ATCH 04 SOO Special PACA Audits 1 Oct 26 - Draft.pdf

PACA Special Program Audits 1 October 2026

RFQ F41999-26-Q-

CUI

CUI

STATEMENT OF OBJECTIVES (SOO)

FOR

AIR FORCE SERVICES CENTER (AFSVC)

PUBLIC ACCOUNTANT CONTRACT

AUDIT PROGRAM (PACA) SPECIAL

PROGRAM AUDITS

AT

Air Force Services Center (AFSVC)& AF

Installations

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

Contents

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1. General

1.2. Background

1.3 Scope

SECTION II

2.0 PROBLEM STATEMENT

2.1 Objective

2.2 Final Outcome

SECTION III

3.0 CONTRACTOR QUALFICIATONS

3.1. Team Lead/Project Manager

3.2 Staff Education…..……………………………………………………………………………11

3.3 Staff Experience……………………………………………………………………………..11

3.4 Audit Standards & Peer Review.............................…………………………………………..11

3.5 Information Security and Data Handling…………………………………………………11

4.0 DELIVERABLES AND ACCEPTANCE CRITERIA.............................……………………11

4.0

SECTION IV

5.0. CONTRACT ADMINISTRATION

5.1. Meetings

5.2. Communication

5.3. ………………………………………………………………………………………………………………..36

SECTION V

6.0. GENERAL INFORMATION

6.1. Contracting Officer’s Representative (COR) Responsibilities

6.2. Installation Point of Contact (POC) Responsibilities

6.3. Place of Performance

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

6.4. Travel

6.5. Privacy Act

SECTION VI

7.0. SECURITY

7.1. Base Access

7.2. Non-Disclosure Agreement

7.3. Intellectual Property

7.4. Information Security

7.5. Personnel Security

7.6. Background Investigation

SECTION VII

8.0 APPENDIX

8.1. DEFINITIONS & ABBREVIATIONS

8.2. Sample Weekly Status Reports or as agreed upon by COR

8.3. Sample Contract Progress Report

8.4. NAFI Observed Holidays

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1. General.

The Air Force Services Center (AFSVC), headquartered at Joint Base San Antonio- Lackland, Texas, delivers Services programs and activities to build and sustain ready and resilient Airmen, Guardians and families. Air Force Services Center supports the bases, major commands and air staff by providing technical assistance, new initiatives, developing programs and procedures and managing central support functions. Air Force Services Center ensures successful operation of essential food, fitness, childcare, lodging and recreation opportunities for military members and their families. The Center’s responsibilities include preparing responses to high-level inquiries, providing technical assistance to the field and developing new programs that support major command and installation activities. The Financial Management Directorate (VF) manages the Nonappropriated Fund (NAF) Public Accountant Contract Audit (PACA) audit program centrally which supports a worldwide mission providing an oversight of internal controls, cash management and financial information to installations at the enterprise level.

1.2. Background.

1.2.1 Nonappropriated Fund (NAF) installations provide support services and activities for military personnel, families and authorized patrons. Proper management and accountability of Nonappropriated Fund resources are critical to ensuring continued service delivery and the protection of government interests. Regular audits are required to evaluate the financial status, internal controls and operational effectiveness of Nonappropriated Fund operations. The Air Force Services Center Financial Management, Strategic Policy & Financial Operations Branch, AFSVC/VFSF manages and administers audit oversight to Central Funds and the Public Accountant Contract Audit (PACA) Program to ensure compliance with annual audit requirements of financial statements audits of the Nonappropriated Fund Instrumentalities (NAFIs) and that adequate audit coverage is provided Air Force wide for the Nonappropriated Fund Instrumentalities (NAFIs) Services activities. The term (Activities) refers to the various operational organizations within the Air Force structure, such as Air Force Shared Services Center, Air Force Venture Gaming, Air Fore Cadet Dining, and other Commander’s Special Interest Audits. Audit engagements include specific audits in areas on accounting practices, internal control procedures, inventories, cash controls, fixed assets, food and beverage

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

operations, gaming programs, central programs, agreed-upon procedures of specific activity programs, shared service center operations.

The following selective list briefly describes some of the Services activities requiring special/regional audits.

A. SHARED SERVICE CENTER. Conduct a performance audit of the Shared Service Center (SSC) at the Air Force Services Center (AFSVC) located in San Antonio, TX. The primary objective of the performance audit is to address the economy and efficiency aspects. The scope of the work shall include, but is not limited to, these areas, accounting processes, cost allocation, service level agreement, metrics, technology system resources. Further details will be outlined in the project assignment document.

B. Department of Air Force VENTURE GAMING PROGRAM. The Department of Air Force (DAF) venture gaming program provides a recreational opportunity to Service members and adult family members (21 years old and older) at overseas locations and is an important source of revenue to maintain and improve Air Force Morale, Welfare, Recreation resiliency and readiness programs at all Air Force installations. The program is authorized by Department of Defense Instruction (DoDI) 1015.10 and is centrally managed by Air Force Services Center in San Antonio, TX. The operation of slot machines is particularly risky due to regulatory complexities, high revenue volume and potential for manipulation which in turn could affect the financial health of Morale, Welfare, Recreation (MWR) programs.

