Attachment 1 - Statement of Work_QCR Audits_vf.pdf

U.S. DEPARTMENT OF COMMERCE

STATEMENT OF WORK

CONDUCTING QUALITY CONTROL REVIEWS

OF SINGLE AUDIT ACT REVIEWS

1.0 OBJECTIVE/PURPOSE

Operating under the authority of the Inspector General Act of 1978, as amended, the U.S.

Department of Commerce (Commerce) Office of Inspector General (OIG) is seeking the services of a Contractor to conduct Quality Control Reviews (QCRs) of single audits performed under 2 U.S. Code of Federal Regulations (C.F.R.) 200 Subpart F, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). The Commerce OIG's Office of Audit and Evaluation, Standards and Quality Control (OAE SQC) will select the audits to be reviewed and will notify the contractor of each audit to be reviewed before the start of each QCR.

2.0 GENERAL BACKGROUND

Commerce OIG fulfills its responsibilities by conducting investigations, audits, evaluations, and other reviews. Nonfederal entities (e.g., states, local governments, tribes, colleges and universities, and nonprofit organizations) that expend $750,0001 or more in federal awards in a year are required by the Single Audit Act of 1984, as amended, to have an annual audit of their federal awards conducted in accordance with the Uniform Guidance.

The purpose of the Single Audit Act regulations is to establish standards for obtaining consistency and uniformity among federal agencies in conducting audits of expenditures of federal awards by nonfederal entities. The audit required by the Single Audit Act includes a review of the entities’ financial statements and Schedule of Expenditures of Federal Awards. The auditor determines whether the statements are presented fairly; tests internal controls; and assesses compliance with laws, regulations, and the provisions of the contracts or grant agreements that may have a direct and material effect on each major program.

The objectives of a QCR are to: (1) determine whether the audit was conducted with the applicable standards, including Generally Accepted Auditing Standards (GAAS) and Generally Accepted Government Auditing Standards (GAGAS), and Uniform Guidance requirements, (2) identify any follow-up work needed to support the conclusions and opinions contained in the reporting package, and (3) identify issues that may require appropriate management (auditee, Federal program, or other grantors) official attention. Firms can receive a rating of pass, pass with deficiency(ies), or fail.

3.0 SCOPE OF WORK

The contractor shall conduct QCRs of single audits submitted under Uniform Guidance using and following the Council of the Inspectors General on Integrity & Efficiency’s (CIGIE) Guide for Quality Control Reviews of Single Audit Reports (2021 Edition or applicable edition).

Commerce OIG may request up to seven QCRs that are selected by Commerce OIG’s OAE SQC team during each option year.

4.0 REQUIREMENTS

4.1 Experience. The contractor shall have experience conducting QCRs and single audits:

4.1.1 Have at least 5 years of cumulative experience following CIGIE’s Guide for Quality Control Reviews of Single Audit Reports, to include conducting and reporting on QCRs and keeping customers informed on progress of QCRs through meetings and other written products such as outlines, draft, and final reports.

4.2.2 Have at least 5 years of cumulative experience following CIGIE’s Guide for Desk Reviews of Single Audit Reports, to include conducting and reporting on single audits.

4.2.3 Have at least 5 years of cumulative experience following other professional standards, to include GAAS, GAGAS, and Uniform Guidance.

4.2.4 Have access to and utilize the American Institute of Certified Public Accountants Audit Guide, “Government Auditing Standards and Single Audits,” for the applicable year under review.

4.2 Desk Reviews. The contractor shall:

4.2.1 Follow the procedures described in the CIGIE’s Guide for Desk Reviews of Single Audit Reports (2021 Edition or revised guide when appropriate), to conduct a desk review of a single audit of the QCRs selected by the OAE SQC team for the required dates of performance.

4.2.2 Follow the procedures described in the CIGIE’s Guide for Quality Control Reviews of Single Audit Reports (2021 Edition or revised guide when appropriate), to conduct and report on QCR’s of single audits selected by the OAE SQC team for the required dates of performance.

