STATEMENT_OF_WORK_(SOW).docx

Statement of Work OMB Circular No. A-123 Compliance Contract Support Services

Corporation for National and Community Service Office of the Chief Risk Officer (OCRO)

1. Purpose The Corporation for National and Community Service (CNCS) Office of the Chief Risk Officer (OCRO) has determined that contractor support is needed to assist with requirements of OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, and its appendices. Support services being requested from a contracting firm are specific to Internal Controls Testing (Appendix A), Enterprise Risk Management (ERM) (Appendix A, and Improper Payments Elimination and Recovery Improvement Act (IPERIA) (Appendix C).

Internal Controls Testing Plan and conduct the testing of internal controls over operations, reporting, and compliance. This includes (1) documenting CNCS key business processes in process narratives, (2) identifying risks within the key processes, (3) documenting the controls implemented to mitigate those risks, (4) assessing the design and operating effectiveness of those controls, (5) reporting the results of those assessments, and (6) making practical recommendations to remediate the findings and improve CNCS’s internal control system and compliance with GAO Internal Control Standards and OMB Circular A-123 Appendices A and C (links above).

Enterprise Risk Management Develop robust and iterative risk assessment processes to identify and manage new/emerging risks arising from the agency’s strategic efforts and from internal and external factors. This includes (1) providing a process that remains consistent to manage, assess, and prioritize CNCS’s risks, (2) validating the risk, sources of the risk, and potential consequences of CNCS’s exposure to the risk, (3) identifying and documenting current risk response activities, (4) developing and prioritizing new risk responses as necessary, (5) collaborating between offices/programs in conducting analyses and implementing cross-functional risk response activities/monitoring plans, (6) identifying Key Risk Indicators (KRIs) to ensure effective monitoring and potential course correction as necessary, (7) developing a maturity model with achievable milestones that help the agency expand the comprehensiveness of its risk management efforts and incorporate risk into strategic decision making, and (8) creating agency specific risk management training which will be made available to new and current CNCS employees.

IPERIA

Plan and conduct IPERIA testing and data collection and provide support and quality control regarding the collection and data processing of financial information and testing of individual transactions. This includes (1) sending data requests, (2) saving all relevant communications, data submissions, etc., (3) performing random sampling on submitted financial information and testing individual transactions based upon grant law, regulation, and CNCS policy, (4) updating status trackers in accordance with the provided Standard Operating Procedures, (5) susceptibility risk assessment work, (6) cost effective cost recovery audit analysis work, (7) exploration of improved data collection methods, (8) communications reviews, (9) SOP updates, (10) testing sheet and instruction updates, (11) OIG audit preparation, including a QC of IPERIA test files and materials, (12) updated OMB A-123 Appendix C crosswalk, as applicable, (13) desk guides/quick reference guides for common processes and issues in IPERIA testing, (14) lessons learned documents, (15) any updates needed to the IPERIA tracking and testing spreadsheets, (16) updating CNCS’s Sampling and Estimation methodology, as applicable, (17) performing statistically valid extrapolations on the data sets, (18) providing adequate sample sizes to meet desired confidence intervals, (19) assist CNCS with explaining and supporting the sampling methodology and extrapolation with the Office of Inspector General and OMB, and (20) record current improper payments data in the established database.

2. Background The Corporation for National and Community Service is a federal agency that helps more than 5 million Americans improve the lives of their fellow citizens through service. The mission of CNCS is to improve lives, strengthen communities, and foster civic participation through service and volunteering. Working hand in hand with local partners, CNCS taps the ingenuity and can-do spirit of the American people to tackle some of the most pressing challenges facing our nation. Within CNCS, OCRO supports efforts to assess, establish, and implement federal agency requirements found in OMB Circular A-123 and the Improper Payments Elimination and Recovery Improvement Act.

Per OMB Circular A-123, federal agencies must implement the integration of risk management activities and internal control functions. CNCS management is responsible for establishing and maintaining internal controls to achieve the objectives of effective and efficient operations, reliable reporting, and compliance with all applicable laws and regulations. Management should consistently apply these standards to meet each of the internal control objectives and to assess internal control effectiveness. In addition, on an annual basis, CNCS management must provide an assurance on internal control over reporting, along with a report on any identified material weaknesses and corrective actions. Furthermore, federal agencies must maintain a prioritized inventory of their most significant risks. Management should also develop an ERM framework and continue to build/enhance risk identification capabilities for identifying new or emerging risks and updating existing risks.

Additionally, the Improper Payments Elimination and Recovery Improvement Act was passed in recognition that federal improper payments resulted in significant loss of taxpayer dollars. In an attempt to reduce the amount of improper payments, IPERIA specified a number of legislative and administrative requirements for federal agencies to follow, including publishing statistically valid estimates of the improper payment rates and report on the recovery of identified improper payments.

