SOW - audit remediation 11 21 2011.pdf

United States Department of Agriculture Natural Resources Conservation Service

Statement of Work Audit Remediation Services

11/21/2011

I. Introduction

The purpose of this contract is to obtain the services of a certified public accounting or consulting firm with demonstrated Federal governmental accounting experience to perform audit remediation services for the Natural Resource Conservation Service (NRCS), a sub-agency of the U.S. Department of Agriculture (USDA).

NRCS received disclaimers of opinion on the 2008, 2009, 2010, and 2011 financial audits.

II. Objective and Scope

The objective is to remediate the known material weaknesses by providing professional audit remediation and audit readiness services to assist NRCS in assuring all financial transactions are in accordance with Federal Accounting Standards, United States Standard General Ledger (USSGL), Federal Manager’s Financial Integrity Act of 1982, (FMFIA), Federal Financial Management Improvement Act of 1996 (FFMIA), Federal Information Security Management Act (FISMA) , Improper Payments Information Act (IPIA), Federal Accounting Standards Board (FASB), Office of Management and Budget (OMB) policies, and any applicable laws and regulations. If additional material weaknesses are identified in the 2011 financial audit, these items will be modified into the contract at the time they are identified.

NRCS received disclaimers of opinion on the 2008, 2009, 2010, and 2011 financial audits.

Material Weaknesses were noted for:

1) Undelivered Orders

2) Revenue and unfilled customer orders

3) Accruals

4) Property, plant and equipment

5) Financial Reporting

6) General and Application Access Control Environment

7) Purchase and fleet card transactions

Significant Deficiencies were noted for:

1) Revenue and unfilled customer orders

2) Purchase and fleet card transactions

NRCS shall provide the Contractor with the final 2011 audit report.

The Contractor shall be required to perform the following:

1. Develop a high level strategy for NRCS to obtain a clean audit opinion by 2013.

2. Review and update the existing project plans for the known audit issues. Develop new project plans as necessary. Project plans shall address the root causes of audit related financial management issues. Plans shall also include audit readiness recommendations that could include analyzing and documenting financial management business processes and procedures, analyzing and documenting general ledger and subsidiary ledger transactions, making recommendations for needed corrections or changes to improve financial management operations.

Plans shall also address compliance laws and regulations including, but not limited to the Federal Accounting Standards, USSGL, FMFIA, FFMIA, FISMA, IPIA, FASB, OMB policies, and any applicable laws and regulations.

Recommendations for improvements or changes to the plans will be submitted to the government within 45 days of the receipt of the project plans. The Government will review and provide any needed corrections to the recommendations.

3. Develop and update policies and procedures to support remediation of audit findings and material weaknesses. NRCS will be converting to the Financial Management Modernization Initiative (FMMI) targeted date of April 2012. The contractor will need to adapt to changes in the accounting system including updating policies and procedures after NRCS has converted to the FMMI. This conversion will may also include attending meetings, updating schedules, and cleansing data as necessary.

4. Develop training materials for NRCS employees that address audit findings in the seven material weakness areas. Training will be on-line computer based training to maximize audience participation. It is estimated that approximately one to two training sessions per month may be required. In addition, the Contractor will set up webinar/conference calls, take notes of questions and answers, and prepare and collect attendance sheets and course evaluations.

5. Develop and implement NRCS’s A-123 program for various business cycles.

The current cycles are:

• Financial Reporting

• Funds Control

• Funds Control Management

• Grants Management

• Human Resource Management

• Reimbursable Agreements

• Easements

• Procurement Management

• Leases

• Personal Property

• Real Property

• Purchase Card Management

• Revenue and Receivables Management

The cycles require the preparation of risk assessments, process narratives, flowcharts, and corrective action plans, including testing processes and communicating results to NRCS management. This also includes uploading results and documents into USDA’s A-123 Document Tracking System (ADTS) per USDA deadlines. The cycles will include business cycles required by the Office of the Chief Financial Officer at the USDA level (the Department) (must be uploaded into ADTS) and other cycles not required by the Department, but identified as required cycles by NRCS.

6. Assist NRCS in the development and implementation of NRCS Compliance Reviews. In 2012, NRCS will launch a compliance review strategy that involves visiting 10 states per year. Compliance Reviews will be conducted simultaneously by various offices within NRCS – Civil Rights, Acquisition, Human Resources, Financial Management, etc, to alleviate the administrative burden on the states created by multiple site visits within the same calendar year.

