Draft PWS - A123.pdf

1 | P a g e Performance Work Statement

U.S. Citizenship & Immigration Services

(USCIS)

Office of the Chief Financial Officer (OCFO)

Performance Work Statement

For

Assessment of Internal Controls (A-123) Support Services

DRAFT

2 | P a g e Performance Work Statement

1. INTRODUCTION:

USCIS Office of Chief Financial Officer (CFO) is responsible for ensuring sound stewardship of USCIS fiscal resources, delivery of accurate and timely financial reporting, improvement of financial management processes, and strengthening of enterprise risk management and internal control. The OCFO mission is to secure and protect resources for Homeland Security.

To accomplish its mission, the USCIS CFO Risk Management and Internal Control Division has a requirement to provide support for the assessment of the internal controls over financial reporting in accordance with the DHS Financial Accountability Act (FAA) that requires DHS, including USCIS, to obtain an unbiased opinion on the internal controls over financial reporting (ICOFR).

2. OBJECTIVE:

The primary objective of this Performance Work Statement (PWS) is to obtain internal control assessment and/or analytic support services and ensure that the CFO remains compliant with the requirements of the CFO Act, Federal Management Financial Integrity Act (FMFIA), OMB Circular No. A-123, DHS Financial Accountability Act (FAA), and other applicable statutes.

Additionally, to support USCIS’s modernization of its core accounting system, RMIC seeks financial audit/consulting expertise to appropriately identify, evaluate, and make recommendations to eliminate financial reporting risks associated with its financial systems and processes.

3. SCOPE OF WORK:

This task order will be the vehicle to obtain professional services to support of the Test of Design (TOD) and Test of Operating Effectiveness (TOE) for business processes and CFO-designated Information Technology systems that are critical to the financial reporting process.

The requirement includes support services to CFO leadership; project management and reporting functions; internal control assessment, and ad-hoc technical support to USCIS for the completion of new assessments, analytics, strategic initiatives, or special projects that USCIS may be required to complete in support of DHS requirements.

3 | P a g e Performance Work Statement

USCIS reserves the right to change the strategic direction of the technical implementation of the task order. The task order work includes adapting to new and/or evolving technical approaches dictated by other major modernization efforts, such as Financial Systems Modernization program, executed by the Department, or other major enterprise-wide IT programs executed by USCIS Office of Information Technology. Such shifts in the technical approach under the umbrella of the Financial Services Management and Processes Automation are within the scope of this task order.

4. CURRENT STATE:

The OFFICE OF MANAGEMENT AND BUDGET (OMB) Administration has emphasized the importance of having appropriate risk management processes and systems to identify challenges early, to bring them to the attention of Agency leadership, and to develop solutions.

The USCIS OCFO Risk Management and Internal Control (RMIC) Division supports OCFO through the responsive, reliable, and efficient delivery of risk management and internal control services to USCIS, in alignment with the requirements of OMB Circular No. A-123.

RMIC is the primary driver of USCIS’s risk management and internal control strategies, with shared responsibility across all branches, divisions, program offices, and directorates through the execution of activities to minimize the risk of fraud, waste, and abuse and ensure compliance with applicable laws and regulations.

5. SPECIFIC TASKS/REQUIREMENTS:

The contractor shall execute the requirements of this PWS through the following tasks.

5.1 Task 1 – Financial support services to CFO leadership.

5.1.1. The contractor shall perform activities to ensure the USCIS OCFO remains compliant with the requirements of the Federal Managers Financial Integrity Act (FMFIA) for an annual assurance statement; DHS Financial Accountability Act (FAA) for a clean opinion on internal controls over financial reporting and DHS Internal Control Management Assurance Guide for assessment activities.

5.1.2. The contractor shall document and/or revise, per any changes in strategy as the fiscal year progresses, the schedule to accomplish the scope of assessments that are required to support USCIS’s efforts to contribute to the Department’s unmodified financial statement audit and internal control over financial reporting opinions.

5.1.3. The contractor shall develop control documentation utilizing the Automated Risk and Control (ARC) tool to include process narratives and related flow charts, control evaluation matrices, walkthroughs, tests of one, test plans and results for tests of control effectiveness, summary of aggregated deficiencies, roll forward assessments and summary memoranda for identified deficiencies.

