P02 - PWS - 11-15-19 FINAL FINAL.docx

OFFICE OF INSPECTOR GENERAL (OIG)

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT (HUD)

OFFICE OF AUDIT (OA)

GOVERNMENT NATIONAL MORTGAGE ASSOCIATION (GINNIE MAE)

FINANCIAL STATEMENT AUDIT SUPPORT

PERFORMANCE WORK STATEMENT (PWS)

1.0 GENERAL.

1.1 BACKGROUND.

The Office of the Inspector General at U.S. Department of Housing and Urban Development (HUD OIG) is an independent government entity established to prevent waste, fraud and abuse within HUD and its programs.

A large part of HUD OIG’s financial management oversight role is compliance with the Chief Financial Officers Act of 1990 (CFO Act). HUD OIG conducts an annual financial statements audit of HUD and its component entities, including Government National Mortgage Association (Ginnie Mae) as the principal auditor. By law, HUD OIG is required to issue its independent auditor’s report by mid-November of each year.

1.2 SCOPE.

The objective of this contract is to obtain the services of an independent public accounting firm (IPA) to complete an Audit of the Ginnie Mae’s financial statements for the fiscal year 2020( comparative statements, if applicable) and upon exercise of three (3) subsequent option periods beginning with fiscal year 2021, in accordance with the CFO Act of 1990, as amended.

The CFO Act requires that the Inspector General, or independent external auditor as determined by the Inspector General, to conduct an annual audit of Department of Housing and Urban Development (DHUD) financial statements. Ginnie Mae's financial statements are a major component of Department of HUD’s consolidated financial statements. This audit must be conducted in accordance with the most recent version of the following standards:

· Generally accepted government auditing standards (GAGAS) or yellow book; issued by the Comptroller General of the United States;

· Generally accepted auditing standards (GAAS) as established by the American Institute of Certified Public Accountants (AICPA) and promulgated in its Statements on Auditing Standards (SAS);

· Financial Audit Manual (FAM) issue by Government Accountability Office (GAO);

· GAO’s Federal Information System Controls Audit Manual (FISCAM);

· National Institute of Standards and Technology (NIST) standards and guidelines;

· OMB Bulletin 19-03, as amended, Audit Requirements for Federal Financial Statements, and other related amendments and memorandum issued by OMB;

· OMB Circular A-136, Financial Reporting Requirements.

1.3 CONTRACTOR PERSONNEL.

1.3.1 CENTRAL POINT OF CONTACT. The Contractor shall provide a Central Point of Contact (CPOC) who shall be the primary point of coordination, and shall be able to serve as a point of communication and coordination between the Government and the Contractor in general. The CPOC shall be reachable during normal business hours. The CPOC may be a designated as an additional role to any senior contractor staff utilized under this action.

1.3.2 PROJECT/PROGRAM MANAGER/TEAM LEAD(S). The Contractor shall provide a Project/Program Manager/Team Lead or equivalent (PME)) who shall be responsible for all Contractor work performed under this action. The role of PME status may be assigned to any individual supporting this action who is a Certified Public Accountant and designated by the Contractor as having the authority to obligate the Contractor.

1.3.2.1 The PME shall be a single point of contact for the Contracting Officer and the COR for the contract, and is designated as KEY. The PME shall be responsible for all deliverables, staffing, and actions under this requirement. The name of the PME, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the PME, shall be provided to the Government. During any absence of the PME, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under the contract. The PME and all designated alternates shall be able to read, write, speak and understand English.

1.3.2.2 The PME shall be available to the COR via telephone during normal business hours.

1.3.3 QUALIFIED PERSONNEL. The Contractor shall provide qualified personnel to perform all requirements specified in this PWS. Personnel proposed shall be in accordance with the labor mix and approach described by the contractor’s proposal. Resumes describing the qualifications of the Contractor’s key personnel will be submitted to the COR on an ongoing basis as new personnel are assigned to this audit. Sufficient information must be provided to justify the qualifications/experience of the personnel assigned to this contract. Once a Contractor’s proposal is accepted, any changes to the Contractor’s key personnel and labor mix (i.e. quantity and quality or personnel assigned) will have to be approved in writing by the Contracting Officer (CO). HUD OIG anticipates KEY personnel as those categories designated in ‘ATTACHMENT #3 – Labor Categories’.

1.3.4 PERSONNEL QUALIFICATIONS AND CREDENTIALS

The Contractor staff must use qualified personnel to perform the financial statements audit, including the evaluation of information systems that support financial reporting. Qualified specialists must be available to assist with the audit as needed, such as specialists in information technology, statistics, and actuarial estimates. HUD OIG anticipates, but does not guarantee, the labor categories (or similar equivalents meeting appropriate minimum standards) contained in ‘ATTACHMENT #3 – Labor Categories’ will be required under this action.

1.3.5 EMPLOYEE CONDUCT. Contractor employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of military uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States and the Housing and Urban Development Office of Inspector General.

