Exhibit E, Scope of Work.pdf

Cover Page

Exhibit E, Scope of Work

RFQ No. HHS0017782 Exhibit E, Scope of Work

Contents

1.1 DESCRIPTION OF SERVICES

1.2 ORGANIZATION REQUIREMENTS

1.3 KEY PERSONNEL AND STAFF REQUIREMENTS

1.4 ASSESSMENT FRAMEWORK

1.5 RISK SCORING METHODOLOGY

1.6 RTS AWARDEE’S DESK REVIEWS

1.7 DESK REVIEW PROCESS

1.8 RECOMMENDATION REPORT

1.9 TECHNICAL ASSISTANCE

1.10 TRAINING

1.11 STATUS AND PROGRESS REPORT

1.12 FINAL SUMMARY REPORT

1.13 CONFIDENTIALITY AND DATA PROTECTION

1.14 COLLECTION OF RTS AWARDEE DOCUMENTATION

1.15 ADDITIONAL REQUIREMENTS

1.16 REPORTING AND DELIVERABLES REQUIREMENTS

1.17 PERFORMANCE MONITORING

1.18 KEY PERFORMANCE MEASURES AND LIQUIDATED DAMAGES

1.19 CYBERSECURITY TRAINING

1.12 PAYMENTS AND INVOICES

1.1 DESCRIPTION OF SERVICES

A. Contractor is expected to provide comprehensive Federal Award Compliance Assessments

(FACAs) for approximately 400 to 1,000 RTS Awardees.

B. Using a list of RTS Awardees that is provided to the Contractor, at a minimum monthly, Contractor will conduct assessments based on the HHSC-approved assessment framework and risk scoring methodology to evaluate RTS Awardees’ internal controls and ability to comply with 2 CFR Part 200 and applicable performance data reporting standards. The assessments are not audits and do not replace or preclude future audits or monitoring activities. The goal of the assessments is to:

1. Identify compliance risks and gaps in internal controls before they result in compliance findings;

2. Provide RTS Awardees with actionable recommendations to reduce identified compliance risks and strengthen grant management practices; and

3. Provide HHSC with objective, documented risk information to inform future monitoring strategies.

1.2 ORGANIZATION REQUIREMENTS

A. Contractor is a certified public accountancy firm.

B. Contractor has the experience and knowledge specific to federal compliance standards, 2

CFR 200, generally acceptable accounting practices, evaluating internal controls, assessing risks, and performing financial reviews for healthcare providers or healthcare-related entities.

C. Contractor has demonstrated expertise and prior experience in applying adult learning principles and curriculum development methodology tailored to educating healthcare providers and healthcare-related entities regarding federal compliance standards.

D. Contractor shall designate an individual as a Project Lead, who will serve as the primary contact for HHSC during the Contract Term. If there is a reassignment or change to the

Project Lead, Contractor shall notify HHSC no later than 10 Business Days from the date

Contractor is aware of the reassignment or change.

1.3 KEY PERSONNEL AND STAFF REQUIREMENTS

A. Contractor must employ, at a minimum, one Certified Public Accountant (CPA) that has experience in:

1. Providing advisory services on assessment standards;

2. 2 CFR 200 curriculum development and training experience with similar projects and entities;

3. Three years of experience evaluating or assessing recipients of federal grant funding compliance with 2 CFR Part 200;

4. Three years of experience conducting financial assessment or financial compliance reviews of healthcare providers or healthcare-related entities; and

5. Documented experience performing risk assessments, including:

a. Evaluation of financial controls;

b. Evaluation of documentation retention and preservation practices;

c. Development of risk scoring methodologies; and

d. Development of corrective recommendations.

B. Contractor shall have demonstrated past performance success on prior government or public-sector contracts.

C. Contractor may use other accountants, financial analysts, regulatory compliance specialists, data analysts, and other staff experienced with federal compliance standards to perform the contractual duties.