4.3. Administrative Task. The contractor shall:

4.3.1 Independence and qualification statements for all planned staff assigned to the contract.

4.3.2 Copy of the report template the Contractor will use during the contract.

4.3.3 Provide all written deliverables in electronic format with read/write capability using applications that are compatible with Commerce OIG’s standard workstation (Windows 11, Microsoft Applications, PDF).

4.3.4 Provide a draft and final report for each QCR that includes the following:

a. Clearly state if the auditor’s work results in a pass, pass with deficiency(ies), or fail.

b. Summarize the QCRs findings and conclusions, while highlighting the impact of any deficiency(ies).

c. Ensure the draft and final reports, as approved by OIG, meet the applicable accessibility standards of Section 508 of the Rehabilitation Act of 1973, for comment by the recipient and posting on the Commerce OIG website, respectively.

4.4 Communication. The contractor shall be in constant communication with the Independent Public Accountant (IPA) and the OAE SQC team. OAE SQC will monitor work performed to determine contractor compliance with requirements.

5.0 DELIVERABLES

The following tasks will be completed by the Contractor at the beginning of the contract:

5.1 Kickoff Meeting

OAE SQC team and Contractor will make introductions, discuss deliverables and timeframes, and Commerce OIG’s work approach and plan on providing the single audits that will be reviewed. The OAE SQC team and Contractor will also discuss how often to meet and the timeframe for providing meeting write-ups to the OAE SQC team.

The Contractor will provide OAE SQC team with an initial briefing to discuss their work approach to the QCRs and a written plan on how they will perform the work.

5.2 Independence certifications and qualifications

OAE SQC team shall provide Contractor with independence certifications, which Contractor will complete and submit to Commerce OIG. Contractor provides OAE SQC qualifications documents for each team member. The qualifications document will include education, professional certificates, experience, areas of specialization, specific single audit training and any other items the Contractor thinks are necessary.

5.3 Report Template and Task

The Contractor shall provide the OAE SQC team with a copy of their report template. The OAE SQC team will review the report template and provide any necessary feedback and ensure it meets the applicable accessibility standards of Section 508 of the Rehabilitation Act of 1973, for posting on the Commerce OIG website.

The Contractor shall provide the following deliverables for each selected single audit QCR. The Contractor shall prepare any materials needed for meetings with the IPA and OAE SQC and document the discussions. All deliverables will be subject to OIG review and approval. The template deliverable will remain consistent throughout the four one-year options (if exercised), subject to contract modification.

5.4 Entrance Conference Meeting

For each selected QCR, Contractor conducts an Entrance Conference meeting with selected IPA. The Contractor shall discuss objective, scope, methodology, timelines, expectations, and other logistics. Contractor shall also submit a written summary of the Entrance Conference Meeting to OAE SQC following the meeting within the agreed upon time.

5.5 Conduct Single Audit Desk Review for each QCR

Contractor performs a single audit for each QCR using CIGIE’s Guide for Desk Reviews of Single Audit Reports (2021 Edition or revised guide when appropriate).

Contractor provides periodic status updates and shall provide the completed Single Audit Checklists and all supporting workpapers to the OAE SQC team. All responses in the Single Audit Checklist must be organized, properly supported, cross-referenced, and reviewed. Any modifications to the CIGIE Guide for Desk Reviews of Single Audit Reports must be sufficiently documented and explained.

When the Contractor identifies an issue, they will discuss the issue with OAE SQC and provide the necessary workpapers to the OAE SQC team via SharePoint for feedback. Once the OAE SQC team reviews the issue, the Contractor will brief the IPA on the issue. The IPA can provide any new supporting workpapers to the Contractor if needed.

5.6 Conduct QCRs

Contractor performs each QCR using CIGIE’s Guide for Quality Control Reviews of Single Audit Reports (2021 Edition or revised guide when appropriate).

Contractor provides periodic status updates and shall provide the completed QCR Checklist and all supporting workpapers to the OAE SQC team. All responses in the QCR Checklist must be organized, properly supported, cross-referenced, and reviewed. Any modifications to the CIGIE Guide for Quality Control Reviews of Single Audit Reports must be sufficiently documented and explained.

