ERM PWS - DRAFT.docx

Draft Performance Work Statement (PWS) Enterprise Risk Management Program (ERM)

U.S. Department of Housing and Urban Development Washington, D.C. 20410

OFFICE OF THE CHIEF PROCUREMENT OFFICER

March 22, 2026

Contents

Performance Work Statement (PWS) Enterprise Risk Management Program Vision Statement To strengthen and enhance Ginnie Mae’s Enterprise Risk Management Program (ERM) to effectively manage our diverse portfolio of risks across our organization to achieve our strategic goals.

1 General Information

1.1 Scope of Work

The U.S. Department of Housing and Urban Development (HUD), Government National Mortgage Association (Ginnie Mae) Office of Enterprise Risk (OER) requires contractor support to provide program management support for the continued enhancement, administration and execution of its Enterprise Risk Management (ERM) Program. The Operational Risk Analysis Division (ORAD) designs and executes the ERM Program according to the following principles:

· creates and protects value.

· is an integral part of organizational processes, including decision-making.

· explicitly addresses uncertainty.

· is systematic, structured, and timely.

· is based on the best available information.

· is tailored, dynamic, iterative, and responsive to change.

· takes human, cultural and geopolitical factors into account.

· is transparent and inclusive.

· facilitates continual improvement of the organization.

ORAD seeks contractor’s support and expertise to manage, enhance and further mature Ginnie Mae’s ERM Program, in accordance with applicable statutes, regulations, policies, standards and leading practices.

The scope of work includes:

· Program management support

· ERM program execution and administration

· ERM program governance and maturity

· Special projects

· Transition (if needed)

Detailed descriptions of specific tasks are provided in Section 5 – Specific Tasks.

1.2 Background

OMB defines “risk” as the effect of uncertainty on objectives. Risk management is a series of coordinated activities to direct and control risks or opportunities to achieve an organization’s goals and objectives. Enterprise risk management enables an agency-wide approach to addressing the full spectrum of internal and external risks by understanding the combined impacts of risk as an interrelated portfolio.

Ginnie Mae’s ERM Program provides a comprehensive framework to identify, assess, evaluate, manage, monitor and report on risks associated with the agency’s internal processes, people, systems and external events. These activities are crucial to the safety and soundness of its operations. Ginnie Mae’s risk management framework and governance structure are intended to provide comprehensive controls and ongoing management of the major inherent and residual risk within its business activities.

Ginnie Mae’s ERM Program provides a robust standardized methodology for managing our diverse portfolio of risks (i.e., credit, financial, legal, operational and strategic). The program provides Ginnie Mae’s leadership with increased awareness of risk information affecting the agency’s ability to achieve its strategic goals. Ginnie Mae leaders can see how risks across the organization are interconnected and require coordinated, data-driven decisions, when viewed through a strategic lens. ERM also brings consistency to how our staff, as well as the extended enterprise of third parties we work with, identify, assess, prioritize, manage, monitor and report enterprise risks. Ginnie Mae’s ERM risk appetite approach guides the organization so that leadership consciously accepts a reasonable amount of risk when pursuing the business outcomes needed to fulfil Ginnie Mae’s mission.

Ginnie Mae’s Enterprise Risk Committee (ERC) provides top-down guidance to Ginnie Mae’s ERM Program and is a key stakeholder. The ERC operates under clearly delineated policies, roles and responsibilities and serves to provide a forum to increase Ginnie Mae’s risk management efficiency, accountability, and transparency, upholding Ginnie Mae’s established risk appetite.

Ginnie Mae coordinates and collaborates with internal points of contacts (POCs) to actively participate in the ongoing iterative process to successfully manage risks across the enterprise. The Contractor will work with their Ginnie Mae stakeholders to organize and gather information from key stakeholders of Ginnie Mae’s eight (8) business units in completing the requirements of the Task Order (TO). The eight (8) business units are: Office of the President (OOTP), Office of Chief Financial Officer (OCFO), Office of Capital Markets (OCM), Office of Enterprise Data & Technology Solutions (OEDTS), Office of Enterprise Risk (OER), Office of Issuer and Portfolio Management (OIPM), Office of Management Operations (OMO) and Office of Securities Operations (OSO).