C. Air Force CADET DINING. The Fund is a Supplemental Mission Nonappropriated fund instrumentality (NAFI) of the United States Government operated by the US Air Force Academy 10th Force Support Squadron (10th FSS) located in Colorado. A Supplemental Mission Fund is defined as “A Nonappropriated fund instrumentality designated to receive Nonappropriated funds (NAFs) generated as the result of installation operation of mission programs such as training, food service, education, and security.” Supplemental Mission Nonappropriated Fund Instrumentalities (NAFIs) are authorized congressionally appropriated funds (APFs) for management personnel, custodial and janitorial service, printing and reproduction, and supplies, equipment, and internet operation not related to the sale of merchandise or services. Nonappropriated funds are used only for the purchase of food and maintenance of the Nonappropriated fund instrumentality (NAFI) financials. United States Air Force Academy Cadet Dining

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

Fund provides dining operations for over 4,400 cadets at the United States Air Force Academy.

D. Commander’s Special Interest Audits. To address immediate, unplanned operational needs, the Government requires the capacity to execute ad hoc, targeted investigations known as Commander’s Special Interest Audits. These audits may be requested at any given time by Installation Commanders, the AFSVC Commander, or other higher headquarters to address immediate operational concerns, suspected material control failures, or strategic risk areas.

These ad hoc engagements may encompass any Air Force Installation, NAF Activity, or fund within the scope of this contract, and will be ordered and executed as individual, consolidated performance audit task orders in accordance with the established deliverables and pricing schedules.

1.3 Scope.

1.3.1 Air Force Services Center requires audit services of licensed Certified Public

Accountants (CPAs) or CPA firms, to perform financial statement audits of the Air Force Nonappropriated Fund Instrumentalities (NAFIs) financial statements and performance audit of the Nonappropriated fund instrumentality (NAFI) Services activities with particular emphasis on high-risk areas identified through a preliminary risk assessment and annual selection matrix.

SECTION II

2.0 PROBLEM STATEMENT

2.1 Objective

The primary objectives of this contract are as follows:

2.1.1 Conduct a comprehensive audit of the financial statements, transactions and internal controls of Nonappropriated Fund (NAF) Air Force Shared Services Center (SSC), Air Force Venture Gaming, Air Force Cadet Dining, and Commander’s Special Interest Audits. AFSVC is seeking to contract an audit firm for a 5-year period, structured with a base year and four (4) subsequent option years. AFSVC intends to issue initial Base Year task orders requiring dual-year financial statement audits encompassing two distinct historical fiscal years as designated in the individual task orders (e.g., FY24 and FY25). .

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

While financial statement audits will examine specific, historical fiscal years, performance audits will be conducted on an as-needed basis with the specific scope defined in individual task orders

2.1.2 Identify discrepancies, inefficiencies and non-compliance with relevant regulations

2.1.3 Assess the adequacy of internal controls within Nonappropriated Fund (NAF) operations, identify weaknesses and provide recommendations to improve internal controls, financial management and operational processes.

2.1.4 Conduct audits of gaming operations (e.g., slot machines) to ensure compliance with gaming regulations and internal controls.

2.1.5 Ensure that Nonappropriated Fund (NAF) activities are compliant with all applicable Department of Defense policies, guidelines and regulatory framework.

2.1.6 Air Force Services Center (AFSVC) requires a comprehensive assessment of the financial and operational integrity of the Nonappropriated Fund (NAF) special activities; Air Force Venture Gaming, Air Force Cadet Dining and the Air Force Services Center Shared Services Center (SSC), and Commander’s Special Interest Audits to ensure compliance with applicable policies, regulations, internal controls and best practices for the stewardship of funds. Specific audit areas,and installations. will be defined in individual task orders. To achieve this objective, the Contractor will evaluate key operational areas to include:

• 2.1.6.1 Financial Audits: Conduct audits of financial statements, including balance sheets, income statements, and cash flow statements. Review financial transactions for accuracy and compliance with Nonappropriated Fund (NAF) policies. Identify and document any irregularities, fraud, or potential mismanagement of funds, and review financial transactions in high- risk areas (area or irregular transactions, unapproved disbursements and cash flow reports). Auditors conduct detailed internal control testing and issue an official opinion related to financial statements and accounts.

• 2.1.6.2 Performance and Operational Audits: Conduct performance audits in accordance with Government Auditing Standards (GAGAS) to assess whether Nonappropriated Fund (NAF) activities are achieving economy, efficiency, and effectiveness. These audits will include an evaluation of day-to-day operational processes, resource allocation, staffing levels, and service delivery methods.

Conduct root-cause analyses and issue a final performance audit report with actionable recommendations to optimize resources and improve operational performance.

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

• 2.1.6.3 Internal Control Evaluation: Evaluate the design and operational effectiveness of internal controls specifically established to safeguard Nonappropriated Fund (NAF) assets and prevent fraud, waste, and abuse.

Evaluation will focus on key transactional guardrails, including the segregation of duties, management approval thresholds, physical security of inventory and cash, and system access rights. Contractor will identify control gaps and recommend specific, practical enhancements to strengthen the installation’s protective control environment.

