OCFO RMC Internal Controls_RFI.pdf

Federal Emergency Management Agency (FEMA) OCFO Financial Management Division

Internal Controls and Compliance Support Services Request for Information (RFI)

September 9, 2026

REQUEST FOR INFORMATION (RFI) SUMMARY: The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Office of the Chief Financial Officer (OCFO) Financial Management Division, Risk Management and Compliance (RMC) Branch is conducting market research to identify contractors capable of providing internal control, compliance, risk management, flood insurance controls, IT control testing, and financial management support services. Support services are anticipated for the following functional areas:

• OMB Circular A-123 Business Process Internal Control Support

• A-123 IT General Control and Application Control Testing Support

• Flood Insurance Controls and Compliance Support

• General Financial Management and Compliance Support

Note: This requirement is focused on evaluating, documenting, testing, monitoring, and reporting on internal controls and compliance activities to identify risks, deficiencies, control gaps, and compliance issues. Corrective action implementation, remediation execution, and closure support for identified deficiencies are outside the primary scope of this requirement and may be addressed through a separate Corrective Action and Audit Remediation Support Services requirement.

GENERAL INFORMATION: This RFI is issued solely for information gathering purposes to identify sources capable of supporting FEMA OCFO RMC. This support will supplement Federal resources with technical expertise to fulfill responsibilities associated with internal control assessment, documentation, risk management, deficiency evaluation and general support services applicable to federal internal control and financial management requirements in alignment with OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, and Federal Managers’ Financial Integrity Act requirements.

In accordance with FAR 15.201(e), RFIs may be used when the Government wants to obtain price, delivery, other market information, and capabilities for planning purposes. Responses to these RFIs are not offers and cannot be accepted by the Government to form a binding contract. This RFI shall not be construed as a commitment by the Government for any purpose, nor does it restrict the Government to an ultimate acquisition approach. Respondents are solely responsible for all expenses associated with their RFI response. Respondents will not receive additional information in response to their submittal to the RFI and will not be notified of the resulting market research.

PROPRIETARY INFORMATION AND DISCLAIMERS: Respondents shall identify any proprietary information in its RFI response. Information submitted in response to this RFI will be used at the discretion of the Government. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts. FEMA reserves the right to utilize any non-proprietary technical information in the anticipated PWS or solicitation.

Although it is not necessary to address in their response, respondents shall be aware of any potential, actual, or perceived organizational conflicts of interests. Any real or potential conflicts must be sufficiently mitigated prior to a contract award. For further guidance, refer to the Federal Acquisition Regulation, Part 9.5.

NAICS CODE: 541211

Internal Controls and Compliance Support Services Request for Information (RFI)

September 9, 2026

PRODUCT SERVICE CODE (PSC): B547

ANTICIPATED PERIOD OF PERFORMANCE START DATE: January 2027

ANTICIPATED ACQUISITION STRATEGY: To be determined

ATTACHMENT: Statement of Objectives

RFI RESPONSE SUBMITTAL INSTRUCTIONS:

Interested contractors shall submit their RFI responses electronically to Janine Bennett, Contracting Officer, at janine.bennett@fema.dhs.gov and Matthew Dusing, Contracting Officer Representative, at matthew.dusing@fema.dhs.gov no later than 3:00PM Eastern Standard Time (EST), September 30, 2026. Questions regarding this RFI are due no later than 3:00PM Eastern Standard Time (EST), September 23, 2026.

“RFI Response for FEMA OCFO Internal Control and Compliance Support Services” shall be in the subject line of your e-mail. All responses shall be unclassified, with proprietary information clearly marked. The document format shall be either Microsoft Word (.doc or .docx), or Adobe Acrobat (.pdf) formats. Pages shall be 8.5 by 11 inch and shall use a type pitch that is no smaller than a standard 11-point font type, with the exception of charts, graphs, or tables, which shall use a pitch not smaller than 10-point font. Responses shall include a cover page, a contractor capability statement, and responses to the RFI questions. The cover page is excluded from the page limitation. The contractor capability statement shall not exceed one page. Responses to the required RFI questions shall not exceed 10 pages. Responses to the optional contract strategy questions are excluded from the 10-page limitation, but respondents are encouraged to provide concise responses. Do not include promotional materials.

RFI Responses shall include the following information in the order below:

A. Cover Page with the following information:

1. Company Name

2. Company Address

3. UEI Number

4. Company Point of Contact - Name, Title, Phone, and Email address

5. Statement of current business size status (i.e., HUBZone small business concern, service-disabled veteran-owned small business firm, 8(a) contractor, woman-owned small business, small business, or large business concern). Also, business size in relation to the NAICS code size standards assigned to this acquisition.

