Attachment A- DRAFT A-123 PWS.docx

Performance Work Statement (PWS) A-123 Internal Controls 4/14/2026 Version 3.0

Contents

Performance Work Statement (PWS) A-123 Internal Controls Vision Statement To strengthen the effectiveness and efficiency of internal controls over financial reporting and financial management systems to ensure compliance with applicable laws and regulations in accordance with the Office of Management and Budget (OMB) Circular A-123, Management's Responsibility for Internal Control.

1 General Information

1.1 Scope of Work

The U.S. Department of Housing and Urban Development (HUD), Government National Mortgage Association (Ginnie Mae) Office of Enterprise Risk (OER) requires contractor support to strengthen internal controls over financial reporting and financial management systems. Services shall include documenting, testing, accessing, and reporting on Ginnie Mae’s internal controls over financial reporting and financial management systems in accordance with OMB Circular A-123, including Appendix A, Management of Reporting and Data Integrity Risk Assessment of Ginnie Mae’s internal controls over financial reporting.

The Contractor shall provide Risk Management and Internal Controls services to perform Ginnie Mae’s annual OMB Circular A-123 including Appendix A to document, test, access and report on Ginnie Mae’s internal controls over financial reporting and financial management systems.

The support services shall include:

· Program Management

· Assessments

· OMB A-123 Entity Level Controls Assessment

· Conclusion and Recommended Assurance Statement

· Policy and Procedure Update

· Training Services

· Additional Special Assessments

· Transition Services (if applicable)

Detailed descriptions of specific tasks are provided in Section 5 - Specific Tasks and Deliverables.

1.2 Background

Ginnie Mae is responsible for its own financial statements and financial reporting and produces a "Report to Congress" and an Annual Report. HUD also receives Ginnie Mae financial information for inclusion in HUD's consolidated financial statements. Ginnie Mae is unique in that it does not use budgetary accounting, and it prepares standard financial statements in compliance with generally accepted accounting principles (GAAP).

Ginnie Mae’s management is responsible for establishing and maintaining effective internal controls and financial management systems that meet the objectives of the Federal Managers Financial Integrity Act of 1982 (FMFIA). Ginnie Mae currently conducts its annual assessment of internal control over the effectiveness and efficiency of operations and compliance with applicable laws and regulations in accordance with OMB Circular A-123. Ginnie Mae also conducts its annual assessment of the effectiveness of internal controls over financial reporting, which includes safeguarding of assets and compliance with applicable laws and regulations, in accordance with the requirements of Appendix A of OMB Circular A-123.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

Federal Managers Financial Integrity Act of 1982 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/financial/fmfia1982.html September 8, 1982

OMB Circular A-123, Managements Responsibility for Internal Control https://www.whitehouse.gov/wp-content/uploads/2026/03/OMB-Circular-No.-A-123-2026.pdf)

OMB A-123, Appendix A of OMB Circular A-123 Revised https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-16.pdf June 6, 2018

OMB A-11, Preparation, Submission and Execution of the Budget https://www.whitehouse.gov/wp-content/uploads/2025/08/a11.pdf August 2025

The Green Book, Standards for Internal Controls in the Federal Government https://www.gao.gov/assets/gao-25-107721.pdf May 2025

The Yellow Book, Government Auditing Standards 2024 Revised https://www.gao.gov/assets/d24106786.pdf February 2024 Revision

Government Performance and Results Modernization Act of 2010 (GPRA) https://www.congress.gov/111/plaws/publ352/PLAW-111publ352.pdf January 4, 2011

Federal Information Security Modernization Act of 2014 (FISMA) https://www.cisa.gov/federal-information-security-modernization-act December 18, 2014

Federal Information Systems Controls Audit Manual (FISCAM) https://www.gao.gov/assets/80/77142.pdf February 2009

Improper Payments Information Act of 2002 (IPIA) and Improper Payments Elimination and Recovery Act 2012 https://www.govinfo.gov/content/pkg/PLAW-112publ248/pdf/PLAW-112publ248.pdf January 10, 2013

Implementation Guide for OMB Circular A-123, Managements Responsibility for Internal Control Appendix A, Internal Control over Financial Reporting https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A123/a123_appx_a_implementation_guide.pdf July 2005

Clinger-Cohen Act of 1996 https://www.fismacenter.com/Clinger%20Cohen.pdf February 10, 1996

Generally Accepted Accounting Principles (GAAP) http://www.accountingtools.com/definition-gaap

Federal Travel Regulations (FTR) http://www.gsa.gov/portal/content/104790 November 15, 2019

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be a 12-month base with four (4) 12-month option periods.

