Attachment 3 Statement of Work.pdf

CONTRACT FOR ACCREDITATION SERVICES:

THE ACCREDITATION OF BUREAU OF PRISONS FACILITIES BASED UPON

FACILITY-SPECIFIC AUDITS UTILIZING CORRECTIONALLY MINDED BEST

PRACTICE STANDARDS

Federal Bureau of Prisons

Statement of Work (SOW)

1.0 INTRODUCTION AND OBJECTIVE

1.1 Introduction

The Federal Bureau of Prisons (BOP) is a component of government within the Department of Justice (DOJ). As the only federal prison system in the United States, the BOP is tasked with fostering a humane and secure environment for all federally incarcerated individuals that ensures public safety by preparing individuals for successful reentry into our communities.

Assisting in the overarching mission of the BOP, the Program Review Division (PRD) functions as a monitoring mechanism, providing oversight, guidance and direction to BOP facilities and staff regarding policy adherence and program performance. In addition to the internal audit process, the PRD has an External Auditing Branch (EAB) responsible for the coordination of logistics involved in audits by outside auditing entities. It is through engagement with these external auditing processes that the BOP can remain transparent with the public and other external stakeholders regarding its operations. It is also a means by which the BOP can assess its policies and procedures against various largely accepted community standards and best practices within the fields of corrections, medicine, mental health, education, and many other components that together allow for the creation of a humane and secure environment.

To strengthen its ability to evaluate BOP policy and procedure, the PRD is continually looking for new and innovative means to effect change and foster growth through evaluation.

1.2 Objective

The BOP, under the oversight of the PRD, seeks to obtain third-party accreditation for all BOP sites through facility-specific audits conducted by a third-party contractor. These audits must be grounded in correctionally oriented best practice standards and serve as the basis for facility accreditation.

In the process of providing accreditation for BOP facilities, a successful program will provide the following strategic benefits to the BOP:

A. External Evaluation and Benchmarking Provide an independent, external evaluation of BOP policies and procedures, evaluating them against industry standards and correctional best practices.

B. Systemic Insight and Prioritization Completion and utilization of Compliance Audit Reports (CAR) as a means of gathering detailed, facility-specific narratives—approximately 30 to 35 annually—that describe operational strengths and identify variables contributing to noncompliance. This body of data enables the BOP to identify and prioritize systemic issues, informing decisions related to funding, staffing, and resource allocation.

C. Operational Improvement and Reform Leverage audit findings to support corrective actions that have proven effective initially across similar non-BOP and later, once a year of CARs have been written and analyzed, across multiple other BOP facilities of similar demographics This comparison will serve to improve the BOP’s operational efficiency by addressing recurring inefficiencies system wide.

D. Transparency and Public Confidence Enhance voluntary transparency by demonstrating to the public and external stakeholders that the BOP is committed to fulfilling its mission in a cost-effective, humane, and accountable manner.

2.0 SCOPE OF WORK

2.1 Audit Standards Requirement

The BOP has solicited for a third-party contract servicer, with the ability to provide accreditation services as an additional method of transparency for the public and other external stakeholders.

Such a determination should be based, at least in part, upon a comprehensive audit in which best practice standards are reviewed at all BOP field locations to compare the functionality of individual BOP facilitates against the expected practices for the field.

For purposes of this contract, comprehensive is a broad term utilized to represent all necessary components/departments of a correctional facility, which for the BOP includes, at minimum, the following:

Human Resources Department/Contracting/Volunteer Services Business Office/Contracting Staff Training (To include mandatory firearms and other Annual Training components) Information Security Correctional Services (To include the Investigative Process, Special Housing Unit/Secure

Housing Unit Procedures, Solitary Confinement Policy, Use of Force Policy, etc.)

Inmate Disciplinary Process Receiving and Discharge Procedures Inmate Access to Mail and Legal Services Health Services (Medical, Dental, Pharmacy, Outside Referral Processes) Psychiatric/Psychological/Mental Health/Drug Abuse Treatment Services Education Services/Inmate Trade Programs/Work Assignments/Recreation Access

Access to Religious Services for various faith-based beliefs.

Trust Fund (To include inmate services like computer access, laundry, commissary, etc.).

Housing Unit Team/Management of Inmate Housing Assignment and Productivity Facilities Safety (To include Fire Safety and other preventive measures)

2.2 Description and Authorization of Best Practice Standards for Use

2.2.1 Description of Best Practice Standards: The specificity included in an Offeror’s explanation of the standards they intend to utilize for purposes of accreditation determination is a factor that will require close evaluation by the evaluation committee. While a detailed manual for the Offeror’s standards is not required at the time of bid submission, a manual (either published or unpublished) will be required to supply the facilities with the best practice standards being reviewed during the on-site audit process. At a minimum, the information that should be made available within the bidding documentation for review includes:

A. The specific best practice standards in their authentic form.

B. Indication as to whether each standard is based off correctional industry standard or community best practice.

C. Specific division/department/discipline the standard is associated with.

D. Any research behind how the standard came to be considered a best practice.

E. Whether the standards presented are the property of the Offeror or another entity.

F. Whether the standards are peer reviewed or currently being utilized by another correctional organization or in a different professional setting.