The Office of the Chief Risk Officer supports CNCS’s effort to comply with OMB Circular A-123 and IPERIA requirements and is seeking to enter into a twelve-month contract. OCRO has determined that contractor support will further enhance efforts to meet the Internal Control and Enterprise Risk Management requirements and will also support the accurate and valid reporting of improper payments by providing consultation and support services for on-site sampling and data analysis.

3. Core Services to be Provided

3.1 Internal Controls Testing

Description: CNCS’s OCRO seeks contract assistance to perform portions, or all, of its assessment of internal controls over operations, reporting and compliance with applicable laws.

OCRO staff will assist the Contractors in all aspects of the assessment including the planning, implementation, and reporting phases. Throughout the assessment performance period, the Contractor will provide CNCS with all work papers, including planning documents, notes, testing plans, testing documents and testing results. Copies of all work papers and the Assessment framework remain the property of CNCS.

Furthermore, Individual CLIN will be funded separately and independently. Additionally, for 3.1.2 and 3.1.3 below, each Optional Sub-task will be funded individually, separately and independently.

3.1.1 Planning and Risk Assessment

The Contractor shall review and update the existing risk assessment and perform quantitative and qualitative reviews to establish the annual scope and plan for the assessment. This will include risk-rating CNCS’s business cycles and other internal control testing (entity level assessment, charge card program, accounts receivable, etc.) to determine the appropriate risk-based rotational testing cycle for the duration of the contract.

A Planning document that summarizes the results of the Planning and Risk Assessment task will be prepared. In addition, a Lessons Learned document and briefing will be held.

Deliverables – 1) Planning and Scoping Document; 2) Risk Assessment Work Paper; 3) Lessons Learned Document; and 4) Briefings.

3.1.2 Process Narratives, Risk and Control Matrices, and Designing Tests of Controls This task consists of nineteen (19) individual optional sub-tasks, each of which will be funded separately and independently.

For each optional sub-task, the Contractor will:

· Perform an initial evaluation of internal control by reviewing CNCS policies and procedures and conducting interviews and walkthroughs as necessary to update/create process narratives/cycle memos, identify controls, and determine key controls for financial and operational processes;

· Update or prepare risk and control matrices mapping risks in business processes to related control activities for financial and operational processes;

· Review CNCS’s current testing methodology and programs and update or design appropriate test plans and procedures to be used in section 3.1.3 for the assessment of operating effectiveness of controls for financial and operational processes; and

· Update or prepare testing programs which will include sampling methodology for financial and operational processes.

Process narratives, risk and control matrices, evaluation of design effectiveness, and testing plans will be developed for financial and operational controls in the following sub-tasks:

i. Optional sub-task 3.1.2.1 – Fund Balance with Treasury (FBWT)

ii. Optional sub-task 3.1.2.2 – Investments and Interest Revenue

iii. Optional sub-task 3.1.2.3 – Trust Service Award Liability

iv. Optional sub-task 3.1.2.4 – Grants Financial Management

v. Optional sub-task 3.1.2.5 – Advances from others

vi. Optional sub-task 3.1.2.6 – Expenditures and Accounts Payable

vii. Optional sub-task 3.1.2.7 – Human Capital and Payroll

viii. Optional sub-task 3.1.2.8 – Revenue and Related Receivables

ix. Optional sub-task 3.1.2.9 – Budgetary Resources

x. Optional sub-task 3.1.2.10 – Entity-Level Controls

xi. Optional sub-task 3.1.2.11 – Financial Reporting

xii. Optional sub-task 3.1.2.12 – Property Management

xiii. Optional sub-task 3.1.2.13 – Grants Operation Management

xiv. Optional sub-task 3.1.2.14 – Information Systems (Financial and Mixed-Systems)

xv. Optional sub-task 3.1.2.15 – Procurement

xvi. Optional sub-task 3.1.2.16 – Member Payroll

xvii. Optional sub-task 3.1.2.17 – Travel Cards

xviii. Optional sub-task 3.1.2.18 – Purchase Cards

xix. Optional sub-task 3.1.2.19 – Non-Financial Reporting

It is anticipated that it may take more than one year to complete or update all the optional sub-tasks included in 3.1.2. As such, business processes identified as high risk in 3.1.1 will be given priority in year 1 as far as process narratives, risk and control matrices, and designing tests of controls are concerned.

A planning document that summarizes the results of the planning process will be prepared by the contractor as well as the results of the testing of design effectiveness for each business cycle considered during the testing period and a notice of findings and recommendations.

Deliverables – 1) Process Narratives; 2) Risk and Control Matrices; 3) Test Plan; 4) Notices of Findings and Recommendations; 5) Lessons Learned Document; and 6) Briefings.