1.3.6 REMOVING EMPLOYEES FOR MISCONDUCT OR SECURITY REASONS. The Government may, at its sole discretion, direct the Contractor to remove any Contractor employee from HUD OIG facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under this agreement. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

1.4 KICK OFF MEETING

The contractor shall be available for a Contract Kick Off meeting within 10 Business Days of the date of award at 451 7th Street, Washington DC, 20410, unless other arrangements are made. All contractors must have a valid ID for security clearance into the building.

1.5 PERIOD OF PERFORMANCE.

12 months from date of award, with four (4) one (1) year options for additional audits. This action will consist specifically of:

· A Base Requirement for a Single Audit

· Four (4) Optional Audits

· Four (4) one (1) year performance extensions to allow for exercise of optional audits

· The ability to extend the period of performance under 52.217-8.

1.6 PLACE OF PERFORMANCE.

The primary place of work shall be the contractor’s facilities. HUD OIG will provide conference space/work space at secondary worksites, to include HUD OIG HQ in Washington DC and other offices located CONUS as necessary.

1.6.1 TRAVEL

The Contractor may be required to travel to conduct fieldwork at the contractor and/or subcontractor’s location, unless otherwise specified. Travel shall be approved in advance by the COR or Contracting Officer. Travel is subject to the Federal Travel Regulations.

The primary travel locations outside of the Washington, D.C. area where fieldwork may be required could include the following: New York, NY; Anaheim, CA; Houston, TX; Andover, MA; and Minneapolis, MN.

1.7 SPECIAL SECURITY AND INFORMATION CONTROL REQUIREMENTS

In addition to any security requirements contained in the Terms and Conditions, the contractor shall adhere to the following:

1.7.1 Information Security and Confidentiality -

The Contractor must comply with all laws, regulations, federal guidelines and internal HUD/Ginnie Mae policies regarding the handling, storage, and safeguarding of Ginnie Mae information, including Ginnie Mae information stored on Contractor’s computers.

1.7.2 Confidentiality Agreements

The Contractor and its employee performing the work under this order must be required to submit a non-disclosure/confidentiality agreement (Attachment D or equivalent).

1.7.3 Records Management

The Contractor shall have a plan for the protection of all electronic records, and any paper records, field notes, or other documents that contain sensitive or personally identifiable information. The Contractor must ensure that all of its employees, subcontractors (at all tiers), and employees of all subcontractor(s), who perform work under this contract/subcontract, are trained on data privacy issues and comply with the above requirements. The Contractor must submit a written plan and assurance for complying with the above requirements at least annually.

1.7.3 Restriction on Opinion Disclosures

Opinions are not to be discussed with any Ginnie Mae personnel without prior approval and presence of the Contracting Officer’s Representative (COR) and task monitor. Any "potential opinion issues" are not to be discussed with any Ginnie Mae personnel without the presence of the task monitor. (Use the following statements only if you feel it is necessary. These statements were added at one agency because components were releasing information to the public prior to the final issuance of the reports.) The opinion to be issued as a result of the audit will be discussed only at the exit conference. All contractor reports (both draft and final reports) shall be submitted only to the OIG. The OIG will redact any necessary sections before submitting the reports to Ginnie Mae for review.

2.0 GOVERNMENT TERMS & DEFINITIONS.

3.0 GOVERNMENT FURNISHED RESOURCES.

The government shall furnish necessary access to employees, facilities, and information systems as necessary for the contractor to complete the required work. For access to certain information the Contractor will be required to sign a Non-Disclosure Agreement.

4.0 CONTRACTOR FURNISHED PROPERTY.

The contractor shall furnish all resources necessary to complete the requirements, excluding those items specified in 3.0.

5.0 REQUIREMENTS.

As applicable, all requirements shall utilize ‘Attachment #4 – Ginnie Mae Background Information’.

The Contractor must conduct the fiscal year 2020 comparative financial statements, if applicable, audit in accordance with auditing standards generally accepted in the United States, as established by AICPA. The Contractor must provide the necessary qualified personnel, materials, and, if requested by the COR/ACOR, travel to conduct a financial audit for the purpose of expressing an opinion on the fairness of the presentation of Ginnie Mae's financial statements in accordance with the GAO auditing standards (referred to as the "Yellow Book") as interpreted by the FAM and FISCAM/NIST standards and guidelines and the AICPA standards related to a commercial entity.

With regards to Audit Documentation, Access to Audit Documentation, and Security of Audit Documentation, the Contractor shall prepare complete and accurate audit documentation in sufficient detail to provide a clear understanding of the work performed, evidence obtained, and its source, and to support conclusions reached. The financial statement audit documentation must be prepared in accordance with the documentation requirements included in the GAO/CIGIE FAM and AICPA standards. The Contractor shall also consult the GAO/CIGIE FAM and AICPA standards for specific audit documentation requirements. At a minimum, audit documentation should include a summary memo documenting the conclusions reached on each significant control cycle, account balance, phase of the audit, audit adjustments, and on the overall audit. The Contractor shall also ensure that the audit documentation contains the Financial Statement Audit Completion Checklist from FAM 1003.

