Attachment 6 - Performance Work Statement.docx

PERFORMANCE WORK STATEMENT

FOR

FINANCIAL IMPROVEMENT AND AUDIT REMEDIATION (FIAR)

AT

DEPARTMENT OF THE AIR FORCE

DD MMMMM 202X

DRAFT

Controlled by: AFDW/PK CUI Categories: PROCURE Distribution/Dissemination Controls: FEDCON AFTER AWARD POC: Christine M. Dolan Christine.dolan@us.af.mil

Contents

When setting up your Section II please use make your task description name “Heading 2” in the style section. This will update the Table of Contents automatically. If unsure, the AFDW/PK PM Branch will assist.

SECTION I

1.0 Description of Services

1.1 General. The Assistant Secretary of the Air Force, Financial Management and Comptroller (SAF/FM) serves as the overall functional lead for the Department of the Air Force (DAF) Financial Improvement and Audit Remediation (FIAR) program. The Deputy Assistant Secretary for Financial Operations, Financial Management and Comptroller (SAF/FMF) is responsible for the day-to-day implementation of the FIAR program and compliance with annual financial statements and audit mandates as required by the Chief Financial Officers (CFO) Act of 1990 and the National Defense Authorization Act (NDAA) of 2010.

1.1.1 Scope. This contract will provide Advisory and Assistance Services (A&AS) for beginning-to-end support as it relates to audit remediation, sustainment, and financial statements reporting and analysis for the Department of the Air Force (DAF), which includes United States Air Force (AF) and United States Space Force (SF); hereinafter referred to as DAF. Contractor support shall assist the DAF in achieving the DAF’s audit strategy and roadmap’s goals and objectives, and for the DAF to obtain and sustain a clean audit opinion. Performance Locations will be identified at the task order, and may include locations identified in Table 1.

Pentagon, Washington DC (various locations within 50 miles)

Barksdale AFB, Louisiana

Hanscom AFB, Massachusetts

Joint Base Langley-Eustis, Virginia

Joint Base San Antonio / Lackland AFB, Texas

Los Angeles AFB, California

Norfolk, Virginia

Peterson SFB, Colorado

Scott AFB, Illinois

Tinker AFB, Oklahoma

Wright-Patterson AFB, Ohio

Table 1 – Performance Locations

1.2 Background. The DAF has undergone six full financial statement audits from FY2018-FY2023. During this time, the DAF has made progress in addressing a complex and labor-intensive endeavor, and claimed early victories in important areas, notably its ability to account for mission critical assets’ and in FY21 downgraded/closed three material weaknesses. However, the DAF continues to receive a ‘Disclaimer of Opinion’ based on documented processes and system weakness. SAF/FM as the executive agent for the DAF’s financial statement audit, along with other DAF partners, continue to manage a comprehensive strategy to align audit remediation efforts across the enterprise. The DAF developed and implemented its Audit Roadmap and Integrated Master Schedule, which lays out milestones to achieve a clean audit opinion by 2026 and 2028 for the General Fund and Working Capital Funds financial statements, respectively.

SECTION II

2.0 Task Descriptions

2.1 Task 1: Risk Management and Internal Control (RMIC) and A-123 Programs.

The contractor shall advise and assist with implementation and compliance with:

· Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

· OMB Circular A-123, Management’s Responsibility Enterprise Risk Management and Internal Control (including Appendix A, Internal Controls Over Financial Reporting)

· OMB Bulletin No 15-02, Audit Requirements for Federal Financial Statements

· Federal Financial Management Improvement Act of 1996 (FFMIA)

· GAO Standards for Internal Control in the Federal Government (Green Book)

· Federal Generally Accepted Accounting Principles (GAAP) and Office of Management and Budget Circular A-136.

2.1.1 The A-123 program shall be designed and implemented across the DAF in conjunction with existing efforts such as the Risk Management and Internal Control Program (RMIC), MAJCOM/FLDCOM Self-Testing, and Sustainment testing. Sustain, enhance, and automate the ERM program. Integrate ERM into the Internal Control Program, to include quarterly Statement of Assurance submissions.

2.1.2 The contractor shall work with organizations across the DAF to accomplish beginning to end A-123 cycle (i.e., process owners, functional community, etc).

