Attachment 1 - Draft SOW for OCMO MSC Assessment of Internal Controls.pdf

Statement of Work (SOW)

Department of the Homeland Security (DHS) Customs and Border Protection (CBP)

For the Office of Finance (OF) on The Office of Operations Support (OS)

Office of the Chief Medical Officer (OCMO) Medical Services Contract (MSC)

I. Background

With more than 60,000 employees, U.S. Customs and Border Protection (CBP) is one of the world's largest law enforcement organizations and is charged with keeping terrorists and their weapons out of the U.S. while facilitating lawful international travel and trade. As the U.S.’ first unified border entity, CBP takes a comprehensive approach to border management and control, combining customs, immigration, border security, and agricultural protection into one coordinated and supportive activity.

CBP is committed to the safety, security, and care of all those in its custody. As the migrant population enters the U.S., CBP must provide medical care to ensure their health and well-being and mitigate any medical and public health concerns upon apprehension and processing. CBP ensures that persons in custody, through a Medical Services Contract (MSC), receive high quality care within the appropriate scope of medical support that is compatible with a front-line operational environment where persons will be in custody for a short period of time.

The current MSC is approximately valued at $300M annually, labor and travel. CBP is seeking a contractor with strong understanding of the requirements of the DHS annual financial audit and risks along with the capabilities to assess, establish, and improve internal controls for this critical contract.

II. Objective

The contractor shall assess current operations of the MSC oversight, identify existing or establish new internal controls to effectively manage this essential multimillion-dollar contract, and provide recommendations for process improvements. The goal is to ensure that OCMO leadership and staff have the internal controls in place to ensure effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations.

The MSC is currently managed and overseen within the OCMO, Operations Directorate and includes several appointed CORs.

III. Scope

The scope encompasses reviewing current contract management processes, assessing existing internal controls, developing new and/or refining existing internal controls, developing corrective actions for identified weaknesses, implementing improper payment provisions, and addressing other risk areas potentially impacting financial management and internal controls for the MSC.

The contractor shall at high level:

Conduct risk-based top-down approach determination of the significant processes whose controls need to be documented, assessed, and tested.

Define the weaknesses of processes and current internal control procedures Provide recommendations to remediate identified weaknesses Assist with implementing improper payment provisions mandated by IPIA and IPERA Establish standard procedures and associated training

Tasks to be performed include, but not limited to:

Assess and document existing internal controls and processes being utilized by the OCMO MSC management and oversight team.

Identify additional and/or refined internal controls.

Identify issues that shall impact the reliability of contract and financial oversight, efficiency and effectiveness of MSC oversight and management operations, and compliance with laws and regulations.

Develop and rank an inventory of risks pertaining to MSC management and oversight.

Included should be any results of external (Government Accountability Office (GAO)/Office of Inspector General (OIG)/Financial Statement) and internal (Department of Homeland Security (DHS)/CBP) reviews.

Prepare internal control assessment documentation to support risk management decisions and control identification.

Evaluate, assess, and rank internal control deficiencies identified during the assessment.

Develop internal controls to be put in place and maintained by the OCMO MSC management and oversight team.

Corrective action plans to resolve identified internal control weaknesses, significant deficiencies/reportable conditions, and control deficiencies, including the following topics:

o Issue Description o Root Causes o Key Strategies o Key Performance Measures o Process improvement recommendations

Formal, executive level report that provides the assessment methodology, assessment results, including gaps, and findings, and recommendations.

For these requirements, contractors must possess a comprehensive knowledge of all current provisions under Section F Applicable Documents.

IV. Deliverables

The Contractor shall produce deliverables in a timely manner on the agreed upon schedule.

Draft deliverables shall be provided for review and comment at least 7 working days before date of final deliverable to the OF POC and any other designated individuals. This will facilitate questions and allow for required changes.

All deliverables shall be presented in the current version of the Microsoft suite of software used by CBP unless otherwise stated. The format/structure of each deliverable shall be proposed by the Contractor and approved by the OF POC. The Contractor shall provide the deliverables in one or more forms (electronic, hard copy, and/or compact disc) as specified by COR with direction from the OF POC. Copies of all deliverables, including supporting documentation and analysis, shall be archived in accordance with procedures established within two weeks of completion.