The Contractor must obtain sufficient appropriate evidence in order to attest the account balances either in existence on the close of the fiscal year or for the transactions during the fiscal year and related prior year comparatives.

The audit services to be performed will include an audit of Ginnie Mae's Annual commercial GAAP basis Financial Statements for fiscal year 2020, comparative statements, if applicable, and subsequent option years, as awarded. Ginnie Mae's fiscal year covers the period from October 1 through September 30 of the following year. The auditor's opinion on the financial statements is to cover Ginnie Mae's Principal Statements including the Notes to the Principal Statements. The audit will be performed in accordance with the AICPA and Government Auditing Standards, and will cover the following additional requirements of OMB Bulletin No. 19-03, as amended, or its successor (which go beyond Government Auditing Standards for financial audits) which is to determine whether the reporting entity has an internal control structure that provides reasonable assurance of achieving the following internal control objectives:

· Transactions are properly recorded and accounted for to permit the preparation of reliable financial statements and to maintain accountability over assets;

· Funds, property and other assets are safeguarded against loss from unauthorized use or disposition; and

· Transactions, including those related to obligations and costs, are executed in compliance with: (a) laws and regulations that could have a direct and material effect on the Statements and (b) any other laws and regulations that OMB, Ginnie Mae management, or the IG has identified as being significant for which compliance can be objectively measured and evaluated;

· Management Discussion and Analysis (MD&A), Required Supplementary Information (RSI). Required Supplementary Stewardship Information (RSSI) and other information, In addition to the audit of the financial statements, the Contractor must:

· Read the MD&A, RSI, RSSI, and other information and consider whether it, or the manner of its presentation, is materially inconsistent with the auditors’ understanding of the facts or with information appearing in the financial statements.

· When requested, perform an attestation engagement with respect to MD&A, RSI, RSSI, and other information.

· With respect to internal control, the Contractor shall obtain an understanding of the components of internal control and assess the level of control risk relevant to the assertions embodied in the classes of transactions, account balances, and disclosure components of the financial statements. The Contractor shall also obtain an understanding of the components of internal control relating to the existence and completeness assertions relevant to the performance measures included in MD&A.

· With respect to MD&A, the Contractor shall assess whether the information and manner of its presentation in the MD&A of the Reporting Entity is materially consistent with the information in the principal statements. In performing this assessment, the Contractor shall consider this required supplementary information and shall follow the guidelines presented in the American Institute of Certified Public Accountants’ (AICPA) AU-C Sections 725 and 730, Codification of Statements on Auditing Standards. In addition, the Contractor shall obtain an understanding of the design of internal controls relating to the existence and completeness assertions over performance measures and determine whether they have been placed in operation, as required by OMB Bulletin 19-03, as amended, or the most current OMB audit guidance.

· With respect to Required Supplementary Stewardship Information (RSSI) and Required Supplementary Information (RSI), the Contractor shall assess whether the information and its presentation is materially consistent with the information in the principal statements. In performing this assessment, the contractor shall follow the guidelines presented in the AICPA’s AU-C Sections 725 and 730, Codification of Statements on Auditing Standards.

· With respect to Other Accompanying Information, the Contractor shall assess whether the information and its presentation is materially consistent with the information in the principal statements. In performing this assessment, the Contractor shall follow the guidelines presented in AICPA’s AU-C 720 Other Information in Documents Containing Audited Financial Statements, Codification of Statements on Auditing Standards.

5.1 GINNIE MAE FINANCIAL STATEMENT AUDIT (FISCAL YEAR 2020)

The Contractor must conduct an audit of Ginnie Mae’s financial statements, in comparative format for the fiscal year 2020 and fiscal year comparative statements, if applicable, (and option year periods if exercised). Additionally, the Contractor must also conduct an assessment of the automated systems for the general controls and major application controls in support of the financial statements audit. The assessments related to Ginnie Mae’s compliance with Federal Financial Management Improvement Act of 1996 (FFMIA), the Federal Managers’ Financial Integrity Act (FMFIA), and Federal Information System Management Act (FISMA) requirements will be performed by the HUDOIG and will not be part of this contract, but this shall not preclude the Contractor from reporting to the OIG consolidated audit team any FFMIA, FMFIA, or FISMA related issues identified during the audit.

· In accordance with the Government Corporation Act and 0MB Bulletin 19-03 perform a financial audit of Ginnie Mae’s 2020 comparative financial statements, if applicable, in accordance with AICPA Standards Government Auditing Standards. The audit will be performed in accordance with AICPA standards: “Government Auditing Standards” issued by the Comptroller General of the United States, as contained in the “Yellow Book”, This contract does not require any expanded review of performance data beyond that which is required under GAO and AICPA standards. To the extent identified, the contractor will prepare a report on internal control, including all material weaknesses and significant deficiencies.