2.1.3 Support the Department in evolving its established A-123 Program into an overall Enterprise Risk Management (ERM) and Internal Control program. Provide support that helps advance and achieve DAF’s goals surrounding audit sustainment and a sound ERM program.

2.1.4 Develop recommendations and assist with the implementation of an effective governance structure to include a Senior Assessment Team (SAT), Risk Management Council (RMC) and Senior Management Council (SMC).

2.1.5 Make training recommendations, and develop and provide annual training across the DAF to ensure awareness and compliance with the RMIC program. Provide eGRC training to new users and refresher training for system users.

2.1.6 Perform an analysis of existing Assessable Units (AUs) and align them to business cycles (Procure to Pay, Order to Cash, Record to Report, etc.) for proper evaluation by the OMB Circular A-123 program.

2.1.7 Annually assist the DAF in performing the full cycle of A-123. The contractor shall provide an annual schedule for the A-123 to include timelines and deliverables. Contractor support shall include, but not limited to, the following tasks for each A-123 cycle:

· Scoping and planning activities that includes a documented risk based assessment of Business Process Cycle Memos and Programs, etc. These risk assessments should also include consideration of the DAF’s system environment for financially significant systems, applications, spreadsheets, etc. The risk assessments should also assess financially significant accounts and operating locations.

· Deliverables include: Planning and scoping document for A-123 cycle execution and overall project schedule for the next fiscal year. The project schedule becomes contractual due dates when accepted by the AU lead.

· Documentation and testing to include updating existing internal control process such as Process Cycle Memorandums (PCM), process controls memos, performing test of Design (TOD) and testing of operating effectiveness (TOE), performing gap analysis control effectiveness and conducting process improvement. Develop and/or update existing internal control documentation based on business process cycles to include narratives, flowcharts, risk and Control Evaluation Matrices (CEM), or equivalent. Develop corrective action plans to address self-identified deficiencies (SIDs) resulting from testing failures.

· Deliverables include: Updated business process cycles memorandums; Updated risk assessments, internal controls (including required complementary user entity controls (CUECs), entity level controls, and fraud risk) for each business cycle/assessable unit and a comprehensive master controls catalog; Walk through results, Updated testing plans and resulting TOD and TOE results; Draft update of Statement on Standards for Attestation Engagements (SSAE) No 18 Air Force Analysis Monitoring Report for each SSAE applicable to the Air Force.

· Reporting and Monitoring results internal and external to DAF organizations, to include OUSD(C) deliverables requirements.

· Deliverables include: annual statement of Assurance and associated deliverables, templates and briefing materials for all four quarters.

· Service Provider work. The Contractor shall support DAF by assisting in the development and maintenance of a framework for the management of DAF’s third-party risk at it impacts DAF FIAR business processes. This support shall include:

· Attendance at the OUSD(C) led Service Provider Working Group, updating of materials based on guidance received, and communicating updates to Assessable Units

· Assist with monitoring any new service provider guidance from relevant sources and incorporate into DAF service provider monitoring approach.

· Integration of the existing service provider monitoring cycle into the A-123 approach. This shall include specific monitoring and tracking of DAF controls meeting CUEC classification, their associated financial reporting objectives, key supporting documents (KSDs), and other supporting documentation.

· Remediation of deficiencies/gaps identified during review of Material Service Provider Systems and ensure that necessary controls related to SSAE 18 CUECs are in place and effective.

· Ongoing assessment of needs for formal agreement of roles and responsibilities where DAF has a reliance on others, or DAF is a Service Provider to others.

· Establish and maintain Memorandums of Understanding (MOUs). This shall include coordination with the Service Providers and Assessable Units and the review and update all audit relevant MOUs on an as needed basis, and at least annually.

· Produce Monitoring Reports annually documenting the review and monitoring of Service Organization Controls (SOC 1) reports.

· Make training recommendations and develop and provide annual Service Provider training.

· Establish and maintain control documentation related to third party providers and receivers of services, refresh as needed, and review for updates at least annually.

2.1.8 Sustain and maintain all relevant assessable unit information (i.e., PCMs, CEMs, Test Results, KSDs, Determinations, Corrective Action Plans and Updates to the plans, etc.).

2.1.9 The contractor shall support the development of new integrated master schedules (IMSs), and maintain/update project plans and IMSs as necessary, but at the minimum on a monthly basis support audit remediation/sustainment efforts specific for each assessable unit.