Additionally, coordination and collaboration within ORAD, and among other business units, occurs on a constant basis. For example, internal risk information is pulled and pushed through ORAD risk programs (e.g., A-123 Internal Controls Program, the Risk and Controls Self-Assessment Program including information technology/security, Vendor Risk Management Program and the Operational Incident Management Program) on a recurring basis (i.e., continuous, monthly, quarterly, semi-annually and annually). Other risk information (e.g., emerging risks, new/changed laws, regulations and policies, updated standards, requirements, operations, etc.) are pulled and pushed on an infrequent basis but must also be integrated to ensure awareness and understanding of the risk environment.

Ginnie Mae’s ERM Program is designed to meet the requirements of applicable statutes, regulations and policies identified in Section 1.3 Constraints of this contract. The Contractor will support ORAD, in continuing to meet current and future applicable requirements as part of this TO.

1.3 Constraints

The services identified in this PWS shall adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

a. Federal Managers’ Financial Integrity Act of 1982 (https://www.congress.gov/97/statute/STATUTE-96/STATUTE-96-Pg814.pdf)

b. Government Performance Results Act Modernization Act of 2010 (https://www.congress.gov/111/statute/STATUTE-124/STATUTE-124-Pg3866.pdf)

c. Federal Information Security Modernization Act of 2014 (https://www.congress.gov/113/statute/STATUTE-128/STATUTE-128-Pg3073.pdf)

d. Payment Integrity Information Act of 2019 (https://www.congress.gov/116/statute/STATUTE-134/STATUTE-134-Pg113.pdf)

e. Federal Agency Performance Act of 2024 (https://www.congress.gov/118/plaws/publ190/PLAW-118publ190.pdf)

f. OMB Circular A-123, Managements Responsibility for Internal Control https://www.whitehouse.gov/wp-content/uploads/2026/03/OMB-Circular-No.-A-123-2026.pdf)

g. OMB Circular A-11, Preparation, Submission, and Execution of the Budget, ()

h. CFO Council, Playbook: Enterprise Risk Management for the US Federal Government, https://cfo.gov/wp-content/uploads/2016/07/FINAL-ERMPlaybook.pdf

i. OMB Circular A-136, Financial Reporting Requirements, (https://www.whitehouse.gov/wp-content/uploads/2019/06/OMB-Circular-A-136.pdf)

j. Committee of Sponsoring Organizations’ (COSO), Enterprise Risk Management Framework, (https://www.coso.org/erm-framework)

k. The Green Book, Standards for Internal Controls in the Federal Government, (https://www.gao.gov/assets/gao-25-107721.pdf)

l. U.S. Department of Housing and Urban Development HUDAR, (https://www.acquisition.gov/hudar)

m. Federal Acquisition Regulation (https://www.acquisition.gov/browse/index/far)

n. National Institute of Standards and Technology, Cybersecurity Framework (CSF) 2.0, (https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)

o. NIST, Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53) Rev. 5, (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)

p. U.S. Department of Housing and Urban Development, Information Technology Security Policy, HUD Handbook 2400.25 Rev. 5.0, (https://www.hud.gov/sites/dfiles/OCHCO/documents/240025CIOH.pdf)

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be for a 12-month base with four 12-month option periods.

1.6 Place of Performance

The services to be performed under this contract shall be primarily performed at the Contractor’s facility.

1.7 Hours of Operation

The Contractor is responsible for providing services between the hours of 8:00am to 5:00pm Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. The Government reserves the right to change hours of operation or restrict contractor access. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications Comment by Author: Are these necessary all of these certifications will come at a additional costs. Comment by Author: Revisit. Corporate experience and/or qualifications as well as certification for resources must exist somewhere...