• 2.1.6.4 Compliance Review: Evaluate the Nonappropriated Fund (NAF) activity’s compliance with Department of Defense DoD Instructions, local policies, and applicable financial regulations. Ensure compliance with applicable Nonappropriated Fund (NAF) accounting standards and reporting requirements.

• 2.1.6.5 Reporting: Prepare detailed, evidence-based audit reports that provide clear, actionable insights to relevant stakeholders. Identify root cause and quantify operational or financial impact of each vulnerability. Provide management with specific, practical corrective actions that can be realistically implemented. Present findings and risk-mitigation strategies to relevant stakeholders.

• 2.1.6.6 Technology Systems: As part of the general financial and performance audit scope (and not as a standalone IT system audit), evaluate the effectiveness and efficiency of currently utilized information technology resources. Evaluation will focus on identifying internal control weaknesses related to system access, physical and logical security measures protecting Shared Services Center (SSC) systems, standard security policies, and emergency contingency and backup recover operations.

• 2.1.6.7 Prior Audit Resolution: Review prior Public Accountant Contract Audit (PACA) reports to evaluate and verify through independent testing whether previously identified weaknesses and recommendations have been appropriately remediated and closed. The Contractor will document the status of all prior findings in the draft and final audit reports. Any unresolved, recurring, or unmitigated “repeat findings” must be explicitly highlighted in the report.

2.2 Final Outcome

2.2.1 Air Force Services Center (AFSVC) needs to assess the financial and operational integrity of the Nonappropriated Fund (NAF) activities, ensuring compliance with applicable policies, regulations and best practices for the stewardship of funds.

Department of Air Force Manual 34-201, section 2.9. illustrates the necessity to use

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

Public Accountant firms periodically to review and audit Nonappropriated Fund Instrumentality (NAFI)’s according to Air Force Instruction 65-301, Audit Reporting Procedures, and Air Force Instruction 65-403, Follow-up on Internal Air Force Audit Reports. This supports Department of Defense Instruction 7600.06 Audit of Nonappropriated Fund Instrumentalities and related activities. Audits must be conducted and reported in accordance with generally accepted auditing standards in the United States of America and the standards contained in the latest version of the Government Auditing Standards, issued by the Comptroller General of the United States and follow Government Auditing Standards. Department of Defense 7000.14-R Compliance: Ensure adherence to the Department of Defense (DoD) Financial Management Regulation (DoD 7000.14-R), which governs Nonappropriated Fund operations. This includes confirming that financial activities, reporting, and resource allocation align with Department of Defense and Air Force guidelines. Review compliance with Air Force Instructions and Manuals: DAFMAN 34-201 Use of Nonappropriated Funds (NAFs) & DAFI 34-101 Morale, Welfare, and Recreation (MWR) Programs and Use Eligibility, DAFMAN 34-151 Gaming Operating Procedures, USAFAI 34-104 Operating the Cadet Dining Facility, particularly AFMAN 34-209 Non-Appropriated Fund Financial Management and Accounting and AFMAN 34-202 Procedures for Protecting Nonappropriated Funds Assets. Ensure that Nonappropriated Fund (NAF)operations, including accounting, procurement, and cash handling, meet Air Force standards. Regulatory Adherence: Verify that all Nonappropriated Fund (NAF) activities (including slot machines, procurement, and payroll) comply with applicable federal, state, and local laws. This may include gaming regulations and tax reporting requirements (e.g., IRS Form W-2G for slot machine winnings).

2.2.2 This document is not intended to be a comprehensive manual of audit procedures, nor is it intended to replace the auditor’s professional judgment as to the work required to accomplish their audit objectives. In the audits, the Contractor shall provide all services, travel, and project supervision, as required in connection with this Statement of Objective (SOO).

2.2.3. Express an opinion on whether the consolidated financial statements for the fiscal year ending 30 September fairly represent the financial position, results of operations, and the sources and uses of funds are in conformity with generally accepted accounting principles for the prior twelve-month period. The audit shall include a review of both historical financial data and current operational practices.

2.2.4. Express an opinion on compliance with policies, policy letters, regulations, laws, and directives that may have a material effect on the financial statements.

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

2.2.5. Audit personnel gather evidence to obtain reasonable assurance and express an opinion on whether the subject matter is presented in accordance with established criteria.

2.2.6. Thoroughly review general controls surrounding financial data processing systems to determine whether:

2.2.7. Controls have been designated according to management direction and known legal requirements.

2.2.8. Controls are operating effectively to provide reliability of and security over the data being processed.

2.2.9. Determine whether cash investments exceed normal working capital requirements and are in accordance with applicable regulations and sound financial management practices.

2.2.10. Determine whether cash and other assets are fairly presented, adequately managed, and controlled.

2.2.11. Determine whether transactions with related parties and interrelationships of Nonappropriated Fund (NAF) funds is proper.

2.2.12. Determine whether the accounting treatment for assets, liabilities, expenses, and revenues is proper.

2.2.13. Determine whether revenues and receivables are properly recorded and adequately controlled.

2.2.14. Determine whether expenses are adequately controlled, properly classified, and are reasonable in amount as compared with budget estimates, prior years, and revenues of the current audit year.