2.1.10 The contractor shall track and facilitate metrics reporting for monitoring and oversight; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task.

2.2 Task 2: Corrective Actions and Integrated Master Schedules (IMSs).

The Contractor shall assist in beginning-to-end Corrective Action and IMS activities for all assessable units. CAPs should comply with internal and external policies (i.e., CAP development within 6 weeks of NFR issuance). The contractor shall assist in continuously improving CAP/NFR processing to gain efficiencies. Tasks shall include the following for all CAPs:

· Confirm: Document the deficiencies from the NFR, assign Office/Organization of Primary Responsibility (OPR), and assign priority levels.

· Plan: Perform root cause analysis, identify responsible organizations, search for similar findings, and determine resources

· Design: Develop milestones, tasks, and timelines (e.g., due dates). Advise the government on the best approach to remediate the deficiency.

· Implement: Execute the activities and milestones

· Validate: Confirm that CAPs addressed the deficiency with an IPA pass rate of 90%. CAP validation must include impact of implemented CAPs to the financial statements and compliance with accounting standards/principles.

· Monitor & Report: Inform management of progress at regular intervals (occurs throughout all phases of the CAP process). Submit monthly CAP reports that are generated from the ODCFO database and IMS updates.

2.2.1 The contractor will continuously evaluate the effectiveness of CAPs to ensure they are sufficient to resolve the deficiencies.

2.2.2 The contractor shall execute, track, monitor, report on all CAPs, to include non-critical CAPs, following the government’s lead.

2.2.3 The contractor shall maintain Standard Operating Procedures (SOPs) for CAP management, and update as necessary to remain in compliance with Customer direction, FIAR Guidance, OMB Circular A-123, and GAO Green Book.

2.2.4 The contractor shall assist with all CAPs to ensure the DAF obtains and maintains an audit opinion. The contractor shall ensure CAPs critical to the downgrade/closure of open material weaknesses/significant deficiencies are on track, and inform government personnel if any are at risk. In addition, for CAPs that have been remediated, the contractor shall assist with activities to ensure remediated deficiencies maintain sustainment status.

2.2.5. The contractor shall ensure all CAP milestones are current in ODCFO, and perform regular reconciliations between milestones in IMSs and ODCFO, coordinating with stakeholders to update.

2.2.6. The contractor must produce monthly IMS progress metrics/dashboards for each material weakness, significant deficiency, and any other relevant assessable units as directed by government lead. At the minimum, these metrics will include: fiscal year actual vs. planned progress, overall actual vs. planned progress, and major objective/CAP exceptions.

2.2.7 The contractor will develop and maintain digitalization of the Integrated Master Schedule (IMS) business process to organize, manage, and track progress on remediation activities. The contractor will integrate this capability in the existing Department of the Air Force PerFORM technical environment, ServiceNow, or other avenue approved by the government to support the accurate, efficient, and effective reporting and tracking of progress. The Contractor shall provide ServiceNow developers that will make the necessary changes to the ServiceNow environment as required and assist personnel with questions regarding the use of the tools.

2.2.8 The contractor shall track, monitor, and report on all notices of findings and recommendations (NFRs) received from the IPA, self-identified deficiencies, and financial management findings from the GAO, DoDIG, and AFAA. The Contractor must ensure that 90% of DAF’s CAPs fully mitigate the NFR identified deficiencies and submitted to the Auditor NLT than June 28th of each audit year. CAP submission date that falls on the weekend will be delivered on the last duty day of the week prior to the due date.

2.2.9 The contractor shall track and facilitate metrics reporting; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps (i.e., accounting standards, current processes, etc.), and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task.

2.3 Task 3: Audit Liaison Support.

In coordination with government personnel, provide audit liaison support for DAF’s financial statement audits, to include supporting other audits in which DAF is a service provider. This includes supporting walkthroughs, preparing and providing key-supporting documentation, crafting position papers or other memos for all DAF audits (i.e., general fund, working capital fund, information technology), as well as supporting other DAF associated audits (i.e., DHA, SOCOM, TRANSCOM, AFAA, DODIG). Audit liaison support shall include maintenance and execution of audit infrastructure activities. Update, maintain and sustain DAF’s audit remediation SharePoint tools as requires (AR Tool, NFR Tool, SVT Tool). Audit infrastructure activities includes:

· The Contractor shall, maintain, manage, configure, provide administrative services, update and use the centralized audit response tools to retain audit documents to facilitate audit liaison activities for financial statement audits. These tools will facilitate the exchange of audit information, including auditor requests for information, samples, and supporting documentation, and financial manager submission of documents in response to auditor requests.