3.1.3 Performing Tests of Effectiveness and Reporting on Results For each Optional Sub-task identified in 3.1.2 above (including others that may need to be created), the Contractor will perform tests of effectiveness of transaction level controls according to the tests plan designed in 3.1.2 and the risk-based rotational testing plan developed in 3.1.1. It is anticipated that 5 – 7 of the Optional sub-tasks documented via 3.1.2 would be tested annually in accordance with the risk assessment performed via 3.1.1. A test of operating effectiveness will be performed for financial and operational controls in the following sub-tasks:

i. Optional sub-task 3.1.3.1 – Fund Balance with Treasury (FBWT)

ii. Optional sub-task 3.1.3.2 – Investments and Interest Revenue

iii. Optional sub-task 3.1.3.3 – Trust Service Award Liability

iv. Optional sub-task 3.1.3.4 – Grants Financial Management

v. Optional sub-task 3.1.3.5 – Advances from Others

vi. Optional sub-task 3.1.3.6 – Expenditures and Accounts Payable

vii. Optional sub-task 3.1.3.7 – Human Capital and Payroll

viii. Optional sub-task 3.1.3.8 – Revenue and Related Receivables

ix. Optional sub-task 3.1.3.9 – Budgetary Resources

x. Optional sub-task 3.1.3.10 – Entity-Level Controls

xi. Optional sub-task 3.1.3.11 – Financial Reporting

xii. Optional sub-task 3.1.3.12 – Property Management

xiii. Optional sub-task 3.1.3.13 – Grants Operation Management

xiv. Optional sub-task 3.1.3.14 – Information Systems (Financial and Mixed-Systems)

xv. Optional sub-task 3.1.3.15 – Procurement

xvi. Optional sub-task 3.1.3.16 – Member Payroll

xvii. Optional sub-task 3.1.3.17 – Travel Cards

xviii. Optional sub-task 3.1.3.18 – Purchase Cards

xix. Optional sub-task 3.1.3.19 – Non-Financial Reporting

It is anticipated that transactional testing will be performed on transactions occurring during the last quarter of the prior fiscal year and/or the first two to three quarters of the current fiscal year.

At the conclusion of testing, the Contractor will prepare Notices of Findings and Recommendations summary reports for any issues and exceptions identified during testing. Notices of Findings and Recommendations will include the following sections: Condition, Cause, Criteria, Effect and Recommendation.

Deliverables – 1) Completed work papers with results of tests of key controls identified in section 3.1.2; 2) Testing Summary Memo; 3) Notices of Findings and Recommendations; 4) Lessons Learned Document; and 5) Briefings.

3.1.4 Internal Control Database

The contractor will develop a database, with reporting capabilities, to track and report internal control data in order to easily analyze results/trends and provide trend analysis, as needed.

Deliverables – 1) Database of historical and current internal control data 2) Any related work papers.

3.2 Enterprise Risk Management

Description: CNCS’s OCRO seeks contract assistance to embed robust and consistent risk management practices within CNCS and its programs/units in a way that facilitates risk-informed decision making throughout the agency. The Contractor shall provide day-to-day support for Risk Management capacity development, to include supporting the continual development and implementation of the agency’s ERM program. The Contractor shall review the selected processes within each CNCS line of business from end-to-end, identify risks within those processes that could have an adverse mission impact, analyze and prioritize risks, select appropriate response strategies, and develop processes the respective program offices will use to monitor and control those risks moving forward.

The firm will provide an ERM Implementation Specialist to serve as the primary consultant for the Enterprise Risk Management activities specified in this contract. The ERM Implementation Specialist must have a minimum of 8 years of experience of relevant government and/or corporate experience regarding the implementation of ERM.

3.2.1 Maturity Model

The Contractor shall assess CNCS’s current capabilities and performance and develop an ERM maturity model and implementation plan which defines key milestone and objectives for furthering the effectiveness of CNCS’s ERM program.

Deliverables – 1) ERM Maturity Model; 2) ERM Implementation Plan; and 3) Updates/revisions, as needed.

3.2.2 Refining Current Processes

The Contractor shall provide support to efforts to improve the current CNCS ERM process and methodology, such as refining the methodology for process steps identified in the CNCS ERM Process Framework and documenting the revisions for inclusion in the ERM Policy Manual, as appropriate.

Deliverables – 1) Updates/revisions as needed to ERM Policy Manual; and 2) Any related work papers.

3.2.3 Risk Assessments and Analysis

The Contractor shall make recommendations to OCRO leadership on items which may represent strategic risk to CNCS and provide a plan for identifying those strategic risks. The Contractor shall conduct an analysis of all business processes or programs that should be further assessed. The assessments shall include recommendations and lessons learned to ultimately support ERM. These assessments will include consideration of both operational and mission support areas of CNCS that could negatively impact achieving the agency’s strategic vision. Assessments should include identification and reporting of key risk indicators associated with each areas of strategic risk from across the enterprise.