4 | P a g e Performance Work Statement

5.1.4. The contractor shall conduct internal control assessments in a manner that ensures:

information processing objectives and related financial statement assertions are met;

controls are functioning properly to mitigate risks of misstatements in the financial reports; and adequate testing is performed to support management's financial reporting assertions. In addition, controls are tested to ensure effectiveness and efficiency of operations and compliance with applicable laws and regulations.

5.1.5. The contractor shall perform either of two types of business process assessments, baseline or routine monitoring, in accordance with DHS guidance. A baseline assessment is required for each business process at a minimum of every three years. A routine monitoring assessment is performed for the other two years,if the process and internal controls have not changed significantly. If a business process or internal controls have changed significantly, during a routine monitoring year, a baseline of those changes is required.

routine monitoring of internal controls.

5.1.6. The contractor shall document internal control deficiencies that are identified during the testing process, within 30 days of submitting each major deliverable and in a template provided by USCIS. Prior to finalizing deficiencies, the contractor shall work with process owners to corroborate the deficiency. The contractor shall determine the significance of each deficiency, or group of deficiencies by assessing the magnitude and likelihood of potential misstatements. Further, the contractor shall perform validation and verification procedures (V&V) to substantiate successful remediation of deficiencies, once process and/or systems owners have certified that corrections have been completed and

Baseline Routine Monitoring

Contractors are required to:

• Complete walkthrough for each sub-process – Components should select a transaction and follow the flow of that transaction from initiation, through each step in the process as data moves from one step to the next, to when the transaction is recorded in the general ledger and ultimately reported in the financial reports. Throughout, the contractor should identify and document all related controls.

• Update flowcharts and process narratives as necessary to reflect understanding of the process and controls identified (or refined) gained during the walkthroughs.

• Complete a Test of One for all key controls identified during the walkthrough. The Test of One is, in essence, a re-performance of the control. Contractors should obtain copies of all supporting documentation used in the performance of the control.

• Complete full Test of Design testing.

• Perform quarterly Test of Operating

Effectiveness testing for Q1, Q2, and Q3 over all key controls for all processes/sub-processes in scope.

• Complete Q4 rollforward that utilizes thorough inquiry techniques to identify and document any changes to the process.

Contractors are required to:

• Confirm that the process and internal controls have not changed significantly since the prior year.

• Where changes occurred to a control or a new control is identified, perform a walk through and Test of One of the updated/new control(s) and update controls documentation.

• Perform a Test of One for all key controls that are in scope for a material consolidated line item and assess and document design effectiveness.

• Perform quarterly TOE testing over all key controls for all business.

processes/sub-processes in scope.

• Perform Q4 rollforward procedures for all business process/sub-processes in scope.

5 | P a g e Performance Work Statement integrate that testing into the next quarter’s TOD or TOE either as part of baseline or routine monitoring of internal controls.

5.2 Task 2 - Project management and reporting functions. These services shall include, but are not limited to:

5.2.1. Providing weekly status reports to assist in tracking task progress. This activity may include providing a summary of the total number of controls to be assessed and their status.

5.2.2. Identifying any task order or personnel issues

5.2.3. Reporting the percentage of work completed.

5.2.4. Reviewing monthly invoices to ensure consistency with status reports and addressing any discrepancies with the Contracting Officer’s Representative (COR). Invoices shall be supported by artifacts that were due per the deliverable schedule for the period covered and travel expenses by individual, which shall be retained at the contractor’s facilities and be made available for review upon request.

5.2.5. Documenting, providing, and presenting to RMIC the lessons learned during the current year testing cycle, as applicable.

5.2.6. Providing and maintaining a project plan that details internal control assessment and financial system and process risk management support steps and milestones as well as internal due dates.

5.3 Task 3 – Technical support functions. These services shall include, but are not limited to:

5.3.1. Provide on-site ad-hoc technical support related to the DHS FAA and OMB Circular No. A-123 assessments and financial system and process risk management support. This includes one-on-one and written communications, development of data collection forms and templates, DHS FAA and OMB Circular No. A-123 compliance and testing of products, services, using manual inspection techniques.

5.3.2. Prepare, design and develop for review and approval audience-specific presentations and talking points, and be available to present briefings to USCIS leadership and interagency outreach events. As required, develop handouts or other materials for distribution to participants of these events.

5.3.3. Prepare, design and develop for Government review and approval educational resources including, but not limited to, management directives, white papers, frequently asked questions, guides, and standard operating procedures that will support DHS's FAA, OMB A-123 and financial system and process outreach efforts.