The Primary and/or Sub-Contractors must have the following knowledge, skills, experience, risk and compliance industry certifications:

· Certified Public Accountant (CPA)

· Certified Information Systems Auditor (CISA)

· Certified Internal Auditor (CIA)

· Certified Fraud Examiner (CFE)

· Committee of Sponsoring Organizations (COSO) Internal Control certification

· Certified Government Financial Manager (CGFM)

· Project Management Professional (PMP) certification

· Certified Information Systems Security Professional (CISSP)

· Certified Information Security Manager (CISM)

· Certified Cloud Service Provider (CCSP)

· Certified in Risk and Information Systems Controls (CRISC)

· Certified Operational Risk Professional (CORP)

· Cybersecurity risk-related certification

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5 and HUD Acquisition Regulation (HUDAR) clause 2452.237-79 - Post Award Conference.

1.10 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion.

1.11 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46.

1.12 Transition-In

The Contractor shall, upon the Contracting Officer's written notice, furnish transition-in services as required. As a successor, the Contractor shall have sufficient personnel on board during the 30-day transition-in period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the transition-in period, the Contractor shall become familiar with the requirements to commence full performance of services by the end of the contract transition-in period. Transition-in is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition-Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 30-day transition-out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the transition-out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor contractor is achieved by the end of the new contract transition-in period.

2 Definitions and Acronyms

2.1 Definitions

Business Day - Every official day of the week which are days between and including Monday to Friday. This does not include federal holidays and weekends.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer’s Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable - Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property is property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Standard - The Contractor’s performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

2.2 Acronyms

AAR - After Action Report ACFE - Association of Certified Fraud Examiners AICPA - American Institute of Certified Public Accountants AQL - Acceptable Quality Level CAP - Corrective Action Plan CCB - Change Control Board CCMB - Configuration Change Management Board CMMI - Capability Maturity Model Integration CFO - Chief Financial Officer CFPB - Consumer Financial Protection Bureau CFR - Code of Federal Regulations CIO - Chief Information Officer CO - Contracting Officer COR - Contracting Officer Representative COSO - Committee of Sponsoring Organizations of the Treadway Commission COTS - Commercial Off-the-Shelf CPO - Chief Procurement Officer CSF - Cyber Security Framework ERC - Enterprise Risk Committee ERM - Enterprise Risk Management EST - Eastern Standard Time (U.S.)

ETC - Estimate to Completion FHFA - Federal Housing Finance Authority FISCAM - Federal Information Security Controls Audit Manual FISMA - Federal Information Security Modernization Act GAAP - Generally Accepted Accounting Principals GAO - U.S. Government Accountability Office GFP - Government-Furnished Property GNMA or Ginnie Mae - Government National Mortgage Association HUD - U.S. Department of Housing and Urban Development HUDAR - HUD Acquisition Regulation IG - Inspector General IT - Information Technology IV&V - Independent Validation and Verification KPI - Key Performance Indicator KRI - Key Risk Indicator LOE - Level of Effort NIST - National Institute of Science and Technology OCFO - Office of the Chief Financial Officer OCM - Office of Capital Markets OCPO - Office of the Chief Procurement Officer OEDTS - Office of Enterprise Data & Technology Solutions OER - Office of Enterprise Risk OI - Operational Incident OIG - Office of Inspector General OIPM - Office of Issuer and Portfolio Management OMB - Office of Management and Budget OMO - Office of Management Operations OCC - Office of the Comptroller of the Currency OMB - Office of Management and Budget OSO - Office of Securities Operations ORAD - Operational Risk Analysis Division PIO - Process Improvement Opportunity PM - Program Manager PL - Public Law POC - Point of Contact PPM - Project Planning and Management PWS - Performance Work Statement QA - Quality Assurance QASP - Quality Assurance Surveillance Plan QCP - Quality Control Plan RCSA - Risk and Controls Self-Assessment SF - Standard Form SOP - Standard Operating Procedures SSAE - Statement on Standards for Attestation Engagements TGM - Technical Guidance Memorandum TO - Task Order TOD - Test of Design TOE - Test of Effectiveness TT&E - Test, Training and Exercise TBD - To be determined U.S.C - United States Code VRM - Vendor Risk Management

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

Government services will not be provided.

