Attachment 2-Final RFQ QA Response -OIG Audit Managment System Services_693JK425Q700004.pdf

No. RFQ Section/ Reference Comment/Question Government Response

1.1 SOW Can you provide more details on the specific types of audits and reviews performed by the U.S. Federal government Offices of Inspectors General that the system needs to support?

We perform performance, financial, and attestation projects in accordance with Generally Accepted Government Auditing Standards. We also perform Single Audits in accordance with the Single Audit Act of 1984, as amended in 1996.

2 2.3 Are there any specific user interface design guidelines or standards that the system should adhere to?

No specific user design guidelines or standards.

3 Are there any specific criteria or format required for providing the names and contact information of current audit customers?

Yes, Please refer to Attachment 4- Past Performance Questionnaire

1.2 What does DOT OIG consider similar projects for past performances? We are looking for other customers that do audit work in the government - be that federal, state, or local. If you have no government clients, we are looking for audit work. We hope to see offices that reflect our size - about 150 auditors. We would like a chance to chat with them, possibly, about working with your company.

5 1.4 Can you provide more details on the expected user growth over the five-year period?

We are expected to shrink to about 150 users before awarding this contract. In the past we have had 200 licenses and may grow back to those numbers over the next 5 years.

1.5 What are the specific expectations for ongoing support services, particularly in terms of response times and service levels?

We expect responses within one business day. With the understanding that actual fixes can vary, we expect ongoing communication and efforts to solve the problem in a timely manner. Only 2 - 4 staff members will be utilizing the support services directly. Those 2-4 staff members will provide support to all other users.

1.7 Can you elaborate on the specific functionalities that need to be available offline, and how synchronization should be handled when the connection is restored?

We expect most of the audit documentation and project management requirements to be available in an offline option, so that if connectivity is not available, staff can continue their work. Synchronization should be easy and staff should be able to complete the process within minutes. How this happens can vary by system.

5.1, 5.2, 5.3 Could you specify which third-party tools or applications are currently in use or preferred for integration with the audit management system?

We currently use Microsoft Office (Excel, Word, Teams, Outlooks). Additionally, we have a lot of documentation in Acrobat PDF. Excel, Word, and Acrobat PDF are our most common and must be compatible with the program. We use SharePoint, as well, and would like to see some type of integration available.

9 Are there any specific accessibility features or standards beyond Section 508 that the system should comply with?

No. Section 508 covers our needs.

3.9 Can you provide more details on the current and future Acrobat PDF files that need to be supported?

We currently use a variety of Acrobat versions. Individual documents vary incredibly in size. Most evidence from operating administrations arrive in this format. Many computers have Acrobat 2025 installed. We try to keep our computers up to date on newest version from the company.

11 2.5 What are the specific requirements for API and Azure integration, and are there any existing systems that need to be integrated with?

API (None) we will not be accessing where there would be a need for this product to be API integrated. It would need to integrate with Azure VM for front end and either Azure VM or SQL Managed Instance (SAS) for DB backend

12 1.4 Are there any specific performance benchmarks or load scenarios that the system should be tested against? Performance benchmarks would be capable of handling 150-250 concurrent users with read and write commits running.

13 2.7, 3.12, 3.13, 3.15, 3.16, 3.18, 7.4

What specific audit performance metrics are required, and how should they be presented?

We don't have a requirement for how they are presented. However, we prefer being able to download and adjust the data presentation, so Excel or Word would be good formats. As far as content, we need to know a variety of data points. For example, how many open engagements are there currently? What are the milestones completed so far in the open projects?

How much of the project has been reviewed? For completed projects, we need details about the report such as date issued, number of recommendations issued, etc... We also need recommendation data available - how many are resolved/unresolved?

How much money in each of the 3 categories was closed this period of time? Who is in charge of each recommendation?

Which agency is responsible for taking action on the recommendation? Etc...

14 3.32 Can you provide more details on the expected format and content of training materials and documentation? We prefer training materials in Word, so we can manipulate it to include our particular details.

3.24, 3.25, 3.21, 4.1-4.20

Are there any specific project management methodologies or tools that the system should support?

The project management details should include milestones, project code, staffing, origin, and other project details. We utilize reporting on the review status of the project - how many workpapers have been reviewed, how many have comments awaiting staff answers, etc...

2.21, 2.15

Can you provide more details on the global risk management framework and how it should be integrated into the system?

If this software is cloud based, it must be FEDRAMP Approved for a Moderate system. Also, we follow NIST 800-37 guidance for Risk Management Framework. These controls must be applied. If these controls are not applied, then you must provide to us the Risk Management Framework compensating controls that you will be using.

6.3 SOW

Can you provide more details on the level of customization and configurability required for project templates, user roles, and workflows?

We have unique project codes for each project, which we would love the system to generate. Currently, we do this in Access.

We do require customization to ensure we have enough fields to capture all required data. For each project, that is 4 drop down fields, 7 text fields, 9 milestone fields (with 3 date spots for each milestone - Planned, revised, and actual), 2 date fields for entire projects, staff list of names and titles on each project with defined charge rates that vary by title/grade.

Recommendation customization fields in 6.3 on SOW Response form.

5.17, 4.2 Can you provide more details on the process of cross-indexing as mentioned in the definitions?

Cross-Indexing is a process where we trace every sentence of our report to the evidence contained in the system. In the current system, that consists of hyperlinking each sentence in a Word document back to the workpaper (Excel, Word, or PDF document that contains the evidence). We need a visual indicator of some type that shows where the evidence is. All evidence should live inside of the program.