When the Contractor identifies an issue, they will discuss the issue with OAE SQC and provide the necessary workpapers to the OAE SQC team via SharePoint for feedback. Once the OAE SQC team reviews the issue, the Contractor will brief the IPA on the issue. The IPA can provide any new supporting workpapers to the Contractor if needed.

5.7 Status Meetings

Conduct periodic meetings with OAE SQC and each selected IPA throughout the QCR’s life cycle.

OAE SQC and the Contractor shall have regular status meetings. At the status meetings, the parties shall discuss ongoing tasks, schedule progress, any potential findings/deficiencies, planned meetings with the IPA, issues, and other pertinent discussion items.

5.8 Preliminary Findings/Deficiencies Briefing

OAE SQC and the Contractor shall meet to discuss the results of the QCR to include the overall rating and determine estimated timelines for Exit Conference meetings and draft/final report issuance. OAE SQC will provide feedback on the preliminary findings, if necessary.

The Contractor shall coordinate a preliminary Exit Conference (pre-Exit) with the IPA to discuss preliminary findings prior to drafting the report. The Contractor will discuss preliminary findings/deficiencies with IPA before issuing the draft report and holding the exit conference. The IPA can provide any new supporting workpapers to the Contractor if needed.

5.9 Development of Draft Report

Once the pre-Exit is held and the Contractor has reviewed any additional workpapers form the IPA, the Contractor will start drafting the report. The draft report will:

a. Clearly state if the auditor’s work results in a pass, pass with deficiency(ies), or fail.

b. Summarize the deficiencies and conclusions while also highlighting the impact of any deficiencies.

The Contractor will submit the draft report to OAE SQC for review and feedback.

5.10 Exit Conference Meeting

Once OAE SQC returns the draft report to the Contractor, the Contractor schedules the Exit Conference meeting with the IPA. The Contractor conducts the Exit Conference meeting and discusses the objective, scope, methodology, overall rating, findings/deficiencies, impacts, and next steps. The Contractor shall also submit a written summary of the Exit Conference meeting to OAE SQC following the meeting within the agreed upon time.

5.11 Issuance of Draft Report

The Contractor will issue the draft report and provide the IPA an opportunity to respond to the draft report. The Contractor will ensure the draft report meets accessibility standards as outlined in Section 508 of the Rehabilitation Act of 1973. To do this, the Contractor will use the accessibility check feature built into Adobe Acrobat, making sure all required categories in the “Checking Options” menu are selected, and remediate accessibility issues as required.

5.12 Issuance of Final Report

Once the IPA provides its response to the draft report, the Contractor summarizes and assesses the IPA’s draft report response. The Contractor shall provide the final report to OAE SQC for issuance after any modifications necessitated by the IPA review of the draft report. The Contractor will ensure the final report meets accessibility standards as outlined in Section 508 of the Rehabilitation Act of 1973. To do this, the Contractor will use the accessibility check feature built into Adobe Acrobat, making sure all required categories in the “Checking Options” menu are selected, and remediate accessibility issues as required.

OAE SQC will review the final report and verify the final report meets the applicable accessibility standards of Section 508 of the Rehabilitation Act of 1973, for posting on the DOC OIG website. If OAE SQC identifies Section 508 compliance problems, it will return the report to the contractor for further remediation. Because the final report PDF will be combined with an OIG transmittal memo, the Contractor will ensure security settings on the final report do not prevent OIG from compiling the document with other files. OAE SQC will issue the final report.

6.0 DELIVERABLES SCHEDULE

The Contractor shall follow the schedule below for each deliverable. OAE SQC and the Contractor will work together to finalize deliverable dates at the Kickoff Meeting and throughout the contract.

The deliverables schedule will remain consistent through option year four (if exercised), subject to contract modification.