G. How the Contractor will seek to determine if a particular facility meets or does not meet the standard.

2.2.2 Authorization of Best Practice Standards: Due to the unique operational environment of a federal prison, the BOP prefers the use of industry-specific standards; however, their use is not mandatory. In certain instances where correction-specific best practices have not been formally established, the use of community-based standards is permissible—provided these standards meet similar evaluation criteria and legal use rights requirements and the contractor is diligent in accounting for the unique aspects of the correctional setting.

It is important to emphasize that while flexibility is granted regarding the origin of the standards, whether industry-specific or community-based, this flexibility does not relieve the contractor of the obligation to possess the legal rights to use the standards they recommend. Therefore, the BOP requires the offeror to provide documentation demonstrating the right to utilize the recommended standard(s) for third-party auditing purposes. Acceptable documentation must satisfy one (1) of the following three (3) criteria:

A. Proprietary Development: The offeror developed the standards independently based on original research and, as such, holds full and unrestricted rights to use them as deemed appropriate.

B. Licensed Authorization: The offeror did not create the standards but possesses documented, express authorization from the originator granting the right to use the standards for audit purposes.

C. Hybrid Justification: A combination of the two scenarios above applies. In such cases, the offeror must clearly describe the relationship and submit supporting documentation evidencing the appropriate rights or authorizations to use the standards.

2.3 Contract Deliverables

The Contractor is responsible for providing the following deliverables in accordance with the schedule and requirements established by the BOP:

2.3.1 Facility-Specific Compliance Audit Reports: For each BOP facility audited, the Contractor shall provide a comprehensive (defined as including all departments listed herein) written report that includes:

A. Assessment of compliance with applicable correctional best practice standards B. Documentation of all areas of non-compliance, citing the specific standard(s) C. Narrative findings describing strengths, challenges, and potential causes of non-compliance D. At a minimum, a summary indicating auditor determination as to whether the facility meets the minimum criteria necessary to be considered for accreditation or conversely, a dedicated section of the report for accreditation determination and rationale by the auditor.

2.3.2 Identification of Non-Compliant Standards Requiring Correction Action and Corresponding Technical Assistance in Development of a Corrective Action Plan (CAP):

The BOP prioritizes rectifying compliance issues regardless of whether the facility ultimately achieves accreditation status. While a formal CAP is not a required deliverable as defined within this contract, auditor technical assistance shall be made available to the facility as it develops its own CAP. Specifically, technical assistance as it is defined here may include:

A. Further detail in the explanation of the standard itself and/or why the auditor determined it to be noncompliant with best practice.

B. Scheduled availability to talk a facility through its ideas as they relate to CAP development.

C. Eventual approval of the CAP as a means of rectifying noncompliant findings.

D. Reassessment of the noncompliant findings post the agreed upon corrective action period to assess both whether the CAP was integrated appropriately into facility operations and if the institution had reached the minimum threshold for compliance with the noted standards.

2.3.3 Determination of Accreditation Status: Ultimately, a determination as to the accreditation of each BOP facility that receives an audit is required. This process should be determined by the Contractor, but must include:

A. A brief description of the process of accreditation, including all major benchmarks that an audited facility must successfully pass to be considered for accreditation.

B. A discussion of the variables considered when determining a facility’s accreditation status and description of how the audited facility in question performed on each variable.

C. Consideration of implemented CAPs (if applicable).

D. Decision on Accreditation status/renewal.

E. Requirements Moving Forward:

• If accredited, what is the period of time the accreditation is valid and what, if any, reporting requirements are necessary to avoid revocation.

• If not granted accreditation, what is the time-period before the facility can reapply for accreditation and what is the process to do so.

Note: Ultimately who writes the accreditation status report/section is dependent upon who determines the accreditation status (e.g. auditor, committee, contractor executive staff, etc.).

2.3.4 Annual Audit Summary Report: The Contractor shall submit an Annual Audit Summary Report consolidating data and findings from all facility audits conducted during the audit year. This report must include:

A. Aggregate trends, common deficiencies, and systemic risks.

B. Identification of any BOP specific best-practices observed by the Contractor during the audit/accreditation process that could be scaled nationally to improve overall BOP mission performance;

C. Recommendations for agency-level improvements.

D. Annual Audit Summary Reports should be built on each other through the course of each audit cycle. (Audit Cycle is defined as the amount of time required to evaluate all BOP facilities for accreditation/reaccreditation, which the BOP currently defines as 3-years. After an audit cycle concludes, a new cycle will begin the beginning of the following audit year.

