Independent Audit of Office of Human Capital Records - Draft PWS.docx

Performance Work Statement (PWS) Independent Audit of Office of Human Capital Records

1. Scope The Contractor shall perform an independent, comprehensive audit of Office of Human Capital (OHC) records. The audit shall assess the completeness, accuracy, organization, accessibility, retention, disposition practices, internal controls, and overall management of records within the approved audit scope.

The Contractor shall evaluate both electronic and physical records, as applicable, including records maintained in authorized systems, shared repositories, document-management platforms, network locations, and physical storage locations identified by the Government.

The Contractor shall provide an objective assessment of OHC’s current records-management environment; identify risks, deficiencies, and potential compliance gaps; and recommend prioritized corrective actions to strengthen records governance, controls, and operational practices.

The Contractor shall not make determinations or decisions regarding benefits adjudication, credentialing, vetting, legal or civil investigation, enforcement actions, or other actions affecting an individual’s rights or safety. The Contractor’s work shall be limited to records-management and process-audit functions within the approved scope.

2. Objectives The objectives of this effort are to:

1. Establish a reliable inventory of OHC records, repositories, and records-management practices within the approved scope.

2. Assess whether records are complete, accurate, appropriately organized, accessible to authorized personnel, and maintained in accordance with applicable requirements.

3. Evaluate OHC records-management policies, procedures, governance, roles, responsibilities, training, and internal controls.

4. Identify duplicate, missing, misfiled, improperly retained, inaccessible, or otherwise deficient records.

5. Identify records-management risks and prioritize corrective actions.

6. Deliver an actionable remediation roadmap that OHC can use to improve its records-management program.

3. Applicable Documents and Standards The Contractor shall perform work in accordance with the most current versions of applicable Federal, DHS, Component, and OHC policies, procedures, directives, handbooks, records schedules, privacy requirements, and information-security requirements provided or identified by the Government.

Applicable documents may include, as relevant:

· Federal records-management requirements and National Archives and Records Administration guidance.

· DHS and Component records-management policies and records schedules.

· OHC policies, standard operating procedures, and internal-control documentation.

· Applicable privacy, information-security, system-access, and data-handling requirements.

· Applicable document-retention, litigation-hold, and disposition requirements.

· Contractual safeguarding and nondisclosure requirements.

The Government will identify the documents and requirements applicable to the final scope of work.

4. Definitions Audit: A systematic, independent examination of records, records-management processes, controls, and supporting documentation to determine conformance with established requirements and identify areas for improvement.

Records Repository: Any physical or electronic location where OHC records are created, maintained, stored, accessed, or managed.

Corrective Action: A specific action intended to address an identified deficiency, risk, control weakness, or process gap.

Remediation Roadmap: A prioritized plan identifying recommended actions, responsible offices or roles, dependencies, anticipated effort, and target timeframes.

5. Contractor Requirements

5.1 Task 1: Project Initiation and Audit Planning

The Contractor shall:

1. Conduct a project kickoff meeting with the COR and designated OHC stakeholders within [10] business days after award.

2. Confirm the audit scope, objectives, points of contact, communications procedures, assumptions, dependencies, and project schedule.

3. Develop an Audit Project Plan that describes:

· Audit objectives and scope;

· Proposed methodology;

· Records populations and repositories to be reviewed;

· Sampling methodology, if applicable;

· Interview and stakeholder-engagement approach;

· Records and information request process;

· Quality-control procedures;

· Risk-management approach;

· Schedule and milestones;

· Required Government-furnished information; and

· Deliverable submission and review process.

4. Submit the Audit Project Plan to the COR for review and approval.

5. Update the plan when material scope, schedule, or risk changes occur.

5.2 Task 2: Records Environment and Repository Inventory

The Contractor shall identify and document the OHC records environment within the Government-approved scope.

At a minimum, the Contractor shall:

1. Identify records repositories, including applicable electronic systems, shared drives, collaboration sites, document-management systems, email repositories, archived materials, and physical storage locations.

2. Document the responsible OHC office, program, or record custodian for each repository.

3. Identify the general types and categories of records maintained in each repository.

4. Document the format of records, such as electronic, paper, scanned image, or hybrid.

5. Identify known records-management procedures, access controls, retention practices, and disposition procedures associated with each repository.

6. Identify records populations that may present elevated risk because of volume, age, access limitations, lack of ownership, inconsistent organization, or other observed conditions.

7. Develop and maintain a Records Repository Inventory for Government review.

The Contractor shall not collect, copy, download, transmit, or retain sensitive records except as expressly authorized by the Government and consistent with applicable handling requirements.

5.3 Task 3: Records Sampling, Testing, and Assessment

The Contractor shall perform a documented assessment of OHC records and records-management practices.

