Attachment 1-Requirement Document -Audit Management System Requirements.pdf

A. Requirements. The Contractor shall provide a Commercial Off the Shelf (COTS) product that meets the following requirements.

1 General Requirements

1.1 Commercial, off-the-shelf document management information system specifically designed to manage audits and reviews such as the type performed by the U.S. Federal government Offices of Inspectors General with proven audit usage within the past three years.

1.2 Must provide names and contact information for three current audit customers, preferably in the federal, state, or local government field who have used product within the past 3 years.

1.3 User-friendly, intuitive graphical interface, preferably following a well-established modern click and attach, copy/paste, save, highlight, and link schema commonly used across industry in the United States. User-friendly meaning easy to use, quick for staff to learn, and visually interesting (not all text).

1.4 Scalable from 100 to 250 users. OIG has currently completed between 35 and 50 projects annually. The number of supporting attachments required for each project varies significantly depending on its scope and complexity.

1.5 Must include ongoing support services including, but not limited to, security updates/patches, bug fixes, and updates/patches to address compatibility with operating systems, browsers, and complementary applications for the duration of the licensing period or agreement.

Support Expectations

We expect vendor responses to support inquiries within one business day.

While we understand that the time required to implement a full resolution may vary depending on the nature of the issue, we value ongoing communication and active efforts toward timely problem resolution.

Only 2 to 4 designated staff members will interact directly with vendor support services. These individuals will serve as the primary liaisons and will be responsible for providing support to the broader user base within our organization.

1.6 Must provide controls to prevent data loss when multiple users concurrently modify a document while working online.

1.7 Must provide the ability for users to work with project documentation offline when a network or VPN connection is not available, including ability to create write-ups and add attachments offline, add and utilize links, process to synchronize offline changes to the project, ability to review and resolve conflicts from offline production, save all created offline project documentation, and provide controls to prevent data loss while modified offline.

Offline Capability and Synchronization Requirements:

We anticipate that the majority of audit documentation and project management activities will need to be accessible offline to ensure continuity of work in environments with limited or no internet connectivity. Therefore, the proposed solution must provide a robust offline functionality that allows staff to perform core tasks without disruption.

When connectivity is restored, the system should offer a simple and efficient synchronization process. This synchronization must be user-friendly and should be completed within a few minutes. While the specific method of synchronization may vary depending on the system, ease of use and minimal downtime are critical requirements.

1.8 Ability to provide a read-only copy for use by computer that has never been connected to the network.

1.9 If the product relies upon third-party tools or applications, support for those tools or applications must extend throughout the support lifecycle of the product.

1.10 Must comply with Section 508 of the Rehabilitation Act of 1973, as amended (29

U.S.C. § 794d).

1.11 Must provide Section 508 compliant visual indicators to indicate the signoff status (for 'Prepared', 'Reviewed', and 'Edited', at a minimum) of write-ups, recommendations, and attachments.

2 Infrastructure and Security Requirements

2.1 Ability to test prior to patch/upgrade installations in production environment.

2.2 Compatible with Windows 11 and higher.

2.3 Compatible with Microsoft Office 365 (O365), including Word and Excel; and, if the product requires O365 Click-to-Run versions to be installed, the solution must be compatible with both the 32-bit and 64-bit versions.

2.4 Support for and compatible with current and future Acrobat PDF files.

2.5 Azure Integration: The system must support native integration with Microsoft

Azure services to enhance scalability, security, and global reach.

System Integration Requirements: The solution must be able to integrate with our existing infrastructure, specifically:

• Front-End: Integration with Azure Virtual Machines (VM)

• Back-End: Integration with either Azure Virtual Machines or Azure SQL

Managed Instance (SaaS) for the database

2.6 Compatible with the latest OIG Windows Server build.

2.7 Ability for agency to produce audit performance metrics from system, including listing of current open projects, review status of open projects, report issuance dates, report titles, and number of recommendations issued.