The Financial Management reviews will include performing A-123 testing at a minimum of 3 states in order to assess controls and documentation maintained at the state level. Depending on that assessment, the remaining reviews may be performed at National Headquarters (NHQ) via downloading requesting documents from the SharePoint Site.

7. Per USDA requirements, prepare improper payment risk assessments and detailed transactional testing to identify improper payments. Historically approximately 600 transactions required testing. Approximately six risk assessments/correction action plans may be required.

8. Perform quarterly testing of undelivered orders, accruals, prompt payment and other business processes related to the material weaknesses as required.

Historically three types of these tests per quarter have been conducted. This could include visiting states/centers to test transactions/observe procedures.

9. Provide cost accounting and other project management services related to the implementation of a managerial cost accounting (MCA) program. This system will track NRCS’s costs by major business lines and programs. This includes attending meetings, assessing the auditability of data, making recommendations and serving as the overall cost accounting subject matter expert. The MCA model is currently being developed by a contractor. It should be completed by February 2012. But after completion, it will need to be re-configured to conform to FMMI requirements and will be deployed into production. After deployment, the model may require updates to programs, business lines, etc. Additionally, time allocation data may need to be refreshed. NRCS needs assistance facilitating all of these activities.

10. Provide support for the following Information Technology (IT) activities:

a. Plan of Action and Milestones (POAM) Status and Coordination

b. General and application controls assessment

c. State quality assurance review

d. IT compliance with laws and regulations, including, but not limited to the

FFMIA, FISMA, Federal Information System Controls Audit Manual (FISCAM) and OMB Circular A-123

e. Financial audit requests

f. General Computing Controls (GCC) audit remediation

g. Implementation of an internal control strategy

III. Location of Work to be Performed

The majority of the work will be performed in the NRCS National Office, in Washington, D.C. There may be some travel to NRCS State Offices and Centers.

Government owned facilities will be provided. The government may provide lap top computers as deemed necessary by NRCS.

IV. Deliverables

Deliverables will include:

1. High level audit remediation strategy

2. Revised project plans addressing the known material weakness and additional plans required based on the audit remediation strategy that was developed.

3. Contractor quality control plan

4. Monthly status reports that include accomplishments for the current month and proposed action items by the work stream for the upcoming month

5. A-123 deliverables:

• Risk Assessments

• Narratives

• Flowcharts

• Test Plans

• Test Results

• Corrective Action Plans/POAMS

• Summary of Aggregated Deficiencies

6. Compliance Review deliverables. The Financial Management deliverables should be the A-123 deliverables. But additional deliverables may be required. For example, summaries of testing results, recommendations for improvement, etc.

7. Improper Payment deliverables:

• Risk Assessments

• Corrective Action Plans

• Sampling Methodology

• Testing Results

8. Training materials:

• Power point slides for instructor and participants

• Participant sign-in sheets

• Summary of training related questions and answers

9. IT deliverables:

• A reporting system that provides POAM metrics, key performance indicators, statuses, etc.

• An annual IT assessment plan

• Consolidated testing procedures of IT controls

• Consolidated IT audit requirements document

• IT A 123 standard operating procedures and best practices document

• Testing programs, results of assessments and evidence of all assessment activities, including quarterly testing of access controls

• An artifact repository

• Risk register

• A-123 testing and IT GCC deliverables uploaded into

Cyber Security Assessment Management (CSAM) and ADTS as applicable

• Participation in bi-weekly Assessment Implementation Team (AIT) meetings

• Support of the development of the access control portal

• Financial system mapping

• Internal controls playbook

• Support for A-123, FISMA, FISCAM and other agency assessment audit activities

10. Deliverables shall be provided to the NRCS personnel designated to the specific work stream. NRCS personnel will be identified.

11. Review comments regarding draft deliverables must be addressed within required deadlines identified in the applicable project plan. Material weakness lead and contractor personnel will work together to determine deadlines for deliverables.

V. Communication with NRCS

A. Attendance at Meetings

1. Contractor must attend bi-weekly audit remediation meetings.

2. Contractor must attend monthly audit remediation meetings with senior leadership.

3. Contractor must attend department level meetings for A-123 and improper payments as required. Historically these are held on a monthly basis.

B. Contractor/Agency Communication

Timely and open communication shall occur between NRCS and the contractor to ensure all parties are kept up to date on the progress of deliverables. Matters that should be communicated include, but are not limited to:

• Progress on audit remediation activities

• Improper payment reporting

• A-123 documentation and reporting

• Development of managerial cost accounting

• Issues or problems arising in the preparation of deliverables

VI. Access to Workpapers

All workpapers supporting deliverables are the property of NRCS.