3.2 Facilities

Facilities will not be provided.

3.3 Equipment

Equipment will not be provided.

3.4 Materials and Information

See HUDAR 2452.227-70, Government Information

The Government shall provide ERM Program artifacts (e.g., governance documents, tools, templates, risk registers, reports, matrices, etc.) to the Contractor to enable completion of all tasks and deliverables required from this PWS, after the award.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all off-site facilities to perform the services identified within this PWS.

4.2 Equipment

The Contractor shall furnish all equipment required to perform the services identified within the PWS.

4.3 Materials

The Contractor shall furnish all materials required to perform the services identified within the PWS.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period of performance.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR/PM.

4.5 Contractor Personnel

See HUDAR clause 2452.237-70 - Key Personnel in the Key Personnel section of the contract.

Key Personnel include: Comment by Author: Revisit with CO/CS.

· XXX

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor and/or subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks

5.1 Task One – Program Management Support

The Contractor shall provide program management support under this requirement. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this requirement.

5.1.1 Weekly Status Meetings, Reports and Minutes

a. Weekly Meetings: The Contractor shall meet with the COR/PM and other Government personnel to review and discuss Contractor performance, contract requirements, engagement status, etc. The Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. The Contractor shall provide the COR/PM minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, within two (2) business days following the meeting.

b. Weekly Reports and Minutes: The Contractor shall develop and provide a Weekly Status Report using Microsoft Office Suite applications to the COR/PM at the end of each week. The Weekly Status Report shall include, at a minimum:

1. Activities during reporting period, by task (on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Start each section with a brief description of the task.

2. Problems, risks, issues, and corrective actions taken or proposed resolutions to address them, including recommendations for improved efficiency and/or effectiveness.

3. Personnel gains, losses, and status (security clearance, etc.).

4. Actions required by stakeholders.

5. Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

6. Accumulated invoiced cost for each CLIN up to the previous month.

7. Projected cost of each CLIN for the current month.

Performance Standards

(a) Standard: The Weekly Status Reports and Minutes are completed and delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(b) Standard: The Weekly Status Reports and Minutes are accurate and up to date as well as actionable, when necessary.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A001 Weekly Status Reports and Minutes

5.1.2 Project Work Plan

The Contractor shall submit Project Work Plan (PWP) for the contracted services within thirty (30) business days of contract award. Changes to the PWP shall be reviewed and accepted by the COR/PM prior to work beginning. The PWP shall be updated annually. Provisions will be established to update the PWP at appropriate junctures, as directed by the COR/PM.

a. Project Work Plan: The PWP shall consist of a narrative description and a graphic summary of the schedule and financial elements of the contract. The narrative shall:

1. Describe the planned deliverables schedule.

2. Identify each step in the work process required for executing the full scope of the period of performance year and the period of time needed to accomplish each step, expressed in terms of the calendar dates. All key milestones and actions required to achieve Ginnie Mae’s near-term objectives and to satisfy OMBs requirements must be included in the PWP.

3. Provide the staff, financial, and other resources allocated to each task.

4. Provide the rationale for project organization, staff utilization, and other resources allocated to each task or activity.