The Contractor shall also conduct risk assessments for enterprise risks documented in the CNCS Risk Profile. The required activities will include “as-needed” individual interviews with subject matter experts (SMEs) within CNCS, as well as reviewing the root causes of the risk in question, assessing its impact and likelihood, and supporting the development/updating of response actions for implementation by CNCS risk owners.

Deliverables – 1) Planning and Scoping Document; 2) Any related work papers; 3) Lessons Learned Document; 4) Notices of Findings and Recommendations; and 5) Briefings.

3.2.4 Key Risk Indicators

As presently defined, Enterprise KRIs are leading metrics designed to identify changes primarily in CNCS’s internal and external environment. The Contractor shall:

· Develop and implement the processes and policies necessary for the regular monitoring of Enterprise Key Risk Indicators (KRIs);

· Develop SOPs and processes for reporting, rules changes, action items, monitoring, escalation, etc.;

· Categorize applicable Enterprise KRIs as episodic (occur on a repeatable basis such as seasonal, monthly), triggering (one-off occurrences that can generate downstream risks or opportunities for CNCS), or a combination of both;

· Recommend the frequency of reporting for Enterprise KRIs;

· Establish baselines for Enterprise KRIs for normal operations and associated thresholds that show measurement fluctuations requiring further analysis, monitoring and potential response; and

· Identify roles and responsibilities both at the organizational and information owner levels, recommend a methodology for ongoing development and reassessment of KRIs, and recommend a system to be used to store and communicate KRI information.

Deliverables – 1) Enterprise KRI Implementation Recommendations and Plan (to include roles and responsibilities, descriptions of proposed SOPs and reporting process descriptions); 2) Enterprise KRI Baseline Analysis; and 3) Enterprise KRI Methodology.

3.2.5 Risk Management Training

The Contractor shall develop and implement a computer-based risk management training for CNCS employees which has the purpose of advancing CNCS’s risk awareness and risk management principles and includes an overview of process steps identified in the CNCS ERM Process Framework. The objective is to ensure CNCS personnel have the expertise and familiarity with the fundamental concepts of ERM and Risk Management. This training will be housed on CNCS’s network and owned by the agency.

Deliverables – 1) Risk Management training; and 2) Associated files.

3.3 IPERIA

Description: CNCS’s OCRO seeks contract assistance to support the improper payment testing by accurately and timely processing requests for grantee data, testing transactions, adhering to CNCS standard operating procedures, and providing quality control and assurance on work and work products.

The firm will provide at least one statistician with an advanced degree in statistics, biostatistics, mathematics, a quantitative social science, or similar field, and has training and/or experience designing statistical samples and using statistical methods to calculate population estimates and sampling errors from a probability sample. Prior experience with IPERIA is desired. The statistician will work with large scale accounting data sets using SPSS, Stata, and/or Excel. The statistician will be required to collaborate with the Office of Grants Management and the Office of Information Technology to access CNCS grants and payment data.

The firm will also provide a quality control and management structure to ensure the quality and accuracy of work provided. This includes staff time to review data processing and testing results to ensure accuracy, adherence to CNCS SOPs, and adherence to the sampling methodology.

3.3.1 Data Collection and Transaction Testing

The Contractor shall provide support for data collection of financial information including sending data requests, saving data submissions, performing random sampling on submitted financial data, testing individual transactions in accordance with applicable law, regulation, and CNCS policy, and updating status trackers in accordance with the provided Standard Operating Procedures.

Deliverables – 1) Any related work papers.

3.3.2 Quality Checks

The Contractor shall provide quality checks on both the random sampling methodology work of the FMS Consultants and the individual transaction testing of the Consultants, including ensuring the accuracy and completeness of entire file.

Deliverables – 1) Any related work papers; and 2) Complete, accurate, and compliant sample files.

3.3.3 Database Updates

The Contractor shall update and input current information into the established database of improper payment data to easily analyze results and trends and provide further trend analysis.

Deliverables – 1) Database of historical and current improper payment information; and 2) Any related work papers.

3.3.4 Data Analysis and Documentation

The Contractor shall:

· Provide sampling and data analysis support including technical support, assistance, and consultation for IPERIA staff conducting assessments of CNCS grants;

· Examine quality of data being provided by grantees and provide consultation and direction on addressing problems with missing or incomplete data (e.g. sample failures). Data quality represents a barrier to conducting statistically valid sampling;

· Review current practices and provide consultation on the definition of cases for inclusion/exclusion from the sample. Clear determinants and definitions for what constitutes an improper payment is necessary for the development of a valid sampling plan;

· Perform analysis to confirm the desired confidence intervals are achieved and provide certification;

· Provide narrative to include in the Agency Financial Report, in accordance with OMB A-136 that confirms the sampling plan methodology produces statistically valid estimates;

· Update and/or modify current sampling plans to generate accurate samples of the population of grants. Provide basis on the updated definitions and specifications;

· Document all findings and conclusions made during the IPERIA assessment process and provide all relevant work papers;

· Perform analyses of missing cases to assess sampling bias;

· Review data analysis for accuracy;

· Perform extrapolations of improper payment results to the entire population of data – This is completed per program; and

· Support audit inquiry, as needed.