· At a minimum, the Contractor, working with Ginnie Mae and HUD, must identify and assess the information technology (IT) general and application controls of major information systems and feeder systems. The evaluation of IT systems must be performed in accordance with the GAO Federal Information System Controls Audit Manual (FISCAM). Work will be performed according to the most current issuances of GAS and OMB policy and applicable guidance from the National Institute of Standards and Technology (NIST). The Contractor must also consider the user controls detailed in the applicable service agency’s Service Organization Control Report (SOC 1) during its IT and internal control testing. The Contractor must review and test the user controls discussed in applicable SOC 1 reports to the extent considered necessary to support the Contractor’s opinion on the financial statement.

· Perform an assessment as to whether Ginnie Mae is compliant with the FFMIA. Specific guidance is provided by OMB and the FFMIA Act.

Although the reporting due date is November 15th of each year, it is OIG’s intention to submit the audit reports on or before November 7th.

If requested, additional audit, information assurance, or management advisory services to be provided may include: special supplemental analyses of prior and/or current year account balances; financial management controls, including automated systems process controls; or review of implemented accounting policies and other issues related to the annual Ginnie Mae financial statements audit for the HUD Inspector General's use in transmitting the audited Ginnie Mae financial statements to the Secretary, OMB, Congress and other users.

5.1.1 DELIVERABLES IN SUPPORT OF 5.1

In carrying out these tasks, OIG anticipates a collaborative effort between OIG and the Contractor as both the Contractor and OIG strive to ensure standards are met and audit findings are communicated in the most effective manner. OIG will review the deliverables and the Contractor will incorporate OIG’s comments into the final work products, including NFR’s and reports and resubmit them to OIG for final review prior to releasing it. If unable to do so, the Contractor shall discuss the matter with the COR/ACOR and provide justification for its decision. See Section 8.0, deliverables, for due dates, acceptable quality standard, etc. Deliverables are to be received on or before 3:00 p.m. EST on the due date. If the due date falls on a weekend or holiday, it will be due next business day.

5.1.1.1 DELIVERABLE 1-1, PRE-AUDIT CONFERENCE PREPARATION

The Contractor must provide the on-boarding package to the COR/ACOR before allowing Contractor personnel to work on this audit. Subject to the discretion of the COR/ACOR, the on-boarding package will include, at a minimum the project management plan, staffing plan, resumes of key staff (i.e. audit senior and senior specialist and above, see Section 1.3, Contractor Personnel), key staff and firm independence statements, staff security clearance, most recent Peer Review Report, as well as CPE certifications. As the Contractor adds staff (at any level), or promotes staff, a resume must be submitted to the COR/ACOR for approval. See Section 1.3 for specific requirement regarding replacement or changes to key personnel.

5.1.1.2 DELIVERABLE 1-2, ENTRANCE CONFERENCE

The Contractor must hold the entrance conference meeting with the appropriate Ginnie Mae management officials prior to the start of the fieldwork. The purpose of the entrance conference is to (1) inform management of the audit objectives, scope, and methodology; (2) describe the auditor’s and management’s responsibilities, as well as, prior year report findings, current year timeline, and auditor staffing; (3) establish points of contact (audit liaison) for the audit, and (4) coordinate administrative matters. The entrance conference PowerPoint presentation and agenda shall describe the overall audit strategy and schedules. The presentation is due to OIG for review two business days before the scheduled meeting. Copies of the Minutes as well as official sign-in sheet are to be kept in the Contractor’s workpapers to document significant discussions.

5.1.1.3 DELIVERABLE 1-3, ENGAGEMENT LETTER

The Contractor must prepare an engagement letter addressed separately to OIG and those charged with governance that communicates among other things its responsibilities in the financial statement audit as well as their responsibilities for testing and reporting on compliance with laws and regulations, and internal controls over financial reporting. The Engagement Letter must comply with the requirements and format specified by the GAO and described in the FAM and AICPA Auditing Standards. Further, the letter shall cover any additional testing of compliance and internal controls required by laws and regulations or otherwise requested.

5.1.1.4 DELIVERABLE 1-4, FOLLOW-UP OF PRIOR YEAR’S AUDIT FINDINGS AND EVALUATION OF MANAGEMENT’S CORRECTIVE ACTION PLAN To adequately plan the current year’s audit, the Contractor must report to OIG the status (i.e. what has been done or implemented since last audit) of the prior year’s audit findings (i.e. material weaknesses, significant deficiencies and management letter comments) as part of the audit planning and internal control phases but before testing. Additionally, the Contractor must evaluate current year’s proposed management corrective action plan and recommend to OIG whether or not to accept the current year’s proposed management corrective action plan. Final audit follow-up may be required at year-end to test implementation of the corrective action plan.