1.6 Place of Performance

The services to be performed under this contract shall be performed at the contractor facilities.

1.7 Hours of Operation

The Contractor is responsible for providing services between hours of 8:00am to 5:00pm, Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. The Government reserves the right to change hours of operation or restrict contractor access. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

The Contractor shall have the following risk and compliance industry certifications:

· Certified Public Accountant (CPA)

· Certified Information Systems Auditor (CISA)

· Certified Internal Auditor (CIA)

· Certified Fraud Examiner (CFE)

· Certified Government Financial Manager (CGFM)

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with HUD Acquisition Regulation (HUDAR) clause 2452.237-79 - Post Award Conference.

1.10 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will appraise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion.

1.11 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46.

1.12 Transition-In

The Contractor shall, upon the Contracting Officer's written notice, furnish transition-in services as required. As a successor, the Contractor shall have sufficient personnel on board during the 30-day transition-in period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the transition-in period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract transition-in period. Transition-in is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition-Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 30-day transition-out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the transition-out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor contractor is achieved by the end of the new contract transition-in period.

2 Definitions and Acronyms

2.1 Definitions

Business Day – Every official day of the week which are days between and including Monday to Friday. This does not include federal holidays and weekends.

Complementary User Entity Controls – Controls that management of the service organization assumes, in the design of the service organization’s system, will be implemented by user entities and are necessary to achieve the control objectives stated in management's description of the service organization’s system.

Contractor – A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) – A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer’s Representative (COR) – An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical directions to the Contractor if direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service – A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable – Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Enterprise Risk Management – An effective agency-wide approach to addressing the full spectrum of the organization’s significant risks by understanding the combined impact of risks as an interrelated portfolio, rather than addressing risks only within silos.

Government Furnished Property (GFP) - Government-furnished property is property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is deliverable under a cost contract when accepted by the Government for continued use under the contract.

Independent Validation and Verification – A comprehensive review, analysis and testing performed by an objective third-party to confirm (i.e., verify) that the requirements are correctly defined, and to confirm (i.e., validate) that the systems correctly implement the required functionality and security requirements.

Performance Standard - The Contractor’s performance level required by the Government.

Performance Work Statement (PWS) – A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Quality Assurance (QA) – Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) – A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) – All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Subcontractor – Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

2.2 Acronyms

AICPA - American Institute of Certified Public Accountants AQL - Acceptable Quality Level CCMB - Configuration Change Management Board CFO or OCFO - Office of the Chief Financial Officer of HUD CFPB - Consumer Financial Protection Bureau CFR - Code of Federal Regulations CIO or OCIO - Office of the Chief Information Officer of HUD CO - Contracting Officer COR - Contracting Officer's Representative CPO - Office of the Chief Procurement Officer of HUD CUEC - Complementary User Entity Controls ELC - Entity Level Controls ERM - Enterprise Risk Management EST - Eastern Standard Time (U.S.)

FISCAM - Federal Information System Controls Audit Manual FISMA - Federal Information Security Modernization Act GAO - U.S. General Accountability Office GFAS - Ginnie Mae Financial Accounting System GNMA or Ginnie Mae - Government National Mortgage Association HUD - U.S. Department of Housing and Urban Development HUDAR - HUD Acquisition Regulation IC – Internal Controls IG or OIG - Inspector General (Office of) IPMS - Integrated Pool Management System IT - Information Technology IV&V - Independent Validation and Verification KPI - Key Performance Indicator KRI - Key Risk Indicator MBS - Mortgage-Backed Security MFPDM - Multifamily Pool Delivery Module NIST – National Institute of Science and Technology OCPO - Office of the Chief Procurement Officer OIG - Office of Inspector General OMB - Office of Management and Budget P&I - Principal and Interest PM - Program/Project Manager POC - Point of Contact PPM - Project Planning and Management PWP - Project Work Plan QA - Quality Assurance QASP - Quality Assurance Surveillance Plan QCP - Quality Control Plan RFS - Reporting and Feedback System SF - Standard Form SFPDM - Single Family Pool Delivery Module SFTP - Secure File Transfer Protocol SOP - Standard Operating Procedures TOD – Test of Design TOE – Test of Effectiveness T&M - Time and Materials TBD - To be determined TOD - Test of Design TOE - Test of Effectiveness UFS - Unclaimed Funds System VRM - Vendor Risk Management WSR - Weekly Status Report