2.3.5 Transparency and Stakeholder Engagement: For each facility participating in the audit/accreditation process, the following is required to purposes of transparency with the public:

A. Certificate of Accreditation, if granted, for placement in Administrative Building of the facility.

B. Public-Facing Summary of Accreditation Report/Audit Report Sub-Section appropriate for public viewing/posting, if the BOP determines it is beneficial. The specific format of the summary should be determined by the Contractor.

3.0 BOP CONTRACT POINTS OF CONTACT, THE ACCREDITATION AUDIT

CYCLE, SCHEDULING PROCEDURES, AUDITOR QUALIFICATIONS,

INSTITUTION AND INFORMATION SYSTEM SECURITY REQUIREMENTS,

AND DETERMINATION OF CONTRACTOR INDEPENDENCE

3.1 BOP Contract Points of Contact

What follows is a list of the position titles utilized in this contract and a brief description of their role:

A. Contracting:

1. Contracting Officer (CO): This individual is the person designated by the BOP to ensure the Federal Acquisition Regulations (FAR) are being followed and that the Programming Office requesting the contract is functioning as a good steward of government funds. Concerns that cannot be handled by the Contracting Officers Representative (COR) should then be addressed to the CO.

Contracting Officer Representative (COR): The individual who is designated by the CO, from the Programming Office, who assists in the monitoring of the contract from an administrative perspective. The COR monitors the contract deliverables to ensure the Contractor is meeting the performance requirements.

The COR is the first point of contact for administrative issues related to the contract.

B. Programming Office: As the need for this particular contract is related to auditing and accreditation, the Programming Office for this SOW is Program Review Division.

1. Program Manager (PM): The PM monitors the contract deliverables and other long-term objectives for the Programming Office. Issues that cannot be resolved by the Management Analysts should then be addressed to the PM.

2. Management Analyst: The employees who hold this title function as the audit liaisons between the BOP and auditors for the on-site audits. The Management Analysts are assigned to specific audits to coordinate the flow of data and communication between the facility being audited and the auditor.

3.2 The Accreditation Audit Cycle

It is reasonable to assume the necessity for reassessment of accredited facilities to ensure best practice standards continue to be met. Additionally, over time, community standards and best practices in the field evolve, which may lead to the requirement for reassessment of accredited facilities after an agreed upon amount of time since the standard change went into effect;

allowing for the accredited entity to conform policy and procedure to the expectations in the new standards.

At approximately six (6) months prior to the expiration of a facilities accreditation status, a certified auditor will return to reassess the facility in accordance with the standards. This reassessment will be facilitated utilizing the most updated standards – so long as the agreed upon time-period for implementation has passed. The purpose of this reassessment is to determine whether the facility continues to meet criteria necessary to maintain its accreditation status. That said, it is the expectation the auditor(s) treat each assessment for accreditation/reaccreditation as independent and self-contained from previous assessments performed.

For purposes of this contract, there should be no difference in process or type of data reviewed for reaccreditation versus the initial. The initial accreditation and reaccreditation processes should both include conducting audits at specified facilities on a repetitive audit cycle lasting an equal amount of time to determine functional ability to meet best practice standards mutually agreed upon by the Offeror and the BOP. The three-year audit cycle preferred by the BOP will follow the BOP’s Prison Rape Elimination Act (PREA) legally required auditing schedule. Both audits will occur during the same week, for all specified correctional facilities, unless the BOP initiates a deviation from this schedule.

Auditors will utilize current correctional standards and manuals. The format of the audit process is to be outlined by the Offeror as part of the bid documentation submitted. This process will be evaluated by the BOP as a part of the applicant evaluation process. It is important to note that while an Offeror may receive the award for contract, the process of evaluation will not be deemed finalized until fully reviewed by the BOP. Only portions of the Offerors process that violate a law or jeopardize the safety or security of the institution, employees, or the inmate population will require adjustment. The BOP will not require changes to the Offeror’s process because it appears difficult or time-consuming.

To protect the integrity of both the BOP’s internal and external auditing processes, these dual auditing mechanisms will remain separate and mutually exclusive. Only through ensuring the external auditor bases his/her conclusions around his/her own data gathering, review, and interpretation can the BOP ensure an unbiased independent opinion regarding the operations of a given facility as opposed to mere concurrence with BOP internal audit reports. Accordingly, the auditor will not have direct access to BOP internal auditing staff or work products.

3.3 Audit Scheduling Logistics

To minimize both facility disruption to normal operations and the amount of funding required to ensure proper implementation of the audits managed by the EAB, these audits reviewing best practice standards for accreditation considerations will run concurrently with the BOP’s PREA Audit schedule.