5.1.1.5 DELIVERABLE 1-5, DRAFT FINANCIAL AUDIT STRATEGIC AUDIT PLAN

The Contractor must submit detailed audit planning documents that conform with Auditing standards promulgated by the Auditing Standards Board of the AICPA or are equivalent to the requirements of the FAM and subsequent revisions and workpaper documentation in section 5.5. At a minimum, the draft SAP shall include: (a) Entity profile; (b) Overall Audit Strategy (or General Risk Analysis); (c) Cycle Matrix; (d) LIRA; (e) SCE; (f) Cycle Memo(s); (g) Sampling Plans, (h) Audit Programs, (i) audit milestone (if not already included in GRA) which is in agreement with the HUD CFO and Ginnie Mae timelines, (j) annual audit staff hours planned for the major audit phases and the distribution by each staff classification (see attachment F for example).

Where the Contractor’s planning documents and/or methodology differ in format with the Auditing standards promulgated by the Auditing Standards Board of the AICPA or FAM, a cross-walk from the Contractor’s documents/methodology to Auditing standards promulgated by the Auditing Standards Board of AICPA or FAM must be submitted to and approved by the OIG. Unless specifically agreed to in writing by the COR, the financial audit planning documents shall include audit procedures that the Auditing standards promulgated by the Auditing Standards Board of the AICPA or FAM and subsequent revisions state “must,” “should,” or “generally should” be performed.

Ginnie Mae relies heavily on the work performed by its contractors in the conduct of its day to day operations. To the extent that work of independent third parties can be relied upon, the Contractor shall develop an audit strategy taking into account an analysis of the evaluation of audit risks associated with the control activities performed by Ginnie Mae alone and the control activities performed by its contractors on Ginnie Mae’s behalf (typically in scope as part of SSAE 18 SOC 1, Contract Assessment Review, etc.) in planning and scoping the audit for audit efficiency. At a minimum, the analysis described above, and the planning documents must demonstrate that the Contractor

a. Understands Ginnie Mae Mortgage Backed Securities (MBS) Guide and program requirements;

b. Understands the loan life cycle (e.g., modifications, claims processing, foreclosure);

c. Understands mortgage servicing operations, including use of service organization;

d. Understands the role of insurers/guarantors i.e., Federal Housing Administration (”FHA”) or guaranteed by the U.S. Department of Veterans Affairs (“VA”). Other guarantors or Issuers of loans eligible as collateral for Ginnie Mae MBS including the U.S. Department of Agriculture (“RD”) and the Office of Public and Indian Housing (“PIH”);

e. Performed preliminary analytical procedures;

f. Determined planning, design materiality and tolerable misstatement (test materiality);

g. Identified significant line items, accounts, assertions, and required supplementary information;

h. Identified significant cycles, accounting applications, and financial management systems;

i. Identified significant provisions of laws and regulations;

j. Identified relevant budget restrictions;

k. Identified and assessed risk factors including fraud risk;

l. Determined likelihood of effective system information system controls;

m. Identified relevant operations controls, including information system controls, to evaluate and test;

n. Developed an audit sampling plan, including site selections and sample sizes;

o. Planned other audit procedures;

p. Considered locations to visit;

q. Complied with GAO FAM and AICPA Auditing Standards documentation requirements;

r. Obtained an understanding of Information Systems used by Ginnie Mae and its contractors;

s. Identified control objectives;

t. Identified and obtained an understanding of relevant control activities;

u. Determined the nature, timing, and extent of control tests;

v. Performed nonsampling control tests;

w. Assessed controls on a preliminary basis; and

x. Reviewed Ginnie Mae models and model governance.

The above documents must provide equivalent content as specified in the FAM. At a minimum, the audit program (i.e. test of control and substantive test) must include the audit objectives and audit procedures planned to accomplish the objectives. The audit program shall be mapped to the appropriate account line item(s) and financial statement assertions that are under review.

Restatement Considerations:

Contractor must detail specific audit plan to test restated opening and other relevant periods’ financial statement balances and amounts, including investment of U.S government at beginning of period (i.e., opening “retained earnings” balance)

5.1.1.6 DELIVERABLE, DRAFT IT STRATEGIC AUDIT PLAN

The Contractor must develop and submit to OIG for review and approval detailed IT audit planning documents that conform to the requirements and methodology of the Federal Information System Control Audit Manual (FISCAM) and any subsequent revisions, as well as the workpaper documentation requirements in section 5.5. The steps in FISCAM l shall be performed in coordination with the related steps in the FAM as noted in deliverable 5 above. At a minimum, the IT Audit Plan must include related FISCAM steps for audit planning (e.g. IT risk assessments), internal control testing (general and application system controls) and reporting the results of the IT controls audit as described in FISCAM Appendix VI and subsequent revisions. Unless specifically agreed to in writing by the COR, the draft IT SAP shall include audit procedures that the FISCAM and subsequent revisions state “must,” “should,” or “generally should” be performed.