2.2.15. Determine whether fixed assets are adequately controlled and are properly valued and depreciated based on reasonableness.

2.2.16. Determine whether liabilities are recorded and properly stated.

2.2.17. Determine whether equity accounts are properly presented.

2.2.18. Determine whether inventories are properly valued and are adequately controlled and presented.

2.2.19. Determine the status of contracts or agreements for supplies and services to ascertain whether they accurately portray the supplies and/or services expected and

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

required, and whether payment was made in accordance with contract or agreement terms.

2.2.20. Determine whether the internal control structure can be relied upon to safeguard and account for cash, investments, and all other assets.

2.2.21. The audit must be conducted with a focus on ensuring the reliability and integrity of financial data and internal controls.

SECTION III

3.0 CONTRACTOR QUALIFICATIONS

The Contractor must provide a team of qualified personnel possessing the collective professional expertise, education, and security capabilities required to successfully execute the objectives outlined in this Statement of Objectives (SOO).

3.1. Team Lead/Project Manager. The Team lead will be a licensed Certified Public Accountant (CPA) in good standing, possessing a minimum of six (6) years of public accounting audit experience.

This experience must include conducting financial statement, performance, and compliance audits for activities similar in nature to Air Force Nonappropriated Fund Instrumentalities (NAFIs) (e.g., food and beverage, hospitality, recreation, retail, or service-industry operations)

3.2. Staff Education. All staff assigned to perform the audit will possess, at a minimum, a bachelor’s degree in accounting, Finance, or Business Administration from an accredited institution, to include at least twenty-four (24) semester hours in accounting coursework.

3.3 Staff Experience. Audit staff assigned to the contract will possess a minimum of two (2) years of professional audit experience. Collectively, the audit team must demonstrate experience auditing hospitality, retail, or recreational activities similar to those described in the background of this Statement of Objective (SOO).

3.4 Audit Standards & Peer Review. The contracting firm will be a licensed Certified Public Accountant (CPA) firm in good standing with their respective State Board of Public Accountancy. The firm will have received a passing rating on its most recent independent peer review conducted in accordance with Generally Accepted Government Auditing Standards (GAGAs/Yellow Book)

3.5 Information Security and Data Handling. The Contractor will utilize secure, DoD compliant file repository and transfer protocol capable of securing Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII) in accordance with NIST SP 800-171 standards.

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

4.0 DELIVERABLES, MILESTONE SCHEDULE, AND ACCEPTANCE CRITERIA

The Contractor will provide deliverable(s) in a format that all reports are compatible with Microsoft Office, and Adobe Acrobat Pro .pdf. All reports will be provided in electronic file format in addition to a hard copy of the final audit report to the audited installation POC and AFSVC COR. They must be approved by the Contracting Officer’s Representative (COR) and designated representative from AFSVC prior to acceptance and must be capable of obtaining a viable assessment and authorization. (See paragraph 6.0) A comprehensive audit plan that outlines the methodology, approach and timeline for performing the audit will be provided to the Contracting Officer’s Representative prior to any audit engagement. Regular and recurring updates on audit progress, findings and any issues encountered during the audit progress will be addressed in a timely manner. The draft report will outline findings, recommendations and areas of concern. The final audit report will be a finalized audit report incorporating any feedback from the draft with a clear presentation of findings, recommendations and conclusions. A formal presentation/briefing will be afforded to the audited activity’s senior leadership.

4.1 Applicability of Deliverables: The deliverables outlined in the sections below apply to both Financial Statement Audits and Performance Audits. Because the scope and operational effort vary, the Contractor will perform and invoice these services as separate, individual deliverables in accordance with the contract pricing schedule for each audit type.

4.1.1 For Financial Statement Audits, each individual deliverable applies to a single, individual fund audit.

4.1.2. For Performance Audits, each individual deliverable applies to a consolidated audit engagement encompassing the designated activities on a single installation during a single site visit.

4.2. Deliverables for Financial Statement Audits

4.3 Base Year Deliverables (Auditing Designated Fiscal Year(s), up to a Dual-Year, as defined in individual task orders)

4.3.1.1Audit Plan: The Contractor will provide a detailed audit plan within ten (10) business days of the kickoff meeting to include preliminary itinerary showing the approximate fieldwork dates, list of audit team members (indicating the on-site team lead for each installation), and any projected days the Contractor’s resources will be

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

unavailable. Fieldwork will not exceed four (4) weeks and will be performed during the regular operating hours of the activity being audited.

4.3.1.1Audit plan will include but is not limited to, the following: planning to determine the nature, timing and extent of audit procedures, obtaining financial and other information, communicating with appropriate personnel (in/out briefings), performing specific procedures on-site and providing the audit reports. Fieldwork for this engagement must be performed at the respective sites where the records are maintained.

4.3.1.2The Contractor will provide a realistic, detailed project plan outlining the tasks and subtasks for both the Air Force and the Contractor based on the deliverables and requirements listed in this Statement of Objectives (SOO).