9.24 SOW

What specific engagements are you referring to under the term 'engagement'?

We perform performance, financial, and attestation projects in accordance with Generally Accepted Government Auditing Standards. We also perform Single Audits in accordance with the Single Audit Act of 1984, as amended in 1996. Additionally, we use the system to perform quality assurance reviews, top management challenge reports, and testimonies.

DOT OIG Audit Management System Services Questions & Answers RFP #693JK425Q700004

9.23 SOW

Could you clarify the planning cycle timeframe for engagements?

Audits start in a number of ways - congressional request, departmental requests, accident or tragedy, or evolve from the continuous 24-month plan. We also do a number of audits mandated by law. Once an audit topic is approved by an office senior manager, then the team prepares an Audit Initiation Meeting (AIM) document, which must be backed up by evidence.

That document and all supporting evidence should be in the Audit Management System (AMS) - the product we are looking for. At the AIM meeting with all stakeholders, projects can be approved, approved with changes, or not approved. At that meeting, a schedule of estimated milestones is also approved. Typically, projects last 10 months to 2 years, depending on complexity.

21 3.9 SOW What are the preferred sources for references or indexes? All references or indexes should go to project steps/workpapers and/or evidence, like Word, Excel, and Adobe PDF.

22 1.1 SOW

What specific commercial, off-the-shelf document management systems are preferred? There is no preferred system. We are doing an open competition.

23 1.1 SOW

Could you provide examples of proven audit usage within the past three years?

Meaning provide a contact for companies using your product to conduct audits within the past three years. We don't want a product without a proven success record.

24 What are the names and contact information for three current audit customers? You need to provide the names and contact information for three of your current audit customers.

25 1.3 SOW

What are the expectations for the user-friendly, intuitive graphical interface? It should be easy to use, quick for staff to learn, and visually interesting (not all text).

26 1.1 - 8.17 in SOW Are there any specific features or functionalities that are mandatory for the audit management system? Yes- see the SOW.

27 9.1 SOW

What are the existing audit management software systems from which data needs to be migrated?

We have two existing systems - TeamMate AM and Ideagen Pentana MK Audit. We hope to minimally migrate the TeamMate AM data.

28 6.1 - 6.11 in SOW How do you track individual recommendations from migrated projects, and what reporting capabilities are required?

We need to be able to do the same reporting on migrated recommendations as we do other recommendations. Reporting capabilities need to match those of recommendations created in this system.

9.5 SOW

Can you provide details on the agency-supplied formula for creating project codes?

Sure. It is a 2 digit code for the year, letter for the funding source (from a list that needs to updated every 2 years or so), a number indicating the type of audit (from a list of 5), then three numbers for the sequence of projects started this year for the office, letter for the office, and then three zeros (or a sequential number when the other information is the same (what we call a "roll-off" project). Looks like 25H3003F001 -- this is the first roll off of the third performance project in 2025 for JA-20 (F) that was funded by Hurricane (H) money.

30 3.18 & 9.6 SOW What are the requirements for robust ad-hoc reporting?

Ad-Hoc reporting - our in office experts on the product should be able to generate reports on the data points they want at any time. All data cells in the program should be available for reporting. Excel or Word are preferred formats for the reports.

9.7 SOW

What are the advanced notification abilities needed within the system?

We want to be able to customize notifications for specific roles of peoples. For example, we may want notifications to manager when a staff member's timesheet is ready. We may want notifications to a manager when a workpaper is ready for review. We want a variety of notifications that are customizable.

32 2.4 SOW Does the Vendor need to be Fedramp approved to submit a quote?

Not if the program can be installed locally. Or if the company is willing to get Fedramp approved before installation, that might be a possibility.

Are there any specific actions or changes to fields in projects and recommendations that trigger notifications? We would like this to occur. See #31 above.

Attachment 1: Requirements Document B. Desired Capabilities, but not required. 9.1 SOW

The government indicated that the current systems include both TeamMate AM and Ideagen Internal Audit/Pentana. In 2017, Walters Kluwer introduced a TeamMate+, with many new features and cloud capabilities-- representing a significant advancement beyond TeamMate. Is our assumption that the government is using an older version of TeamMate (and not TeamMate+) correct? Yes, this is correct. We use TeamMateAM, not TeamMate+.

Due Date for submissions changed to June 9

We request a one week extension to due date as many of our key personnel who are working on this solicitation will be out of office all of next week Due Date: June 9 2025

1.4 SOW Requirement states must be "scalable from 50 to 250 users". There is no limit to the number of users in our Enterprise solutions. Pricing is based on the number of records per year; please indicate an approximation of the number of audits conducted per year. We currently completed 35 -50 projects a year. The number of attachments required to support those projects varies widely.

8.1 - 8.17 SOW Does DOT OIG seek a solution would primarily be tracking the metrics of cost for their time and expenses (by importing that information in from a payroll/time/expense software) or are you looking for our solution to provide the expense and timesheet management against projects? Looking for the solution to provide expense and timesheet management against projects.

2.14 SOW We do offer FedRAMP Moderate ceritified hosting option but also offer the option for clients to self-host the solution on their on-premise data centers. Is FedRAMP the preferred option for DOT OIG ? We are open to self-hosting or in the cloud. We have self-hosted for over 20 years. If this software is cloud based, it must be

FEDRAMP Approved for a Moderate system.

Questions