Deliverables – 1) Results of data analysis; 2) Definition of cases for inclusion/exclusion from the sample; 3) Narrative to include in the Agency Financial Report; 4) Sampling plans; 5) Work papers documenting findings and conclusions made during the IPERIA assessment; 6) Lessons Learned Document; and 7) Briefings.

3.3.5 Sample Size and Sample Selection

The Contractor shall provide the necessary sample sizes CNCS must test in each program deemed susceptible to improper payments to reach the OMB required confidence intervals and provide all work papers related to the calculation of sample sizes and generation of the sample population.

Deliverables – 1) Required sample sizes for each CNCS program deemed susceptible; 2) Work papers related to the calculation of sample sizes; 3) Results of sample population selection; 4) Work papers related to the generation of the sample population; and 4) Briefings, as necessary.

3.3.6 Sampling Methodology Report

The Contractor shall generate a sampling methodology report that details all sampling processes including decision points regarding program variations, missing or incomplete data, factors regarding stratification, if employed, and validation analyses. The Contractor shall generate a best practice in accounting methods to support the process employed in the analysis.

Deliverables – 1) Sampling methodology report; 2) Best practice in accounting methods to support the process employed in the analysis; 3) Lessons Learned Document; and 4) Briefings.

3.3.7 Updates to Current Sampling Methodology

The Contractor shall update CNCS’s sampling methodology, as needed, based upon Office of Inspector General (OIG) audit feedback and/or Office of Management and Budget (OMB) requirements and provided CNCS with all work papers related to the revision of the current approach. The Contractor shall provide comprehensive documentation on any sampling methodology updates that must be submitted to OMB.

Deliverables – 1) Updated sampling methodology; 2) Comprehensive documentation on any sampling methodology updates; 3) Work papers related to the revision of the current approach; 4) Lessons Learned Document; and 5) Briefings.

3.3.8 OMB Support

The Contractor shall provide CNCS support in discussions with OMB in regard to the new sampling approach, as needed.

Deliverables – 1) Lessons Learned Document; and 2) Briefings.

3.3.9 Data Collection Process Support

The Contractor shall provide intermittent technical assistance support throughout the IPERIA data collection process, as needed, to ensure CNCS staff is properly applying the sampling methodology.

Deliverables – 1) Work papers related to technical assistance; and 2) Briefings.

3.3.10 Susceptibility Risk Assessments

The Contractor shall assist in research, interviews, and written analysis for susceptibility risk assessments for programs and activities that require an assessment be completed for current FY IPERIA reporting.

Deliverables – 1) Any related work papers; and 2) Written analysis on final determination as to whether programs and activities are susceptible to significant improper payments.

3.3.11 Cost Effectiveness Assessments

The Contractor shall assist in research, interviews, and written analysis for cost effectiveness assessments for recovery audit programs in CNCS programs and activities that require an assessment be completed for current FY IPERIA reporting.

Deliverables – 1) Any related work papers; and 2) Written analysis on final determination as to whether it is cost effective for CNCS programs and activities to have cost recovery audit programs.

3.3.12 Alternative Tools

The Contractor shall explore and implement, as appropriate, alternative tools to facilitate grantee data collection and document review for regular improper payment test cycles.

Deliverables – 1) Any related work papers.

3.3.13 Updates to Current Documents

The Contractor shall review and provide updates, as needed, to outward facing (to CNCS grantees) communications for improper payments testing, internal testing sheets and testing instructions, the IPERIA SOP, and the IPERIA tracking spreadsheets.

Deliverables – 1) Any related work papers; and 2) Updated documents, as needed.

3.3.14 Documenting Changes to OMB Requirements

The Contractor shall develop a crosswalk between the old and updated requirements of OMB Circular A-123, Appendix C.

Deliverables – 1) Any related work papers; and 2) Final crosswalk of OMB A-123, Appendix C updates.

3.3.15 Audit Preparation

The Contractor shall provide OIG audit preparation, including a QC of IPERIA test files and materials.

Deliverables – 1) Any related work papers; and 2) Checklist sheets ensuring accuracy and availability of information for all transactions and files quality controlled.

3.3.16 Reference Guides

The Contractor shall create desk guides and/or quick reference guides for common processes and issues in IPERIA testing.

Deliverables – 1) Any related work papers; and 2) Desk guides for IPERIA testing.

3.3.17 End of Fiscal Year Documents

The Contractor shall provide Lessons Learned analysis and write up for the FY IPERIA testing cycle.

Deliverables – 1) Any related work papers; and 2) Lessons Learned Document.