3.3.1 Initial Scheduling: This contract will ensure the scheduled auditing of all facilities identified by the BOP within the required three (3) year timeframe. BOP facilities will receive accreditation consideration based upon an audit utilizing best practice standards at least once during each continually recurring three-year period. As such, the Offeror awarded the contract requires an auditor staffing complement able to perform the facility specific audits and make the corresponding decisions on accreditation for roughly 30-35 BOP locations during the base period and for each option year period exercised thereafter as follows:

Base period: From Notice to Proceed to 12 months.

Option Period 1: Months 13-24 Option Period 2: Months 25-36 Option Period 3: Months 37-48 Option Period 4: Months 49-60 Option to Extend Services: Months 61 through 66

Prior to the beginning of each option year covered under the contract, the BOP will provide the Offeror a list of facilities to be audited for the upcoming option year. Despite the BOP’s best efforts, the Offeror selected must understand the list provided is fluid and subject to change.

Ordinarily, the annual audit schedule for site visits will be provided to the Contractor no later than June 1 of each year for the following exercised option year.

The Contractor will have 45-calendar days from the ratification of the next option year to provide the BOP with the list of auditors assigned to each institution site on the schedule for the duration of that fiscal year. Within this same timeframe, auditor qualifications will also be provided to the COR annually for the initial clearance of new auditors and update to clearance for those who audited on this contract during previous option years.

An audit of any one BOP facility requires up to three days onsite. Normally, audits will begin on Tuesday and end by the close of business on Thursday of that same week. The specific start and end times of the audit will be determined by the assigned Central Office Management Analyst, after logistical planning with the facility’s Executive Staff Team. The daily audit hours will closely mimic the institution’s normal day watch hours to ensure auditor access to the employees necessary for interview and further explanation of any pre-audit paperwork. The schedule will be adjusted slightly on day two and day three to ensure auditor access to employees on all shifts while on-site. This daily work schedule for the audit will be provided to the Contractor by the Management Analyst prior to the audit. No more than 8.5 hours will be scheduled in a workday, which includes time set aside for a 30-minute lunch. Additional time required to complete an on-site audit will be considered on a case-by-case basis and in accordance with BOP policy and any local employee Union agreements. The assigned Management Analysts will assist in time management, if necessary, to minimize the need for irregular officer shifts or the implementation of overtime, under normal circumstances (defined as conditions not involving emergencies, force majeure, or security threats) negotiated and agreed upon by the Union.

The on-site audit of all facilities identified by the BOP will be properly staffed by the Contractor to meet the timeframes listed above. Any change to the audit team members assigned to a particular facility audit is required to be communicated to the Program Manager at least seven

(7) days prior to the official start of the on-site portion of the audit requiring the change.

That said the Contractor/auditor is encouraged to consider the size of the facility assigned to be audited. Assigning fewer auditors comes with risks related to not being able to compete the onsite audit portion timely and could jeopardize the validity of the audit or limit the information obtained on-site, inhibiting the number of standards the auditor can intelligently form a decision

on. Past experience suggests sufficient staffing will include:

Two (2) - three (3) auditors at any Federal Correctional Complex.

One (1) - two (2) auditors for stand-alone United States Penitentiaries, Federal Correctional Centers, Metropolitan Detention Centers, Metropolitan Correctional Centers, Federal Medical Centers, and the Federal Transit Center; and, One (1) auditor for Federal Prison Camps and Central Office.

There is one caveat to this process, where the BOP will weigh in regarding the size of the on-site auditing teams. Specifically, should a pattern become clear where the number of auditor(s) assigned to a particular type of facility (Stand-Alone FCI/Detention Center/Medical Center/Complex/etc.) is leading to either auditor(s) sitting idle/requesting an early close-out of the on-site week, or alternatively, is leading auditor(s) to continually request additional time outside the routine schedule agreed upon, the BOP reserves the right to make certain audit team provisions. A couple examples of what this may look like include but are not limited to: (1) Only one auditor should be assigned to a standalone facility, or (2) when a complex has 2+ institutions on-site, the audit team needs to consist of a minimum of two (2) auditors.

3.3.2 Rescheduling/Cancellation of Audits

The BOP reserves the right to cancel and/or reschedule any on-site audit previously scheduled and agrees to inform the Contractor as soon as possible, under normal circumstances (defined as conditions not involving emergencies, force majeure, or security threats) no later than seven (7) days prior to the audits official travel day. Similarly, the BOP reserves the unilateral authority to cancel the entire audit process for any facility under BOP jurisdiction for any reason. This non-negotiable allows the BOP to ensure the safety of all auditors, employees, and inmates in often unpredictable situations (e.g. medical epidemic, recent violence resulting in complete lockdown operations, intelligence received regarding risk to safety that occurs during the time of the on-site audit, etc.).