· The contractor shall assist the Government in managing the requests from the IPA, sending the request to the applicable organization for fulfillment, review responses, send responses to IPA and answer questions form IPA on requested items. The Contractor shall provide technical support for performing the bulk upload of IPA audit samples into the Audit Response Tool (ART) and using the ART to distribute samples to the appropriate POC for response. This liaison support will include facilitating walkthroughs of audit processes and operation/sustainment of Audit Response Tools facilitating the exchange of audit information, audit samples, and supporting documentation, in response to auditor requests. The contractor will support in researching and uploading audit documents requested to support audits. The contractor will assist Government personnel in providing timely quality review of key supporting documentation provided and responses and refer to Government personnel for final approval.

· Contractor shall assist in discussions and communications with IPA and other meetings, as required by the government lead, and document meeting minutes, decision points, action items, and requests for documentation and submission to IPA.

· Monitor audit status and provide updated status to MAJCOMs/FIELDCOMs, SAF/FMF leadership and OSD or other Department of Defense (DOD) Executive leadership briefings as required.

· Assist in logistics of organizing site visits and participate in site visits related to IPA.

· Assist in generating reports to assess the status of IPA requests for support documentation.

· Provide support to facilitate an effective and efficient audit, this includes raining/educating the IPA on business processes and controls under audit, and use of audit tools

· Contractor shall provide SharePoint developers that will make the necessary changes to the SharePoint as required and provide a helpdesk to assist personnel with questions regarding the use of the automated audit remediation tools.

2.3.1 The contractor shall track and facilitate metrics reporting; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task.

2.4 Task 4: Financial Reporting and Analysis.

The contractor shall assist with beginning to end financial reporting and analysis support for all of DAF’s financial statements.

2.4.1 Annual Agency Financial Report. The contractor shall assist SAF/FMF in the preparation of the DAF Annual Agency Financial Report (AFR) in compliance with DoD guidance and OMB Circular A-136. As such, at a minimum, activities will include:

· Review the DoD financial reporting schedule published by OUSD(C) and develop a plan within 30 days of contract award to help ensure that the Government stays on track with publishing the DAF AFR by November 15.

· Create and submit the DAF’s FY AFR Schedule to the Government for review by March 30th of each year.

· Update the AFR schedule as items are completed; and provide bi-weekly updates to the Government from 15 February 20XX to 15 July 20XX; provide weekly updates to the Government from 15 July 20XX to 15 November 20XX.

· Develop the overall AFR theme for the fiscal year to include at least three options for the Government to choose from.

· Research and recommend graphics (logos, photos, illustrations, maps, etc.) for inclusion in the AFR to improve the presentation of information. The graphics must be obtained from the DOD/DAF website of graphics that have been approved for public release and source references must be available upon request.

· Create and submit the AFR outline to the Government for review and approval each fiscal year.

· Review and update the draft Management’s Discussion and Analysis (MD&A) to ensure the content is written in plain English/understandable to the general public; content is factual and supported; facts and figures reconcile with the actual financial statements (FSs), footnotes and or budget data; contents and graphics are consistent with the AFR theme; only approved graphics and photos from the DOD/DAF website are included; and detect all grammatical and mechanical errors. Reviews and approval are to be completed by Contractor Partner level prior to the submission to the Government.

· Provide recommendations for improvement to the Government and update the MD&A with the approved recommendations.

· Draft the Agency Head Message, the CFO message, and the Management Response Letters providing the Government with a draft “ready for coordination” copy for review and approval. Reviews and approval are to be completed by Contractor Partner level prior to the submission to the Government.

· Assist the Government in coordinating with SAF/FMF leadership, DoDIG and all stakeholders to prepare and review the interim and final management representation letters for the General Fund and Working Capital Fund.

· Assist the Government in coordinating with the review and coordination of the interim and final Legal Representation Letters (LRLs), Management Schedule of Information (MSI), and prepare them when applicable in the proper format.