6 | P a g e Performance Work Statement

5.4 Task 4 - Base Period Tasks. The tasks outlined below provide the detailed objectives for the base tasks within the base period of performance.

5.4.1. Contractor shall provide ad-hoc technical support to USCIS for the completion of new assessments, analytics, strategic initiatives, or special projects that USCIS may be required to complete in support of DHS requirements.

5.4.2. The contractor shall perform an internal control assessment in accordance with OMB Circular No. A-123, Appendix D, of approximately one third of USCIS’s Information Technology enterprise-level controls; systems-level controls for four USCIS owned and operated systems; complementary end user controls for 13 systems that are owned and operated by service providers, and application controls including Information Provided Entity Used in Controls (IUCPE) designed to ensure the complete and accurate processing of data, from input through output. The contractor shall perform activities to determine if systems owned and/or used by USCIS that were not previously identified as CFO-designated have since met the criteria for CFO-designation. The contractor shall review SOC 1 reports or similar service provider reporting and test the design and operating effectiveness of relevant Complementary User Entity Controls (CUECs) for those systems and related business processes. The contractor shall also review DHS- and USCIS- identified fraud risks and complete deliverables related to the annual Fraud Risk Assessment for those systems and related business processes. The contractor shall also conduct and document assessments of Business Process Application Controls (BPACs) as defined by DHS and USCIS requirements for those systems and related business processes. The contractor will complete all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies. The mix of controls to be assessed includes: approximately 20 controls to be identified by DHS as part of DHS Office of the Chief Information Security Officer (OCISO) sustainment efforts; controls that are ready for testing following efforts by the system owner to remediate failed controls; controls that have not been assessed in the previous two Fiscal Years.

5.4.3. Contactor shall perform an internal control assessment in accordance with OMB Circular No. A-123, Appendix A, of the Human Budgetary Resources and Payroll Management process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

7 | P a g e Performance Work Statement

5.5 Base Period Optional Tasks: The tasks outlined below provide the detailed objectives for optional tasks within the base period of performance.

5.5.1. The contractor shall perform either a baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred, in accordance with OMB Circular No. A-123, Appendix A, of the Financial Reporting Human Resources and Payroll Management process and Property Management processes by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

5.6 Optional Period 1 and 2 Tasks: The tasks outlined below provide the detailed objectives for the optional periods of performance.

5.6.1. The contractor shall perform an internal control assessment in accordance with OMB Circular No. A-123, Appendix D, of approximately one third of USCIS’s Information Technology enterprise-level controls; systems-level controls for four USCIS owned and operated systems; complementary end user controls for 13 systems that are owned and operated by service providers, and application controls including Information Used in Controls Provided Entity (IUCPE) designed to ensure the complete and accurate processing of data, from input through output. The contractor shall perform activities to determine if systems owned and/or used by USCIS that were not previously identified as CFO-designated have since met the criteria for CFO-designation. The contractor shall review SOC 1 reports or similar service provider reporting and test the design and operating effectiveness of relevant Complementary User Entity Controls (CUECs) for those systems and related business processes. The contractor will complete all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies. The mix of controls to be assessed include: approximately 20 controls to be identified by DHS as part of DHS Office of the Chief Information Security Officer (OCISO) sustainment efforts; controls that are ready for testing following efforts by the system owner to remediate failed controls; controls that have not been assessed in the previous two Fiscal Years.

5.6.2. The contractor shall provide ad-hoc technical support to USCIS for the completion of new assessments, analytics, strategic initiatives, or special projects that USCIS may be required to complete in support of DHS requirements.

5.6.3. The contractor shall perform either a baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred, in accordance with OMB Circular No. A-123, Appendix A, of the Revenue and

8 | P a g e Performance Work Statement

Receivables process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

5.6.4. The contractor shall perform either a baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred, in accordance with OMB Circular No. A-123, Appendix A, of the Financial Reporting process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

5.6.5. The contractor shall perform either a baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred, in accordance with OMB Circular No. A-123, Appendix A, of the Budgetary Resources Management process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

5.6.6. The contractor shall perform either a baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred, in accordance with OMB Circular No. A-123, Appendix A, of the Property Management process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

5.6.7. The contractor shall perform either baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred , in accordance with OMB Circular No. A-123, Appendix A, of the Payment Management process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.38, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