The IT planning documents described above must provide equivalent content as specified in FISCAM. Where the Contractor’s planning documents and/or methodology differ in format with the FISCAM, a cross-walk from the Contractor’s documents/methodology to FISCAM must be submitted to and approved by the COR/ACOR.

a. IT Planning - Ginnie Mae relies heavily on the work performed by its contractors in the conduct of its day to day operations, To the extent that control test work performed by independent third parties can be relied upon, the Contractor shall develop an audit strategy taking into account an analysis of the evaluation of audit risks associated with the IT control activities performed by Ginnie Mae alone and the IT control activities performed by its contractors on Ginnie Mae’s behalf (typically in scope as part of SSAE 18s SOC 1 Report, Contract Assessment Review, etc.) in planning and scoping the audit for audit efficiency. At a minimum, the IT planning documents must demonstrate that the Contractor has:

· Obtained sufficient understanding of the end-to-end IT architecture process flow, business specification documents as it relates to the subledger database, NPAAR;

· Obtained a sufficient understanding of the overall audit objectives and related scope of the IT control audit;

· Obtained a sufficient understanding of the entity, its operations and key business processes;

· Identified key areas of audit interest (files, applications, systems, locations);

· Identified critical control points (for example, external access points to networks);

· Obtained preliminary understanding of IT controls;

· Obtained a general understanding of (a) Ginnie Mae’s and service organization’s computer structure and/or computer network schema (flowchart would be preferable); (b) Ginnie Mae IT personnel’s roles and responsibilities in managing Ginnie Mae and third-party owned computer systems; (c); the adequacy and appropriateness of the assigned roles and responsibilities and the level of oversight performed in monitoring the IT contracts;

· Obtained and reviewed the SSAE18 SOC 1 reports (prior years and current year if available) and NIST/FISCAM cross-walk analysis (Contractor to prepare the crosswalk analysis if not yet already available) for completeness and adequacy of audit scope, as well as, audit procedure testing plans, etc. Since the SSAE18 reports are prepared in support of Ginnie Mae’s financial statements audit, the Contractor is expected to work with Ginnie Mae’s contractors and its service auditors in the early audit planning phase to ensure that the current year’s SSAE18 SOC 1 report scope is sufficient to meet the needs of the user auditor; and

· Performed other audit planning procedures as needed.

b. IT Testing – In the testing phase, the Contractor must use the information obtained in the planning phase to test the effectiveness of the controls (i.e. general and application controls) that are relevant to the audit objectives. For the general control testing, the controls shall be tested at the entity, system, and application levels. The application controls shall be tested, as appropriate. Based on the information obtained above, the Contractor is expected to leverage some of the IT control testing performed by independent third parties to reduce the overall level of IT control testing, to the extent that Ginnie Mae contractor’s control test work can be relied upon. Consequently, it is OIG’s expectation of the Contractor to include in its testing plans those relevant IT controls where no audit coverage is provided. For example, the SSAE 18 SOC 1 reports typically provide limited or no audit coverage related to contingency planning (CP).

The draft plan shall identify the major information systems and either specifies a multi-year cycle review of such applications or how integrated reviews with the financial audit provide defined cyclic coverage of the major application systems reviewed. The plan shall include annual audit staff hours planned for the major audit phases and the distribution by each staff classification (see Attachment F for example).

The Contractor must coordinate with OIG’s Information Systems Audit Division (ISAD), through the COR/ACOR, any planned reviews or assessments of Ginnie Mae’s critical contracted or vendor operated application systems to prevent duplication of effort. Where appropriate, the Contractor must review and incorporate in its audit strategy any SSAE18 SOC 1 reports of service organizations whose systems are a critical part of Ginnie Mae’s system of internal controls.

5.1.1.7 DELIVERABLE, INTERIM AND FINAL LEGAL REPRESENTATION LETTERS

The Contractor must obtain the interim and final legal representation letters from Ginnie Mae’s authorized counsel in sufficient lead time for OIG to meet the HUD CFO Timeline. The form and content of the letters must conform to FAM, AICPA, and OMB requirements.

5.1.1.8 DELIVERABLE, COMPLETION OF INTERNAL CONTROL PHASE

Within 90 calendar days after award date or as agreed, the cycle memos and/or standard operating procedures, walkthroughs shall have been completed and documented in the workpapers (i.e completion of the internal control phase). At this point in the audit process, the Contractor must plan to provide the updated cycle memos (i.e. only if there are significant changes from the initial submission during the audit planning phase), updated LIRA’s and SCE’s to the COR/ACOR. Additionally, the Contractor must submit the results of control design testing which is typically documented in the SCE form.