Once the submitted plan/schedule is approved by the Contracting Officer’s Representative (COR), the Contractor will deliver in accordance with approved schedule.

4.3.1.3. All forecasted or unexpected delays to the schedule must be reported to the Contracting Officer’s Representative (COR) within one (1) business day of discovery. The Contractor will provide reason for delay and proposed resolutions to the Contracting Officer’s Representative (COR) no later than 1600 Central Standard Time (CST) the same day.

4.3.1.4. If a delay occurs and is the result of Contractor error, the Contractor will submit a revised schedule to the Contracting Officer’s Representative (COR) for review and approval within two workdays of recognition or delay.

4.3.2. PBC List and Audit In-Brief. The Contractor will submit the initial Provided by Client (PBC) document request list to the designated installation Points of Contact (POCs) no later than fifteen (15) calendar days prior to arriving on-site. The contractor will then prepare a brief presentation and conduct a formal in-brief meeting on-site with the designated Points of Contacts and installation leadership. The in-brief will explicitly outline the audit schedule, methodology, communication plan, and status of the previously requested PBC documents. On-site fieldwork will begin on the day of, or the business day immediately following the in-brief.

4.3.3. Audit Out-Brief. All audit fieldwork will be fully completed within four (4) weeks of the In-Brief. The Contractor will prepare and conduct a formal on-site out-brief meeting with installation leadership and designated Points of Contacts on the final day of on-site fieldwork. The briefing will present preliminary findings, identify any

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

immediate high-risk vulnerabilities, and ensure mutual understanding of the audit’s initial outcomes before the audit team departs the installation.

4.3.4. Preliminary Draft Audit Report: The Contractor will provide the Contracting Officer’s Representative (COR) and audited installation Point of Contact (POC) with a preliminary draft audit report within four (4) weeks of the completion of audit fieldwork. The draft will include the draft independent Auditor’s Report, proposed adjustments, and a draft of the Management Letter detailing initial internal control findings. This preliminary draft is intended to initiate the initial management review and comment cycle.

4.3.5. Draft Audit Report: Within ten (10) business days of receiving the government’s initial review comments on the preliminary draft, the Contractor will submit a formal draft financial audit report. This report will incorporate accepted management feedback, resolve proposed audit adjustments, and include the updated draft of the Independent Auditor’s Report and the updated draft Management Letter. The report will be provided to the Contracting Officer’s Representative (COR), the Installation Point of Contact, and other designated recipients (to be determined).

4.3.6. Final Audit Report: The final audit report will be issued by the audit firm within ten (10) business days of the approved draft audit report. The final report package will include the signed, finalized Independent Auditor’s Report (audit opinion) bound to the audited financial statements, and the final Management Letter detailing any identified internal control deficiencies. The report will be provided to the COR, the Installation POC, and other designated recipients (to be determined).

4.3.7. Progress and Summary Reports (see sample 8.2 and 8.3); The Contractor will provide weekly and monthly status reports and/or other updates as needed to the Contracting Officer’s Representative (COR). Updates will include status of tasks completed and planned as well as any summary/interim progress report. The status report must identify action and/or items completed by individual contract resources, planned task/activities, risks and status updates.

4.3.7.1. Provide a list of planned task/activities for the week in the status report. Subsequent status reports will include the completed percentage of completion of the previous week’s planned task/activities and a new list of planned activities for the following week (See 8.2 Sample Weekly Status Report).

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

4.3.7.2. The Contractor will provide a monthly contract progress report, with their monthly invoice, consistent with the submitted and Contracting Officer’s Representative (COR) approved weekly status reports. (See 8.3 Contract Progress Report).

4.3.7.3. The Contractor will provide a monthly summary/interim progress report with an executive summary section of audit results and a cross feed of audit result information in a matrix format to report systemic weaknesses and deficiencies identified during the audit.

4.4. Option Year 1 Deliverables (Auditing Designated Fiscal Year(s) as defined in individual Task Orders)

4.4.1. Audit Plan: The Contractor will provide a detailed audit plan within ten (10) business days of the kickoff meeting to include preliminary itinerary showing the approximate fieldwork dates, list of audit team members (indicating the on-site team lead for each installation), and any projected days the Contractor’s resources will be unavailable.

Fieldwork will not exceed four (4) weeks and will be performed during the regular operating hours of the activity being audited.

4.4.1.1. Audit plan will include but is not limited to the following: planning to determine the nature, timing and extent of audit procedures, obtaining financial and other information, communicating with appropriate personnel (in/out briefings), performing specific procedures on-site and providing the audit reports. Fieldwork for this engagement must be performed at the respective sites where the records are maintained (Shared Services Center, Department of Air Force Gaming Program slot locations, Air Force Cadet Dining Activity).

4.4.1.2. The Contractor will provide a realistic, detailed project plan outlining the tasks and subtasks for both the Air Force and the Contractor based on the deliverables and requirements listed in this Statement of Objectives (SOO). Once the submitted plan/schedule is approved by the Contracting Officer’s Representative (COR), the Contractor will deliver in accordance with approved schedule.

