ERM RFI (9-19-24).pdf

1 | P a g e

Enterprise Risk Management (ERM) Request for Information

A. General Information

THIS IS A REQUEST FOR INFORMATION (RFI). This is NOT a solicitation for proposals, proposal abstracts, or quotations and in no way obligates the Government to award a task order.

The purpose of this RFI is to obtain knowledge and information for project planning purposes, to explore alternative solutions, and to determine industry standards for the administration and operation of an Enterprise Risk Management (ERM) contract within the Centers for Medicare and Medicaid Services (CMS).

B. Project Background

CMS aims to build its existing ERM contract in a sustainable manner. It has already begun to implement ERM within the agency. At this juncture, it needs to integrate ERM more closely with its program strategy. Most of all, it plans to create a risk-focused culture at CMS, both from an operational and enterprise perspective. CMS requires that each of its divisions take ERM into consideration during their day-to-day operations, and not simply as a theoretical goal of the organization.

In light of this necessary change in organizational culture, CMS must also examine the potential challenges and drawbacks of ERM implementation. It will look to both the practice and future of ERM, as well as its structures, to inform it in this project. For those reasons, it is seeking input from industry to answer the following questions.

C. Questions for Industry

CMS is looking for information including, but not limited to:

• The Practice and Future of ERM o What are some new trends and risks that have emerged in the past few years that would not be obvious to an observer or a non-versed manager or employee?

o What are some data tracking mechanisms that are being used to perform ERM?

o What are some challenges you foresee in terms of implementation of ERM in a government agency that would not exist/be as relevant in the private sector?

o What do you see ERM looking like in five years?

o What are some best practices (or key success factors) for ERM?

o What does it look like to best advance ERM throughout a government agency?

2 | P a g e o What are some best practices to develop & maintain a risk-aware culture, and what are some objections decision-makers might have to the implementation of such a culture in an organization?

o What is the role of ERM in the mitigation of enterprise risk?

• The Structure of ERM o What is the relationship between ERM and Operational Risk Management?

o How might ERM and its metrics be integrated with a strategy practice for the purpose of actively managing agency performance?

o What does it look like to integrate ERM with a strategy practice for the purpose of actively managing agency performance?

o Where in the organization, and in which capacities and departments, should an ERM and strategy capability be placed? Why?

o What benefits and drawbacks are there in different organizational structure models with regard to ERM?

We appreciate your time and effort in responding to this request for information.

D. Instructions for Submitting RFI Responses to CMS

Email responses are due no later than 12:00 PM EST on October 3rd, 2024 to Anoop Shetty at anoop.shetty@cms.hhs.gov and Jennifer Davis at jennifer.davis@cms.hhs.gov in the following format:

• Microsoft Word document with page size 8.5 by 11 inches, with a minimum of 1" margins.

• Times New Roman Font Size 12, with double-spacing between lines.

• Submissions shall not exceed 8 pages. Cover Page is not included in the total page count.

E. Protection of Privileged or Confidential Commercial or Financial Information

The Freedom of Information Act (FOIA), 5 U.S.C. § 552, provides individuals with a right to access certain records in the possession of the Federal government, subject to certain exemptions. Exemption 4 of the FOIA permits information to be withheld that is in the nature of "trade secrets and commercial or financial information obtained from a person and privileged or confidential." The term "person" refers to a wide range of entities, including corporations, banks, state governments, agencies of foreign governments, and Native American tribes or nations, who provide information to the government.

Information that does not qualify withholding under the Exemption will be disclosed.

CMS may invoke Executive Order 12600 in accordance with FOIA Regulation 45 C.F.R. § 5.42. Information provided by entities to CMS in response to this RFI may be subject to FOIA disclosure requirements unless protected under Exemption 4 of the FOIA itself. Should entities wish to protect any trade secret or confidential information under Exemption 4, they should mark their submission accordingly citing applicable redactions and non-disclosure rationale. Pre-disclosure redactions and non-mailto:anoop.shetty@cms.hhs.gov mailto:jennifer.davis@cms.hhs.gov https://uscode.house.gov/view.xhtml?req=(title:5%20section:552%20edition:prelim)%20OR%20(granuleid:USC-prelim-title5-section552)&f=treesort&edition=prelim&num=0&jumpTo=true https://www.archives.gov/federal-register/codification/executive-order/12600.html https://www.govinfo.gov/content/pkg/CFR-2019-title45-vol1/xml/CFR-2019-title45-vol1-part5.xml#seqnum5.42

3 | P a g e disclosure rationale shall be sent via e-mail to the requesting contracting officer with a copy to the CMS FOIA Office at 12600@cms.hhs.gov.

If an entity’s submission is not marked and CMS receives a FOIA request related to this RFI, the CMS Contracting Officer will notify the entity. The entity will have 10 working days to object to the release of any part of their information submitted to CMS citing relevant case law. Final determination on the applicability of Exemption 4 of the FOIA are made on a case-by-case basis by CMS.

The statutory language of the FOIA is codified at 5 U.S.C. § 552(b). Additional information and resources, including the 9 FOIA Exemptions and HHS FOIA Regulation, and examples, can be found on the HHS FOIA Website.

F. Other Information:

1. Proprietary Information and Disclaimers: All transmitted information marked proprietary shall be treated as such. Therefore, respondents should identify any proprietary information in its RFI response. Information submitted in response to this RFI will be used at the discretion of the Government. Proprietary materials will neither be distributed, nor discussed with any other organization or business. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts. CMS reserves the right to utilize any non-proprietary technical information in the anticipated SOW or solicitation.

2. Respondents should be aware that this RFI is for market research purposes only and any responses submitted do not constitute a commitment by CMS to treat any respondent more or less favorably in any anticipated forthcoming solicitation and/or ultimate award.

3. Responses to the RFI are not offers and cannot be accepted by CMS to form a binding contract.

CMS does not intend to award a contract on the basis of this RFI, or to otherwise pay for the information solicited. No reimbursement for costs will be made associated with providing information in response to this RFI or follow-up information request.

4. Responses to the RFI will not be returned and will not be accepted after the due date. All communications shall be by email.

5. Respondents will not be notified of the results of the review of the responses. Information received will be considered solely to make informed decisions regarding a potential procurement.

On behalf of the Centers for Medicare & Medicaid Services, thank you for your interest in this Request for Information.

mailto:12600@cms.hhs.gov https://www.cms.gov/Regulations-and-Guidance/Legislation/FOIA https://www.hhs.gov/foia/index.html https://www.hhs.gov/foia/index.html