6. GSA Schedule Number, Contract Number, and Period of Performance and/or DHS Strategic Sourcing Vehicle Category Name and Contract Number, if applicable

Internal Controls and Compliance Support Services Request for Information (RFI)

September 9, 2026

B. Contractor Capability Statement - No more than one page in length and included in the (10) page limit.

1. Summarization of relevant projects and experience showing capabilities.

2. Past performance in applicable areas

C. Contractor RFI Responses to questions (No more than 10 pages in length).

The responses received will assist FEMA with identifying the number and nature of the entities that consider themselves potential technical solution providers. Each respondent, by submitting a response, agrees that any cost incurred in response to this RFI, or in support of activities associated with this RFI, shall be the sole responsibility of the respondent. FEMA shall incur no obligations or liabilities whatsoever, to anyone, for any costs or expenses incurred by the respondent in responding to this RFI.

REQUEST FOR INFORMATION (RFI) QUESTIONS

1. OMB Circular A-123 Business Process Internal Control Support What experience does your organization have supporting OMB Circular A-123 business process internal control activities for federal agencies or similarly complex organizations? Please describe your experience with risk assessment, process documentation, control identification, control design assessment, operating effectiveness testing, routine monitoring, deficiency identification, and internal control reporting.

2. A-123 IT General Control and Application Control Testing Support What experience does your organization have supporting A-123 IT general control and application control testing? Please describe your experience with planning and scoping ITGC assessments, control documentation, evidence review, test of design, test of operating effectiveness, system-generated reports, interface controls, issue identification, risk assessment, system-level reporting, FISCAM, NIST guidance, and coordination with system owners, information system security personnel, and business process owners.

3. Flood Insurance Controls and Compliance Support What experience does your organization have supporting internal control and compliance activities related to flood insurance or comparable high-volume insurance, claims, risk, or financial reporting programs? Please describe your experience assessing, documenting, testing, monitoring, and reporting on flood insurance-related controls, data, financial reporting processes, service provider monitoring considerations, fraud risk assessment support, and compliance risks.

4. General Financial Management and Compliance Support What experience does your organization have supporting financial management analysis, data integrity assessment, compliance-related reporting, risk analysis, financial reporting support, payment integrity, or other financial management compliance activities? Please describe the scope, scale, transaction volume, complexity, stakeholders supported, and outcomes of comparable work.

Internal Controls and Compliance Support Services Request for Information (RFI)

September 9, 2026

5. Risk Identification, Reporting, and Management Insight

How would your organization identify and communicate risks, control gaps, compliance issues, recurring trends, data concerns, and areas requiring management attention? Please describe your approach to producing clear, concise, supportable, and actionable documentation, reports, briefings, dashboards, or other management insight products.

6. Comparable Mission Experience Within the past three years, what experience has your organization had supporting internal control assessment, compliance monitoring, control testing, IT control testing, flood insurance controls, financial management compliance, or similar requirements for federal agencies or comparable organizations? Please describe the scope, scale, volume, complexity, stakeholders supported, and outcomes of the work performed, including the relevance of that experience to FEMA OCFO’s anticipated requirement.

7. Capacity, Partnerships, and Objectivity Considerations Does your company have the internal capacity and qualified personnel to perform the full range of anticipated internal control and compliance support services? If partnership with another entity would be required, please describe the proposed structure and the functional areas each entity would support.

Please also describe how your organization would identify, avoid, or mitigate potential overlap, independence concerns, or organizational conflicts of interest related to assessment, testing, remediation, and validation activities.

8. Leading Practices, Tools, and Innovation How would your company identify and apply leading practices, tools, data analytics, automation, or innovative approaches to improve internal control assessment, control testing, compliance monitoring, risk identification, documentation quality, reporting, stakeholder coordination, and knowledge transfer while adhering to applicable DHS and FEMA policies?

OPTIONAL Contract Strategy Questions: Responses to the following questions are optional and are requested solely for market research and acquisition planning purposes. Responses to these questions are excluded from the five-page response limitation.

a) Performance Metrics Based on the draft Statement of Objectives, what performance metrics or service quality measures would you recommend the Government consider to assess successful delivery of services?

b) Staffing Approach Based on the draft Statement of Objectives, what estimated number of full-time equivalent technical staff would be appropriate to support the anticipated requirement? Please identify approximate labor categories, skill sets, and any key assumptions affecting staffing levels.

c) Requirement Structure Does your organization recommend structuring this requirement by functional area, such as OMB Circular A-123 business process internal control support, A-123 IT general control and application control testing support, flood insurance controls and compliance support, and general financial management and compliance support, or as an integrated internal control and compliance support contract? Please explain your recommendation, including any implications for objectivity, quality control, staffing, or contract management.