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

Government services will not be provided.

3.2 Facilities

Facilities will not be provided.

3.3 Equipment

Equipment will not be provided.

3.4 Materials and Information

See HUDAR 2452.227-70, Government Information

The Government shall provide A-123 Program assessment deliverables to the Contractor to facilitate completion of all tasks and deliverables required from this PWS, after the award.

The Contractor will be provided access to HUD systems upon completion of the Personal Identity Verification (PIV) process.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all off-site facilities to perform the services identified within this PWS.

4.2 Equipment

The Contractor shall furnish all equipment required to perform the services identified within the PWS.

4.3 Materials

The Contractor shall furnish all materials required to perform the services identified within the PWS.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period of performance.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR/PM upon request and at the conclusion of the contract.

4.5 Contractor Personnel

See HUDAR clause 2452.237-70 - Key Personnel in the Key Personnel section of the contract.

· Manager/Project Manager

· Senior Associate 1

· Senior Associate 2

· Associate 1

· Associate 2

· Associate 3

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks

5.1 Task One - Program Management

The Contractor shall provide program management support under this requirement. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this PWS.

5.1.1 Weekly/Monthly Status Reports

The Contractor will meet weekly with the Contracting Officer's Representative (COR), Program Manager (PM), and other Government personnel, to review Contractor performance, contract requirement, engagement status, etc. The Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. The Contractor shall provide the COR minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, within two (2) business days following the meeting.

By the second day of each work week, the Contractor shall develop and provide a Weekly Status Report using Microsoft Office Suite applications to the COR/PM.

The Weekly/Monthly Status Report shall include at a minimum:

1. Activities during reporting period, by task (on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Start each section with a brief description of the task.

2. Problems, risks, issues and corrective actions taken or proposed resolutions to address them.

3. Personnel gains, losses, and status (security clearance, etc.).

4. Government actions required.

5. Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

6. Accumulated invoiced cost for each CLIN up to the previous month.

7. Projected cost of each CLIN for the current month.

Performance Standards

1. Standard: The Weekly Status Report and Meeting Minutes are completed and delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

b. Standard: The Weekly Status Reports and Meeting Minutes are accurate and up to date as well as actionable, when necessary.

AQL: Zero deviation, unless discussed and agreed to by all parties.

c. Standard: The Monthly Enterprise Risk Committee Status Report (Internal to Ginnie Mae) is completed and delivered in accordance with PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

d. Standard: The Monthly Enterprise Risk Committee Status Report (Internal to Ginnie Mae) is accurate and up to date as well as actionable, when necessary.

AQL: Zero deviation, unless discussed and agreed to by all parties.

e. Standard: The Monthly HUD Status Report (External to Ginnie Mae) is completed and delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

f. Standard: The Monthly HUD Status Report (External to Ginnie Mae) is accurate and up to date as well as actionable, when necessary.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A001 A-123 Program Weekly Status Reports and Meeting Minutes A002 A-123 Program Monthly Enterprise Risk Committee Status Report (Internal to Ginnie Mae) A003 A-123 Program Monthly HUD Status Report (External to Ginnie Mae)

5.1.2 Project Work Plan

The Contractor shall submit a Project Work Plan (PWP) for the contracted services within five (5) business days of contract award, not including edits and/or comments. Changes to the PWP shall be reviewed and accepted by the COR/PM prior to work beginning. The PWP shall be updated annually. Provisions will be established to update the PWP at appropriate junctures, as directed by the COR/PM.