The Contractor shall:

1. Develop and apply a Government-approved sampling methodology when the scope or volume of records requires sampling.

2. Review a representative sample of records from identified repositories and record categories.

3. Assess records, as applicable, for:

· Completeness;

· Accuracy and consistency;

· Organization and filing practices;

· Appropriate categorization and indexing;

· Accessibility by authorized personnel;

· Presence of duplicate or redundant records;

· Potentially missing, incomplete, misfiled, or inaccessible records;

· Conformance with applicable retention and disposition requirements;

· Evidence of appropriate controls for storage, handling, access, and disposition.

4. Document audit observations, supporting evidence, and any limitations encountered during testing.

5. Identify systemic issues, recurring deficiencies, and potential root causes.

6. Provide interim notification to the COR of any significant risk, suspected unauthorized disclosure, records-loss concern, or other material issue identified during the audit.

Any suspected privacy, information-security, records-loss, or other incident shall be reported promptly in accordance with Government-provided reporting procedures. The Contractor shall not independently investigate such incidents unless directed by the Contracting Officer or COR.

5.4 Task 4: Policy, Process, Governance, and Internal-Control Assessment The Contractor shall assess the adequacy and implementation of OHC’s records-management governance and internal controls.

The assessment shall include, as applicable:

1. Policies, procedures, guidance, and standard operating procedures.

2. Roles and responsibilities for records creation, maintenance, access, retention, and disposition.

3. Records-management training, awareness, and accountability mechanisms.

4. Governance structures and oversight processes.

5. Controls related to record access, version control, classification, storage, retention, and disposition.

6. Processes for identifying and managing duplicate, obsolete, or redundant records.

7. Processes for managing records subject to preservation, hold, or other restrictions, as applicable.

8. Existing performance measures, monitoring activities, and internal reviews.

9. Gaps between documented procedures and actual operational practices.

5.5 Task 5: Findings, Risk Assessment, and Corrective-Action Recommendations The Contractor shall analyze audit results and develop findings and recommendations.

For each finding, the Contractor shall provide:

1. A unique finding identifier.

2. A concise description of the condition identified.

3. Applicable requirement, policy, procedure, control objective, or expected practice.

4. Supporting evidence or basis for the finding.

5. Root cause or contributing factors, when identifiable.

6. Potential operational, compliance, privacy, security, or records-management impact.

7. Risk rating of High, Moderate, or Low, using a methodology approved by the COR.

8. Recommended corrective action.

9. Recommended responsible role or office.

10. Estimated level of effort, dependencies, and suggested target timeframe.

11. Suggested measure of completion or closure criterion.

Recommendations shall be practical, prioritized, and tailored to OHC’s operational environment.

5.6 Task 6: Remediation Roadmap

The Contractor shall develop a Remediation Roadmap that consolidates audit findings and recommended corrective actions.

The roadmap shall include:

1. A prioritized list of corrective actions.

2. Recommended sequencing of actions.

3. Short-term actions, generally achievable within 90 days.

4. Mid-term actions, generally achievable within 3 to 12 months.

5. Long-term actions requiring more than 12 months, major system changes, or substantial resource commitments.

6. Suggested accountable offices or roles.

7. Dependencies, resource considerations, and key implementation risks.

8. Suggested performance measures for tracking progress.

9. Recommended governance and oversight approach for corrective-action implementation.

5.7 Task 7: Reports and Executive Briefings

The Contractor shall prepare and deliver draft and final reports and brief OHC leadership on the audit results.

The Contractor shall:

1. Provide periodic status reports in accordance with Section 7 of this PWS.

2. Submit a Draft Audit Report for Government review.

3. Participate in review meetings and address Government comments.

4. Submit a Final Audit Report incorporating accepted Government comments.

5. Deliver an executive-level briefing that summarizes:

· Audit scope and methodology;

· Key findings and risk areas;

· Identified strengths and best practices;

· Recommended corrective actions;

· Remediation priorities and next steps.

6. Provide final supporting materials, including inventories, workpapers, data-collection instruments, and audit documentation, in formats approved by the COR.

6. Deliverables

Unless otherwise directed, deliverables shall be provided electronically in accessible Microsoft Office formats and PDF format. The Contractor shall submit all deliverables to the COR or designated Government repository.

7. Performance Management and Reporting

7.1 Status Reporting

The Contractor shall provide a written status report monthly, or more frequently if directed by the COR. Each report shall include:

· Work completed during the reporting period;

· Progress against the approved schedule;

· Upcoming activities and deliverables;

· Risks, issues, and mitigation actions;

· Decisions or Government support required;

· Changes to assumptions, dependencies, or scope;

· Summary of stakeholder engagements; and

· Updated project schedule, if applicable.