Contractor requests for audit schedule changes must occur at least 60-days prior to the first day of travel for the pre-scheduled audit and be approved by the contract’s PM. An auditor replacement is always preferred to audit rescheduling/cancellation. Under no circumstances will the price of travel be considered as an acceptable reason for audit reschedule/cancellation.

Barring uncontrollable forces of nature such as weather, travel restrictions, and auditor medical emergencies, Contractor requests for reschedule/cancellation made less than 60-days prior to the first travel day of the on-site audit may result in documentation of the incident in the CPARS contractor rating system. If scheduling problems persist and/or appear systematic in nature, the situation may result in the BOP declining to exercise future option years as contracted.

3.4 Auditor Qualifications

The Contractor must ensure it keeps an adequate roster of qualified auditors to perform roughly 30-35 BOP audits per fiscal year. Additionally, the Contractor bears the primary responsibility for ensuring auditors assigned to the BOP audit schedule possess the training, experience, and overall audit skills required to perform the functions of the audit processes with minimal difficulty. At a minimum, the BOP requires the following qualification to be considered for participation in a BOP audit:

A. Security Requirements: Maintaining a high level of security allows for the preservation of safety for BOP employees, those in BOP custody, and the public. As such, BOP Contractors and their auditors are similarly expected to abide by federal laws, regulations, standards, and FBOP directives and handbooks while assigned to a BOP audit.

1. Contractor Employee Background Check: Contractor shall certify that all its employees and auditors having access to BOP sensitive information (e.g. inmate central file, employee human resources file) during the performance of this contract have successfully passed a Contractor employee background check.

2. National Crime Information Center (NCIC) Check: One of the resources that will be utilized to ensure both physical and information technology security stays intact is the requirement of government background checks/screening. Given the short time-period access is granted to individual facilities, compliance with an abbreviated process, known as an NCIC check, will be the expectation for the Contractor, auditors, and other contracting staff who may enter the confines of the facility and/or be given access to BOP data considered sensitive.

NCIC checks will be required prior to beginning the base year audit schedule, with reassessments to occur annually, prior to the commencement of the next option year. Those Contracting staff/auditors who begin on the BOP contract at any other point in time, during the base or an option year, will participate in an NCIC check prior to participating in any part of the BOP audit/accreditation process. These Contracting staff/auditors will follow the re-check process prior to the start of the following option year regardless of the length of time that passes between their initial check and first re-check.

i. Given the NCIC check is not a federal background investigation, even those passing the check are required to be escorted by BOP staff at all times while inside the secure perimeter of a facility.

ii. While the BOP requires the NCIC check be performed annually, note an additional check may be required of those entering a facility at the discretion of the facility’s CEO/Warden. Should such a requirement exist, prior to an on-site audit, the assigned management analyst will notify the auditor prior to arrival at the facility.

iii. Any fees associated with the cost of the NCIC check will be the responsibility of the Contractor; however, advanced payment by the BOP is possible; the fee of which will be deducted from the cost of the audit by the Contractor at the time of invoice.

iv. Failure to comply or to “pass” the NCIC check requirement will likely result in their inability to participate in the BOP accreditation contract.

3. Identification Requirements: All Contractor employees/auditors entering the confines of a BOP facility are required to provide proof of identity upon entering the facility’s Administration Building. All forms of identification utilized for this purpose must be issued by a governmental body, be currently valid (not expired), and have a photo of the individual requesting admittance. Examples of identification that meets this criterion include: A state issued driver’s license, a state issued Identification Card, or a United States Government Passport.

If requesting entrance into the secure perimeter of the facility, as all auditors will, the individual will have his/her identification checked again at the Control Desk.

Whether or not the ID card is kept in the secure control room and replaced with a visitor badge is at the discretion of the facility itself. Regardless, to avoid scenarios where the Contractor/auditor enters the secure perimeter without a means to identify themselves, a second form of ID is highly recommended.

This second means of identification does not need to be an official document, nor government issued. Any picture identification card will suffice; however, one that denotes your name and rationale for entry is recommended (e.g. an ID issued from the Contractor). The second form of identification will be essential for entering into the enhanced security areas of a facility (e.g. the Secure Housing Unit) and should be shown to identify yourself to any BOP staff member who inquires.

B. Contractor Certification: The contractor is responsible for providing the BOP with a copy of the criteria utilized to certify their auditors. Any Contractor-led training for the auditors should be shared with the BOP(COR) prior to the start of the base year of the contract. Any updates to the certification criteria should be provided to the COR prior to each option year exercised moving forward. Additionally, the contractor is responsible for providing an update to the list of auditors they plan to utilize for BOP audits determining accreditation.