The PWP shall consist of a project narrative description and a graphic summary of the schedule and financial elements of the contract. The narrative shall:

1. Describe the planned deliverables schedule;

2. Identify each step in the work process required for completing the A-123 Assessment and the period of time needed to accomplish each step, expressed in terms of the calendar dates;

3. Provide the staff, financial, and other resources allocated to each task; and

4. Provide the rationale for project organization, staff utilization, and other resources allocated to each task or activity.

Performance Standards

1. Standard: The Project Work Plan is accurate, kept up to date and accessible.

AQL: Zero deviation, unless discussed and agreed to by all parties.

1. Standard: The Project Work Plan includes all significant activities and/or milestones related to each contract deliverable.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A004 A-123 Program Project Work Plan

5.2 Task Two – A-123 Internal Controls (IC) Assessment

The Contractor shall document, test, assess, and report on Ginnie Mae's internal controls over financial reporting for (5) five to (6) six of the (13) thirteen significant financial business cycles and processes, and subprocesses related to financial reporting in accordance with OMB Circular A-123 and Government-provided guidance annually.

Annual Scoping of Ginnie Mae’s Significant Financial Business Cycles:

1. Financial Reporting shall be assessed each year. Annually, approximately 5 to 6 of the remaining 13 business cycles shall be assessed each year.

2. Annual in-scope business cycles are determined based on the previous year’s audit findings, qualitative and quantitative risk assessments and other business reasons determined by HUD and/or Ginnie Mae leadership.

Ginnie Mae Significant Financial Business Cycles

Financial Reporting

Property Management

Allowance Accounting

Mortgage Servicing Rights Reporting

Repurchase Liabilities Reporting

Human Resources and Payroll Management

Procurement and Payment Management

Cash and Treasury Related Services

Budgetary Execution

Revenue and Cash Collections Management

Non-Pooled Loan Asset Accounting

Guaranty Reporting

Principal and Interest Advances Reporting

The Contractor shall develop and provide recommendations for corrective actions to strengthen internal controls. All A-123 assessment results shall support Ginnie Mae’s annual Management Assurance Statement.

The contractor assesses 5 to 6 Ginnie Mae financial business cycles and processes in accordance with Government approved, risk-based assessment plan and annual assessment schedule provided by the COR/PM.

The contractor shall complete the A-123 assessment in accordance with the schedule provided at task order award and as updated by the COR/PM.

The Contractor shall coordinate with the COR/PM and designated Government stakeholders to:

· Confirm A-123 assessment scope and timelines

· Conduct preliminary A-123 risk assessment (Quantitative and Qualitative)

· Perform walkthroughs with meeting minutes

· Obtain required documentation

· Validate preliminary observations and findings

The Contractor shall prepare and submit an A-123 Assessment Report. The report shall include, at a minimum:

· Scope and objectives

· Control testing results

· Identified deficiencies (categorized per A-123)

· Root cause analysis

· Risk Register / Risk and Control Matrix

· Recommendation for corrective action

The Contractor shall develop and maintain complete supporting electronic workpapers.

Workpapers shall:

· Stand-alone and clearly document procedures performed

· Include source data, testing steps, and conclusions

· Support all findings and recommendations

· Be reviewed and approved internally by Contractor senior management prior to submission

The Contractor shall independently review results of internal and/or external testing, on information technology-based controls. The Contractor shall evaluate internal controls, including information technology (IT) general and application controls, to determine the existence of control deficiencies and whether such deficiencies rise to the level of significance deficiency or material weakness as defined by OMB Circular A-123.

1. The Contractor will review the results of testing performed over the following systems based on the planning phase and risk-based approach:

I. Ginnie Mae Financial Accounting System (GFAS): A PeopleSoft system that tracks, records and reports on the agency’s accounting information. GFAS supports the financial functions required to process payments and receipts, track financial events, provide financial information significant to the financial management of the agency, and/or required for the preparation of requirements such as OMB and U.S. Government Accountability Office (GAO) reporting.

II. Integrated Pool Management System (IPMS): A suite of proprietary mainframe applications that has three major component subsystems: New Pool Processing, Pool Reporting and Generalized Mortgage Backed Securities.