4.4.1.3. All forecasted or unexpected delays to the schedule must be reported to the Contracting Officer’s Representative (COR) within one (1) business day of discovery. The Contractor will provide reason for delay and proposed resolutions to the Contracting Officer’s Representative (COR) no later than 1600 Central Standard Time (CST) the same day.

4.4.1.4. If a delay occurs and is the result of Contractor error, the Contractor will submit a revised schedule to the Contracting Officer’s Representative (COR) for review and approval within two workdays of recognition or delay.

1 October 2026

RFQ F41999-26-Q-

4.4.2. PBC List and Audit In-Brief. The Contractor will submit the initial Provided by Client (PBC) document request list to the designated installation Points of Contact (POCs) no later than fifteen

(15) calendar days prior to arriving on-site. The contractor will then prepare a brief presentation and conduct a formal in-brief meeting on-site with the designated Points of Contacts and installation leadership. The in-brief will explicitly outline the audit schedule, methodology, communication plan, and status of the previously requested PBC documents. On-site fieldwork will begin on the day of, or the business day immediately following the in-brief.

4.4.3. Audit Out-Brief. All audit fieldwork will be fully completed within four (4) weeks of the In- Brief. The Contractor will prepare and conduct a formal on-site out-brief meeting with installation leadership and designated Points of Contacts on the final day of on-site fieldwork. The briefing will present preliminary findings, identify any immediate high-risk vulnerabilities, and ensure mutual understanding of the audit’s initial outcomes before the audit team departs the installation.

4.4.4. Preliminary Draft Audit Report: The Contractor will provide the Contracting Officer’s Representative (COR) and installation Point of Contact with a preliminary draft audit report within four (4) weeks of the completion of audit fieldwork. The draft will include the draft Independent Auditor’s Report, proposed adjustments, and a draft of the Management Letter detailing initial internal control findings. This preliminary draft is intended to initiate the initial management review and comment cycle.

4.4.5. Draft Audit Report: Within ten (10) business days of receiving the government’s initial review comments on the preliminary draft, the Contractor will submit a formal draft financial audit report.

This report will incorporate accepted management feedback, resolve proposed adjustments, and include the updated draft of the Independent Auditor’s Report and the updated Management Letter.

The report will be provided to the Contracting Officer’s Representative (COR), the installation Point of Contact, and other designated recipients (to be determined).

4.4.6. Final Audit Report: The final audit report will be issued by the audit firm within ten (10) business days of the approved draft financial audit report. The final report package will include the signed, finalized Independent Auditor’s Report (audit opinion) bound to the audited financial statements, and the final Management Letter detailing any identified internal control deficiencies.

The report will be provided to the Contracting Officer’s Representative (COR), the installation Point of Contacts, and other designated recipients (to be determined).

4.4.7. Progress and Summary Reports (see sample 8.2 and 8.3); The Contractor will provide weekly and monthly status reports and/or other updates as needed to the Contracting Officer’s

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

Representative (COR). Updates will include status of tasks completed and planned as well as any summary/interim progress report. The status report must identify action and/or items completed by individual contract resources, planned task/activities, risks and status updates.

4.4.7.1. Provide a list of planned task/activities for the week in the status report. Subsequent status reports will include the completed percentage of completion of the previous week’s planned task/activities and a new list of planned activities for the following week (See 8.2 Sample Weekly Status Report).

4.4.7.2. The Contractor will provide a monthly contract progress report, with their monthly invoice, consistent with the submitted Contracting Officer’s Representative (COR) approved weekly status reports. (See 8.3 Contract Progress Report)

4.4.7.3. The Contractor will provide a monthly summary/interim progress report with an executive summary section of audit results and a cross-feed of audit result information in a

4.5. Option Year 2 Deliverables (Auditing Fiscal Year 2026)

4.5.1. Audit Plan: The Contractor will provide a detailed audit plan within ten (10) business days of the kickoff meeting to include preliminary itinerary showing the approximate fieldwork dates, list of audit team members (indicating the on-site team lead for each installation), and any projected days Contractor’s resources will be unavailable. Fieldwork will not exceed four (4) weeks and will be performed during the regular operating hours of the activity being audited.

4.5.1.1. Audit plan will include but is not limited to the following: planning to information, communicating with appropriate personnel (in/out briefings), performing specific procedures on-site and providing the audit reports. Fieldwork for this engagement must be performed at the respective sites where the records are maintained (Shared Services

4.5.1.2. The Contractor will provide a realistic, detailed project plan outlining the requirements listed in this Statement of Objectives (SOO). Once the submitted plan/schedule is approved by the Contracting Officer’s Representative (COR), the Contractor will deliver in

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

accordance with approved schedule.

4.5.1.3. All forecasted or unexpected delays to the schedule must be reported to the

Contracting Officer’s Representative (COR) within one (1) business day of discovery. The Contractor will provide reason for delay and proposed resolutions to the Contracting Officer’s Representative (COR) no later than 1600 Central Standard Time (CST) the same day.