5.1.1.9 DELIVERABLE, UPDATED/REVISED FINANCIAL AUDIT AND IT STRATEGIC AUDIT PLAN DOCUMENTS The Contractor must submit to OIG the same documents described in deliverable numbers 1-5 and 1-6 above but they shall contain the most up to date information or revisions made to those documents since the initial submission. Although OIG recognizes that the plan may change throughout the audit, the expectation upon submission of the final SAP, is for the Contractor to submit the SAP in final form by incorporating any OIG’s comments made to the draft IT and financial audit planning documents where appropriate as well as all the updates and/or significant changes made to the cycle memos and audit programs, materiality level adjustments, including the results of the control design evaluation but before testing the control effectiveness and substantive testing.

5.1.1.10 DELIVERABLE, COMPLETION OF IT TESTING WORK

The Contractor must submit to OIG for review the interim and final general and application control testing results in a report format. The report shall include, but is not limited to, the relevant IT general and application (as appropriate) controls tested, how these controls were tested (methodology), testing results, and the Contractor’s overall conclusion based on these results. The Contractor will work directly with OIG to agree on the form and content of the report.

5.1.1.11 DELIVERABLE, COMPLETION OF FINANCIAL AUDIT INTERNAL CONTROL TESTING

The Contractor must submit to OIG for review the results of the financial audit interim and final control effectiveness testing in a report format. The report shall include, but is not limited to, the relevant manual and/or automated controls (as described in the LIRA form) tested, how these controls were tested (i.e. methodology), testing results, and the Contractor’s overall conclusion based on these results. The Contractor will work directly with OIG to agree on the form and content of the report in sufficient lead time to meet the deliverable deadlines.

Special considerations for significant estimates (i.e., Guaranty Asset, Guaranty Obligation and Reserves for loss) as well as non-pooled assets:

Although, Contractor is not expected to perform an audit over internal control over financial reporting related to non-pooled assets, the following shall be considered:

a. Entity user control testing over the Ginnie Mae’s key processes to initiate, record, numbering process and report non-pooled assets

b. Information Technology general control testing over the Ginnie Mae’s key applications used to initiate, record, process and report non-pooled assets

5.1.1.12 DELIVERABLE, COMPLETION OF SUBSTANTIVE TESTING

The Contractor must submit to OIG for review the results of interim and final substantive testing in a report format. The report shall include, but not limited to, the sbstantive procedures performed for each significant line item (i.e. methodology), testing results, and the Contractor’s overall conclusion based on these results, The Contractor will work directly with OIG to agree on the form and content of the report in sufficient lead time to meet the deliverable deadlines.

As a special consideration to significant estimates (i.e., Guaranty Asset, Guaranty Obligation and Reserve for Loss) as well as non-pooled assets, substantive test procedures shall sufficiently document sampling methodology for risk areas, including related modeling changes due to restatement test plans and work shall document:

a. Testing of non-pooled assets to determine fair presentation of the financial statements Formatted: Not Highlight and disclosures in all material respects

b. Testing of non-pooled assets to determine whether SLDB processing and output is in compliance with business specification documents, which also reflect accounting policies.

5.1.1.13 DELIVERABLE, DRAFT AND FINAL MANAGEMENT REPRESENTATION LETTER

The Contractor must submit to COR/ACOR for review the draft management representation letter as well as the final signed management representation letter in sufficient lead time to meet the HUD CFO Timelines. The form and content of the management representation letter must conform to the FAM and/or AICPA Auditing Standards. The Contractor shall provide five (5) days prior to the anticipated end of fieldwork, a Summary of Unadjusted Differences (SUD) to the COR/task monitor and it should follow the format presented in the FAM. Additionally, the SUD shall be provided to component management for inclusion in the management representation letter as required by the most current audit OMB Bulletin.

A SUD is required to be prepared for GAO for purposes of satisfying the FR. The Contractor shall provide a SUD to the COR/task monitor that follows the format provided by GAO in accordance with the time prescribed by GAO in the annual audit communication letter.

5.1.1.14 DELIVERABLE, NOTICE OF FINDINGS RECOMMENDATIONS AND EVALUATION OF CONTROL DEFICIENCIES It is important to notify the OIG and auditee of potential audit findings as they arise. The Contractor must use the NFR, in the format prescribed in Attachment A, to describe potential audit findings and request management’s written agreement or disagreement. NFR’s must be communicated in writing and contain all the elements of a finding: condition, criteria, cause, effect and recommendations. NFR’s shall be well written and clearly communicate the problems that management must correct.

The OIG will review and approve all NFR’s before issuance to an auditee for management’s comment. A process control record is to be maintained by the Contractor over all NFR’s issued and must describe their disposition. Additionally, prior to the submission of the draft NFRs to COR/ACOR for review and approval, all working papers must be completed (including supervisory review). To ensure that NFR quality is promoted, the Contractor must prepare and submit for COR/ACOR review and approval, a NFR Quality Control Record (NQCR). A copy of the NQCR is to be issued every 10 business days to COR/ACOR as a means of ensuring timely processing of NFR’s.