III. Reporting and Feedback System (RFS): A suite of applications that supports the centralized data collection and feedback for all MBS post settlement accounting and reporting. Ginnie Mae Issuers upload reported data using Secure File Transfer Protocol (SFTP) to RFS for data collection, quality checking, data reconciliation, exception reporting to Issuers, and final storage in a central data store. RFS provides immediate feedback to Issuers regarding the status of reported data.

IV. GinnieNET: An internet application that is used by Issuers to electronically submit MBS pools, final certifications and recertification information. HUD forms include: 11705 Schedule of Subscribers and Ginnie Mae Guaranty Agreement, 11706 Schedule of Pooled Mortgages, 11708 - Transfers of Document Custodian Responsibility, 11711A - Release of Security Interest, and 11711B - Certification and Agreement. GinnieNET is used by Document Custodians to certify or reject submissions. This includes Security Administration, Maintenance, New Pool Processing, Certifications, Host Communications and Reports.

V. Multifamily Pool Delivery Module (MFPDM): An application that allows Multifamily Issuers to submit pool and loan data, to be assembled and issued as MBS. Pool and loan data can be entered manually or uploaded using a file. The above-mentioned process is currently initiated via a legacy system, GinnieNET. Document Custodians will continue to use GinnieNET to certify pool and loan data. In addition, Issuers will continue to use this application to accept pools, in the event that a transfer at issuance occurs.

VI. Single Family Pool Delivery Module (SFPDM): An application currently being implemented that allows Single Family Issuers to submit pool and loan data, to be assembled and issued as MBS. The SFPDM is an Issuer-facing application which supports the issuance process. It collects the required pool and loan data that is necessary for the creation of MBS.

VII. The Unclaimed Funds System I (UFS I): An application that allows Ginnie Mae to track and reconcile Ginnie Mae I MBS unclaimed principal and interest (P&I) payments. UFS I is used for tracking, honoring claims from Issuers and investors and reconciling receipt versus payment of unclaimed funds. In the event the investor does not process payment and the payment is six (6) or more months old, then the funds are remitted to the Pool Processing Agent.

VIII. The Unclaimed Funds System II (UFS II): An application that allows Ginnie Mae to track and reconcile Ginnie Mae II MBS unclaimed P&I payments. Ginnie Mae’s UFS II is used for tracking, honoring claims from Issuers and investors and reconciling receipt versus payment of unclaimed funds.

IX. Ginnie Mae’s Production Portal Platforms: Provide browser-based access to Ginnie Mae’s applications and modules via a common presentation layer.

X. Ginnie Mae may add any application or system not on this list if required for the A-123 Assessment effort as well as any subsequent new Ginnie Mae financial related applications or systems implemented during the period of performance of this contract.

The contractor shall submit all deliverables to the COR/PM via Government approved electronic repository. Deliverables shall be submitted in accordance with the following schedule:

· COR/PM will provide comments within 5 business days of draft electronic workpapers submission.

· Contractor shall provide the final electronic workpapers within 3 business days of receiving comments from COR/PM

· A-123 Assessment deliverables shall be submitted no later than August 1st of each contract year, unless otherwise directed by the COR.

Performance Standards

a. Standard: The A-123 Assessment Walkthrough Meeting Minutes delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

1. Standard: The A-123 Assessment Walkthrough Meeting Minutes are accurate and up to date as well as actionable, when necessary.

AQL: Zero deviation, unless discussed and agreed to by all parties.

c. Standard: The A-123 Assessment Quantitative Risk Assessment Results demonstrate comprehensive quantitative analyses and thoughtful evaluations of internal and external risk information.

AQL: Zero deviation, unless discussed and agreed to by all parties.

d. Standard: The A-123 Assessment Qualitative Risk Assessment Results demonstrate comprehensive Qualitative analyses and thoughtful evaluations of internal and external risk information.

AQL: Zero deviation, unless discussed and agreed to by all parties.

e. Standard: The A-123 Assessment Risk Register/Risk Control Matrices is continuously kept updated, accessible and monitored with relevant risk data to enable analyses and evaluations.

AQL: Zero deviation, unless discussed and agreed to by all parties.

f. Standard: The A-123 Assessment Risk Register/Risk Control Matrices comprehensively integrates risk information from internal and external sources timely and routinely.