9 | P a g e Performance Work Statement

5.6.8. The contractor shall perform either a baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred, in accordance with OMB Circular No. A-123, Appendix , of the Human Resources and Payroll Management process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

5.6.9. The contractor shall perform either a baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred, in accordance with OMB Circular No. A-123, Appendix A, of the Fund Balance with Treasury process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

5.6.10. If USCIS grants becomes material, the contractor shall perform either a baseline or routine monitoring internal control assessment, depending on USCIS’s 3-year rotation cycle or if significant remediation has occurred, in accordance with OMB Circular No. A-123, Appendix A, of the Grants Management process by completing all required documents, templates, and files based on OMB, DHS, and USCIS requirements and in accordance with sections 5.1 to 5.8, where applicable, from above. The contractor shall be responsible for completing any new and/or amended DHS requirements related to this assessment that may be instituted or implemented after the start of the assessment and for documenting summary memoranda for any identified deficiencies.

5.6.11 The contractor shall support OCFO with monitoring to ensure controls are appropriately designed when business processes or IT controls are modified. Activities include but are not limited to the review of artifacts to validate and verify that corrective action, in the design and effectiveness of controls, will/has effectively mitigated the risks to a business process or system(s) that the contractor is responsible for assessing and that the control(s) will pass subsequent assessments. NOTE: transformation and remediation efforts are not within the scope of this contract. The focus of this task will be to ensure the OCFO has comfort over controls that are implemented by various process owners to prevent/detect material misstatements. The contractor shall conduct independent verification and validation (IV&V) of ITGC deficiencies determined to be remediated and ready for reassessment to confirm the design and effectiveness of controls.

5.6.12 The contractor shall provide risk management support functions related to process and system improvements (e.g., financial system modernization) in a manner to ensure:

10 | P a g e Performance Work Statement

• post-deployment key controls will be in place, for both business and information technology processes, to meet financial and information processing objectives and mitigate associated risks; and

• Data integrity is maintained during the deployment (e.g., data conversion, data migration) and post-deployment (e.g., system interfaces).

6. APPLICABLE DOCUMENTATION:

The following documents apply to this PWS. It is expected that the Contractor will be knowledgeable of with these laws, regulations, and policies and will execute the tasks of this PWS in accordance with these regulations:

• Chief Financial Officers Act of 1990 (CFO Act)

• Federal Managers Financial Integrity Act of 1982 (FMFIA)

• Federal Financial Management Improvement Act of 1996 (FFMIA)

• Foundations for Evidence-Based Policymaking Act of 2019 (Evidence Act)

• Immigration and Nationality Act of 1952 (INA)

• Office of Management and Budget (OMB) Circular A-11, Preparation Submission and

Execution of the Budget

• OMB Circular A-50, Audit Follow-up

• OMB Circular A-123, Management’s Responsibility for Internal Control (effective beginning fiscal year 2006) (Appendices A, B, C, and D)

• OMB Circular A-127, Financial Management Systems

• OMB Circular A-134, Financial Accounting Principles and Standards

• OMB Circular A-136, Financial Reporting Requirements

• DHS Financial Management Policy Manual (FMPM)

• DHS Financial Accountability Act (FAA) of 2004

• DHS 4300A Sensitive Systems Handbook

• DHS Internal Control Playbook

• Federal Accounting Standards Advisory Board (FASAB) accounting standards, as issued

• Treasury Financial Manual (TFM), as issued by the Bureau of Fiscal Service (BFS)

• Digital Accountability and Transparency Act of 2014 (DATA Act)

7. CONTRACTOR KEY PERSONNEL & QUALIFICATIONS:

The Contractor shall provide qualified personnel to perform all requirements specified in this PWS. An adequate number of cleared and qualified personnel shall be readily available to ensure continuity of services. All personnel working on this task order shall possess the necessary security clearance as addressed in the Security Requirements section of this PWS.

The Contractor shall be timely and responsive during the performance of work. This is a “Non-Personal Services” contract. Contractors are not subject by the contract’s terms or by the manner of its administration, to the supervision or control prevailing in relationships between the Federal Government and its employees. Only the Contracting Officer (CO) can

11 | P a g e Performance Work Statement obligate USCIS for contract responsibilities. Although no contract employee or official is authorized to officially represent USCIS to any other party, contractor personnel will display decorum, dress, and behavior comparable to USCIS personnel.