· Assist the Government in the coordination effort for the 3 letters, 2 letters and through the Secretary of the Air Force level to help ensure the appropriate signatures are obtained on the Agency Head and CFO messages by the end of October.

· Assist the Government in the coordination for the 3 letters, 2 letters, Legal Counsel and through the glass door to obtain the appropriate signature on the final management representation letters by the end of October.

· Ensure Financial Statements and footnotes in the AFR reflect/reconcile with DDRS-AFS official versions.

· Review and edit various subsections and portions of the AFR to ensure information is clear, consistent, succinct, accurate, grammatically correct, and in plain English/understandable to the general public. Reviews and approval are to be completed by Contractor Partner level prior to the submission to the Government.

· Review and edit the Required Supplementary Information.

· Track changes to sections of the AFR in a tie-point spreadsheet to ensure that changes made in one section carryover to corresponding sections. Provide all final AFR templates, memorandums, letters and messages in PDF and Word formats.

· Automate the AFR document ensuring that changes made in one section systemically carryover to corresponding sections.

· Obtain DoDIG transmittal letter and IPA audit opinion on the General Fund and Working Capital Fund Financial Statements and incorporate the documents into the AFR

· Compile all sections of the AFR including repagination to ensure page numbers correspond to the Table of Contents.

· Obtain Government’s approval on the final copy of sections and sub sections of the AFR in accordance with the AFR schedule.

· Deliver the Final AFR to the Government by the first week in November and provide 12 hard copies of the AFR to the Government.

· Advise on ways to improve the presentation of information in the AFR for the following fiscal year.

2.4.2 Quarterly Financial Statement Variance Analysis Preparation. The contractor shall assist SAF/FMF in the preparation of the DAF’s quarterly financial statements variance analysis. In accordance with OUSD memo, ‘Variance Analysis for Financial Statement Reporting (FPM 19-17)’, dated April 6, 2020, the contractor shall:

· Support a variance analysis to be prepared on a quarterly basis for each of the four principal financial statements (Balance Sheet, Statement of Net Cost, Statement of Changes in Net Position, and Statement of Budgetary Resources).

· Variance analysis should be focused on those variances that exceed the materiality threshold within the Variance Analysis for Financial Statement Reporting (FPM 19-17) memorandum.

· Variance analysis will consist of comparing the current quarter year-to-date financial statement to the same quarter year-to-date statement from the prior year for all four principal statements as well as comparing current quarter Balance Sheet to the prior fiscal year end Balance Sheet or as directed by the government lead.

· Provide an email identifying variances requiring an explanation within 1 business day of receiving draft financial statements

· For General Fund, assist the SAF/FMFA Branch Chief and Accountant in running GAFS-R and DEAMS queries and preparing analysis to provide to the responsible POCs. This includes preparing data calls, creating pivot tables, perform checklist review of JVs and JV Logs, and tracking journal vouchers recorded during the quarter.

· Assist with requests to responsible POCs driving fluctuations within 1 business day of receiving draft financial statements. Assist in tracking that SAF/FMFA receives the required information from the respective point of contact and coordinate with the responsible POCs to compile information to explain the reason for the variance, as necessary.

· Assist the Government in consolidating all input received from responsible POCs for the variance analysis by 17th business day after quarter end for Q1-Q3 and the 20th calendar day after 4th quarter end.

· Confirm amounts in the variance analysis explanations reflect/reconcile with DDRS-AFS official versions.

· Provide a summary report noting the results of the analysis and identifying any amounts that did not reconcile to the SAF/FMFA Branch Chief and Accountant.

· Assist with preparing variance analysis briefing materials for SAF/FMF leadership no later than the 17th business day after quarter end for Q1-Q3 and the 20th calendar day after 4th quarter end.

· Support SAF/FMFA in briefing the variance analysis to SAF/FMF Senior Leaders.

· Consolidate and maintain all quarter’s variance analyses to aid in research for the current quarter’s variance analysis compilation.

2.4.3 Quarterly Financial Statement Data Call Preparation. Assist with gathering of data and develop quarterly journal voucher postings, prior period adjustments, and analyze financial statements for accuracy and impact of adjustments. The contractor shall track all data calls performed throughout the quarter to ensure they are posted timely (i.e., before declaring financial statements are final and complete with reporting).