2.8 Support load balancing.

2.9 Perform well in Virtual Machines and/or Virtual Desktop Infrastructure (VDI).

2.10 Support for single user sign-on/PIV cards.

2.11 Ability to handle slow or latent connections through VPN or remote connections.

2.12 Ability to install client software with single installation package distributed via System Center Configuration Manager (SCCM) or other widely used software deployment mechanisms.

2.13 Provides granular access control to include projects, user roles and security groups.

2.14 If the solution is hosted, the following requirements must be met:

a. The solution must be available for use 24 hours per day, 7 days per week, without disruption except during system updates which must be scheduled at least 6 weeks in advance and must occur on Saturdays, Sundays, and/or United States federal holidays, unless a newly identified security vulnerability is identified that requires immediate attention, in which case as much advance notice as possible must be provided.

b. Data must reside in United States.

c. Follow Federal Risk and Authorization Management Program (FedRAMP).

d. Open to either self-hosted or cloud-based solutions. While we have operated in a self-hosted environment for over 20 years, any cloud-based software must be FEDRAMP Authorized at the Moderate level.

2.15 Comply with the following U.S. federal government security requirements when appropriate, at a minimum:

a. Federal Information Security Management Act (FISMA);

b. National Institute of Standards and Technology (NIST) Special Publication

800-53 REV5; and

c. Federal Information Processing Standards (FIPS) 199.

If the proposed software solution is cloud-based, it must be FedRAMP Authorized at the Moderate Impact Level. Additionally, the system must adhere to the NIST SP 800-37 Risk Management Framework (RMF). All applicable security controls must be implemented.

If any required RMF controls are not applied, the vendor must provide documented compensating controls, along with a justification demonstrating how those controls satisfy the associated security requirements.

2.16 FIPS 140-3 Encryption Capable.

2.17 Advanced Encryption Protocols: Implement advanced encryption (e.g., Quantum-safe algorithms) for data in transit and at rest, specifically tailored to protect highly sensitive information on a global scale.

2.18 Time Zone Management: The system should automatically adjust deadlines, notifications, and scheduling based on the user’s local time zone.

2.19 Cross-Border Data Transfer Compliance: Ensure that any cross-border data transfers adhere to international standards and local laws, such as GDPR for Europe and CCPA for California.

2.20 Global Audit Trail: Provide a comprehensive, centralized, accessible audit trail for those with the role of Administrator that logs all user activities, changes, and accesses across different jurisdictions and regions. This includes the ability to perform logging/capture of user activity, including deletions.

2.21 Risk Management Integration: Implement a global risk management framework that supports risk assessments across multiple regions, integrating local risk factors and global risk trends.

2.22 Global Scalability: The system must support a scalable architecture that can handle the increased load from global operations, including high-traffic scenarios in specific regions.

2.23 Performance Optimization for Remote Locations: The system should optimize performance for auditors operating in remote or bandwidth-constrained environments globally.

2.24 Compliance with International Standards. ISO/IEC 27001 Compliance: Ensure the system adheres to international standards for information security management systems.

2.25 Anti-Bribery and Anti-Corruption Compliance: Include features that support compliance with international anti-bribery and anti-corruption laws, such as the Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act.

2.26 Global Collaboration Tools: Incorporate tools that enable real-time collaboration and communication among teams across different regions, including secure messaging, video conferencing, and document sharing.

2.27 Knowledge Management System: Implement a global knowledge management system that allows for the sharing of audit best practices, lessons learned, and guidance documents across regions.

2.28 Global Disaster Recovery Plan: Develop a robust disaster recovery plan that ensures business continuity in the event of natural disasters, cyber-attacks, or other crises affecting global operations.

2.29 Data Redundancy Across Regions: Ensure data redundancy across multiple geographic locations to safeguard against data loss due to regional outages.