4.5.1.4. If a delay occurs and is the result of Contractor error, the Contractor will

4.5.2. PBC List and Audit In-Brief. The Contractor will submit the initial Provided by Client (PBC) document request list to the designated installation Points of Contact (POCs) no later than fifteen (15) calendar days prior to arriving on-site. The contractor will then prepare a brief presentation and conduct a formal in-brief meeting on-site with the designated Points of Contacts and installation leadership. The in-brief will explicitly outline the audit schedule, methodology, communication plan, and status of the previously requested PBC documents. On-site fieldwork will begin on the day of, or the business day immediately following the in-brief.

4.5.3. Audit Out-Brief. All audit fieldwork will be fully completed within four (4) weeks of the In- Brief. The Contractor will prepare and conduct a formal on-site out-brief meeting with installation leadership and designated Points of Contacts on the final day of on-site fieldwork. The briefing will present preliminary findings, identify any immediate high-risk vulnerabilities, and ensure mutual understanding of the audit’s initial outcomes before the audit team departs the installation.

4.5.4. Preliminary Draft Audit Report: The Contractor will provide the Contracting Officer’s Representative (COR) and audited installation Point of Contact with a preliminary draft audit report within four (4) weeks of the completion of audit fieldwork. The draft will include the draft Independent Auditor’s Report, proposed adjustments, and a draft of the Management Letter detailing initial internal control findings. This preliminary draft is intended to initiate the initial management review and comment cycle.

4.5.5. Draft Audit Report: Within ten (10) business days of receiving the government’s initial review comments on the preliminary draft, the Contractor will submit a formal draft financial audit report.

This report will incorporate accepted management feedback, resolve proposed adjustments, and include the updated draft of the Independent Auditor’s Report and the updated draft Management Letter. The report will be provided to the Contracting Officer’s Representative (COR), the audited activity Point of Contact, and other designated recipients (to be determined).

1 October 2026

RFQ F41999-26-Q-

4.5.6. Final Audit Report: The final audit report will be issued by the audit firm within ten (10) business days of the approved draft audit report. The final report package will include the signed, finalized Independent Auditor’s Report (audit opinion) bound to the audited financial statements, and the final Management Letter detailing any identified internal control deficiencies. The report will be provided to the Contracting Officer’s Representative (COR), the installation Point of Contacts, and other designated recipients (to be determined).

4.5.7. Progress and Summary Reports (see sample 8.2 and 8.3); The Contractor will provide weekly and monthly status reports and/or other updates as needed to the Contracting Officer’s Representative (COR). Updates will include status of tasks completed and planned as well as any summary/interim progress report. The status report must identify action and/or items completed by individual contract resources, planned task/activities, risks and status updates.

4.5.7.1. Provide a list of planned task/activities for the week in the status report. Subsequent status reports will include the completed percentage of completion of the previous week’s planned

4.5.7.2. The Contractor will provide a monthly contract progress report, with their monthly

4.5.7.3. The Contractor will provide a monthly summary/interim progress report with an executive summary section of audit results and a cross feed of audit result information in a

4.6. Option Year 3 Deliverables (Auditing Designated Fiscal Year as defined in individual task orders)

4.6.1. Audit Plan: The Contractor will provide a detailed audit plan within ten (10) business days of the kickoff meeting to include preliminary itinerary showing the approximate fieldwork dates, list of audit team members (indicating the on-site team lead for each installation), and any projected days Contractor’s resources will be unavailable. Fieldwork

4.6.1.1. Audit plan will include but is not limited to the following: planning to

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

information, communicating with appropriate personnel (in/out briefings), performing specific procedures on-site and providing the audit reports. Fieldwork for this engagement must be performed at the respective sites where the records are maintained (Shared Services

4.6.1.2. The Contractor will provide a realistic, detailed project plan outlining the requirements listed in this Statement of Objectives (SOO). Once the submitted plan/schedule accordance with approved schedule.

4.6.1.3. All forecasted or unexpected delays to the schedule must be reported to the

Contracting Officer’s Representative (COR) within one (1) business day of discovery. The Contractor will provide reason for delay and proposed resolutions to the Contracting Officer’s Representative (COR) no later than 1600 Central Standard Time (CST) the same day.

4.6.1.4. If a delay occurs and is the result of Contractor error, the Contractor will

4.6.2. PBC List and Audit In-Brief. The Contractor will submit the initial Provided by Client (PBC)

(15) calendar days prior to arriving on-site. The contractor will then prepare a brief presentation and conduct a formal in-brief meeting on-site with the designated Points of Contacts and installation leadership. The in-brief will explicitly outline the audit schedule, methodology, communication plan, and status of the previously requested PBC documents. On-site fieldwork will begin on the day of, or the business day immediately following the in-brief.

4.6.3. Audit Out-Brief. All audit fieldwork will be fully completed within four (4) weeks of the In- Brief. The Contractor will prepare and conduct a formal on-site out-brief meeting with installation leadership and designated Points of Contacts on the final day of on-site fieldwork. The briefing will present preliminary findings, identify any immediate high-risk vulnerabilities, and ensure mutual understanding of the audit’s initial outcomes before the audit team departs the installation.