2.4.4 Journal Voucher Review. In accordance with financial reporting deadlines, the contractor shall review monthly and quarterly journal vouchers posted in DEAMS, GAFS-R, DDRS-B, and DDRS-AFS to ensure they are properly tic and tied and supported with transactional level details. The contractor shall provide the results of their review to SAF/FMFA and track that all monthly journal vouchers have been accounted for and approved by SAF/FMFA prior to the finalization of reports. For JVs, specifically those not identified annually in the Journal Voucher MOUs with DFAS, the contractor shall assist in the research of root cause and resolution.

2.4.5 The contractor shall track and facilitate metrics reporting; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task.

2.5 Task 5: FIAR IT Systems/Integration.

The Contractor shall provide support in documenting and assessing IT compliance, in both legacy and target environments, to assist SAF/FMF and the Department in achieving and maintaining an audit ready state for information systems identified in the FIAR assertion process.

2.5.1 Security Controls Assessment. The contractor shall provide support assessing, documenting, testing and monitoring internal controls in alignment with current DAF, Federal Information System Controls Audit Manual (FISCAM), Risk Management Framework (NIST 800-53), and FIAR Guidance related to systems utilized in the performance of material business processes.

2.5.2 Business Process Control Assessment. The contractor shall provide FFMIA and Federal Financial Management System Requirements (FFMSR) Assessments on DAF/ material systems utilizing requirements identified in the Treasury Financial Manual (TFM) Chapter 9500. The contractor shall assist with compliance with applicable FFMSR compliance.

2.5.3 Data Standardization Assessments. The contractor shall provide assessments on Standard Financial Information Structure (SFIS) compliancy on FIAR systems and provide recommendations for Air Force management for business process change requirements. The contractor shall assist with developing and/or update improvement plans to increase SFIS / U.S. Standard General Ledger (USSGL) compliance and update.

2.5.4 For systems that have completed previous FIAR baseline assessments, the contractor shall conduct updated testing to include implemented corrective action plans and sustainment testing of selected internal controls. This approach shall be integrated into the A-123 approach identified within this PWS.

2.5.5 Audit remediation support after the completion of IT Compliance Assessments, internal audits, or external audits of DAF Financial Management systems.

2.5.6 Advising and assisting DAF Management in the prioritization of identified issues, assessment of risk, development of corrective actions, and tracking of their resolution.

2.5.7 Assisting system program managers and their designees with required updates and modifications to CAPs as adjustments are required.

2.5.8 Developing and documenting of best practices for distribution and incorporation in FM information assurance guidelines.

2.5.9 For systems requiring critical changes as a result of SIDs, Critical Issues, or NFRs; support the requirement definition process for system change requests required to address corrective actions.

2.5.10 Support the AF Business Capability Acquisition Cycle (BCAC) as required for development activity related to FIAR business processes. This support shall include: Provide research and support to ensure future defense business systems material to audit are FIAR compliant.

2.5.11 Advise and assist in researching future systems development, evaluation and implementation on current and future financial relevant systems. Assistance does not include tasks associated with program management offices, system integrators, and functional management offices. Provide research and support to ensure future systems are FIAR compliant.

2.5.12 Supporting the identification of key FFMIA requirements for proposed development activity.

2.5.13 Integration with program managers to provide clarification on FFMIA requirements as required. The contractor shall support DAF management in the development, revision, implementation, and documentation of IT Compliance strategies. This support shall include:

· Assisting in the strategy for the establishment, development and integration of system and enterprise level Governance Risk and Compliance policies, procedures and tools.

· Development of policy, directives, memorandums, CONOPS, and other documentation to support cyber security and defensive cyber operations capability employment, governance, oversight, strategy, command and control, failover and support to sections of the NIST Cybersecurity Framework and other Federal Governance documents.

· Development and implementation of Information Protection processes, procedures, and technology requirements, to include creating and managing a baseline configuration of IT/industrial control systems, System Development Life Cycle, configuration change control processes, and policy and regulations regarding the physical operating environment for organizational assets to achieve resilience requirements in normal and adverse situations.

· Recommendations on, and development of, Tactics, Techniques, and Procedures (TTPs), checklists, Incident Response and Recovery Plans, crew binders/handbooks etc. to support system and information protection, incident detection and response, and actions required to implement similar capabilities across the Air Force enterprise.