D. Contractor shall provide experienced staff to perform the contractual requirements throughout the Contract Term. Preferred requirements for additional staff include:

1. At least three years of experience conducting financial post-award compliance reviews or audits; and

2. Experience working with small healthcare providers, including organizations with 10 or fewer employees.

E. Contractor shall not remove any staff member that was assigned and approved by HHSC to perform Services during the Contract Term.

1.4 REPLACEMENT OF KEY PERSONNEL

A. In the event Contractor determines a change to key personnel or staff member assigned to perform Services under the Contract is necessary or appropriate or HHSC requests a replacement for any reason, Contractor shall provide HHSC with the resumes of qualified individual(s) that Contractor proposes as replacement(s). The resumes for the proposed project staff must be provided to HHSC either:

1. Within 10 Business Days prior to the proposed start date of the additional staff member

(e.g., individual filling a new position) or replacement (i.e., individual replacing a removed individual) staff; or

2. Within 10 Business Days of notification of resignation or illness of staff or, if less than

10 Business Days’ notice is given by staff, immediately upon key personnel’s notice of resignation or illness.

B. In addition to meeting the minimum standards set forth in the Contract, Contractor shall ensure that the replacement or substitute key personnel or staff member must have a level of qualification and experience similar or superior to the person being replaced.

C. Contractor shall ensure that HHSC has reasonable time to review the qualifications and/or credentials of the proposed new key personnel or staff member and to approve the proposed replacement.

1.5 ASSESSMENT FRAMEWORK

A. Contractor shall develop an assessment framework to conduct the desk reviews. Contractor shall obtain HHSC’s written approval of the framework by the deadline and prior to contacting any RTS Awardee to conduct the desk review.

B. The assessment framework must include:

1. An analysis of accounting management practices to ensure compliance with GASB or other similar accounting standards;

2. An assessment of financial policies and procedures;

3. An assessment of internal control documentation;

4. An assessment of accounting and financial reporting practices;

5. An assessment of documentation retention and preservation mechanisms;

6. An assessment of performance or quality data collection methodologies;

7. An assessment of adequacy of performance or quality data systems; and

8. An assessment of organizational capacity and prior experience managing federal awards.

1.6 RISK SCORING METHODOLOGY

A. Using the assessment framework as referenced in Section 1.5 (Assessment Framework), Contractor shall develop a standardized risk-scoring methodology that will be used to identify RTS Awardees as “low risk,” “medium risk,” or “high risk” when conducting the desk review and preparing the recommendation report of the RTS Awardee. The methodology must identify how Contractor will define what is “low risk,” “medium risk,” and “high risk.”

B. Each RTS Awardee must be provided a risk determination (i.e., low risk, medium risk, or high risk) based solely on the documentation submitted and the standardized methodology.

C. Contractor shall submit the risk scoring methodology to HHSC for review and approval.

Contractor’s scoring methodology must be reviewed and approved in writing by HHSC by the reporting deadline and before Contractor contacts any RTS Awardees to schedule desk reviews.

1.7 RTS AWARDEE’S DESK REVIEWS

A. The Contractor shall conduct a virtual and online desk review of documentation submitted by each RTS Awardee under Section 1.15 (Collection of RTS Awardee Documentation), to evaluate how the RTS Awardee’s procedures support 2 CFR Part 200 compliance and review an RTS Awardee’s current internal controls and documentation to make recommendations aimed at minimizing or removing potential risks. All desk reviews must be completed no later than September 30, 2028.

B. For each desk review, Contractor shall:

1. Review documentation provided by the RTS Awardee;

2. Evaluate processes and procedures for maintaining financial controls and reporting practices;

3. Evaluate documentation sufficiency to demonstrate appropriate use of funds;

4. Assess RTS Awardee’s compliance with 2 CFR Part 200 and applicable performance data reporting standards; and

5. Identify risks of future noncompliance related to:

a. Financial record-keeping;

b. Documentation retention; and

c. Performance or quality data tracking and submission.