(a) Standard: The Project Work Plan is accurate, kept up to date and accessible.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(b) Standard: The Project Work Plan includes all significant activities and/or milestones related to each contract deliverable.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A002 Project Work Plan

5.2 Task Two – ERM Program Execution & Administration

The Contractor shall provide support and expertise to administer, execute, enhance and mature Ginnie Mae’s ERM Program. Additionally, the Contractor shall continuously monitor and manage enterprise risk information to analyze and evaluate Ginnie Mae’s internal and external risk environments and response (past, present and future) strategies and activities. The Contractor shall conduct assessments to analyze and evaluate risk information across the enterprise, including prioritized risks and/or high-risk areas (e.g., counterparty, cybersecurity, procurement, vendor, etc.), to provide stakeholders timely and appropriate information to enhance risk awareness and understanding by examining Ginnie Mae’s portfolio of risks (Risk Profile) as well as the status of risk response strategies and activities to address internal control findings (e.g., gaps, deficiencies and weaknesses). Finally, the Contractor shall support the communications of risk information through cyclical (e.g., dashboards, reports, risk indicators, metrics, etc.) and ad hoc reporting (e.g., change assessment summaries, emerging risks, high-risk areas, etc.).

5.2.1 Risk Awareness & Monitoring

The Contractor shall enhance the understanding and awareness of Ginnie Mae’s internal and external environments to enable proactive risk monitoring and data-informed/risk-based decisions. For example, prioritized and/or high-risk areas are directly related to Ginnie Mae’s risk environment, and may include risks regarding credit / counterparty risk, cybersecurity / information security and technology risk, procurement / vendor oversight risk, etc.). The Contractor shall develop/update, maintain and monitor Ginnie Mae’s risk environments by integrating risk appetite concepts (e.g., key indicators, metrics, tolerances, thresholds, etc.), enhancing the development and application of risk management concepts (e.g., risk taxonomy, scoring methodology, risk and control matrices, and other tools and templates, etc.) and maintaining a reporting system that communicates reliable, comprehensive and timely risk information (i.e., ERM Dashboards) to relevant stakeholders.

a. Risk Appetite: On a monthly cycle, the Contractor shall develop/update, monitor, maintain and apply Ginnie Mae’s risk appetite, tolerances, performance indicators and associated metrics to enable understanding and awareness of the internal and external risk environments. The Contractor shall monitor enterprise risk information and evaluate internal control systems, including indicators and metrics to identify and portray changes and trends in the risk environment to provide context regarding residual risks, including the integration of response activities completed, in-progress or planned. Monitoring results shall be synthesized and communicated through monthly and quarterly risk dashboard updates as well as incorporated into the semi-annual Enterprise Risk Profile and the annual Fraud Risk Profile report as well as the change assessment summaries.

1. Ginnie Mae’s Enterprise Risk Appetite represents qualitative and quantitative limits describing the amount of risk, on a broad level, Ginnie Mae is willing to accept (or not accept) when making decisions related to the pursuit of its enterprise-level strategic goals and their associated outcome measures. It is an active measurement of performance with risk indicators developed at both the enterprise- and office-levels (Ginnie Mae currently has eight (8) Offices). Enterprise risk appetite statements can express Ginnie Mae’s willingness to accept (or not accept) risk in selected domains, risk categories, strategies, or functions. Additionally, Ginnie Mae's Risk Appetite also includes how key risk indicators (KRIs) and key performance indicators (KPIs) align with tolerance levels for individual risks; how risk rating criteria can become a tool that reflects and enforces Ginnie Mae’s risk appetite approach; how risk appetite can be cascaded to other affected policies and /or procedures; and how it can be applied in decision-making.

(a) Standard: The Risk Appetite includes the comprehensive integration and application of tolerances, performance indicators and associated metrics to enable awareness and understanding of the current and/or changed risk environment.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(b) Standard: The Risk Appetite includes qualitative and quantitative analyses and rationale to enable risk-based decisions.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(c) Standard: The Risk Appetite, and associated activities, are completed and delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(d) Standard: The Risk Appetite includes all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A003 Risk Appetite

b. Risk Management Tools & Templates: Annually, the Contractor shall update and/or develop new risk management tools and templates (e.g., risk taxonomy, scoring methodology, flowcharts, workpapers, etc.), with the latest standards, guidelines and/or requirements applicable to the ERM Program, to enhance the ERM Program at Ginnie Mae. The Contractor must ensure that the ERM Program has the necessary and required tools and templates to enable understanding and awareness of the risk environment, and to enable both orally and written communications. Updates to risk management tools and templates must be applied throughout the ERM program (e.g., related ERM artifacts, dashboards, governance documents, other reporting tools, etc.).