Deliverable

Item

SOW

Section Deliverable Schedule

1 5.1 Kickoff Meeting Within 15 business days of contract award

2 5.2 Complete Independence certifications and qualifications documents

As agreed, during Item 1 meeting

3 5.3 Report Template As agreed, during Item 1 meeting

4 5.4 Hold Entrance Conference As agreed, during Item 1 meeting

5 5.5 Conduct Single Audit Desk Review for each QCR As agreed, during Item 1 meeting

6 5.6 Conduct QCR As agreed, during Item 1 meeting

7 5.7 Status Meetings and Reports As agreed, during Item 1 meeting

8 5.8 Preliminary Findings/Deficiencies Briefing As agreed, during Item 1 meeting

9 5.9 Development of Draft Report As agreed, during Item 6 10 5.10 Exit Conference Meeting As agreed, during Item 7 11 5.11 Issuance of Draft Report As agreed, during Item 7 12 5.12 Issuance of Final Report As agreed, during Item 6

7.0 PERIOD OF PERFORMANCE

The period of performance is anticipated as follows: one base year and four one-year options (if exercised).

8.0 PLACE OF PERFORMANCE

The Contractor company shall be physically located in the United States of America. The Contractor shall perform work at their office location. No travel is expected. However, for any onsite work, the Government reserves the right to exclude or remove from the site or building any employee of the Contractor whom the Government deems incompetent, careless, insubordinate, or otherwise objectionable.

The contractor shall supply its own secure work site, to include telephones, office supplies, and other equipment, in the United States of America.

9.0 CONTRACTOR PERSONNEL

The Contractor shall initiate and maintain procedures to ensure that persons performing work are skilled and knowledgeable in the methods and craftsmanship needed to produce the required quality levels for acceptance of completed work. Workmanship shall comply with the requirements set forth in this Statement of Work (SOW).

10.0 PERFORMANCE MONITORING

The Contractor shall provide all deliverables under this SOW to the OAE SQC team for review and acceptance. Deliverables not complying with the requirements of the agreed upon set of standards determined at the Kickoff meeting shall be returned to the Contractor for correction at no additional cost to the Government. Generally, all work performed under this contract shall comply with Commerce OIG Directives, Instructions, and Standards in place at the time of contract award.

Exceptions may be made on a case-by-case basis with mutual agreement by the Commerce OIG and the Contractor.

With an advance notice of five calendar days to the Contractor, the OAE SQC team may elect to conduct any workpaper material inspection at the Contractor’s office or virtually. If not done remotely, the contractor shall make the workpapers available on weekdays during the hours of 7 a.m.

to 5 p.m., local time. The Contractor shall provide the OAE SQC team with reasonable access to a copier or scanner if necessary for non-electronic documents, without charge to Commerce OIG.

Workpapers delivered by the Contractor become the property of Commerce OIG and shall be provided as noted in the deliverables. Workpapers shall be available for inspection by Commerce OIG upon request for a period of seven years after the issuance of the final report.

11.0 INSPECTION AND ACCEPTANCE

The Contracting Officer's Representative will perform inspection and acceptance of supplies and services to be provided under this contract.

12.0 GOVERNMENT RIGHTS TO DELIVERABLES

All deliverables provided under this contract become the property of the U.S. Government.

13.0 GOVERNMENT FURNISHED PROPERTY AND INFORMATION

OAE SQC will not provide the Contractor with any Government property and information. However, if a need arises during the contract that Government property and information is necessary, the Contractor shall be responsible for safeguarding all government equipment, information, and property provided for Contractor use. The Contractor shall not use Government furnished property and information for any purposes other than official Government business as performed under this contract. At the close of each work period, government facilities, equipment, and materials shall be secured.

While no onsite work is needed for this contract, if the need arises, the Contractors working on Government sites will be provided standard business equipment including all or some of the following: desk, chair, phone, computer, and access to office equipment such as printers, copiers, fax, etc.

At its discretion, the Government may provide the Contractor with Government Furnished Information (GFI) if believed to be relevant and helpful to the work objectives. The Government is not obligated to provide, nor the Contractor to accept, any GFI.

14.0 POINTS OF CONTACT

TBD