4. Reporting

4.1 Briefings, Status Reports, and Minutes

The Contractor shall hold briefings with the Contracting Officer’s Representative (COR) and/or others designated by the COR with status reports prepared for each task of the contract and/or assessment. The COR will designate the tasks and frequency of briefings, status reports, and minutes, based on the organization of the overall project and/or assessment. These briefings and status reports shall describe the project progress, results to date, and near-term planned activities; provide updated timetables; and identify matters that may impact the timing or outcome of future work.

The timing of the briefings, status reports, and minutes will be based on need, but shall be held at least bi-weekly after the end of the planning period. At the discretion of the COR or responsible project monitor, the briefings may be increased to weekly, if project and/or assessment activity during a period of time become significant or necessary to facilitate better communication. Status reports shall be provided to the COR or a representative designated by the COR at least one day before the briefings. Minutes should document significant discussions, decisions, and commitments made by management and the Contractor and shall be included in the Contractor’s work papers. The Contractor shall notify the COR immediately in writing if they become aware of issues that could jeopardize the successful completion of the contract and/or assessment.

4.2 Work Papers

The Contractor shall develop complete and accurate work papers that document all work performed, support conclusion reached, are consistent with Federal Standards, and can be relied upon by external auditors performing audits. Work papers shall clearly show the:

Work papers shall contain sufficient information to enable OCRO personnel to understand the work performed and the results obtained. Testing procedures, Notices of Findings and Recommendations (NFRs), and summary reports shall be indexed to the work papers, and vice versa. The COR shall have access to the Contractor’s work papers on an ongoing basis to facilitate (1) an understanding of the project and/or assessment, its progress and quality, and its results, and (2) timely issuance of reports.

At the request of the COR or his/her representative, the Contractor shall provide, within three working days of the written request, a copy of any work papers, (paper or electronic format), including relevant supporting documentation, if any, created or obtained during the project and/or assessment. All of the Contractor’s work papers shall be secured in a manner that prevents unauthorized access to the information and must be available for review in a format pre-approved by the COR. The Chief Risk Officer (CRO) or the COR may require the Contractor to perform corrective or additional work within the assignment scope based upon their review of the work papers or work products. The CRO anticipates that most of their needs for work paper access will be satisfied by the delivery schedule provided in Part 7.

The COR or its designated representative will review Contractor work papers in accordance with applicable standards and guidance, such as OMB Circular A-123 and its Appendices, the GAO Standards for Internal Control in the Federal Government, other OMB circulars, and applicable Memoranda and bulletins. The COR will perform their review throughout the life of the contract and according to the deliverable schedule in Part 7. If the COR Quality Assurance Review discloses any case of sub-standard or unacceptable work product, the Contractor shall be required to perform corrective action or additional work within the work order's scope at the Contractor's expense.

4.3 Notice of Findings and Recommendations

It is important to notify the COR and/or the CRO of potential findings as they arise. During the course of the project and/or assessment, the Contractor shall use Notice of Findings and Recommendations (NFR) to describe potential findings. OCRO will discuss the finding with management and may involve the contractor’s personnel in the discussion with management. NFRs shall be in writing and contain the following elements of a finding: condition, criteria, cause, and effect. The Contractor must ensure that the recommendation will correct the cause of the condition before issuing the final NFR. NFRs should be well written and clearly communicate the problems that management must correct. The facts identified in the NFR should be vetted with CNCS management prior to OCRO review.

The COR will review and approve all NFRs before issuance to the CRO for management’s comment. A process control record is to be maintained by the Contractor over all NFRs issued and shall describe their disposition. Additionally, all scheduled deliverables, including working papers and reports, must be completed (including supervisory review) prior to the COR’s review and approval, however this requirement does not apply to unscheduled request of work papers by the COR. For all NFRs developed and prepared at remote locations, the work papers need to be prepared electronically or scanned into a file and forwarded to the COR for review. It is expected that material weaknesses or significant deficiencies presented in the summary report shall be supported by previously issued NFRs, unless weaknesses become apparent in the closing stage of the project and/or assessment process when issuing an NFR may be impractical. At the time of NFR submission to CRO for review or approval, the Contractor shall also provide the summary work papers that clearly support the narratives in the NFRs.

5. Contract Administration

5.1 Contract Type

The agency contemplates award of IDIQ Contract at fixed unit rate resulting from this solicitation. The estimated not-to-exceed amount of each year requirement is between $2,500,000.00 and $3,000,000.00.

5.2 Standards

The contract must be performed in accordance with the following standards and guidance as applicable, including any subsequent issuances or revisions:

• GAO's Federal Information System Controls Audit Manual (FISCAM);

GAO's Standards for Internal Control in the Federal Government (green book);

· OMB Circular A-123, "Management's Responsibility for Enterprise Risk Management and Internal Control" (Appendix A) and "Requirements for Payment Integrity Improvement." ; and

• OMB Circular A-136, "Financial Reporting Requirements.".