1. Ginnie Mae’s Risk Taxonomy provides a comprehensive, consistent structure to organize a large and diverse portfolio of risks around common categories and sub-categories. The Risk Taxonomy serves as the underlying "architecture for how risk data is organized, creating a common tagging and classification structure that makes it easier to link risk data from different sources for more advanced and real-time reporting.

2. Ginnie Mae’s risk scoring methodology is an evaluation tool that assists with conducting risk management. The scoring methodology enables analysts to examine the inherent and residual ratings (impact x likelihood) of a risk as well as the response requirements and/or recommendations. The risk rating scale is informed by an understanding of critical risk drivers that influence Ginnie Mae’s Risk Appetite.

3. Ginnie Mae’s risk management tools and templates enable enhanced understanding, awareness and a uniform method of applying risk management concepts throughout the organization. Appropriate documentation (e.g., workpapers, risk assessment analyses and results; internal control system designs, flowcharts, implementation and operating effectiveness; descriptors, rationale and justifications of risks, responses and findings; monitoring and/or change assessment summaries; corrective action and/or process improvement plans, etc.) shall be properly developed, managed and maintained.

(a) Standard: The Risk Management Tools and Templates include updates from applicable standards, guidelines and/or requirements to enable comprehensive intake and output of risk information.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(b) Standard: Risk Management Tools and Templates are managed, maintained and kept updated and accessible.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(c) Standard: The Risk Management Tools and Templates include all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A004 Risk Management Tools and Templates

c. Risk Dashboards: The Contractor shall provide support and expertise to communicate risk information through the development, maintenance and updating of ERM dashboards. The Contractor must maintain dashboards that visually represents risk information (e.g., risks, internal controls, responses, corrective action plans, process improvement plans, changes in the internal/external environments, etc.) to enable understanding and awareness of Ginnie Mae’s risk environment. Additionally, these risk dashboards will enable the Contractor to consistently monitor the changes and trends of prioritized and/or high-risk areas, responses and internal control system findings and/or deficiencies on a continuous basis.

1. The Contractor shall develop, update and maintain ERM Program’s dashboards to provide stakeholders a quarterly snapshot of Ginnie Mae’s risk environment, prioritized risks, internal control system information, etc. Risk information must integrate up-to-date data, be relevant and timely, and must provide actionable information regarding Ginnie Mae’s risk exposure to enable risk-informed decisions and increase engagement, transparency, and accountability. The dashboards must be maintained to represent up-to-date information, including integration of risk information across the enterprise.

(a) Standard: The Risk Dashboards enable timely and routine visual communication of risk information to stakeholders.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(b) Standard: The Risk Dashboards are consistently monitored for changes, trends and anomalies and timely reported to the COR/PM when exceptions and/or escalations are required.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(c) Standard: The Risk Dashboards, and associated activities, are completed and delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(d) Standard: The Risk Dashboards include all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A005 Risk Dashboards

5.2.2 Risk Assessments

The Contractor shall provide support and expertise that enables Ginnie Mae to identify, assess, analyze, evaluate, respond to and report on internal control systems associated with enterprise risk, fraud, waste and abuse, as well as from significant internal or external changes. The Contractor shall execute two (2) enterprise risk profile assessments (i.e., semi-annually), one (1) fraud risk profile assessment annually, and approximately a dozen (12) change assessments annually to meet applicable laws, regulation and policies (e.g., OMB Circular A-123, GAO’s Fraud Risk Framework, etc.).