2.30 Region-Specific User Interfaces: Design user interfaces that are customizable for different regions, accommodating local preferences and practices while maintaining consistent user experience globally. No specific user design guidelines or standards.

2.31 Accessibility Compliance Globally: Ensure that the system complies with accessibility standards not just in the U.S. (e.g., Section 508) but also in other regions, such as the European Accessibility Act (EAA).

3 System Configurability and Centralized Administration

3.1 Role of 'Administrator' (or similar) with privileges to

add/edit/approve/delete projects, configure application settings, create/remove/enable/disable/update user accounts, and perform other administrative tasks.

3.2 Ability for users with Administrator role to see history/audit trail to project status.

3.3 Ability for users with Administrator role to create, update, and archive multiple project templates to ensure new projects include predefined project structure and content including all required steps, based on the project type.

3.4 Ability for users with Administrator role to create and assign permissions based on custom user roles such as admin, director, manager, independent referencer, reviewer, preparer, or combination of roles.

3.5 Ability to limit project view based on user roles/permissions defined by the those with Administrator role.

3.6 Ability to assign users to different projects at any phase with role permissions specific to each project.

3.7 Centralized software policy management including user preferences and project settings.

3.8 Ability to create workflows.

3.9 Ability to copy existing projects as new projects and write-ups as new write-ups.

3.10 Configurable fields and labels for project information, recommendations, attachments, write-ups, etc.

3.11 Ability to generate standard and custom data reports across entire database in MS Word, MS Excel, and/or Adobe PDF formats (as appropriate) and within specific projects on current, real-time data for the purposes of resource management, project management, and recommendation tracking, at a minimum.

3.12 Ability to create data reports for tracking milestones - initial and revised dates compared to actual - and ability to capture number of days spent in each milestone.

3.13 Ability to automate creation of regularly produced reports.

3.14 Ability to create data reports for tracking recommendation status - including but not limited to initial and revised dates compared to actual, recommendations resolved in a date range, recommendations opened and closed in a date range, individual staff responsible for recommendation, amount of funds applied to specific categories of recommendations, and agency responsible for recommendations.

3.15 Ability to generate time and expense reports based on criteria such as time charged by user, project, or specified groups, specified time frames, specified milestones, etc.

3.16 Ability to generate reports on any database field, including entities.

3.17 Ability to create ad hoc reports and queries, with data limits guided by user role. The system shall support ad-hoc reporting capabilities, allowing in-office experts to generate reports on demand using any available data points. All data fields within the system must be accessible for reporting purposes. Reports should be exportable in preferred formats, including Microsoft Excel and Word.

3.18 Ability to identify content such as Controlled Unclassified Information (CUI).

3.19 Ability to add identifying information beyond title to each attachment.

3.20 Ability to support Agency records management requirements of retention and destruction.

3.21 Ability for users to access completed and closed projects by other teams based on role defined by users with Administrator role.

3.22 Ability for users with Administrator role to grant users read-only access to projects after project closeout.

3.23 Ability for each project to maintain a status of “Open”, “suspended,” “cancelled”, or “Closed.”

3.24 Ability to limit re-open a project (in other words, reverting a project with a

'Status' of "Suspended", "Cancelled", or "Closed" back to "Open") to those with the 'Administrator' role to ensure the integrity of project records.

3.25 Once a project is suspended, closed, cancelled, or suspended, all project fields and data entry changed to ‘read only’.

3.26 Controls to require project approval before work can begin.

3.27 Ability to train in simulated production environment using previous work.

3.28 Robust training for administrators.

3.29 Train the trainers option available.

3.30 Extensive training documentation. Training materials must be provided in Microsoft Word format to allow for customization and inclusion of OIG-specific details and procedures.