The Government shall have the opportunity to review the qualifications, education, and experience of proposed key personnel to ensure compliance with this section. In accordance with HSAR 3052.215-70, before removing or replacing key personnel, the contractor shall submit sufficient information to support the proposed action to the CO at least ten (10) calendar days before the effective date of the proposed change. Resumes are required within three (3) business days after award and at any time when a replacement is needed during the contract period for the CO to determine suitability. The individual’s resume shall clearly show how the individual meets the requirements for the position. The following personnel are considered key personnel and shall have the following skills and level of experience:

7.1. Journeyman Business Financial Operations Specialist, Group 3 Senior Consultant II

Must possess demonstrated subject matter work expertise of 3 to 10 years in internal control matters. Duties include but are not limited to the ability to anticipate and effectively solve problems by analyzing their root causes and recognize key causal connections; Manage multiple work streams in a manner that effectively delivers results to the government; Provide insightful responses to government requests in a timely manner to ensure the delivery of the highest quality products; Engage in open, direct, candid, constructive, and regular exchanges of information between engagement team members and the government that ensures work activities are effective across teams and government.

7.2. Journeyman Business Financial Operations Specialist, Group 3 Senior Consultant II

Must possess demonstrated subject matter expertise of 3 to 10 years in information technology general computer, information system data processing audit matters and application control matters. Duties include but are not limited to the ability to anticipate and effectively solve problems by analyzing their root causes and recognize key causal connections; Manage multiple work streams in a manner that effectively delivers results to the government; Provide insightful responses to government requests in a timely manner to ensure the delivery of the highest quality products; Engage in open, direct, candid, constructive, and regular exchanges of information between engagement team members and the government that ensures work activities are effective across teams and government.

12 | P a g e Performance Work Statement

8. STAFF ADDITIONAL QUALIFICATIONS & EXPECTATIONS:

The contractor shall provide qualified personnel to perform all requirements specified in this PWS.

8.1. CONTINUITY OF SUPPORT:

The Contractor shall ensure required level of support for this requirement is maintained at all times. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel are not provided, the Contractor shall provide e-mail notification to the COR prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement in accordance with the HSAR 3052.215-70 requirements outlined above.

In the event the contractor terminates associated contract employees, or any contractor employee resigns, the contractor is obligated to inform the CO and COR in writing within five (5) business days of each occurrence.

8.2. EMPLOYEE CONDUCT:

Contractor’s employees shall comply with all applicable Government regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the DHS. The Program Manager shall ensure contractor employees understand and abide by DHS established rules, regulations and policies concerning safety and security.

8.3. EMPLOYEE IDENTIFICATION & BADGING:

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the contractor’s name, the employee’s photo, name, clearance-level and badge expiration date. Visiting contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

All Contractor employees are required to have a suitability clearance. USCIS requires that Contractor employees be designated differently than USCIS employees. This may be accomplished via a different style or color ID badge provided by USCIS. ID badges are to be worn conspicuously at all times while contract employees are on-site at USCIS facilities.

Should a badge be lost, damaged, or destroyed, the contractor will immediately notify the local office COR upon discovery of the loss so that the badge can be deactivated and replaced by USCIS.

13 | P a g e Performance Work Statement

8.4. REMOVING EMPLOYEES FOR MISCONDUCT OR SECURITY REASONS:

The Government may, at its sole discretion (via the CO), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The CO will provide the Contractor with a written explanation to support any request to remove an employee.

In the event the Contractor terminates associated contract employees, or any contract employee resigns, the Contractor is obligated to inform the CO and COR in writing within five

(5) business days of each occurrence.

9. OTHER APPLICABLE CONDITIONS:

9.1. PERIOD OF PERFORMANCE:

The following is the projected period of performance for this task order. Actual POP will be established at time of award by the Contracting Officer.

Period Period of Performance Base 10/16/2024 - 10/15/2025 1st Option 10/16/2025 – 10/15/2026 2nd Option 10/16/2026 – 10/15/2027

9.2. PLACE OF PERFORMANCE:

The primary place of performance will be at a government owned facility; 5900 Capital Gateway Drive, Camp Springs, MD. Contractor personnel shall be required to perform financial support services in Washington, DC area. However, travel may be required to the following USCIS locations and in accordance with Section 9.5 of the PWS:

• 124 Technology Park Way South Burlington, VT;

• 70 Kimball Avenue, South Burlington, VT;

• As-needed at USCIS Service Centers (Vermont; Texas; California and Nebraska);

• USCIS locations nationwide deemed acceptable and approved by the Government

Program Office.