For each control deficiency identified during the audit including control deficiencies reported in prior years, the Contractor must evaluate them in accordance with Statement on Auditing Standards Number 112/115, Communicating Internal Control Related Matters Identified in an Audit and subsequent revisions. The internal control evaluation analysis must provide the basis for the auditor’s evaluation of the control deficiency (i.e. evaluation of the likelihood and magnitude of misstatements). The Contractor will work directly with OIG to agree on the form and content of the report in sufficient lead time to meet the deliverable deadlines.

5.1.1.15 DELIVERABLE, DRAFT COMBINED AUDIT REPORT

The Contractor must prepare and submit to the COR/ACOR, audit report(s) in the format approved by the COR/ACOR. The following reporting elements must be in combined format addressed to the Inspector General of HUD and consist of a report on compliance with applicable laws and regulations, a report on internal controls, and an opinion or disclaimer of opinion on Ginnie Mae's financial statements. The Contractor is required to provide a detailed briefing on deficiencies as requested by the COR/ACOR for those designated by the COR. The Contractor must review all comments made or provided by the OIG, GAO Government wide audit team and HUD with regard to their draft reports and incorporate them as necessary or provide an explanation to the COR/ACOR why the comments are inappropriate.

5.1.1.16 DELIVERABLE, FINAL COMBINED AUDIT REPORT

The Contractor must prepare and submit their final version of the audit report(s) in the format approved by the COR and conform to AICPA and GAGAS standards. The audit report shall contain, at a minimum, Reports on Internal Control and on Compliance with Laws, Regulations, Contracts, and Grant Agreements as described under the CFO Act reporting requirements as implemented through OMB Bulletin 19-03, as amended, or its successor. Findings shall be classified according to the auditing standards as either significant deficiencies or material weaknesses. The findings shall characterize or summarize the response(s) to the draft audit from Ginnie Mae officials and, where the applicable response(s) is too lengthy, refer to the applicable report appendix containing the full response to the audit findings and recommendations. Recommendations shall address the applicable organization head responsible for taking corrective action. The Contractor must furnish a crosswalk between unimplemented recommendations and their prior year recommendation. The Report on Compliance with Laws and Regulations, Contracts, and Grant Agreements shall specify the law(s) and regulation(s), contract(s), and grant agreement(s) violated, the effect of such violations on the applicable statement assertions without affecting the privacy rights of individuals or organizations involved, whether reported to the applicable governing law or law enforcement authorities. The Contractor must also include an indexed final report copy cross-referenced to the working papers with the final report delivery.

5.1.1.17 DELIVERABLE, EXIT CONFERENCE

The Contractor must hold an IT and Program office exit conferences with OIG and designated HUD/Ginnie Mae officials, to present their reports along with their findings and recommendations. The Contractor must coordinate with the COR/ACOR on the dates of the exit conferences not less than five (5) calendar days before each conference is to be held. The PowerPoint presentation including a meeting agenda must be submitted to COR/ACOR for review and comment at least two business days before the scheduled meeting.

5.1.1.18 DELIVERABLE, DRAFT MANAGEMENT LETTER

The Contractor must prepare a draft management letter to communicate to those charged with governance other deficiencies in internal control that were not included in the audit report(s) but need management’s attention. The management letter must be prepared in accordance with GAAS, GAGAS, AICPA standards, and the OMB Guidance. The Contractor must submit the draft management letter to OIG for review within 30 calendar days of final audit report date,

5.1.1.19 DELIVERABLE, FINAL MANAGEMENT LETTER

The Contractor must prepare and submit to the OIG within 45 calendar days of final audit report date, a final management letter incorporating the OIG’s comments and suggestions, as appropriate.

5.1.1.20 DELIVERABLE, MONTHLY STATUS REPORT

The Contractor must submit to OIG a monthly status report which contains, at a minimum, the following:

· The progress to date as compared to the contractor’s audit timing and milestones (included in GRA). This can be accomplished with an analysis of planned versus actual project completion dates for each key task in the audit milestones (see deliverable number 5.1.1.5(i)) categorized by audit phases (i.e. planning, internal control, testing and reporting phases)

· Significant audit issues and discrepancies identified to date and any proposed resolution, including all matters that could impact the audit reports

· Any matter that could impact deliverable due dates

· Recommended audit adjustments

· Staff schedule and their corresponding assignments initially and updated schedule if the schedule changes significantly

The monthly status report is due by the 5th business day of the month following the reporting month. For example, if the reporting month is June, then the report is due July 5. The first reporting month will be the month in which the contract is awarded or as agreed. The Contractor will work directly with OIG to agree on the form and content of the report in sufficient lead time to meet the deliverable deadlines.

5.1.1.21 DELIVERABLE, AUDITEE STATUS MEETING

The COR/ACOR will be kept advised of all audit findings and issues as they arise. The Contractor must conduct biweekly status report meetings through August and then weekly beginning in September of the current year leading up to the exit meeting. The Contractor must provide a written briefing Agenda and Status report for distribution to attendees at each meeting.