3.31 Detailed reference materials for system support.

4. Project Management Requirements

4.1 Self-contained projects with unique permissions and roles (including custom roles such as read only roles).

4.2 Custom fields for individual projects, minimally 15 project-level fields available which can be edited throughout the project duration for limited roles. For each project, that is minimally 4 drop down fields, 7 text fields, 9 milestone fields (with 3 date spots for each milestone - Planned, revised, and actual), 2 date fields for entire projects, and staff list of names and titles on each project with defined charge rates that vary by title/grade.

4.3 Unique identifier for each project.

4.4 Ability to establish, monitor, revise, and track unlimited number of administrator defined milestones for each project.

4.5 Milestones tracker for each project must capture three date fields - initial, revised, and actual dates.

4.6 Revised milestone date field must allow for multiple revisions.

4.7 Milestones variable by type of project.

4.8 Ability to add, edit, and archive unlimited number of project entities linkable to each open project.

4.9 Preparer signoffs indicating write-up ready for review including date/time and username.

4.10 Multi-level reviewer signoffs indicating write-up ready for review including date/time and reviewer name.

4.11 Controls to prevent users from reviewing documents they prepared.

4.12 Control to prevent reviewer signoff prior to preparer signoff for each write-up.

4.13 Ability for reviewers to add comments on individual write-ups and for preparers to respond to the comments prior to reviewer final approval, and to retain those comments.

4.14 Ability to notify reviewers and preparers when comments are pending review or response.

4.15 Provide reviewer comments in different sections of the write-up.

4.16 Ability for reviewers to mark comment as resolved or complete, even if they didn’t initially author the comment.

4.17 Ability to see complete history of user activity including name, action (create, edit, prepare, and review) and date/time for each action taken by user in project.

4.18 Ability to see when write-ups are modified/updated (e.g. days/times write-ups were modified).

4.19 Ability to identify changes made after supervisory review.

4.20 Ability for users to logically organize project documentation in a manner of their choosing in sections, folders, or other organizing schema.

4.21 Ability to report out on the above project management items, including but not limited to staffing information (including names, titles, charge rates), project codes, origins, milestones, review status of work papers (number of workpapers reviewed, number of workpapers with reviewer comments awaiting staff response, etc…)

5. Audit Documentation Requirements

5.1 Support for and compatible with alternative office file types (GoogleDocs, open-source office files, etc.).

5.2 Support for and compatible with industry-standard media files (audio, video, image).

5.3 Support for and compatible with large-scale, complex data and analysis files, including Excel, Word, and Adobe PDF.

5.4 Unique identifier for each attachment visible to project team in the project.

5.5 Ability to create, edit, and delete an unlimited number of write-ups (that includes fields to contain title, purpose, source, scope, methodology, results, conclusion, and recommendations) until a project is closed, suspended, or terminated even if a reviewer has approved the write-up.

5.6 Ability for users with Administrator role to retrieve deleted write-ups and attachments.

5.7 Ability to limit recommendation deletions to users with Administrator role.

5.8 Ability to add an unlimited number of attachments and rename, update/replace, export, and print attachments.

5.9 Ability to print individual write-ups, attachments, or selection of write-ups/attachments.

5.10 Ability to print from projects in every status.

5.11 Support for unlimited number of and unlimited file size attachments in each project (e.g., several hundred attachments per project).

5.12 Ability to restrict access to attachments to a specific project (limit/lock so cannot change original data/data integrity).

5.13 Ability to easily share selected attachments across projects.

5.14 Ability to retain/recover multiple versions of attachments, including the original document that was added to the AMS.

5.15 Ability to link to external sites such as websites and email addresses.

5.16 Ability to link write-ups to supporting attachments or other write-ups.

5.17 Ability to link attachments to each field of write-ups as well as other attachments (e.g., Word, Excel, and Acrobat), to support cross-indexing efforts. Includes some kind of visual indicator to evidence support.

5.18 Ability to efficiently handle unlimited number of links within individual attachments (e.g., several hundred links within a single Word or Excel file) and across the audit file while maintaining document integrity (e.g., multiple Word files with several hundred links).