7.2 Performance Standards

8. Key Personnel The Contractor shall provide qualified personnel with experience relevant to the scope of this PWS. The Contractor shall propose appropriate staffing, which may include the following key roles:

The Contractor shall notify the COR and Contracting Officer in writing of any proposed replacement of key personnel. Replacement personnel shall possess qualifications equal to or greater than those of the individual being replaced and shall be subject to Government approval where required.

9. Government-Furnished Information and Support The Government anticipates providing, as applicable and subject to approved access and handling requirements:

1. Relevant OHC policies, procedures, records schedules, and records-management guidance.

2. A list of known OHC systems, repositories, record custodians, and stakeholder points of contact.

3. Existing records inventories, audit reports, assessments, corrective-action plans, and related documentation.

4. Reasonable access to authorized OHC personnel, systems, records, and physical locations within the approved scope.

5. Timely review and feedback on deliverables.

6. Identification of any records subject to special handling requirements, preservation requirements, or access restrictions.

The Government is not responsible for providing access to systems, records, or locations outside the approved scope or where access would violate applicable law, policy, security requirements, or individual-rights protections.

10. Security, Privacy, and Information Handling

1. Contractor personnel shall comply with all applicable Government security, privacy, records-management, and information-handling requirements.

2. The Contractor shall access only the records, systems, facilities, and information necessary to perform this PWS and expressly authorized by the Government.

3. The Contractor shall use the principle of least privilege and minimize the collection, copying, retention, and transmission of sensitive information.

4. The Contractor shall not use Government information for any purpose outside the performance of this contract.

5. The Contractor shall not store Government records or derived audit data on unapproved systems, devices, media, or cloud services.

6. The Contractor shall immediately report suspected loss, unauthorized disclosure, inappropriate access, or compromise of Government information in accordance with Government-provided incident-reporting procedures.

7. At the conclusion of the contract, the Contractor shall return all Government-furnished information and deliver all contract-created materials to the Government. The Contractor shall certify the destruction of any remaining Government information, if destruction is authorized and directed by the Government.

8. The Contractor shall comply with all suitability, credentialing, access, nondisclosure, and training requirements before receiving access to Government facilities, systems, or records.

11. Place and Hours of Performance Work may be performed at Government facilities, contractor facilities, and approved remote locations, as authorized by the Contracting Officer or COR.

The Contractor shall coordinate all on-site activities in advance with the COR and comply with applicable facility-access and visitor procedures. Work requiring access to sensitive records or systems shall be performed only in Government-approved locations and through approved methods.

Core business hours are anticipated to be 9am-3pm ET, Monday through Friday, excluding Federal holidays, unless otherwise approved by the COR.

12. Travel Travel is not anticipated unless specifically authorized in writing by the Contracting Officer. If travel is authorized, the Contractor shall identify anticipated travel in its proposal and comply with applicable Federal travel requirements and contract terms.

13. Quality Assurance The Contractor shall maintain a quality-assurance process to ensure that all work products are accurate, complete, internally consistent, professionally prepared, and supported by documented evidence.

Before submitting deliverables to the Government, the Contractor shall conduct internal quality-control review. The Contractor shall correct errors, omissions, and deficiencies identified by the Government at no additional cost when those corrections are necessary to meet PWS requirements.

14. Acceptance of Deliverables The COR will review deliverables for completeness, quality, technical accuracy, and compliance with the PWS. The Government may:

· Accept the deliverable;

· Accept the deliverable with minor comments;

· Return the deliverable for revision; or

· Reject the deliverable if it does not meet PWS requirements.

The Contractor shall address Government comments and resubmit revised deliverables within [five to ten] business days, or within another timeframe approved by the COR.

Final acceptance authority resides with the Government in accordance with the terms of the resulting contract.

15. Assumptions and Constraints

1. The final audit scope, including records populations, systems, repositories, and physical locations, will be confirmed during project initiation.

2. The audit schedule may be affected by records volume, system availability, access approvals, stakeholder availability, and the condition or organization of existing records.

3. The Contractor shall identify and document audit limitations, unavailable information, or access constraints that could affect findings or conclusions.

4. The Contractor shall not destroy, alter, move, disposition, or otherwise modify Government records unless expressly authorized in writing by the Contracting Officer.

5. The Contractor shall not implement corrective actions under this PWS unless separately authorized by the Government. This PWS is limited to assessment, findings, recommendations, and planning support.

16. Optional Task: Corrective-Action Implementation Support At the Government’s discretion, the Contractor may be required to provide implementation support following completion of the audit. This optional task may include:

1. Developing detailed corrective-action plans.

2. Assisting OHC with records inventory updates and records-cleanup planning.

3. Developing or revising standard operating procedures.

4. Developing training materials and conducting records-management training.

5. Establishing performance measures and dashboards.

6. Supporting validation of completed corrective actions.

7. Providing periodic progress reports to OHC leadership.

Any optional work shall be authorized in writing by the Contracting Officer before performance begins.