4.7 Milestones variable by type of project.

4.8 Ability to add, edit, and archive unlimited number of project entities linkable to each open project.

4.9 Preparer signoffs indicating write-up ready for review including date/time and username.

4.10 Multi-level reviewer signoffs indicating write-up ready for review including date/time and reviewer name.

4.11 Controls to prevent users from reviewing document they prepared.

4.12 Control to prevent reviewer signoff prior to preparer signoff for each write-up.

4.13 Ability for reviewers to add comments on individual write-ups and for preparers to respond to the comments prior to reviewer final approval, and to retain those comments.

4.14 Ability to notify reviewers and preparers when comments are pending review or response.

4.15 Provide reviewer comments in different sections of the write-up.

4.16 Ability for reviewers to mark comment as resolved or complete, even if they didn’t initially author the comment.

4.17 Ability to see complete history of user activity including name, action (create, edit, prepare, and review) and date/time for each action taken by user in project.

4.18 Ability to see when write-ups are modified/updated (e.g. days/times write-ups were modified).

4.19 Ability to identify changes made after supervisory review.

4.20 Ability for users to logically organize project documentation in a manner of their choosing in sections, folders, or other organizing schema.

5. Audit Documentation Requirements

5.1 Support for and compatible with alternative office file types (GoogleDocs, open-source office files, etc.).

5.2 Support for and compatible with industry-standard media files (audio, video, image).

5.3 Support for and compatible with large-scale, complex data and analysis files.

5.4 Unique identifier for each attachment visible to project team in the project.

5.5 Ability to create, edit, and delete an unlimited number of write-ups (that includes fields to contain title, purpose, source, scope, methodology, results, conclusion, and recommendations) until a project is closed, suspended, or terminated even if a reviewer has approved the write-up.

5.6 Ability for users with Administrator role to retrieve deleted write-ups and attachments.

5.7 Ability to limit recommendation deletions to users with Administrator role.

5.8 Ability to add an unlimited number of attachments and rename, update/replace, export, and print attachments.

5.9 Ability to print individual write-ups, attachments, or selection of write-ups/attachments.

5.10 Ability to print from projects in every status.

5.11 Support for unlimited number of and unlimited file size attachments in each project (e.g., several hundred attachments per project).

5.12 Ability to restrict access to attachments to a specific project (limit/lock so cannot change original data/data integrity).

5.13 Ability to easily share selected attachments across projects.

5.14 Ability to retain/recover multiple versions of attachments, including the original document that was added to the AMS.

5.15 Ability to link to external sites such as websites and email addresses.

5.16 Ability to link write-ups to supporting attachments or other write-ups.

5.17 Ability to link attachments to each field of write-ups as well as other attachments (e.g., Word, Excel, and Acrobat).

5.18 Ability to efficiently handle unlimited number of links within individual attachments (e.g., several hundred links within a single Word or Excel file) and across the audit file while maintaining document integrity (e.g., multiple Word files with several hundred links).

5.19 Ability for user to review and verify links within Word, utilizing visual cues indicating that links are correct or incorrect (e.g., tickmarks, highlighting, comment boxes).

5.20 Ability for other team members to view user’s review work in the attachment, as the work occurs in real time (e.g., comments or reviewer notes are visible as they are written even though the document is open by another user).

5.21 Monitor what changes were last made/what is being worked on to individual write-up.

6. Recommendation and Audit Follow Up Requirements

6.1 Ability to create, view, and report on recommendations, all custom fields, and their updates based on audit work within a single project after a project is closed.

6.2 Ability to link recommendations to supporting attachments and write-ups.

6.3 Ability to create and update custom fields for recommendation tracking to meet reporting requirements (minimum of 5 monetary fields, 5 date fields, 4 dropdown fields, 4 text fields, assignment of 3 users) with the option to make fields mandatory.

6.4 Ability to record and update response text and drop-down options for each recommendation even after project is closed.

6.5 Ability to associate recommendations with offices and department organizations.

6.6 Ability to mark and select individual recommendations for reporting (i.e., for tracking or information only).

6.7 Status indicator for each recommendation, with a minimum of 5 status agency defined options (e.g., unresolved, resolved, closed).

6.8 Ability to update individual recommendation status, including target action dates, and attach supporting documents for both open and ofr follow-up on closed projects, including date controls to prevent backdating from date of entry.

6.9 Ability to export all recommendation data fields into an Excel format and/or

CSV format, with filter options for date ranges, types of recommendations, organization, status of recs, etc.

6.10 Ability to see audit trail of changes including edited field by user, date, and time indicators for each audit.

6.11 Ability to limit recommendation updates to specific roles or users.

7. Usability Requirements

7.1 Ability to quickly locate information within attachments and write-ups within a project using text-based search of titles and contents.

7.2 Ability to filter search results for projects, write-ups, and attachments based on custom metadata or custom tags such as Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI).

7.3 Word search ability within a single write-up as well as across the project file.

7.4 Ability for access of entire project file for external agency employees without access to internal network.

7.5 Easily accessible reports for users indicating completion, review status, and review notes.

7.6 Visual reminders for pending deadlines and open items (e.g., projects, write-ups, recommendation tracking etc.).

7.7 Provides project management dashboards displaying real-time information for project such as percentage of project work completed, document review status percentage, status of milestone phases, time and expenses charged to projects, status of assigned recommendations, etc.