The Contractor shall manage the consolidated enterprise risk register to ensure risk and internal controls documentation exists and can support all tasks within this contract. The Contractor shall conduct qualitative and quantitative risk analyses, evaluate the design, implementation and effectiveness of internal control systems, including response activities, manage risk response planning across the enterprise and report results timely.

a. Consolidated Enterprise Risk Register: The contractor shall continuously update and maintain the Consolidated Enterprise Risk Register with risks, internal controls, responses and other relevant risk data identified by Ginnie Mae. This risk inventory brings together risk information in a portfolio view, enabling Ginnie Mae to compare risks on the same footing, analyze relationships between risks, evaluate responses and identify gaps in Ginnie Mae’s internal control systems and/or risk environment.

1. Bottoms-Up Data Inputs: The contractor must integrate assessment results, findings and other pertinent information from internal sources (i.e., A-123 Internal Controls, RCSA, VRM, OIs, information security/technology, SSAE-18 reports, etc.), responses (e.g., corrective action plans, process improvement plans, internal controls and/or gaps, and other risk information from external sources.

2. The Consolidated Risk Register shall include, but is not limited to, risk description, key risk indicator, risk owner, risk taxonomy, impact, probability of occurrence, and risk score (heat map), etc. The current version will be provided to the vendor upon award.

(a) Standard: The Consolidated Enterprise Risk Register is continuously kept updated, accessible and monitored with relevant risk data to enable analyses and evaluations.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(b) Standard: The Consolidated Enterprise Risk Register comprehensively integrates risk information from internal and external sources timely and routinely.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(c) Standard: The Consolidated Enterprise Risk Register includes all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A006 Consolidated Enterprise Risk Register

b. Risk Analyses and Evaluation: The contractor shall conduct qualitative and quantitative risk analyses to identify, assess and evaluate risks, responses and their associated internal control system that enables achievement of Ginnie Mae’s objectives. For example, Ginnie Mae’s prioritized and/or high-risk area may include counterparty / credit risks related to our program participants (e.g., issuers, investors, custodians, subservicers, etc.), information technology / security risks (e.g., infrastructure, software, operations, etc.), or vendor / procurement related risks (e.g., acquisition strategy, COR/PM responsibilities, etc.). The analyses and evaluations must examine, document and communicate the assessment of internal control components and principles of internal control (e.g., the design, implementation and effectiveness of internal control systems that enable the achievement of Ginnie Mae’s operations, reporting and compliance).

1. Coordinate data calls and/or requests for information with ORAD programs to minimize disturbances and maximize efficiencies for each of the eight (8) Ginnie Mae Offices. Ensure supporting documentation and/or rationale exists to provide context and background regarding risk and internal control findings, observation and recommendations.

2. The Contractor shall conduct and manage two types of risk analyses and evaluations.

i. The first type must be a comprehensive and thorough assessment, which examines the activities and conditions that support or prevent mission completion. For example, these assessments should include the analyses and evaluation of prioritized and/or high-risk areas, the risk appetite, tolerance levels, impacts and likelihood of events, vulnerabilities to fraud, improper payments, information security/technology, stakeholder dependencies and interdependencies, completed, current and future responses, etc. This type of assessment will apply to the enterprise risk and the fraud risk assessments and must include all workpapers supporting the analyses and evaluations.

ii. The second type of assessment will still identify, assess and evaluate risks, responses, and their associated internal control system, but in a more nimble and simplified way. These change assessments enable the organization to quickly gain context of the issue so that responses can be determined and monitored (including the development of all workpapers supporting the analyses and evaluations). For example, change assessments may be conducted on internal program changes (e.g., Mortgage-Backed Securities Guide, All Participant Memorandums, etc.), changes impacting stakeholder participants (e.g., Issuers, investors, custodians, sponsors, vendors, etc.) or external events (e.g., laws, regulations, policies, standards, etc.).