AQL: Zero deviation, unless discussed and agreed to by all parties.

g. Standard: The A-123 Assessment Risk Register/Risk Control Matrices includes all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

h. Standard: The A-123 Assessment Test Plans include information regarding the assessment of internal control systems, as directed from OMB Circular A-123.

AQL: Zero deviation, unless discussed and agreed to by all parties.

i. Standard: The A-123 Assessment Test of Design (TOD) and Test of Effectiveness (TOE) include information regarding the assessment of internal control over financial reporting, as directed from OMB Circular A-123.

AQL: Zero deviation, unless discussed and agreed to by all parties.

j. Standard: A-123 Assessment A-123 Assessment Report, and associated activities, are completed by August 1st of each contract year, and/or within the specified deadline provided by the COR/PM.

AQL: Zero deviation, unless discussed and agreed to by all parties

k. Standard: The A-123 Assessment Process Flowcharts and Business Cycle Process Narratives include information regarding the assessment of internal control over financial reporting, as directed from OMB Circular A-123.

AQL: Zero deviation, unless discussed and agreed to by all parties.

l. Standard: A-123 Assessment Draft and Final Root Cause Analysis and Recommendations Report include information regarding the assessment of internal control over financial reporting, as directed from OMB Circular A-123.

AQL: Zero deviation, unless discussed and agreed to by all parties.

m. Standard: The Electronic Workpapers for each Assessment and Recommendations Report for 5 to 6 Financial Business Cycles and Processes includes all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A005 A-123 Assessment Walkthrough Meeting Minutes A006 A-123 Assessment Quantitative Risk Assessment A007 A-123 Assessment Qualitative Risk Assessment A008 A-123 Assessment Risk Register/Risk Control Matrices A009 A-123 Assessment Test Plans A010 A-123 Assessment Test of Design (TOD) and Test of Effectiveness (TOE) A011 A-123 Assessment A-123 Assessment Report A012 A-123 Assessment Process Flowcharts and Business Cycle Process Narratives A013 A-123 Assessment Draft and Final Root Cause Analysis and Recommendations Report for 5 to 6 Financial Business Cycles and Processes per Ginnie Mae's annual A-123 schedule A014 Electronic Workpapers for each Assessment and Recommendations Report for 5 to 6 Financial Business Cycles and Processes.

5.3 Task Three - Entity Level Controls (ELC) Assessment

The Contractor shall conduct planning activities and evaluate the internal controls at the entity level to determine if the entity level controls over financial reporting are operating effectively. In accordance with the Green Book framework for federal internal controls standards, the contractor shall complete a consolidated, entity-level Internal Control Framework Assessment.

The contractor shall distribute surveys to Ginnie Mae senior management, conduct interviews with select members of Ginnie Mae’s management committees. The ELC Survey serves as a qualitative ELC risk assessment to identify specific attributes, principles, or components for ELC Testing and to document management’s overall attitude, awareness, and actions concerning the importance of internal control throughout Ginnie Mae.

The contractor shall develop the ELC Test Plan to document the ELC control activities and test procedures related to the Green Book components, principles, and attributes.

The Contractor shall conduct other activities necessary to effectively assess the control design and operating effectiveness of key controls at the entity as outlined in OMB's Implementation Guide.

The Contractor shall submit an ELC Assessment Report summarizing the results of the ELC assessment. The ELC assessment report should contain the Contractor's determination as to whether the control is adequate to achieve the objectives of internal control. The report shall include a comprehensive deficiency matrix containing all deficiencies identified during the assessment, the control objective, severity of deficiency, recommendations, and corrective action plans.

The contractor shall complete the ELC Assessment in accordance with the schedule provided at task order award and as updated by the COR.

The Contractor shall coordinate with the COR and designated Government stakeholders to:

· Confirm ELC assessment scope and timelines

· Conduct preliminary risk assessment (Qualitative) - Survey

· Perform ELC assessment walkthroughs with meeting minutes

· Obtain required documentation

· Validate preliminary observations and findings

The Contractor shall prepare and submit an ELC Assessment Report. The report shall include, at a minimum:

· Scope and objectives

· Control testing results

· Identified deficiencies (categorized per GAO Greenbook)

· Root cause analysis

· Risk Register / Risk and Control Matrices

· Recommendation for corrective action

The Contractor shall develop and maintain complete supporting electronic workpapers.