2.5.14 Maintaining current knowledge of guidance, policies, and regulations; and be able to communicate updates and incorporate into existing IT Compliance strategies. Contractor support shall include development and delivery of cybersecurity awareness, role-based, and operational training, including realistic cyber and defensive cyberspace operations training and exercise scenarios and objectives.

2.5.15 Coordinating and collaborating with various portfolio managers and program offices. For new Defense Business Systems (DBS) in the BCAC process, advise and assist Government leads with researching and documenting audit requirements, and validating/using data, reports and other outputs from existing systems to define and document system audit deficiencies.

2.5.16 The contractor shall support the development of recommendations for improved audit status posture through the purchase, design and implementation of hardware, software, tools, and other infrastructure that directly supports improvement in cyber security and defensive cyberspace operations capability aligned to controls and governance like RMF, National Institute of Standards and Technology (NIST) SP800-53, NIST Cybersecurity Framework (CSF), and any others as determined by the government.

2.5.17 Coordinate and collaborate with various portfolio managers and program offices for all financial systems identified as relevant for audit. For new systems, advise and assist Government leads with researching and documenting audit requirements, and validating/using data, reports and other outputs from existing systems to define and document system audit deficiencies.

2.5.18 Assisting with collecting, developing and briefing FIAR IT metrics. This will include collecting and tracking CAP/NFRs for systems.

2.5.19 Analyzing system impacts and materiality to the USAF/USSF including coordination of and updates to the official list of FIAR-identified systems maintained by SAF/FMF.

2.5.20 Assist SAF/FMF with the integration of FIAR information into existing portfolio management initiatives.

2.5.21 Assisting with collecting, briefing and reporting progress on IT Compliance Assessments, corrective actions, and FIAR Metrics.

2.5.22 Maturity Model. This model should establish a plan to integrate ongoing CFO Compliance activities into processes being established for Risk Management Framework (RMF) authorizations. The Contractor should look to identify areas where the RMF processes can be improved or modified to deliver the output required for ongoing FIAR compliance. These processes will include the following RMF Steps: Categorize, Select, Implement, Assess, Authorize, and Monitor as directed by DODI 8510.01.

2.5.23 IT FIAR Functional Management Support. The Contractor shall provide support in assisting identified functional communities with the integration of IT Compliance activities into specific corporate initiatives.

2.5.24 In support of audit remediation, the contractor shall support the development, implementation and integration of IT solutions with capabilities for enhanced enterprise internal controls for financial and financial feeder systems. These capabilities should assist DAF in downgrading and/or resolving material weaknesses for IT systems. These capabilities should:

· Identity compliance, role management, user provisioning, service request management, and password management

· User access provisioning process for new users (normal and privileged) requiring access to the information system

· Automate the completion of user access authorization request from initiation, review, authorization, and removal

· Retain electronic supporting evidence for user access (request, approval, removal)

· System security and continuous monitoring for vulnerability and patch management

· Configuration management for system development lifecycle (SDLC)

· Integration of IT risk management

· Establish centralized data management capability

· Address interoperability and integration challenges of financial and financial feeder systems

· Assess current state and design future state software asset management strategy

· Meet DAF network access security parameters.

· Demonstrate a sound plan for establishing and delivering the most efficient and effective capability.

The contractor shall implement above capabilities via seven (7) DAF Enterprise Audit Remediation solutions and tools:

· Identity, Credential & Access Management (ICAM)

· Configuration Management Database (CMDB)

· System Security (SS)

· Security Information & Event Management (SIEM)

· Enterprise Integration (EI)

· Software Asset Management (SAM)

· Enterprise Governance, Risk and Compliance (eGRC)

The contractor shall be prepared to support audit related line of efforts on the DoD and DAF Zero Trust Roadmap.

2.5.25 The Contractor shall lead, plan, and collaborate with SAF/FM, other contractors, and stakeholders to develop and maintain Schedules, Roadmaps, Program Increment/Product Release Plans to track progress, identify dependencies within and across teams, and to help clearly communicate priorities. The integrated plan shall be developed by the collective project team with each team leading their responsible areas and contributing to overall project to align dependencies during Agile development. Large-scale planning activities such as Program Increment Planning events expected and executed in collaboration with SAF/FM and any other stakeholder involved in seven (7) DAF Enterprise solutions. The Contractor should complete work based on agile development methodology and shall include an Agile Work Management Plan (AWMP) to define the agile process for the work that will be performed. The AWMP shall include processes, definitions, Agile team composition, sprint duration and definition of done (DoD). The Contractor is responsible for ensuring these DAF enterprise solutions are progressing toward the visions. The Contractor is responsible for ensuring clear mapping of Vision > Themes > Epics > Features > Stories, and should have a strong understanding of the policies, processes, standards, and best practices. The contractor is responsible for providing sustainment for developed solutions (e.g. eGRC, IMS)

2.5.26 The contractor shall track and facilitate metrics reporting; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task.

