Draft SOO for Audit Remediation BPA_16 Jun 26 Final.pdf

UNCLASSIFIED

Statement of Objectives (SOO): Audit Remediation (BPA Level)

1.0 Purpose

The Defense Intelligence Agency (DIA) requires expert audit remediation and audit sustainment support services to resolve Notices of Findings and Recommendations (NFRs) and advance the Agency toward a clean financial audit opinion. This Statement of Objectives (SOO) establishes enterprise-wide objectives for a Blanket Purchase Agreement (BPA); specific requirements will be executed through individual call orders.

2.0 Scope

The scope of this BPA encompasses enterprise-wide audit remediation and audit sustainment support across DIA organizations, including work performed within highly classified and compartmented environments. The Contractor shall provide expertise to support root cause analysis, corrective action planning, remediation execution support, sustainment, and audit response readiness for deficiencies impacting financial reporting and related systems and processes.

This BPA is for non-personal services. Contractor personnel shall perform as contractor employees and shall not be subject to Government supervision or control. Contractor personnel are accountable solely to the Contractor for performance of assigned duties.

3.0 Performance Objectives

Over the life of the BPA, the Contractor shall support achievement of the following high-level objectives. Specific performance measures, deliverables, and timelines will be established at the call-order level.

Objective 1: NFR Remediation and Closure Support. Support Government efforts to remediate, downgrade, and/or close auditor-issued NFRs and associated corrective actions for the NFR population identified in each call order. Support shall include remediation strategy development, Corrective Action Plan (CAP) or Substantive Corrective Action Plan (SCAP) support as directed, evidence quality support, and tracking/reporting sufficient to support Government and auditor validation.

Objective 2: Audit Sustainment and Recurrence Reduction. Support development of sustainable, repeatable remediation practices that reduce recurrence of previously remediated findings in subsequent audit cycles. Sustainment support may include monitoring, documentation updates, and process reinforcement as directed by the Government.

Objective 3: Audit Liaison and Data Request Support. Support Government audit liaison functions, including coordinating and facilitating audit data requests, maintenance of request logs, and support to meet Government-established suspense dates, as specified in call orders.

Objective 4: Process Improvement and Automation (as authorized). Identify opportunities to improve remediation processes and propose modernized, data-driven approaches (e.g., automation, data analytics, workflow improvements) to increase efficiency, improve traceability, and reduce rework. When authorized by the Government, support implementation and adoption of approved improvements within Government-approved environments and security constraints.

Objective 5: Secure On-Site Operations. Provide highly cleared Subject Matter Experts (SMEs) capable of performing on-site support within DIA facilities and Sensitive Compartmented Information Facilities (SCIFs) to support classified systems, data, and mission operations without disruption.

Objective 6: Internal Control Program Coordination. Support seamless coordination with DIA's Internal Control testing program to ensure remediation efforts align with ongoing control testing activities and findings. The Contractor shall participate in bi-weekly and ad-hoc coordination meetings with the Internal Control team, provide timely feedback on remediation progress for controls under testing, and utilize a unified tracking system to maintain visibility of both testing and remediation status. The Contractor shall establish formal handoff procedures when internal control testing identifies deficiencies requiring remediation support, ensuring that root cause analysis considers both current and historical testing results. This coordination shall prevent duplicative work, ensure consistent control assessment methodologies, and enable effective resource prioritization across both testing and remediation activities.

4.0 Operating Constraints

The Contractor shall comply with applicable Federal and Department of Defense (DoD) financial management and audit remediation guidance, applicable Intelligence Community directives as provided by the Government, and all DIA security protocols. A DD Form 254 will specify classification guidance and Top Secret/Sensitive Compartmented Information (TS/SCI) requirements for personnel, facilities, systems, and information. All work under this BPA is expected to be performed on-site at DIA unless otherwise authorized in writing by the Government.

5.0 Call Order Tailoring (BPA Execution)

Individual call orders issued under this BPA will define the specific scope of work, including (as applicable): supported DIA organization(s), audit areas and NFR population, required deliverables and formats, schedules and suspense dates, Government-furnished systems/data/access, performance standards, and acceptance criteria. The Contractor shall perform in accordance with the requirements established in each call order.

Call orders may include Government-developed task descriptions and/or Performance Work Statement (PWS) language tailored to the supported organization.

6.0 Offeror Response Expectations (BPA Level)

At the BPA level, the Contractor shall be prepared to provide, and update as required, an approach that describes how the Contractor will support the objectives in Section 3.0, including:

staffing and clearance sustainment strategy; quality control approach for remediation performance and evidence support; methods for tracking and reporting progress; and an approach for identifying and proposing process improvements and automation opportunities consistent with Government authorization and security requirements.

7.0 Call Order Work Plan

For each call order issued under this BPA, the Contractor shall develop and submit a Call Order Work Plan within 15 business days after call order award (or as otherwise directed by the Government). The Call Order Work Plan shall describe the Contractor’s approach to accomplishing the call order objectives and shall include, at a minimum:

a. Task approach and assumptions

b. Staffing plan and clearance/access status

c. Schedule with milestones

d. Risks, dependencies, and mitigation actions

e. Quality control approach for remediation performance and evidence support

f. Coordination approach with Government stakeholders and audit organizations, as applicable

The Contractor shall update the Call Order Work Plan as directed by the Government.

8.0 BPA-Level Program Management Review (PMR)

The Contractor shall support a quarterly Program Management Review (PMR) with the Government to review BPA health and performance of active call orders. The PMR shall be scheduled quarterly or as otherwise directed by the Government. The Contractor shall provide a PMR briefing package in advance of the meeting (timeframe as directed by the Government) and shall document PMR decisions and action items in an action item log. The Contractor shall track action items to closure and report status at subsequent PMRs.

9.0 BPA Administration (Personnel Roster)

The Contractor shall maintain and provide a BPA-level Personnel Roster identifying all contractor personnel supporting the BPA and active call orders. The roster shall include, at a minimum: individual name, role, supported call order(s), work location, clearance/access status (e.g., TS/SCI and any additional accesses as applicable), start/end dates, and qualifications on the effort. The Contractor shall submit and update the roster in accordance with Appendix A (CDRLs).

APPENDIX A - CONTRACT DATA REQUIREMENTS LIST (CDRLs)

The deliverables identified in this Appendix will be formalized through DD Form 1423, Contract Data Requirements Lists (CDRLs). Unless otherwise directed by the Government, deliverables shall be submitted electronically via the Government-designated repository. Specific formats, content requirements, and submission procedures will be confirmed at the call-order level.

CDRL # Deliverable Name SOO Ref Freq Due Date Call Order Work Plan 7.0 Per Call

Order Within 15 business days after call order award (or as otherwise directed by the Government)

Quarterly PMR Briefing Package 8.0 Quarterly NLT two (2) business days prior to the PMR

BPA Personnel Roster 9.0 Initial and as changes occur

Initial within 10 business days after BPA award (or call order award); Updates within two (2) business days of personnel changes