Kickoff Meeting

The Contractor shall attend a Post Award Conference (i.e., Kickoff Meeting) conducted by the CO, COR and the OF POC no later than 3 business days after the date of award. Additional government employees and contractor employees may be invited. The purpose of the Post Award Conference, which will be chaired by the CO, is to discuss objectives of the contract, and to discuss all requirements of the contract. This meeting will be held at the Government’s facility located in Washington, DC.

Weekly Status Reports

The Contractor shall email weekly status reports to COR and the OF POC commencing no later than the first Friday following the kick-off meeting.

At a minimum, this report shall include a narrative description of the following items:

Executive Summary (1 page) providing:

o A bulletized status update including an assessment of the conduct of the undertaking (red = significant issues, yellow = concerns exist, green = no impediment to timely completion) o Estimated percentage complete o 2-3 Executive-level talking points for communicating with CBP leadership

Management Summary - Document any major problems/issues and any significant progress or events.

Resource Expenditures - Funds expended during the reporting period at the cumulative total, and funds remaining on the Contract by CLIN as applicable.

Narrative - Description of work performed in conjunction with the tasks/deliverables during the reporting period and work anticipated to be performed during the next reporting period, including discussions of any problems/issues to include recommendations for correction by the next report.

Specific coordination requests the Contractor requests CBP to undertake to help alleviate an identified problem.

Should the weekly report fall on a Federal Holiday, the report is to be submitted the first Federal workday after holiday.

Bi-weekly In-person Meeting

The Contractor shall be prepared to conduct a bi-weekly in-person status update to the OF POC, COR and/or other designated officials. This meeting may occur virtually, but the Contractor shall be prepared for in-person meetings – especially for the kick-off and initial meeting.

Final Report and Executive Briefing

The Contractor shall provide an executive level final report on the MSC internal controls and oversight that shall include, at a minimum, Assessment of existing internal controls, processes, management, and oversight.

Ranked inventory and impact of internal control, process, management and oversight deficiencies and risk Recommended remediation plan on any deficiencies found.

Recommendations for additional and/or refined internal controls, processes, management, and oversight.

The final report is due three (3) days before the end of the period of performance.

The Contractor shall compile and present, in person, an executive briefing to the CBP Chief Financial Officer (CFO), Deputy CFO, and other executive leadership. The contents of the briefing should include findings and recommendations, and not exceed 8 slides. This briefing is to be scheduled no later than 2 weeks before the end of the period of performance, with the briefing occurring no later than 3 days before the end of the period of performance.

The Contractor shall provide a draft of the final report and executive briefing for review and comment to the designated OF POC and COR no later than 2 weeks before the deliverables are due. The OF POC and COR will provide comments within 3 working days to the contractor for adjudication.

V. Specific Contractor Requirements

a) The Contractor shall be available to engage in on-site meetings as required within a 24-hour notification within a 50-mile radius of Washington, DC. Time required to be available at any location beyond the 50-mile radius will be agreed upon by the OF Point of Contact (POC) and/or the Contracting Officer’s Representative (COR) and the Contractor.

b) The Contractor shall identify a full-time Program Manager (PM), which is a key position, to provide centralized administration of all aspects included in this effort. The Contractor shall not replace the PM without written notification by the OF POC and COR no later than two weeks before the proposed replacement. The PM shall maintain continuous open lines of communication with the COR and the OF POC

c) The Contractor shall be responsible for maintaining qualified employees throughout the life of the contract. The required minimum qualifications are set forth below and will continue as the minimum standards for all personnel hired during the course of performance under this contract.

d) All personnel must be able to pass a CBP background investigation. The identified key personnel must be available and on site no later than ten working days after the period of performance begins. CBP may accept an interim background investigation based on the circumstances and expertise of the prospective Contractor. These requests shall be in writing and routed through the COR, OF POC, and CO.

e) All proposed replacements shall possess qualifications equal to or superior to those of personnel being replaced. The OF POC and COR must be notified in writing and approve any personnel replacement actions no later than two weeks before the replacement.

f) CBP must receive the completed EQIP, fingerprints and any other required documentation within 10 business days of the Contractor offer to a prospective employee.