5.3 Period of Performance

This statement of work, tasks, and optional sub-tasks are effective upon signature of the Contracting Officer. The period of performance consists of one (1) base and four (4) option years, unless otherwise extended by a modification to the task orders. The agreement may be terminated at the convenience of the government unilaterally and may be rewritten or revised at the option of the Contracting Officer. Revision shall be accomplished by modification to the task order. Obligation is only incurred when a task order is placed for a specific service and amount.

5.4 Personnel Qualifications

Contractor staff shall be qualified in performing internal control testing, identifying and mitigating risks, evaluating information systems, and in accounting practices, sampling, and data analysis. Qualified specialists shall be available to assist with the project and/or assessment as needed, such as specialists in information technology, statistics, and actuarial estimates. Resumes describing the qualifications of the Contractor’s key staff (i.e., partners, principals, directors, and senior staff) and specialists shall be submitted as part of the proposal package and on an ongoing basis as new personnel are assigned to the engagement. Sufficient evidence shall be provided to justify the billing rates of staff and their assignments, such as relevant experience, educational and professional certifications. Substituted staffs shall at a minimum have comparable qualification and experience as those they are replacing.

Qualification and Experience of Proposed Staffs

Partner/ Principal/ Director

Any personnel working under the contract, including subcontractors, must meet the minimum qualification and experience listed in above.

5.5 Substitution of Key Personnel

During the period of performance, the Contractor may make substitutions of key personnel on the condition that the replacement be equally or better qualified as measured by education, certifications, and years of experience in the component area (i.e., Internal Controls, ERM, and IPERIA) in which the personnel being replaced was working. Key contractor personnel include the Partner/ Principal/ Director and Senior Manager/ Statistician / Senior Consultant/ ERM Implementation Specialist.

The Contractor shall submit a written request to the COR at least 15 calendar days prior to a substitution of personnel assigned to this task. The Contractor shall include the circumstances necessitating the proposed replacement of the key personnel and shall provide the name and resume of the proposed replacement. The COR would approve any personnel replacement that is equally or better qualified as the person being replaced. It must be noted that the replacement personnel must meet all the security requirements and deemed suitable by CNCS before they can begin work on the project. The replacement personnel should preferably be approved before the personnel being replaced can roll off the engagement. The Contracting Officer (CO) will resolve disputes regarding the substitution of key personnel.

All key personnel replacements must be identified and onboarding initiated within ten (10) business days of the end date of the prior individual.

5.6 Subcontracting

If the Contractor uses a subcontractor for this project, the Contractor shall inform the COR about the subcontractor and the scope of its involvement in the performance of the contract prior to the subcontractor starting work under the resulting task(s). The COR shall approve the sub-Contractor prior to the sub-Contractor starting work under the resulting task orders. The CO will resolve disputes regarding the use of sub-Contractors. The subcontractor shall meet the same requirements as the Contractor in terms of security clearances, confidentiality of information, quality of work, IT security, and other similarly applicable sections of this statement of work.

If a designated subcontractor will change during the term of this statement of work or resulting task(s), the Contractor shall notify the COR in writing as soon as reasonably possible and at least 30 days prior to making any proposed substitution of the subcontractor. The notification shall include a detailed explanation of the circumstances necessitating the proposed substitution, complete resumes for the proposed sub-Contractor personnel/substitutes, and any other information requested by the COR, related to scope of the work to be performed, qualifications and/or supervision of sub-Contractor personnel. Proposed substitutes should have comparable or better qualifications to those of the sub-Contractor being replaced.

5.7 Invoices and Payments

Payment will be based on receipt of a proper invoice and satisfactory contract performance. A proper invoice must include the following items:

6. General Information

6.1 OCRO Project Monitors

The COR will monitor the performance of the contract and/or assessment and may assign other CNCS employees as project monitors to oversee performance in specific parts of the project and/or assessment depending on the skills required to competently evaluate the work being performed by the contractor.

6.2 Contact with CNCS Personnel

The Contractor shall notify the COR or assigned project monitor in writing, prior to making initial contact with CNCS personnel, to start work on a task. The COR or project monitor is to be kept abreast of the Contractor’s activities and interaction with CNCS personnel during the course of contract performance. The Contractor shall inform the COR or project monitor of all meetings with CNCS personnel. The COR or project monitor will attend those meetings at his/her discretion.

6.3 Staff Schedule

Every thirty (30) days, or as agreed to by the COR and Contractor in writing, the Contractor shall provide a schedule of staff, and their Component assignments to the COR or project monitor to assist him/her in monitoring work performed under this contract. If schedules change significantly (as determined by the COR), the Contractor shall provide the COR or project monitors with updated schedules.