9.3. HOURS OF OPERATION:

The Contractor shall schedule contractor personnel, ensuring adequate office coverage between the hours of 8:00 AM and 5:00 PM Eastern Time (ET).

14 | P a g e Performance Work Statement

Contract employees shall not to perform work at a Government site without a Government employee being present. Facility hours of operation are between the hours of 7:00 AM and 6:00 PM (ET) Monday through Friday. Work on Government Holidays and/or weekends, or before after operation hours is not permitted without prior approval from the CO or the COR and Government Program Manager. The Contractor shall not be allowed to work when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

Contract employees must be available via the organization’s primary business communication platform (currently Microsoft Teams) during duty hours.

9.4. GOVERNMENT HOLIDAYS:

A current list of Federal Government holidays is located at the following website:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

Also included are days specifically declared by an Executive Order from the President of the United States of America as a national holiday.

When such holiday falls on a Saturday, the preceding Friday will be considered a holiday.

When such holiday falls on a Sunday, the following Monday will be considered a holiday.

9.5. TRAVEL:

Travel outside of the Metropolitan Washington, DC area may be required. In the event travel is required, travel shall not be performed in connection with this task order without prior approval in writing (email for the request and approval is acceptable) by the COR. The contractor shall be reimbursed for travel in accordance with Federal Travel Regulations (FTR). The contractor shall submit proposed travel expenses to the COR for approval, and a Trip Report submitted with the invoice detailing the exact authorized travel costs incurred.

Local travel is defined as being within fifty (50) miles of the contractor’s place of performance and shall not be reimbursed. The government defines local travel as travel that is conducted with 50 miles of an employee’s duty station. Contractor personnel shall not be reimbursed for local travel, which is defined as within a fifty (50) mile radius from the primary place of performance.

10. GOVERNMENT FURNISHED PROPERTY (GFP):

GFP will be provided to the Contractor for use in the performance of this contract in accordance with the FAR Part 45. The contractor must comply with clause 52.245-1, Government Property and clause FAR 52.245-9 Use and Charges, included in this order. The CO authorizes the COR to assume the role of Property Administrator for this contract/order.

The GFP to be provided under this order is as follows:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

15 | P a g e Performance Work Statement

DESCRIPTION

OF PROPERTY

QUANTITY UNIT OF

MEASURE

UNIT COST UNIQUE

ITEM

IDENTIFIER

Government

Issued Laptop After EOD

1 per person EA $1,565.00 Asset Tag

The property may not be used for any tasks outside the terms and conditions of this order.

The Contractor bears full responsibility for all loss of this property, whether accidental or purposeful, at full replacement value. No personal or company owned storage devices, (thumb drives, DVDs, or CDs) will be used with the GFP.

The Contractor shall have a system of internal controls to manage GFP in its possession as set forth in FAR clause 52.245-1. Specifically, under FAR 52.245-1(f)(1)(iii), the Contractor shall create and maintain records of all Government property accountable to the contract, including Government-furnished, and contractor-acquired property. The property records shall enable a complete, current, auditable record of all transactions and shall, unless otherwise approved by the property administrator/COR, contain the ten elements listed in clause 52.245-1(f)(1)(iii)(A). Under FAR 52.245-1(f)(1)(iv), the Contractor shall periodically perform, record and disclose physical inventory results to the Property Administrator/COR.

The frequency of inventory and reporting required by this contract is provided in the deliverables table below.

GOVERNMENT FURNISHED PROPERTY DELIVERABLES:

TYPE OF

REPORT

TIMEFRAME AND

FREQUENCY GOVERNMENT RECEIVER

Initial

GFP

Report

Within ten (10) business days of initial receipt of

GFP upon contract commencement.

Contract identified CO, COR, and GFP mailbox:

USCISGovernmentFurnishedProperty@uscis.dhs.gov

Annual

Each year by August 30th CO, COR & GFP Mailbox

Interim

Within (10) business days of any GFP inventory changes (i.e. when

CO, COR & GFP Mailbox mailto:USCISGovernmentFurnishedProperty@uscis.dhs.gov

16 | P a g e Performance Work Statement new property is issued or property is returned to the

Government), or as requested by the

CO.

Closing

Five (5) business days before contract ends or as otherwise directed by the CO.