4.6.4. Preliminary Draft Audit Report: The Contractor will provide the Contracting Officer’s Representative (COR) and audited installation Point of Contact with a preliminary draft audit report within four (4) weeks of the completion of audit fieldwork. The draft will include the draft

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

Independent Auditor’s Report, proposed adjustments, and a draft of the Management Letter detailing initial internal control findings. This preliminary draft is intended to initiate the initial management review and comment cycle.

4.6.5. Draft Audit Report: Within ten (10) business days of receiving the government’s initial review comments on the preliminary draft, the Contractor will submit a formal draft financial audit report.

This report will incorporate accepted management feedback, resolve proposed adjustments, and include the updated draft of the Independent Auditor’s Report and the updated draft Management Letter. The report will be provided to the Contracting Officer’s Representative (COR), the audited installation Point of Contact, and other designated recipients (to be determined).

4.6.6. Final Audit Report: The final audit report will be issued by the audit firm within ten (10) business days of the approved draft audit report. The final report package will include the signed, finalized statements, and the Management Letter detailing any identified internal control deficiencies. The report will be provided to the Contracting Officer’s Representative (COR), the installation Point of Contacts, and other designated recipients (to be determined).

4.6.7. Progress and Summary Reports (see sample 8.2 and 8.3); The Contractor will provide weekly and monthly status reports and/or other updates as needed to the Contracting Officer’s Representative (COR). Updates will include status of tasks completed and planned as well as any summary/interim progress report. The status report must identify action and/or items completed by individual contract resources, planned task/activities, risks and status updates.

4.6.7.1. Provide a list of planned task/activities for the week in the status report. Subsequent status reports will include the completed percentage of completion of the previous week’s planned

4.6.7.2. The Contractor will provide a monthly contract progress report, with their monthly

4.6.7.3. The Contractor will provide a monthly summary/interim progress report with an executive summary section of audit results and a cross-feed of audit result information in a matrix format to report systemic weaknesses and deficiencies identified during the audit.

4.7. Option Year 4 Deliverables (Auditing designated Fiscal Year as defined in individual Task Orders)

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

4.7.1. Audit Plan: The Contractor will provide a detailed audit plan within ten (10) business days of the kickoff meeting to include preliminary itinerary showing the approximate fieldwork dates, list of audit team members (indicating the on-site team lead for each installation), and any projected days Contractor’s resources will be unavailable. Fieldwork

4.7.1.1. Audit plan will include but is not limited to the following: planning to information, communicating with appropriate personnel (in/out briefings), performing specific procedures on-site and providing the audit reports. Fieldwork for this engagement must be performed at the respective sites where the records are maintained (Shared Services

4.7.1.2. The Contractor will provide a realistic, detailed project plan outlining the requirements listed in this Statement of Objectives (SOO). Once the submitted plan/schedule accordance with approved schedule.

4.7.1.3. All forecasted or unexpected delays to the schedule must be reported to the

Contracting Officer’s Representative (COR) within one (1) business day of discovery. The Contractor will provide reason for delay and proposed resolutions to the Contracting Officer’s Representative (COR) no later than 1600 Central Standard Time (CST) the same day.

4.7.1.4. If a delay occurs and is the result of Contractor error, the Contractor will

4.7.2. PBC List and Audit In-Brief. The Contractor will submit the initial Provided by Client (PBC)

(15) calendar days prior to arriving on-site. The contractor will then prepare a brief presentation and conduct a formal in-brief meeting on-site with the designated Points of Contacts and installation leadership. The in-brief will explicitly outline the audit schedule, methodology, communication plan, and status of the previously requested PBC documents. On-site fieldwork will begin on the day of, or the business day immediately following the in-brief.

1 October 2026

RFQ F41999-26-Q-

CUI

CUI

4.7.3. Audit Out-Brief. All audit fieldwork will be fully completed within four (4) weeks of the In- Brief. The Contractor will prepare and conduct a formal on-site out-brief meeting with installation leadership and designated Points of Contacts on the final day of on-site fieldwork. The briefing will present preliminary findings, identify any immediate high-risk vulnerabilities, and ensure mutual understanding of the audit’s initial outcomes before the audit team departs the installation.

4.7.4. Preliminary Draft Audit Report: The Contractor will provide the Contracting Officer’s Representative (COR) and audited installation Point of Contact with a preliminary draft audit report within four (4) weeks of the completion of audit fieldwork. The draft will include the draft Independent Auditor’s Report, proposed adjustments, and a draft of the Management Letter detailing initial internal control findings. This preliminary draft is intended to initiate the initial management review and comment cycle.

4.7.5. Draft Audit Report: Within ten (10) business days of receiving the government’s initial review comments on the preliminary draft, the Contractor will submit a formal draft finandical audit report.

This report will incorporate accepted management feedback, resolve proposed adjustments, and include the updated draft of the Independent Auditor’s Report and the updated draft Management Letter. The report will be provided to the Contracting Officer’s Representative (COR), the audited installation Point of Contact, and other designated recipients (to be determined).

4.6.6. Final Audit Report: The final audit report will be issued by the audit firm within ten (10) business days of the approved draft audit report. The final report package will include the signed, finalized Independent Auditor’s Report (audit opinion) bound to the audited financial statements, and the final Management Letter detailing any identified internal control deficiencies.