Workpapers shall:

· Stand-alone and clearly document procedures performed

· Include source data, testing steps, and conclusions

· Support all findings and recommendations

· Be reviewed and approved internally by Contractor senior management prior to submission

The contractor shall submit all ELC assessment deliverables to the COR/PM via Government approved electronic repository. Deliverables shall be submitted in accordance with the following schedule:

· COR/PM will provide comments within 5 business days of draft electronic workpapers submission.

· Contractor shall provide the final electronic workpapers within 3 business days of receiving comments from COR/PM

· ELC Assessment deliverables shall be submitted no later than August 1st of each contract year, unless otherwise directed by the COR.

Performance Standards

a. Standard: The ELC Assessment Interview Meeting Minutes delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

b. Standard: The ELC Assessment Interview Meeting Minutes are accurate and up to date as well as actionable, when necessary.

AQL: Zero deviation, unless discussed and agreed to by all parties.

c. Standard: The ELC Assessment Survey and Analysis demonstrate comprehensive quantitative analyses and thoughtful evaluations of internal and external risk information.

AQL: Zero deviation, unless discussed and agreed to by all parties.

d. Standard: The ELC Assessment Risk Register / Risk and Control Matrices is continuously kept updated, accessible and monitored with relevant risk data to enable analyses and evaluations.

AQL: Zero deviation, unless discussed and agreed to by all parties.

e. Standard: The ELC Assessment Risk Register / Risk and Control Matrices comprehensively integrates risk information from internal and external sources timely and routinely.

AQL: Zero deviation, unless discussed and agreed to by all parties.

f. Standard: The ELC Assessment Risk Register / Risk and Control Matrices includes all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

g. Standard: The ELC Assessment Control Testing includes information regarding the assessment of internal control systems, as directed from OMB Circular A-123.

AQL: Zero deviation, unless discussed and agreed to by all parties.

h. Standard: The ELC Assessment Report, and associated activities, are completed by August 1st of each contract year, and/or within the specified deadline provided by the COR/PM.

AQL: Zero deviation, unless discussed and agreed to by all parties

Deliverables A015 ELC Assessment Interview Meeting Minutes A016 ELC Assessment Survey and Analysis A017 ELC Assessment Risk Register / Risk and Control Matrices A018 ELC Assessment Control Testing A019 ELC Assessment Report

5.4 Task Four - Conclusion and Recommended Assurance Statement

The Contractor shall provide a recommended assurance statement for Financial Reporting, Information Technology, and Operations in accordance with Appendix A of OMB Circular A-123 for Ginnie Mae’s use in reporting on internal control over financial reporting.

The Contractor shall conduct other activities necessary to fulfill the Concluding, Reporting, and Correcting steps as outlined in OMBs Implementation Guide.

The Contractor shall obtain the Complementary User Entity Controls (CUECs) test results from the Vendor Risk Management (VRM) Contractor to include in the Assurance Statement.

Potential findings and/or observations shall be discussed with the appropriate Ginnie Mae personnel throughout the course of the assessment. Preliminary conclusions and review findings and/or observations shall be discussed with the process owners and Ginnie Mae management.

The Contractor shall keep the COR updated on a regular basis, verbally and/or by email, on the overall status and progress of the assessment. The Contractor shall notify the COR immediately of any significant problems or major issues the Contractor may be experiencing during the assessment. The notification of problems shall be made in writing and provide detailed documentation of the specific issue(s). Problems or major issues may be, such as, lack of cooperation by Ginnie Mae personnel, inability to obtain copies of required documents, etc.

At a minimum, the detailed documentation shall identify the specific issue, the risk to Ginnie Mae if it is not resolved, attempts by the Contractor to resolve the issue, potential impact on schedule and cost to Ginnie Mae as a result of the issue.

The contractor shall submit all deliverables to the COR/PM via Government approved electronic repository. Deliverables shall be submitted in accordance with the following schedule:

· COR/PM will provide comments within 5 business days of draft electronic workpapers submission.