5.19 Ability for user to review and verify links within Word, utilizing visual cues indicating that links are correct or incorrect (e.g., tickmarks, highlighting, comment boxes).

5.20 The ability for other team members to view user’s review work in the attachment, as the work occurs in real time (e.g., comments or reviewer notes are visible as they are written even though the document is open by another user).

5.21 Monitor what changes were last made/what is being worked on to individual write-up.

6. Recommendation and Audit Follow Up Requirements

6.1 Ability to create, view, and report on recommendations, all custom fields, and their updates based on audit work within a single project after a project is closed.

6.2 Ability to link recommendations to supporting attachments and write-ups.

6.3 Ability to create and update custom fields for recommendation tracking to meet reporting requirements (minimum of 5 monetary fields, 5 date fields, 4 dropdown fields, 4 text fields, assignment of 3 users) with the option to make fields mandatory.

6.4 Ability to record and update response text and drop-down options for each recommendation even after project is closed.

6.5 Ability to associate recommendations with offices and department organizations.

6.6 Ability to mark and select individual recommendations for reporting (i.e., for tracking or information only).

6.7 Status indicator for each recommendation, with a minimum of 5 status agency defined options (e.g., unresolved, resolved, closed).

6.8 Ability to update individual recommendation status, including target action dates, and attach supporting documents for both open and for follow-up on closed projects, including date controls to prevent backdating from date of entry.

6.9 Ability to export all recommendation data fields into an Excel format and/or

CSV format, with filter options for date ranges, types of recommendations, organization, status of recs, etc.

6.10 Ability to see audit trail of changes including edited field by user, date, and time indicators for each audit.

6.11 Ability to limit recommendation updates to specific roles or users.

6.12 Ability to mark and select individual recommendations for reporting (i.e., for tracking or information only).

6.13 Status indicator for each recommendation, with a minimum of 5 status agency defined options (e.g., unresolved, resolved, closed).

6.14 Ability to update individual recommendation status, including target action dates, and attach supporting documents for both open and ofr follow-up on closed projects, including date controls to prevent backdating from date of entry.

6.15 Ability to export all recommendation data fields into an Excel format and/or

CSV format, with filter options for date ranges, types of recommendations, organization, status of recs, etc.

6.16 Ability to see audit trail of changes including edited field by user, date, and time indicators for each audit.

7. Usability Requirements

7.1 Ability to quickly locate information within attachments and write-ups within a project using text-based search of titles and contents.

7.2 Ability to filter search results for projects, write-ups, and attachments based on custom metadata or custom tags such as Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI).

7.3 Ability for access of entire project file for external agency employees without access to internal network.

7.4 Easily accessible reports for users indicating completion, review status, and review notes.

7.5 Visual reminders for pending deadlines and open items (e.g., projects, write-ups, recommendation tracking etc.).

7.6 Provides project management dashboards displaying real-time information for project such as percentage of project work completed, document review status percentage, status of milestone phases, time and expenses charged to projects, status of assigned recommendations, etc.

7.7 Shortcut access to projects, time and expense, and recommendation data directly from dashboards.

7.8 Ability to create notifications within the system for administer-defined triggers such as pending deadlines, review status, recommendation dates, and required actions.

7.9 Ability to create e-mail notifications based on administer-defined triggers.

7.10 Support for rich text formatting in write-ups, recommendations, and project information sections (including bold, italics, underline, highlight, text alignment, numbering, bullets, cut/page/copy).

7.11 Support for Copy/Cut/Paste from attachments to write-up and move write-up locations.

7.12 Support for inline and on-demand spell check, with editable/customizable dictionary.

7.13 Ability to create and format tables within a write-up.

7.14 Ability for multiple users to collaborate on attachment or write-up creation and edit simultaneously in real-time.

7.15 Allow users to copy attachments with all links to a new document and then continue adding more links and other changes to such document.