1.8 DESK REVIEW PROCESS

To ensure all RTS Awardees clearly understand the desk review process, Contractor shall provide to each RTS Awardee:

A. A 21 calendar days’ advance notice to RTS Awardee of the desk review;

B. Outline the specific documents and reports RTS Awardee must submit into the HHSC-hosted repository and the deadline by when the documents and reports must be submitted;

C. Instruct RTS Awardees on how to access and upload records in the HHSC-hosted repository;

D. Schedule a virtual kickoff meeting five Business Days after notice to RTS Awardee of desk review; and

E. Explain the desk review process, expected time commitments, and discuss the expected outcome and results at the kickoff meeting.

1.9 RECOMMENDATION REPORT

A. For each RTS Awardee, the Contractor shall develop a recommendation report that includes:

1. Overview of documentation reviewed;

2. Identified risks and findings of RTS Awardee;

3. RTS Awardee’s risk score determination based on the assessment and documentation provided;

4. List of all RTS Awardee documents provided for review;

5. Specific, actionable recommendations to address, reduce, and/or eliminate identified compliance risks and provide recommendations to strengthen controls; and

6. Copies of all RTS Awardee documents.

B. Each report must not exceed 10 pages (not including attachments) and be provided to the

RTS Awardee via the HHSC-hosted repository no later than 30 calendar days from the deadline by when the RTS Awardee was required to submit the requested documentation under Section 1.8 (Desk Review Process). A copy of the report must be submitted to

HHSC concurrently, via the HHSC-hosted repository.

1.10 TECHNICAL ASSISTANCE

A. After finalization of an RTS Awardee desk review and risk score determination, the

Contractor shall meet with the RTS Awardee to review findings and recommendations, answer questions, and provide clarification on the recommended improvements. If RTS

Awardee agrees to meet with Contractor to discuss the findings and recommendations, Contractor shall schedule, coordinate and participate in a meeting of up to one hour in length with the RTS Awardee.

B. Such Technical Assistance meetings must be conducted no later than 30 calendar days from the date Contractor issued its assessment to the RTS Awardee.

1.11 TRAINING

A. Contractor shall develop and provide training materials (e.g., handouts, curriculum) and web-based, on-demand training modules to assist RTS Awardees with the foundational knowledge needed for grant management and how to maintain compliance with 2 CFR Part

200. RTS Awardees are not required to complete the training modules; however, the training materials and training modules must be designed to educate RTS Awardees on minimum auditing standards for financial management, documentation, and performance or quality data tracking.

B. Contractor shall develop the training materials for the modules and provide to HHSC for review and approval by or before 30 calendar days from Contract Effective Date.

C. Contractor shall make the web-based, on-demand training modules available to RTS

Awardees no later than five Business Days after receiving HHSC written approval of training materials.

D. The training materials and modules must incorporate updates and revisions during the

Contract Term as requested by HHSC at no additional cost.

E. The training modules must meet the following requirements:

1. Be available to RTS Awardees 24 hours a day, seven days a week for the duration of the Contract;

2. Address requirements under 2 CFR Part 200 and generally accepted accounting principles;

3. Explain expectations for documentation to demonstrate appropriate use of federal funds;

4. Identify common risk areas and best practices to mitigate future noncompliance;

5. Total length of training per user must be a minimum of two hours but not exceed eight hours;

6. Allow the user to take the training at their own pace;

7. Track the user’s progress to allow the user to resume where the user’s prior session left off;

8. Include mandatory quizzes after each module with a passing score of 75%;

9. Prevent users from skipping ahead without the user interacting with the content;

10. Issue a time-stamped certificate of completion with the user’s name; and

11. Be accessible to users with disabilities requiring closed captioning for all audio, screen-reader capability, keyboard-only navigation, and comply with the Web Content

Accessibility Guidelines (WCAG) 2.2.

F. Contractor shall track and collect data and information regarding progress, completion, and use of training modules by the RTS Awardees during the Contract Term.