This will include detailed testing results and summary reports.

VII. Contractor Performance Standards

Contractor performance will be monitored throughout the period of performance.

The Contracting Officer’s Representative (COR) shall review all reports/deliverables required under the contract for acceptance and, as needed, perform periodic inspection of contractor quality control. The COR shall notify contractor whenever revisions to reports/deliverables are required in order for the deliverables to be deemed acceptable

VIII. Key Personnel

A. The contractor must identify in the technical proposal the key personnel at the technical expertise level (i.e., statistician, information systems experts, etc.), and senior level management and above assigned to the contract, as well as the total number of personnel assigned to the audit, the position of each such person and the expected number of work hours of each person. Any subsequent changes in key personnel from those in technical proposal must be approved in advance by the Contracting Officer.

B. The contractor shall provide current resumes of all staff assigned to the audit. In addition, the contractor shall provide a detail report of all continuing education courses taken by all of the assigned staff within the last 2 calendar years.

C. During the first 90 days of performance, the contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The contractor shall notify the contracting officer within 15 calendar days after the occurrence of any of these events and provide the information required by the paragraph immediately below. After the initial 90-day period, the contractor shall submit information, required by the paragraph immediately below, to the contracting officer at least 15 days prior to making any permanent substitutions.

D. The contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the contracting officer.

Proposed substitutes should have comparable qualifications to those of the persons being replaced. The contract will be modified to reflect any approved changes of key personnel.

IX. Staff Qualifications

A. The contractor’s minimum staff qualifications must be as follows:

1) Bachelor’s degree or advanced degree from an accredited university or college in the appropriate technical field (i.e., accounting, information technology) and/or 3 years relevant work experience.

2) Appropriate certifications (i.e., a Certified Public Accountant (CPA) or Certified Government Financial Manager (CGFM) preferred but not required for the senior management level.

3) Government accounting experience required for senior management level.

4) Eighty hours of continuing professional education and training in the past 2 years, of which 24 hours must be in Federal accounting, auditing and/or budgeting.

B. The contractor should include the resume and/or minimum qualification level of every individual assigned to this effort. NRCS reserves the right to approve any contractor prior to staff assignment to the engagement.

X. Travel

Travel will be required to support Compliance Reviews. Additional travel may be required to support other activities. The number and specific State offices to be visited will be determined by NRCS. All travel will be in accordance with Federal Travel Regulations.

XI. Contract Officer Representative

1. Contracting Officer’s Representative

a. The performance of work required herein shall be subject to the technical direction of the cognizant COR or his/her designee with respect to technical matters pertaining hereto. As used herein, “Technical Direction” to the Contractor which fills in details, suggests possible lines of inquiry, or otherwise supplements the scope of work.

“Technical Direction” must be confined to the general scope of work set forth herein and shall not constitute a new assignment, nor supersede or modify any other Clause of this solicitation. To be valid, technical direction:

(1) Must be issued in writing consistent with the general scope of work set forth in the contract;

(2) Shall not change the expressed terms, conditions, or specifications incorporated into the contract; and

(3) Shall not constitute a basis for extension to the contract delivery schedule or contract price.

b. The COR is authorized to:

(1) Act as a liaison and to coordinate contractor/government activities;

(2) Arrange for and coordinate the use of Government resources;

(3) Provide technical guidance in the performance of the contracts;

(4) Receive, review, and approve reports and other functions of a technical nature; and

(5) Review and approve invoices for payment.

c. The COR does not have the authority to alter the Contractor’s obligations under the contract.

d. The original payment documents shall be submitted to the Contracting Officer, with 1 copy of all documents furnished to the COR for verification, on a monthly basis for payment as required under the Prompt Payment Act.

XII. Special Contract Requirements

1. FAR Subpart 4.13, Personal Identify Verification of Contractor Personnel, establishes the policy and use requirements for FAR Clause 52.204.9, Personal Identify Verification of Contractor Personnel. Before an employee may work on this contract, each employee must complete a SF-85, Questionnaire for Nonsensitive Position, SF-95P, Questionnaire for Public Trust Positions, or SF-86, Questionnaire for National Security Positions, as appropriate and complete 2-FD-258, Fingerprint Charts. Contractor employee’s fingerprints shall be taken to a Federal security officer, or Federal, State, municipal or local law enforcement agency. The contractor employee must receive a favorable agency adjudication of the FBI fingerprint and security background investigation. The contractor is responsible for all costs associated with the background investigation requirements.