7.16 Ability to quickly locate information within attachments and write-ups within a project using text-based search of titles and contents.

7.17 Ability to filter search results for projects, write-ups, and attachments based on custom metadata or custom tags such as Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI).

7.18 Word search ability within a single write-up as well as across the project file.

7.19 Ability for access of entire project file for external agency employees without access to internal network.

7.20 Easily accessible reports for users indicating completion, review status, and review notes.

7.21 Visual reminders for pending deadlines and open items (e.g., projects, write-ups, recommendation tracking etc.).

8. Cost Accounting for Time and Expenses (e.g. travel and contracting expenses)

The OIG is seeking a solution that enables effective expense tracking and timesheet management aligned with project activities.

8.1 Ability for user to report time and expenses on a biweekly basis on all seven days of the week.

8.2 Ability for add unlimited number of agency-defined non-project time codes.

8.3 Ability for user to charge time to unlimited number of project and non-project codes (e.g., leave, holiday, etc.).

8.4 Workflow for supervisory review of all time and expense entries with name, date, and time information, and rejection comments.

8.5 Ability to easily re-assign user to a different reviewer for time and expense reporting.

8.6 Ability to submit timesheet and expenses to another user when complete, recording date and time of submission.

8.7 Ability for each user to edit timesheets and expenses after submission.

8.8 Ability to assign billing rates for individual employees and edit those rates upon promotion or demotion.

8.9 Ability to report on user time, including for specific users, on specific projects, within phases, or specific time frames.

8.10 Ability for user with Administrator role to determine which users must submit timesheets, which users are reviewers of timesheets, and to change those reviewers.

8.11 Ability for user with Administrator role to input, submit, un-submit, approve, reject, and delete timesheets for all users.

8.12 Ability to prevent user from charging negative time or amounts.

8.13 Ability to prevent user from submitting with less than 80 hours on timesheet without user with Administrator role waiver.

8.14 Ability for user with Administrator role to define, update, and edit hourly pay rates for all users.

8.15 Ability for user with Administrator role to define expense categories.

8.16 Ability to associate expenses and time with specific projects.

8.17 Retention of timesheets for agency-defined time frames, usually about 10 years.

B. Desired Capabilities, but not required:

9.1 Ability to migrate recommendation and project data from the existing audit management software system (s) – TeamMate AM (not TeamMate+) and Ideagen Internal Audit/Pentana. The desired capability is to migrate the TeamMate AM data. The system must support full tracking and reporting capabilities for individual recommendations originating from migrated projects. These capabilities must be equivalent to those available for recommendations created natively within the system. Users must be able to generate reports on migrated recommendations using the same criteria, filters, and formats to ensure consistency and continuity in oversight and analysis.

9.2 Ability to track individual recommendations from migrated projects, including reporting.

9.3 Ability to automatically create project codes based on agency supplied formulas.

The project code format consists of the following elements:

• A two-digit year identifier

• A single letter representing the funding source (selected from a list that is updated approximately every two years)

• A digit representing the audit type (from a list of five types)

• A three-digit sequence number indicating the order of projects initiated that year for a given office

• A letter representing the office

• A three-digit identifier (typically “000” for initial projects or a sequential number for follow-on or “roll-off” projects when other elements remain the same)

For example, the code 25H3003F001 breaks down as follows:

• "25" = Year 2025

• "H" = Funding source (e.g., Hurricane-related funding)

• "3" = Audit type (e.g., performance audit)

• "003" = Third project of the year for the office

• "F" = Office designation

• "001" = First roll-off project associated with the original project

9.4 Robust ad-hoc reporting that allows reporting on all data points in system. The system shall support ad-hoc reporting capabilities, allowing in-office experts to generate reports on demand using any available data points. All data fields within the system must be accessible for reporting purposes. Reports should be exportable in preferred formats, including Microsoft Excel and Word.