1.12 STATUS AND PROGRESS REPORT

Contractor shall submit to HHSC, on a quarterly basis, information about its status and progress regarding the Services, Deliverables, and other requirements set forth under this Scope of Work on an HHSC-provided template.

HHSC reserves the right to request additional information on the report, as needed.

1.13 FINAL SUMMARY REPORT

Contractor shall draft and submit to HHSC an analysis of all work performed including identifications of trends and recurring patterns, if any, a summary of all findings, and recommendations for future risk-based performance and financial monitoring protocols. The report must be no more than 30 pages having one-inch margins, double-spaced, and in Times New Roman font.

https://www.w3.org/TR/WCAG22/ https://www.w3.org/TR/WCAG22/

1.14 CONFIDENTIALITY AND DATA PROTECTION

A. Contractor shall comply with all federal and state laws and regulations regarding confidentiality, privacy, data protection, and breach notification; HHS Data Use

Agreement; and security requirements provided by HHSC, or amended by HHSC during the Contract Term, (see Exhibit M, Texas Health and Human Services Information

Security and Privacy Controls, and HHS’ Information Security Controls at:

https://www.hhs.texas.gov/sites/default/files/documents/information-security-controls.pdf).

B. During the Contract Term, Contractor may receive financial and operational documents and information from RTS Awardee. All such data and information must be treated as confidential and used solely for purposes of performing the Services of this Contract.

C. Contractor shall ensure that all Confidential Information (as defined in Exhibit D, HHS

Data Use Agreement), including such information residing on back-up systems, remains within the United States. Confidential Information shall not be accessed by Contractor personnel located outside of the United States. Furthermore, Confidential Information may not be received, stored, processed, or disposed via information technology systems located outside of the United States.

1.15 COLLECTION OF RTS AWARDEE DOCUMENTATION

Contractor shall use a document repository hosted by HHSC for conducting the assessments and summary reports to RTS Awardees. Contractor shall ensure that any documents removed from

HHSC’s document repository and moved to the Contractor’s systems for desk reviews are stored in compliance with the security requirements provided by HHSC as identified in Subsection A of

Section 1.14 (Confidentiality and Data Protection). RTS Awardee’s documentation may include, but is not limited to:

A. Financial policies and procedures;

B. Internal control documentation;

C. Accounting and financial reporting practices;

D. Documentation retention and preservation mechanisms; and

E. Performance or quality data collection methodologies.

1.16 ADDITIONAL REQUIREMENTS

A. Contractor shall perform the Work independently and objectively and shall structure the assessment process to promote consistency, fairness, accessibility, and transparency across all assessed RTS Awardees.

B. Contractor shall be ready to begin desk reviews within 60 calendar days after Contract award.

C. Contractor shall attend and participate in any meetings required by HHSC for this Contract.

D. If, during the Contract Term, a change occurs to the Contractor’s name, organizational structure such as a merger or acquisition, or change in form of business then Contractor shall provide HHSC Representative with written notice no later than five Business Days of the change.

E. If, during the Contract Term, Contractor becomes aware of financial insolvency or inability to pay debts or conditions that would impede Contractor’s ability to perform in accordance with the requirements of the Contract then Contractor shall provide HHSC Representative with written notice no later than five Business Days.

1.17 REPORTING AND DELIVERABLES REQUIREMENTS

The Contractor shall submit all reports and Deliverables to HHSC by or before the deadlines set forth below.

DELIVERABLE FREQUENCY DUE DATE

Assessment Framework and

Risk Scoring Methodology

One-Time 30 calendar days following

Effective Date of the

Contract

Training Modules and

Training Materials

One-time and as requested by HHSC

Due by or before 30 calendar days following

Effective Date of the

Contract

Revisions to materials or modules, if requested by

HHSC, are due no later than five calendar days from date of HHSC request

Desk Reviews One per RTS

Awardee

Each review must be completed no later than 30 calendar days from the deadline by when the RTS

Awardee was required to submit the requested documentation.