CO, COR, & GFP Mailbox

11. PERFORMANCE STANDARDS & QUALITY ASSURANCE:

11.1. OVERVIEW:

The USCIS has specified performance standards in each task area related to processes that USCIS believes are critical to successful performance. These requirements and their associated performance standards define the work to be performed, although these may change over time. The USCIS established these performance requirements and associated standards after careful analysis of current operations based on historical performance against similar established standards.

USCIS requires the Contractor to conduct ongoing quality and process control and to effectively monitor performance continually. USCIS will measure performance against the published requirements and standards on an ongoing basis and will report the summarized results monthly.

11.2. QUALITY ASSURANCE SURVEILLANCE PROCEDURES:

The Quality Surveillance Procedures involve all planned and systematic actions necessary to provide adequate confidence that the services and resulting product from the contractor will satisfy the requirements. This program involves making sure that quality standards are met and includes a continuing evaluation of adequacy and effectiveness with a view toward the use of timely corrective and preventive measures where necessary. Quality Assurance Surveillance is the activity the Government utilizes to monitor the in-process product quality based upon the outcome of attribute inspection of product units. Quality Assurance Surveillance will be performed on all performance requirements to some extent.

The COR and Government Program Office will inspect Contractor performance for compliance with the Performance Work Statement and Performance Requirements

17 | P a g e Performance Work Statement

Summary (PRS) requirements throughout the contract period of performance. The Government intends to monitor the contractor’s performance by performing checks in accordance with the Performance Requirements Summary.

11.3. QUALITY CONTROL PLAN (QCP):

The contractor shall be responsible for exercising quality control of the processes called for in the PWS.

The contractor shall develop, maintain, and manage all quality control measures to ensure compliance with the standards of the performance requirements.

The contractor shall analyze trends and identify cost-saving approaches and productivity improvements to maintain performance while operating within budget constraints.

The contractor shall provide the COR and Government Program Office with a quality assurance report no later than the tenth (10th) calendar day following the end of each month and attend quality review meetings with the COR.

The COR and Government Program Office will review the Quality Assurance Monthly

Report as part of the QCP. The COR will provide oversight and review performance standards based on the Acceptable Quality Level (AQL) below.

The COR and Government Program Office will hold monthly quality assurance meetings to ensure performance standards are met.

GENERAL QUALITY MEASURES:

Accuracy: Deliverables shall be accurate in presentation; technical content; and adherence to accepted elements of style. All deliverables shall conform to the appropriate DHS Directive and/or policy.

Clarity: Deliverables shall be clear and concise and appropriate for the intended audience; plain language is preferred. Industry and technical terminology, acronyms, and complicated language should be avoided. All diagrams shall be easy to understand and relevant to the supporting narrative.

File Editing: All text and diagrammatic files shall be editable by the Government using the Microsoft Office Suite of Products.

Timeliness: Deliverables shall be submitted on or before the specified and/or agreed due date.

Quality Assurance/Acceptance: The COR shall review, for completeness, draft and final work products and deliverables that the contractor submits and may return

18 | P a g e Performance Work Statement them to the contractor for correction. Absence of any comments by the COR shall not relieve the contractor of the responsibility for complying with the requirements of the contract.

11.4. CONTRACTOR DEFICIENCY REPORTS:

When the Contractor’s performance is unsatisfactory, the COR will prepare and submit a Contract Deficiency Report (CDR) to the CO for issuance. The Contractor shall reply to the COR in writing within fifteen (15) calendar days of notification and in accordance with instructions contained therein, giving the reasons for the unsatisfactory performance, corrective action taken, and procedures to preclude recurrence.

11.5. PERFORMANCE REQUIREMENTS SUMMARY (PRS):

PERFORMANCE STANDARDS:

This contract includes a PRS. The PRS plays an integral role in the administration of the contract. In addition to any applicable inspection clauses or other related terms and conditions contained in the contract, the PRS shall serve as a primary tool for inspection and acceptance of services as facilitated by the COR and Government Program Office. Evaluation of the contractor’s overall performance shall be in accordance with the performance standards set forth in the PRS, and will be conducted by the COR. The PRS constitutes a material aspect of the contract and will not be changed or otherwise modified without prior written approval of the CO.

Performance standards define desired services. The Government performs surveillance to determine if the contractor exceeds, meets or does not meet those standards. The PRS, of the Performance Work Statement, includes performance standards. The Government shall use these standards to determine contractor performance and shall compare contractor performance to the stated AQL.