9.5 The system shall provide advanced notification capabilities through both email and in-system pop-up alerts. Notifications must be configurable by the agency based on user actions and changes to project fields and recommendations.

• The system shall support role-based notification customization.

• For example, notifications should be sent to managers when:

o A staff member’s time sheet is submitted and ready for review.

o A workpaper is completed and requires managerial review.

• The system shall offer a variety of notification types that are fully customizable, including defining recipients, triggers, and delivery methods.

9.6 Ability to automatically calculate milestones based on agency defined formulas based on audit type.

9.7 Ability for users with Administrator role to override agency defined formulas on specific projects.

9.8 Ability to have multiple levels of reviews defined by user and/or agency on specific project write-ups or attachments.

9.9 Automatically assign numbers to all write-ups and attachments based on agency defined formula.

9.10 Ability to capture and query staff qualifications and availability for resource assignment purposes.

9.11 Natural language search of project documentation contents.

9.12 Use natural language processing and generative artificial intelligence technology within user databases to author documentation based on user-supplied questions and prompts with clear labeling and limitations imposed by agency.

9.13 Agency-customized dashboards.

9.14 Ability to create notifications within the system for user-defined triggers such as pending deadlines, review status, recommendation dates, and required actions.

9.15 Ability to create e-mail notifications based on user-defined triggers.

9.16 Ability to set agency-defined holidays by region for timesheets.

9.17 Ability for entities outside of organization to view read-only project documentation contents without installing the product.

9.18 System-generated reports that identify projects scheduled to be disposed.

9.19 Provide integrated data analysis tools that perform analytical tests of full datasets such as (but not limited to) identification of duplicate payments, related party vendors, duplicate expense claims, and employee/vendor matching via a user interface that does not require the user having coding or database knowledge.

9.20 Provide the capability to perform and document risk-based planning on a cyclic basis.

9.21 Provide the capability for administrators to define start and end dates for planning cycles. The system must support the initiation and approval process for audits, which may originate from various sources such as congressional or departmental requests, incidents, or the agency’s rolling 24-month audit plan. It must also accommodate audits mandated by law. Once an audit topic is approved by a senior manager, the system must allow the team to create and store an Audit Initiation Meeting (AIM) document along with all supporting evidence. The system must facilitate stakeholder review and decision-making during the AIM meeting, where projects may be approved, conditionally approved, or rejected. Additionally, the system must enable scheduling and tracking of estimated project milestones. Audit projects typically range from 10 months to 2 years in duration, based on complexity.

9.22 Allow administrators to create an unlimited number of engagements plans for each planning cycle.

Here are some specific engagements:

• Ability to performance, financial, and attestation projects in accordance with Generally Accepted Government Auditing Standards.

• Ability to perform Single Audits in accordance with the Single Audit Act of 1984, as amended in 1996.

• Ability to use the system to perform quality assurance reviews, top management challenge reports, and testimonies.

9.23 Link projects created the appropriate (risk-based) engagement plan to facilitate tracking of progress of engagement plan (in other words, planned engagements versus actual engagements).

9.24 Provide the capability to assign a probability and impact to each entity in the audit and inspection universe during each planning cycle.

9.25 Calculate risk using a user-defined formula for each entity in the audit and inspection universe during each planning cycle.

9.26 Provide the capability for users to make adjustments to risk scores during each planning cycle.

9.27 Allow users to change the formula for calculating risk from planning cycle to planning cycle.

9.28 Provide the capability for users to add project proposals which include 'Justification', 'Proposed Objective', 'Proposed Scope/Methodology', and 'Proposed Division' to an engagement plan.

9.29 Provide the capability to include mandatory work (in other words, work required by law or regulation) in engagement plans.

9.30 Identify planned engagements as either 'Mandatory', 'Planned', or 'Unplanned'.

9.31 Provide the capability for risk-based plans to be copied from one cycle to the next cycle.

9.32 Provide the capability for users to define an unlimited number of objectives for each risk-based plan.