7.8 Shortcut access to project, time and expense, and recommendation data directly from dashboards.

7.9 Ability to create notifications within the system for administer-defined triggers such as pending deadlines, review status, recommendation dates, and required actions.

7.10 Ability to create e-mail notifications based on administer-defined triggers.

7.11 Support for rich text formatting in write-ups, recommendations, and project information sections (including bold, italics, underline, highlight, text alignment, numbering, bullets, cut/page/copy).

7.12 Support for Copy/Cut/Paste from attachments to write-up and move write-up locations.

7.13 Support for inline and on-demand spell check, with editable/customizable dictionary.

7.14 Ability to create and format tables within a write-up.

7.15 Ability for multiple users to collaborate on attachment or write-up creation and edit simultaneously in real-time.

7.16 Allow users to copy attachments with all links to a new document and then continue adding more links and other changes to such document.

8. Cost Accounting for Time and Expenses (e.g. travel and contracting expenses)

8.1 Ability for user to report time and expenses on a biweekly basis on all seven days of the week.

8.2 Ability for add unlimited number of agency-defined non-project time codes.

8.3 Ability for user to charge time to unlimited number of project and non-project codes (e.g., leave, holiday, etc.).

8.4 Workflow for supervisory review of all time and expense entries with name, date, and time information, and rejection comments.

8.5 Ability to easily re-assign user to a different reviewer for time and expense reporting.

8.6 Ability to submit timesheet and expenses to another user when complete, recording date and time of submission.

8.7 Ability for each user to edit timesheets and expenses after submission.

8.8 Ability to assign billing rates for individual employees and edit those rates upon promotion or demotion.

8.9 Ability to report on user time, including for specific users, on specific projects, within phases, or specific time frames.

8.10 Ability for user with Administrator role to determine which users must submit timesheets, which users are reviewers of timesheets, and to change those reviewers.

8.11 Ability for user with Administrator role to input, submit, un-submit, approve, reject, and delete timesheets for all users.

8.12 Ability to prevent user from charging negative time or amounts.

8.13 Ability to prevent user from submitting with less than 80 hours on timesheet without user with Administrator role waiver.

8.14 Ability for user with Administrator role to define, update, and edit hourly pay rates for all users.

8.15 Ability for user with Administrator role to define expense categories.

8.16 Ability to associate expenses and time with specific projects.

8.17 Retention of timesheets for agency-defined time frames, usually about 10 years.

B. Desired Capabilities, but not required:

Ability to migrate recommendation and project data from the existing audit management software system (s) – TeamMate AM and Ideagen Internal Audit/Pentana.

Ability to track individual recommendations from migrated projects, including reporting.

Ability to automatically create project codes based on agency supplied formula.

Robust ad-hoc reporting that allows reporting on all data points in system.

Advanced notification abilities via email and pop-ups within system as defined by agency based on all actions taken by users and changes to fields in projects and recommendations.

Ability to automatically calculate milestones based on agency defined formulas based on audit type.

Ability for user with Administrator role to override agency defined formulas on specific projects.

Ability to have multiple levels of reviews defined by user and/or agency on specific project write-ups or attachments.

Automatically assign numbers to all write-ups and attachments based on agency defined formula.

Ability to capture and query staff qualifications and availability for resource assignment purposes.

Natural language search of project documentation contents.

Use natural language processing and generative artificial intelligence technology within user database to author documentation based on user-supplied questions and prompts with clear labeling and limitations imposed by agency.

Agency-customized dashboards.

Ability to create notifications within the system for user-defined triggers such as pending deadlines, review status, recommendation dates, and required actions.

Ability to create e-mail notifications based on user-defined triggers.

Ability to set agency-defined holidays by region for timesheets.

Ability for entities outside of organization to view read-only project documentation contents without installing the product.

System-generated reports that identify projects scheduled to be disposed.

Provide integrated data analysis tools that perform analytical tests of full datasets such as (but not limited to) identification of duplicate payments, related party vendors, duplicate expense claims, and employee/vendor matching via a user interface that does not require the user having coding or database knowledge.

Provide the capability to perform and document risk-based planning on a cyclic basis.

Provide the capability for administrators to define start and end dates for planning cycles.

Allow administrators to create an unlimited number of engagement plans for each planning cycle.

Link projects created to the appropriate (risk-based) engagement plan to facilitate tracking of progress of engagement plan (in other words, planned engagements versus actual engagements).

Provide the capability to assign a probability and impact to each entity in the audit and inspection universe during each planning cycle.

Calculate risk using a user-defined formula for each entity in the audit and inspection universe during each planning cycle.

Provide the capability for users to make adjustments to risk scores during each planning cycle.

Allow users to change the formula for calculating risk from planning cycle to planning cycle.

Provide the capability for users to add project proposals which include 'Justification', 'Proposed Objective', 'Proposed Scope/Methodology', and 'Proposed Division' to an engagement plan.

Provide the capability to include mandatory work (in other words, work required by law or regulation) in engagement plans.

Identify planned engagements as either 'Mandatory', 'Planned', or 'Unplanned'.

Provide the capability for risk-based plans to be copied from one cycle to the next cycle.

Provide the capability for users to define an unlimited number of objectives for each risk-based plan.