VI. Applicable Documents

The Contractor shall be familiar with and operate in accordance, at a minimum, with the following applicable statutory and regulatory requirements:

Audit Report No. 3981-2024O1700002, this will be provided upon award Chief Financial Officers (CFO) Act Integrity Act (FMFIA) and its implementing guidelines, the Office of Management and

Budget (OMB) OMB Circular A-123, “Management’s Responsibility for Internal Control” and its accompanying appendices OMB Circular A-136, “Financial Reporting Requirements;” the Federal Financial

Management Improvement Act (FFMIA) DHS Financial Accountability Act (DHS FAA) Improper Payments Information Act (IPIA) and amended by the Improper Payments

Elimination and Recovery Act (IPERA) Payment Integrity Information Act of 2019 (PIIA) Government Charge Card Abuse Prevention Act GAO’s Standards for Internal Control in the Federal Government DHS and other Federal Regulatory and/or promulgated authoritative guidance and applicable laws related to financial management and internal controls tasks that are enacted throughout project duration

VII. Special Considerations

a) Inspection and Acceptance

The Government reserves the right to reject any deliverable based on defects with respect to completeness, correctness, clarity, and consistency. In the event of a rejection of any deliverable, the COR will notify the Contractor in writing of any deficiencies to be corrected.

The Contractor shall have three (3) business days to correct the deficiencies or request additional time citing the request’s rationale.

Accuracy - all deliverables shall be accurate in presentation, content, and shall adhere to the guidelines set forth in this document. All documentation presented to the Government shall be complete, correct, clear, and consistent.

Clarity - deliverables shall be clear and concise.

Timeliness - deliverables shall be submitted on or before the due date specified in the task order statement of work or submitted in accordance with a later scheduled date mutually agreed upon by the Government and Contractor. A deliverable is considered timely if submitted on or before the date specified in the Statement of Work and, if the Government provides any written notification of deficiencies, the contractor corrects the deficiencies within five (5) business days.

Overall clarity, accuracy, and timeliness will determine acceptance of services.

VIII. Travel

a) Travel is not anticipated for this SOW. However, if the Contractor recommends travel will increase the veracity of specific deliverables, the Contractor is free to conduct this travel with advance approval to the CO, COR and the OF POC. However, the timeline for work completion shall not be extended to permit this travel.

b) Any travel costs shall be borne by the Contractor within the cost and scope of the original proposal. The contractor shall detail any estimated travel costs included in the proposal.

c) The contractor shall not charge local travel costs in the Washington, DC, metropolitan area to the Government (e.g., parking, taxi) unless on approved Travel status.

d) Any travel shall be in accordance with Government regulations (e.g., 46 CFR § 31.205- 46, Travel Costs and 41 CFR § 300-1, Federal Travel Regulations) and with the Department of Homeland Security (DHS) and CBP guidelines.

e) Costs for transportation, lodging, meals, and incidental expenses shall be reimbursed in accordance with Federal Acquisition Regulation (FAR) 31.205-46 and acceptable accounting procedures.

IX. Information Technology Support

The Contractor shall provide all personnel with the appropriate IT equipment to meet the obligations of this SOW not detailed in Section 13.

The Contractor shall not invoice for cell phone or pager charges, internet connectivity, or other costs considered standard “costs of doing business.”

X. Government Furnished Equipment & Information

Government furnished property (i.e., materials, equipment, and information) will be provided in conjunction with the required activities. The government will provide laptops for all cleared personnel working this effort. The contractor shall return all issued equipment at the conclusion.

Disposition of any other government furnished property at the conclusion of the contract/task.

All activity shall be in accordance with FAR clause 52.245-1.

XI. Performance Address

CBP operates in a hybrid work environment. The Government will provide hoteling space as available to include a desk, chair, Government laptop computer, and access to office equipment such as copiers, scanners, and fax machines. The Government will provide office supplies such as pencils, paper, binders, and self-adhesive note pads necessary for the performance of the work contained in the SOW. The physical address for in person work is below.

U.S. Customs and Border Protection National Place 1331 Pennsylvania Avenue, NW Washington, DC 20004

XII. Hours of Work

Normal agency hours of operation are Monday – Friday from 8:30am – 5:00pm ET. The Contractor is responsible for designating work hours for its employees but, at a minimum, shall be available as required by the Government according to the project/area assigned. This may vary depending on project or event. Use of overtime is not allowed.

Weather-related closures and non-recognized holidays may be directed by the Government.

Contractor personnel shall not report to the work location when the Government site is closed (e.g., snow days, Executive Order, other reason determined by the Office of Personnel Management (OPM)). The Contractor shall not be required to work, and the Government shall not be billed for work not performed. On rare occasions, any work performed will be with the prior written (e-mail or memorandum) approval from the COR and OF POC.

XIII. Period of Performance

The period of performance is December 1, 2024, to April 30, 2025.