The PRS tables below sets forth the expected requirements of the contract. The PRS is not an exclusive remedy and inclusion of the PRS does not preclude the Government from using any other remedy available by law or contract terms, including reductions in payment in accordance with any clause for inspection of services. Changes to the standards will be made by bi-lateral agreement.

PRS

Item

Required Services Performance Requirement

Description

Acceptabl e Quality

Level

(AQL)

Performance Work

Statement Reference

Measurement Disincentive

1 Project Plan: Draft, & Final, Revision.

Provide Draft Project Plan at the beginning of each performance year. List all of the steps for each of the A- 123 assessment deliverables and timetables for internal review and submission for the government. Provide a final Project Plan not later

95% SOW 10

Ongoing Monitoring

Rework at no additional cost

19 | P a g e Performance Work Statement than 5 business days after receiving comments from the government. Provide revised project plans not later than 5 business days at the request from the government after the Contractor has communicated projected delays or other adjustments to the project plan.

2 Project Management and Reporting Functions

Provide project management and reporting functions.

These services shall include but are not limited to:

1. Providing weekly status reports to assist in tracking task progress. This activity may include providing a summary of the total number of controls to be assessed and their status;

2. Identifying any task order or personnel issues;

3. Reporting the percentage of work completed; and

4. Reviewing monthly invoices to ensure consistency with status reports and addressing any discrepancies with the Contracting Officer’s Representative (COR).

Invoices shall be supported by artifacts that were due per the deliverable schedule for the period covered and travel expenses listed by individual, which shall be retained at the contractor’s facilities and be made available for review upon request.

95% 5.2

Ongoing Monitoring

Rework at no additional cost to the Government.

3 Lessons Learned Document - Draft and Final Submissions

Provide at the end of each performance year, shall document and present to the government for discussion RMIC the lessons learned during the current performance year and corrective or compensating action items for the next performance year, as applicable.

Document should be free of grammatical and spelling errors, reviewed and by contract management prior to submission, and delivered on time in accordance with the deliverable schedule.

95% 5.2.5

Government Review of Submission of Deliverables

Rework to correct at no additional cost to the Government.

20 | P a g e Performance Work Statement

4 Lessons Learned Document - Draft and Final submission

The lesson learned should be documented comprehensively, outlining the context of the issues and challenges, actions taken, outcomes, with examples and reflections. It should demonstrate a clear understanding of the situation, identify specific insights gained, and articulate actionable takeaways.

Furthermore, the lesson learned should be communicable, providing guidance or recommendations for future scenarios. The documentation should be organized in a format conducive to sharing and application across relevant contexts. It should be provided timely.

NOTE: DHS RM&A is updating their platform technology and ITGC assessment process in FY 24.

USCIS will finish implementing and begin utilizing the (SNOW) ARC tool for A-123 assessment, deficiency management, and reporting. The ICOFS Branch will be monitoring and become involved with several ongoing USCIS projects such as GovTA, CIBS (FSM), RPA, etc. at some point. It’s important to be flexible during the year and more guidance will be provided as it becomes available.

97% 5.2.5 Ongoing Monitoring

Rework at no additional cost to the

21 | P a g e Performance Work Statement

5 Internal Control Deficiency Documentation

Document internal control deficiencies that are identified during the testing process, within 30 days of submitting each major deliverable (Test of Design, Test of Operating Effectiveness, etc.) and in a format provided by USCIS.

Prior to finalizing deficiencies, the contractor shall work with process owners to corroborate the deficiency. Determine the significance of each deficiency, or group of deficiencies by assessing the magnitude and likelihood of potential misstatements.

Further, the contractor shall perform validation and verification procedures (V&V) to substantiate successful remediation of deficiencies, once process and/or systems owners have certified that corrections have been completed, and integrate that testing into the following quarter’s TOD or TOE either as part of baseline or routine monitoring of internal controls.

Document should be free of grammatical and spelling errors and conform to USCIS and RMIC style guidance, reviewed and by contract management prior to submission, and delivered on time in accordance with the deliverable schedule.

95% 5.1.6

Government Review of Submission of Deliverables

Rework at no additional cost to the Government.

6 Draft Internal Control Deficiencies (if deficiencies noted)

Draft Internal control deficiencies must be identified, and documented, in accordance with USCIS ARC tool requirement, established standards and…