· Contractor shall provide the final electronic workpapers within 3 business days of receiving comments from COR/PM

· Conclusion and Recommended Assurance Statement deliverables shall be submitted no later than September 30th of each contract year, unless otherwise directed by the COR.

Performance Standards

a. Standard: Recommended Assurance Statement for Financial Reporting, Information Technology, and Operations are provided in accordance with Appendix A of OMB Circular A-123, and completed by September 30th of each contract year and/or within the specified deadline provided by the COR/PM.

AQL: Zero deviation, unless discussed and agreed to by all parties

Deliverables A020 A-123 Assessment Recommended Assurance Statement for Financial Reporting, Information Technology, and Operations

5.5 Task Five - Policy and Procedures

The Contractor shall provide recommended updates to Ginnie Mae’s related Policy, and procedures annually.

The Contractor shall review and recommend updates to Ginnie Mae’s related Policy and standard operating procedures. Ginnie Mae has one (1) Policy and one (1) Standard Operating Procedure (SOP) document related to this task.

1. The policy updated should identify relationships with other related Ginnie Mae (e.g., financial internal controls), HUD, ERM and government-wide policies that relate to risk management or could directly impact the ERM/Appendix A program.

2. Procedure updates should describe in detail how we conduct the Appendix A assessment (roles based) and maintain and update the Flowcharts and Business Cycle narratives, Risk Registers, Test of Design, Test of Effectiveness, Materiality Calculation, Risk Assessment, Workpapers and related Key Performance Indicators (KPI) and Key Risk Indicator (KRIs) The Appendix of the procedures should include templates with directions that are created to facilitate the program’s success.

3. Compliance Review Checklist. The Contractor shall review and recommend updates to Ginnie Mae’s Compliance Review Checklist on an annual basis.

The contractor shall submit all deliverables to the COR/PM via Government approved electronic repository. Deliverables shall be submitted in accordance with the following schedule:

· COR/PM will provide comments within 5 business days of draft electronic workpapers submission.

· Contractor shall provide the final electronic workpapers within 3 business days of receiving comments from COR/PM

· Annual Policy & Procedures deliverables shall be submitted no later than September 30th of each contract year, unless otherwise directed by the COR.

Performance Standards

a. Standard: The A-123 Program Policy & Procedures updates are comprehensive, pertinent and relevant to enable greater efficiency and/or effectiveness.

AQL: Zero deviation, unless discussed and agreed to by all parties.

1. Standard: The A-123 Program Policy & Procedures are completed by September 30th of each contract year, and/or within the specified deadline provided by the COR/PM.

AQL: Zero deviation, unless discussed and agreed to by all parties.

c. Standard: A-123 Program Compliance Review Checklist updates are comprehensive, pertinent and relevant to enable greater efficiency and/or effectiveness as directed by OMB Circular A-123.

AQL: Zero deviation, unless discussed and agreed to by all parties.

d. Standard: The A-123 Program Compliance Review Checklist updates are completed in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A021 A-123 Program Policy & Procedures A022 A-123 Program Compliance Review Checklist

5.6 Task Six - Special Projects

The Contractor may be requested to perform special projects. This work shall be obtained via issuance of individual TOs issued by the Government, priced on a time and material basis. The Contractor shall be responsible for demonstrating proactive project management to ensure timely completion of the additional work that satisfies all requirements specified by the COR/PM. Additional work may include but are not limited to the areas listed below:

a. Risk Assessments: New or changed requirements from the OCC, CFPB, FHFA, OMB, GAO, Congress, HUD, AICPA, FISCAM, NIST and FISMA. To efficiently and effectively address any new or changed requirements such as assessments, reporting, reviews and other new requirements. The Contractor may be required to produce reports to address specific areas. The COR/PM will determine the need to exercise and implement this requirement.

Performance Standards

a. Standard: A-123 Special Projects Risk Assessment Deliverables, and associated activities, are completed and delivered in accordance with the technical guidance memorandum.

AQL: Zero deviation, unless discussed and agreed to by all parties.

b. Standard: A-123 Special Projects Risk Assessment Deliverables includes all data and/or information required to re-create and/or modify deliverables, without…