C. BOP Specific Training: In addition to the Contractor’s normal training procedures for its auditors, given the unique environment of a federal prison when compared to other state and local agencies, the BOP requires the contract auditors to receive additional training information prior to auditing a federal facility. The BOP is responsible for creating additional content; however, the Contractor is responsible for ensuring the information is provided and the auditors understand and agree to its content. At the discretion of the Contractor, the information may be provided in lecture format or via self-study with an attestation signature required as acknowledgement of the content. Some examples of information for this training include but are not limited to: Specifics related to personal electronic devices entering the facility; BOP expectation not to interfere in an emergency;

BOP required report specifics noted in the SOW; any specific requirements for reporting accreditation decisions unique to the needs of the BOP; etc. This BOP specific training is required to be attended at least once for each auditor; however, the training information will be reviewed by BOP staff annually to ensure the information is current. If this annual review leads the BOP to make amendment(s) to the BOP specific training, the Contractor will be provided with the updated training version. This newly amended BOP training will replace all prior versions of the training for purposes of the Contractor’s requirement to ensure new auditors assigned to the BOP audit schedule receive said training prior to participation in their first BOP audit.

1. Refresher Training: Whether refresher training will be required of the auditor(s) prior to the beginning of the upcoming option year will depend upon the significance the BOP places on the annual changes made, and the projected effect on the audit process. More routinely offered refresher training may be provided by the Contractor should they determine it advisable for their auditors or, if they determine it an easier way to manage this training requirement, so long as the Contractor first ensures, through correspondence with the COR/Program Manager, it has the most recent amended version.

D. Prior Employment within the BOP: Auditors with a history of employment within the BOP will be ineligible to participate in this audit process until three years have passed since the auditors’ last day of BOP employment. Those affected auditors who meet the three-year criteria may be added to the BOP audit schedule with the understanding they will not be scheduled to audit a facility in which they had previous direct oversight as a supervisor holding the position of Department Head over any discipline found at the particular facility and/or was considered a member of the facility’s Executive Staff (e.g.

Executive Assistant, Associate Warden, Warden).

E. COR Approval: All auditors will be approved by the COR and/or the PM prior to the start of an audit period. Denial of a Contractor’s appointed auditor(s) from participation in a BOP audit will occur at the discretion of the BOP, based upon considerations to include, but not limited to the criteria noted above. Additionally, recent criminal behavior, behavioral/professional issues noted during the current or a prior BOP audit; and reported/observed physical/psychological characteristics deemed to affect one’s fitness to safely enter the confines of a correctional facility may result in denial of entry into a federal facility.

3.5 Identification and Resolution of Potential Conflicts to Independence

Regardless of the auditing conceptual framework to which an Offeror subscribes, one of the principles that appears of consensus is the idea the auditing agency must have Independence from the entity it is auditing. As explained in the Generally Accepted Government Auditing Standards (GAGAS) (p. 29), the Contractor should have Independence of Mind and Independence in Appearance. The Independence of Mind referenced is required for the auditing agency to be able to evaluate objectively and form conclusions based upon the data obtained with integrity, while the Independence in Appearance refers to the level of independence required to avoid situations where a somewhat informed third-party questions whether that objectivity or integrity has been compromised.

Given the level of importance placed on the construct of Independence in the field of auditing, the Contractor will establish or indicate proof of previously established and current maintained formal, documented process in place for identifying, evaluating, and resolving both actual or potential conflicts of interest of employees, interns, volunteers, board members, sub-contractors, and all others associated with the Contractor and who also who function or may function in any role of decision-making process throughout the duration of the facilities individual audit process. The BOP will not insist upon a specific framework, as there are many; however, there are specific areas in which the BOP expects the risk analysis process be completed.

3.5.1 Outline of Basic Requirements for Ensuring Contractor Independence

A. Identification and Disclosure of Actual/Potential Conflicts All individuals with a role or potential role in determining compliance-level with best practices and/or determining the facility’s Accreditation Status must participate in the identification process. This includes, but is not limited to, those who engage in scheduling/planning activities, the facility review, data analysis, quality assurance, or any phase post completion of the final audit report involved in the procedural process of determining accreditation, if applicable.

Examples of conflict may include personal, organizational, financial, and current or previous non-audit related services/contracts.

All potential conflicts identified should first be internally reviewed and a determination made as to whether the relationship, in its current state, represents a threatening or non-threatening relationship. The rationale for deeming a relationship non-threatening must also be documented.

All conflicts to independence should be provided to the BOP in full disclosure.

B. Attempt to Resolve All Conflicts to Independence Attempts to resolve all conflicts of independence should be made and documented.

All conflicts identified must be resolved to the satisfaction of the client and the

BOP reserves the right to require contract employees or representative of the Contractor be removed from the specific audit, or in some instances certain percentages of and up to the entire contractual engagement depending on the significance of the conflict and at what level of the Contractor and the client organization the conflicts occur.