(a) Standard: The Risk Analyses and Evaluation Results demonstrate comprehensive qualitative and quantitative analyses and thoughtful evaluations of internal and external risk information.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(b) Standard: The Risk Analyses and Evaluation Results include information regarding the assessment of internal control systems, as directed from OMB Circular A-123.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(c) Standard: The Risk Analysis and Evaluation Results are produced through effective and efficient collaborations with applicable stakeholders.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(d) Standard: The Risk Analysis and Evaluation Results for the comprehensive and thorough assessment will be completed in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(e) Standard: The Risk Analysis and Evaluation Results for the simplified and nimble assessment will be completed within 10 days.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(f) Standard: The Risk Analyses and Evaluation Results, and associated activities, are completed and delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(g) Standard: The Risk Analyses and Evaluation Results include all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A007 Risk Analyses and Evaluation Results

c. Risk Response: The Contractor shall develop, update and maintain Enterprise Risk Response Plans by supporting Ginnie Mae’s eight (8) Offices in managing their risks and internal control findings and observations. For example, risk response plans may include risk acceptance memorandums / records, corrective action plans, process improvement plans, etc. but must meet the requirements of OMB Circular A-123 and include enough time in the schedule for senior leadership and/or CRO review to meet the annual HUD and OMB reporting and/or compliance deadlines. Specific dates will be mutually agreed upon as part of the PWP on an annual basis.

Coordinate the collection and maintenance of information to assist Ginnie Mae risk owners in developing and/or updating Risk Response Plans, including associated workpapers.

1. Design, implement and maintain a process to coordinate enterprise risk response planning with each program office.

2. Assist risk owners to identify existing and/or new KRIs and KPIs, risk appetites and tolerance levels that can be used to measure the level of risk in relation to the established tolerance levels and can help gauge the effectiveness of risk response strategies.

3. Integrate and report response activities and/or findings across Ginnie Mae risk programs (e.g., dashboards, reports, KRI/KPIs, etc.) to enable monitoring and awareness of risks.

(a) Standard: The Enterprise Risk Response Plan includes comprehensive and up-to-date risk and response information from relevant sources, including all eight Ginnie Mae offices.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(b) Standard: The Enterprise Risk Response Plan is developed/updated and maintained in a way that assists and adds value to risk owner.

AQL: Zero deviation, unless discussed and agreed to by all parties.

(c) Standard: The Enterprise Risk Response Plan, and associated activities, are completed and delivered in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A008 Enterprise Risk Response Plan

d. Risk Reporting: The Contractor must produce a total of three (3) reports annually–two (2) reports based on the semi-annual Enterprise Risk Assessment and one (1) report based on the annual Fraud Risk Assessment–including documents and/or artifacts that support the reports. Additionally, the Contractor must also produce approximately twelve (12) change assessment summaries based on assessments related to the changes in the internal and external environments. These summaries must be timely, succinct and monitored outside the normal assessment cadence (i.e., enterprise and fraud risk assessments). Information contained in the reports and summaries must be integrated into the ERM Program (e.g., dashboards, risk appetite, etc.)

1. The Contractor shall produce three (3) risk reports annually–two (2) for the semi-annual enterprise risk assessments and one (1) for the fraud risk assessment. Reports must include the following supporting workpapers, at a minimum:

i. Risk assessments results (e.g., quantitative and qualitative analyses, identification of risks, controls, findings, observations, etc.).

ii. Documents detailing the design, implementation and operating effectiveness of the internal control system, including rationale and/or decisions for internal control components or principles that are ineffective.

iii. Results from ongoing monitoring activities, changes in the internal and external risk environments and evaluation determinations regarding internal control issues.

iv. The status of response activities (e.g., corrective action plans, process improvement plans, risk acceptance memorandums, etc.) completed, in-progress or planned.

2. The Contractor shall produce summaries based on their change assessment analyses and evaluations. Ginnie Mae estimates approximately one (1) change assessment summary per month and/or twelve (12) per year, subject to change. The summaries must provide context, enable the organization to determine the appropriate response and allow monitoring of the issue. Summary contents are subject to change, but the level of effort will be significantly less than the enterprise and fraud risk assessments but on a quicker turnaround timeframe.