All desk reviews must be completed by September 30, RTS Awardee

Recommendation Reports

One per RTS

Awardee

No later than 30 calendar days from the deadline by when the RTS Awardee was required to submit the requested documentation

Quarterly Status and

Progress Reports

Quarterly • January 15th

• April 15th

• July 15th

• October 15th

Final Summary Report One-Time Due 60 calendar days following completion of the final assessment and at least

30 calendar days before end of Contract

1.18 PERFORMANCE MONITORING

A. The performance of the Contractor will be determined by whether the competencies of the professional standards have been demonstrated and met and by whether the completion of activities and reporting or Deliverable due dates are being met. HHSC reserves the right to exercise contract remedies set forth in this RFQ, including withholding payment if any reporting or Deliverable requirement is unmet.

B. Deliverables and reports must be submitted and accepted by or before the due dates set forth in Section 1.17 (Reporting and Deliverables Requirements); otherwise, the report or Deliverable is considered late.

1.19 KEY PERFORMANCE MEASURES AND LIQUIDATED DAMAGES

A. The Contractor shall meet the certain Key Performance Measures (KPMs) during the

Contract Term. Failure to meet the KPMs may result in assessment of Liquidated Damages

(LDs).

B. HHSC is not required to provide the Contractor with notice and opportunity to resolve issues prior to HHSC’s assessment of liquidated damages. HHSC’s acceptance of a report or Deliverable after the specified due date does not relieve Contractor from its obligation to timely submit the report or Deliverable by the applicable due date.

C. Contractor agrees that (i) the liquidated damages and any amounts assessed in connection therewith are neither a penalty nor a forfeiture, and (ii) the amount of liquidated damages are a reasonable estimate of just compensation.

D. Contractor is subject to the following LDs:

1. KPM No. 1 (Timeliness of Deliverables): Contractor shall submit all Deliverables by the due dates established in Section 1.17 (Reporting and Deliverables

Requirements).

Performance Standard: At least 95% of Deliverables submitted on time.

LD: $100.00 per late Deliverable, assessed after the second late Deliverable within a calendar quarter.

2. KPM No. 2 (Responsiveness to HHSC Requirement): Contractor shall respond to

HHSC requests for information in a timely manner.

Performance Standard: Responses must be provided within one Business Day; and requested documents provided within three to five Business Days, unless otherwise mutually agreed upon.

LD: $100.00 per instance where response time exceeds three Business Days without an approved extension.

1.20 CYBERSECURITY TRAINING

Contractor and all staff assigned to perform the Work of the Contract shall complete HHS

Information Security/Cybersecurity training within 21 calendar days of Contract Effective Date.

Contractor shall ensure that any staff member that is assigned to provide Services under the Project during the Contract Term completes HHS Information Security/Cybersecurity training before they are permitted access to the HHSC-hosted document repository and any RTS Awardee documentation.

1.21 PAYMENTS AND INVOICES

A. Contractor shall submit monthly invoices by the 15th of each month only after each report or Deliverable having an agreed upon per unit cost has been received and accepted in writing by HHSC.

B. Invoice must be complete and include supporting documents that meet HHSC requirements and those set forth in the Texas Comptroller’s State of Texas Procurement and Contract

Management Guide.

C. The invoice must comply with Texas Administrative Code Title 34, Part 1, Chapter 20, Subchapter F, Division 1, §20.487. Invoice must contain, at minimum, the following: (i) the Contract number; (ii) Contractor name, address, telephone number, and email; (iii) invoice number; (iv) amount billed for the completed report(s) or Deliverable(s); and (v) description and submission date of the report(s) or Deliverable(s).

D. All invoices must be submitted to HHSC by email to: CFOPCruraltxstrong@hhs.texas.gov and a copy to: ruraltexasstrong@hhs.texas.gov.

mailto:CFOPCruraltxstrong@hhs.texas.gov mailto:ruraltexasstrong@hhs.texas.gov