Should an identified conflict that was resolved have a change in status or a new conflict to independence be brought to the attention of the Contractor, it is the responsibility of the Contractor to immediately bring the threat or potential threat to the BOP.

C. Certify Independence Only upon resolution of all actual and potential conflicts, will the Contractor be able to supply a Statement of Independence as affirmation that to the Contractor’s best knowledge either no conflicts exist, or all current or potential conflicts have been resolved.

While the Statement of Independence may be templated, one statement for each facility audit/accreditation process, with signatures from all associated with contractual determination of deliverables is a requirement of the contract.

If the Contractor believes individual statements are more effective for some individuals, depending upon their role in this process, that is acceptable, so long as at least one signature from all engaged in the process is retained on an independence certification.

The Certificate(s) of Independence must be added as an appendix at the end of each facility report submitted to BOP or utilized for accreditation determination.

Failure to participate in, or determination that the Contractor has engaged in deceit in any part of this process involving even one facility audit will not only be grounds for that facility’s engagement to be terminated, it may be grounds for early termination of the entire contractual engagement.

4.0 CONTRACTOR PERFORMANCE TASK SPECIFICS (GENERAL AUDITING

EXPECTATIONS, PRE-AUDIT PROCESS, ON-SITE AUDIT PROCESS, POST-

AUDIT PROCESS AND QUALITY ASSURRANCE

4.1 Contractor Performance Task Specifics: General Auditing Expectations

4.1.1 Contractor Communications with BOP: The Contractor and its auditors will comply with the procedures the BOP has established to streamline the flow of information from auditor to institution via BOP Central Office and vice versa. The Contractor and its auditors will:

• Provide all pertinent information for each assigned audit to the BOP’s assigned CO or his/her designee, which for purposes of this accreditation contract, is the COR. Such information should include, but is not limited to, processes utilized during all stages of the audit process (e.g., documentation review, interviews, auditor observations, etc.), the expected level of BOP participation deemed necessary by the assigned auditor, and a detailed explanation of each standards individual finding, as well as the overall level of functioning and an informed opinion related to further consideration of accreditation.

• Cooperate with BOP representatives regarding BOP requests within the confines of the contract meeting deadlines; being responsive to requests for additional information related to auditor qualifications, scheduling concerns, and questions related to audit findings; etc. For purposes of this contract, BOP representatives include, but are not limited to its CO, COR, PM, and Management Analysts responsible for facilitating the flow of information between BOP institutions and the contract auditors.

• Respond to contact made by the CO, COR, Management Analyst, PM, or other BOP representative within two (2) business days from sent receipt.

• Ensure all facilities are provided all relevant information, manuals, and software required for the best practice audit to include the list of standards with associated explanations of its meaning, purpose, and the way each standard will be assessed.

• All auditor communication related to a facility shall occur through the assigned Central Office Management Analyst. Examples of such scenarios include but are not limited to:

requests for additional information regarding a particular standard, logistical questions related to travel or the local area, and assistance in scheduling institution employee and inmate interviews.

4.1.2 Information Security Requirements:

A. Access to BOP Information Systems: For purposes of providing the deliverables denoted in section 2.3 of the SOW (above) the Contractor does not require direct access to BOP information systems. As such, no usernames or passwords will be created for the Contractor or its auditors to access a government virtual database for purposes of data searches.

Any information required to perform the tasks identified by the contract will be provided to the Contractor/auditor by the assigned Management Analyst. Under no circumstances should the Contractor/auditor request a BOP employee utilize their credentials to provide the Contractor/auditor with access to these secure databases.

While data may be provided to the Contractor/auditor utilizing password protected emails/secure data storage websites in which the Contractor/auditor may be required to create and provide a username and/or password for entry, such access will be limited to data sharing spaces and will not allow unattended access to any information not formally requested or required to perform the functions of the contract.

B. Legal Considerations: The Contractor shall conform to the requirements of the Freedom of Information Act (5 U.S.C. § 552) regarding the disclosure of records and information furnished by the BOP or created by the auditor during the audit process. Ordinarily, the BOP’s physical/electronic documentation will not be allowed out of government databases or the confines of the institutions. Auditors will have access to all requested information during the time of the on-site audit. Release of information from BOP institutions and databases will be considered on an individual basis and would require redaction of said information for confidentiality purposes and protection of Personally Identifiable Information (PII). The BOP requires any request for information the Contractor or one of its auditors receive from a third party be discussed with the BOP prior to any information, including the final audit report, being released. The Contractor cannot independently release any information without the expressed written approval of the BOP.

