Draft PWS for Audit Management Information System.docx

Part 5 Specific Tasks

5.1 Services

The DOL is comprised of several agencies that respond to audit activity. The contractor shall provide services for enterprise audit management and tracking. The DOL seeks a cloud-based, interoperable, and modern audit management system consistent with IT modernization goals that will improve accuracy and timeliness of audit activity while providing insights into performance and vulnerabilities. Under this PWS, the DOL will identify capabilities that support the full audit management lifecycle to include:

· Preparing for audits

· Selecting audit criteria

· Measuring performance level

· Making improvements

· Sustaining improvements

5.2 Infrastructure Requirements

5.2.1 Communicates clearly defined software patch and upgrade schedules to afford proper planning

5.2.2 Performs testing prior to patch/upgrade installations to production environment to ensure functionality

5.2.3 Provide the ability to extract all data from off-premise cloud (FedRAMP certification required)

5.2.4 Ensure compatibility with Windows 10 or higher

5.2.5 Ensure compatibility with MS Office 365 and above

5.2.6 Supports load-balancing (i.e. high availability, failover, clustering) to ensure seamless operations

5.2.7 Must support virtual machines and/or virtual desktop infrastructure (VDI) to provide flexibility for a broad user base

5.2.8 Must support single user sign-on/PIV cards consistent with federal employee access and credentials

5.2.9 Must handle slow or latent connections via VPN or remote connections to ensure availability and performance

5.3 Security

5.3.1 Provides full logging of user activity to support agency reporting requirements

5.3.2 Provides access to logs and activity reports to ensure availability of information for analysis and decision-making

5.3.3 Must be FIPS 140-02 encryption capable

5.3.4 PIV access required, must be supported

5.4 System Configuration and Centralized Management

5.4.1 Provides user-friendly, intuitive graphical interface to ensure usability and accessibility for all users

5.4.2 Must be compliant with revised Section 508 accessibility standards to ensure accessibility, meeting all Section 508 criteria

5.4.3 Provides the ability to create multiple project templates to ensure new projects include all required steps based on their type, so unique work efforts can follow out-of-the-box or ad hoc workflows

5.4.4 Provides ability to create templates for auditors/analysts to document work, including designated fields to ensure unique business needs

5.4.5 Ability to create and assign permissions on user roles such as administrator, supervisor, manager, independent referencer, reviewer, preparer, or combination of roles

5.4.6 Ability to assign users to different projects with different roles and permissions specific to each project to ensure flexibility

5.4.7 Centralized policy management to ensure consistency and ease of use

5.4.8 Ability to copy projects (extend, rollover) to reuse templates and project details

5.4.9 Configurable fields, labels, and flags for project information, recommendations to account for unique business requirements

5.5 Retention, Archive, Storage

5.5.1 Must support Agency records retention requirements and policies, to ensure appropriate disposition of audit artifacts

5.5.2 Ability to access completed/finalized projects, for the purpose of analysis and reporting

5.5.3 Ability to push completed/archived projects to latest software version to ensure accessibility and support historical analysis

5.6 Training

5.6.1 Must provide training in simulated production environment with current work product so Agency can verify necessary functionality included with the proposed solution

5.6.2 Provides robust training for administrators to ensure ongoing local support

5.6.3 Supports train-the-trainer efforts to ensure agency staff can transfer knowledge

5.6.4 Provides training documentation as needed to supplement local support

5.7 Support

5.7.1 Provides access to daily technical support to address urgent issues within 1-2 days

5.7.2 Provides access to detailed reference materials to facilitate timely issue resolution

5.8 Distinct Projects

5.8.1 Provides functionality to create self-contained projects with unique permissions and roles to ensure need-to-know, restricted access to audit activities

5.8.2 Must provide unique project identifiers to differentiate various audit records and activities

5.8.3 Must provide ability to establish, monitor, and revise milestones for each project to support tracking and analytics

5.8.4 Ability to design and manage projects for analysis for specific audits as well as multiple audit records

5.8.5 Must provide ability to deploy separate instances for different agencies/organizations allowing separation of work and access, ensuring access is based on roles and permissions

5.9 Document Management

5.9.1 Provides support for current and future Microsoft Office file types, including Outlook to ensure interoperability with standard software

5.9.2 Provides support for current and future Acrobat PDF files to ensure key functionality is maintained in support of audit processes

5.9.3 Must support for industry-standard media files (audio, video, image)

5.9.4 Creates unique identifier for each attached file to differentiate artifacts

5.9.5 Provides ability to update/replace attachments with version control management capabilities, to ensure appropriate copies are maintained for routine use

5.9.6 Provides ability to import/export/replace documents with version control management capabilities

5.9.7 Ensures support for large numbers of attachments with each project, including large individual attachments to ensure complete records and collection of associated artifacts with the appropriate audit record

5.9.8 Provides ability to restrict access to attachments within a project to support need-to-know access and privacy

5.9.9 Provides functionality to easily share selected attachments across projects to support convenience and re-use of artifacts

5.9.10 Provides ability to lock attachments to prevent changes to ensure consistency and integrity of the audit record

5.9.11 Provides functionality to set follow-ups by date and follow-up type based on specific correspondence, due actions, documents, and artifacts

5.10 Review process for documentation, including findings and recommendations

5.10.1 Provides ability to support preparer sign-offs to ensure recording of appropriate status of audit activities and artifacts

5.10.2 Provides ability to support reviewer sign-offs, including multi-level reviews, to support layered review and signatures

5.10.3 Provides functionality to support reviewer-to-preparer comments and retain them for integrity and consistency, indicating status of each comment and artifact

5.10.4 Provides ability to support peer-to-peer comments and notes that are retained for accuracy, integrity and consistency

5.10.5 Provides ability to identify changes were made to audit records and artifacts after supervisory review to determine status of recommendations, notes, and key documentation steps

5.11 Cross-Indexing

5.11.1 Provides ability to index auditor/analyst write-ups to supporting documentation

5.11.2 Provides functionality to link documentation to artifacts created within software as well as attachments such as Word, Excel, Acrobat documents to ensure related artifacts are associated with the appropriate records

5.11.3 Provides ability to efficiently handle large numbers of indices within individual documents and across the audit file

5.12 Independent Referencing

5.12.1 Provides capability to review and verify cross-index of all statements of fact within MS Word reports to ensure all documentation is available per each record

5.12.2 Provides ability to add visual indicators or status showing independent referencer has verified that indexed evidence supports each statement of fact (e.g. tickmarks)

5.13 Findings and Recommendations

5.13.1 Provides ability to develop and document findings based on audit work, so all findings are associated with the appropriate record

5.13.2 Provides ability to develop and document recommendations based on audit work, so all findings are associated with the appropriate record

5.14 Miscellaneous Features

5.14.1 Supports copy/paste within the application and across findings, recommendations, and other artifacts associated with the record

5.14.2 Supports inline and on-demand spell-check, with editable dictionary

5.14.3 Provides ability to create and format tables within the application to support analysis and reporting

5.14.4 Provides ability to generate reports and dashboards across all data sets and platform for each project and sets of projects based on key indicators

5.14.5 Provides ability to create standard reports for tracking milestones – initial and revised dates compared to actuals, so work-in-progress and completed items can be analyzed

5.14.6 Provides ability to automate creation of required ad hoc and out-of-box reports

5.14.7 Provides ability to generate ad hoc and out-of-box reports on all database fields

5.14.8 Supports creating of ad hoc reports and queries to ensure unique analysis activities and reporting are complete and accurate