6.4 Security Clearances

All contractor personnel performing work under this contract shall be subject to security background investigations as prescribed by CNCS Office of Human Capital (OHC) to be allowed to work or continue to work on this contract. The Contractor must maintain a record, available for audit and inspection by CNCS, of all personnel who successfully complete a security background investigation. All contractor personnel will be pre-screened by CNCS OHC and/or through other processes as designated by CNCS before being allowed to work on this contract.

6.5 Information Security

The Contractor shall comply with all laws, regulations, federal guidelines, and internal CNCS policies regarding the handling, storage, and safeguarding of CNCS information, including CNCS information stored on contractor’s computers. The Contractor shall maintain the confidentiality of and protect all documents, data, and other information supplied by CNCS. The contractor will be required to sign a non-disclosure agreement prior to accessing CNCS data.

6.6 Personally Identifiable Information (PII)

The contractor shall abide by CNCS policies regarding the handling of PII. It is the contractor’s responsibility to become aware of CNCS policies regarding the handling and safeguarding of PII. The Contractor will maintain PII in a secure manner throughout the period of performance, pass on to designated CNCS staff at the time of the final report, and destroy it in a secure manner at the end of the period of performance. The Contractor also agrees to take appropriate measures to restrict access to PII to only those Contractor employees needing such information to perform assigned work under a task; i.e., on a “need to know” basis. The Contractor agrees to immediately notify the COR in the event that he/she determines or has reason to suspect a breach of any of these requirements or restrictions or any improper handling of PII or Sensitive PII (SPII), and to provide written notification as soon as possible.

6.7 Information System Requirements

The Contractor agrees to take appropriate precautions to ensure that all electronic files and media used to store or transmit data to CNCS and OCRO are free of computer viruses, malware, spyware and any other similar software, programs, and scripts that would compromise the integrity and disclosure of CNCS information. If the Contractor personnel must be able to connect their laptops to the internet, the Contractor shall work with the COR and the Office of Information Technology (OIT) to obtain telecommunication, system links and internet access. The Contractor representative shall notify the COR about the need for connectivity to the internet and the COR will coordinate with the OIT. Under no circumstances shall the Contractor attempt to connect to or enter any CNCS network or system with their own equipment without the CNCS OIT written approval.

6.8 Computer Software

Reports and work papers are to be prepared using software compatible with CNCS software, which currently is Microsoft Windows Office Suite of products (e.g. Word, Excel). In addition, the CRO will require any software tools used by the Contractor for processing of CNCS information to be properly licensed and approved by the CNCS Office of Information Technology.

6.9 Confidentiality Agreements

Each Contractor partner or employee performing work under this contract shall be required to submit a non-disclosure/confidentiality agreement.

6.10 Intellectual Property

All contractor developed processes and procedures and other forms of intellectual property which are identified in the contract as a Deliverable shall be the property of the Government.

All documentation and electronic data and information provided by the government to the Contractor shall remain Government property and shall be returned to the Government at the end of the performance period or when requested. However, the Contractor may retain such information in its work papers to the extent necessary to comply with applicable professional standards.

6.11 Independence and/or Objectivity

During the period of performance of this SOW, the Contractor shall adhere to the independence and/or objectivity standards as issued by the Government Auditing Standards and the American Institute of Certified Public Accountant (AICPA). As part of the proposal, the contractor shall represent in a separate statement that it is independent with respect to the CNCS. In this separate statement, the Contractor shall briefly describe all work performed for CNCS in the past two (2) years and all known future work with CNCS. If the COR believes that an independence or objectivity impairment exists, the COR will notify the CRO, who will make the final determination as to whether independence/objectivity has been impaired. The CNCS reserves the right to determine at its discretion, based on the information provided, if an interdependence/objectivity impairment exists and shall notify the Contractor to either defer the independence/objectivity impairment work or cease performing work under this contract. The Contractor shall immediately inform the COR via email of any potential or actual conflict of interest that the engagement team performing work under this task becomes aware of. The CO will determine what actions by the Contractor will be necessary to protect the Government’s interest.

6.12 Section 508 Compliance

Federal laws require Federal agencies to make their electronic and information technology accessible to people with disabilities. Inaccessible technology interferes with an individual’s ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology, to make available new opportunities for people with disabilities, and to encourage development of technologies that will help achieve these goals. Accordingly, Section 508 is to be complied with when applicable.

6.13 Government Furnished Equipment

Government furnished equipment will be provided in CNCS offices as applicable and shall be limited to work areas, desks, chairs, phones, laptops and connectivity to the internet. The Contractor shall communicate space needs to the COR or appropriate project monitors. The Contractor shall provide all other equipment and supplies. Additionally, the Contractor will provide the COR with a written description and purpose of all IT equipment that the Contractor will bring to CNCS location to conduct the Assessment. The Contractor shall upon request from the COR also provide a description of the configuration of such equipment.

6.14 Travel

The project work will principally be performed at CNCS Headquarters in Washington, DC, with travel to other CNCS sites throughout the United…