The Contractor shall conform to the requirements of the Privacy Act (5 U.S.C.§ 552a) regarding the sampling of inmate records by the Contractor’s assigned auditor(s) to determine which best practice standards are met and based on overall functioning, the facility’s accreditation status. The Offeror awarded the contract will have provided a safe and secure way by which the BOP is able to make necessary facility/agency confidential documentation available for review in a manageable way for the facilities being audited in accordance with the Privacy Act of 1974. Ultimately, the BOP will evaluate provided method(s) and determine if information security is adequate or if another means of data transmission will require implementation. As such, the BOP will provide such information requested by the auditor(s) in the way deemed most secure and least likely to jeopardize the security of this private and confidential information.

C. Ethical Considerations: Except as required or authorized by federal, state, local law, judicial order or as permitted by the BOP, the Contractor and its auditors will not make any oral or written public statements – including, but not limited to, statements to the press, conference presentations, lectures, or articles – with regard for the status of the BOP’s ability to meet best practice standards, the BOP’s accreditation status, or any act or omission of the BOP or its employees.

Except as required or authorized by the terms of this contract, or by permission of the BOP, the Contractor and its auditors shall not testify in any litigation or proceeding regarding the status of the BOP’s performance with part or all the auditing standards utilized, or any act or omission of the BOP or its employees. If the auditor is lawfully compelled to provide such information, the auditor and/or the Contractor responsible for auditor oversight shall immediately notify the BOP.

D. Confidential or Personal Identifying Information: In addition to auditor accountability through both legal and regulatory means, it is the BOP’s expectation the Contractor hold their auditors accountable through their own means. These means will include but are not limited to company internal policies and an Employee/Auditor Code of Conduct.

It should be understood; the Contractor and its auditors are responsible for the adequacy and legitimacy of their work product. As part of this responsibility, collectively, both entities must:

• Protect and safeguard all BOP data/information in their custody, including that which contains personally identifiable information, commensurate with the sensitivity and value of the data at risk.

• Protect and safeguard all BOP information systems granted access, from unauthorized access, unauthorized or inadvertent modification, disclosure, damage, destruction, loss, theft, denial of service, and improper sanitization or use.

• Ensure the safekeeping and confidentiality of all sensitive correspondence received in the course of the audit/accreditation process, unless otherwise required by law to disclose such information.

• Do not share the passwords to their computers, laptops, or other mobile devices holding sensitive audit data.

• Do not leave sensitive audit-related information, in either electronic or paper format, in a public place or outside of their supervision.

• Screen-lock or log-off any computers or devices holding sensitive audit data when outside their supervision.

• Ensure that individuals have the proper clearance, authorization, and need to know before providing them with access to any sensitive information.

• Immediately destroy confidential and privileged information once requirements of law, policy, and the FAR have been met for retention.

E. Unauthorized Electronics: For reasons of both physical and information security, limitations are placed on the personal electronic equipment allowed entry into the secure perimeter of all BOP facilities for BOP employees, Contractors, and facility guests/visitors. Broadly speaking, no device with the ability (or the assumed ability) to hold an internet or cellular connection is allowed access. Specifically, no Contractor and/or auditor will be allowed admittance with any of the following: cellphone, computer, laptop, tablet, smart watches, etc. If caught trying to bring such items through the metal detector at the entrance of any BOP facility, will at a minimum, result in the individual’s immediate denial of entry and could result in further investigation, criminal charges, and/or Contract termination.

F. Recording Devices: Apart from the devices listed above, any camera or other visual recording devices are considered unauthorized items and may subject the owner to the repercussions referenced above. If an audio device is requested prior to arrival at the facility for purposes of taking personal notes or recording the opening or closing sessions with the facility staff, it may be permitted so long as it does not have internet or cellular capability. These audio recording devices may be utilized within the administrative areas of BOP facilities and outdoors – so long as it is outside the confines of any secure perimeter. As these devices are permitted under the limitations mentioned above, recordings of any kind, including open-up and close-out sessions with the executive staff at the facility shall not be requested of the institution by the auditor. BOP employees can assist with transcribing such a meeting by providing attendance sheets and taking notes;

however, the facilities are not responsible for recording these sessions for Contractor/auditor use.

If recorded, the audio file and its transcription shall be considered property of the BOP, shall be utilized only for the purposes of auditing and accrediting the facility where the recording was taken, and is subject to the same data storage, retainment, and destruction processes as other BOP physical documentation/data secured by the Contractor for the purpose of fulfilling the deliverables of the contract.

Any specific questions related to what can and cannot be brought within the confines of a federal prison facility should be directed to the assigned Management Analyst for the audit. A Contract employee or auditor stating they were not aware will not excuse them from trying to bring in a prohibited item. It is the responsibility of the Contractor to provide this information to all affiliated with this contract.

4.1.5 Summation of Auditing Procedures: The auditor(s) shall evaluate each facility in accordance with the set of Contractor-determined standards. These standards should have been vetted against community standards and/or industry best practices and tailored specific to a correctional environment.