2.5.27 The contractor shall ensure data fidelity across the enterprise by converting all end-to-end (E2E) process work products into artifacts in compliance with the Department of Defense (DoD) Architecture Framework (DoDAF), version 2.02 standards. The contractor shall align all artifacts to E2E processes and subsequent operational activities (OA) of Business Enterprise Architecture (BEA) 11.2. BEA 11.2 is the enterprise architecture for the DoD Business Mission Area (BMA). The contractor shall ensure the content within the artifacts developed leverages complete E2E process alignment and the subsequent OAs outlined in BEA 11.2, ranging from Level 0, Level 1, Level 2, and Level 3 OA alignment. These E2E processes may include the following processes and others as directed by the Government.

· Budget-to-Report

· Hire-to-Retire

· Procure-to-Pay

· Acquire-to-Retire

· Order-to-Cash

· Plan-to-Stock-Inventory Management

2.6 Task 6: Asset Valuation and Sustainment.

2.6.1. Assist the DAF in analyzing and sustaining the valuation beginning balances baseline for each category of asset including, but not limited to, general property, plant, and equipment, and inventory. This will involve supporting the Government in development of processes and procedures to obtain and maintain necessary Key Supporting Documentation and updating all associated systems as it relates to beginning balances.

2.6.2. Assist the DAF in the development and sustainment of Statement of Federal Financial Accounting Standard (SFFAS) compliant processes for the valuation of all DAF owned assets including, but not limited to, general property, plant, and equipment, and inventory. Analyze and prepare documentation to support financial statement reporting of all DAF assets and inventory including modifications. This includes reconciliation of general ledger activity to accountable property systems of record, and development and sustainment of the control environment.

2.6.3. Assist in the automation of SFFAS compliant processes by supporting meetings with systems program offices and providing requirement needed for automation as well as recommended approaches to automation that fit within the DAF’s information technology structure.

2.6.4. Support the valuation calculations and documentation at all levels to include USSF and MAJCOM Program Offices. Documentation shall be maintained in a data repository determined and approved for use by each applicable DAF and MAJCOM Program Offices. The data repository shall include position papers, reconciliations, supporting documentation, facilitate the exchange of audit information, auditor requests for information, samples, and any other program office documents provided in response to auditor requests. Enter valuation data into the approved DAF system as required by government personnel.

2.6.5. Monthly/Quarterly valuations shall include a reconciliation to work with program offices to ensure Logistics and Finance data in relevant systems of record are consistent and accurate. Program Offices may be geographically separated with data being maintained at multiple locations. The contractor shall also assist DAF in developing, documenting, and implementing accrual methodologies/procedures, controls and processes to mitigate relevant FIAR financial reporting risks.

2.6.6. Where deficiencies exist, work with applicable Government personnel to recommend executable corrective actions necessary to properly report values and assets in an approved DAF System.

2.6.7. The contractor shall track and facilitate metrics reporting; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task.

2.7 Task 7: Universe of Transactions (UoT).

The DAF requires the capability to present the IPA a transactional level audit trail that is complete and can support CFO reporting.

2.7.1 The Contractor shall assist with the maintenance of the Population Completeness Universe of Transactions (UoT) Framework for Full Financial Statements addressing the accounting transactions and audit requirements necessary to support the DAF’s Financial Statements. This Framework shall include:

· The contractor shall support SAF/FMF and AFMC to maintain the UoT strategy and completeness controls based upon transactional level detail and data pathways (DDRS-AFS, DDRS-B, GAFS-R, DEAMS, and other future subsidiary ledgers). Deploy analytical techniques and toolsets to support the development and review of financial system data (e.g., quantitative drill down) as requested by SAF/FMF and AFMC.

· The Universe of Transactions Framework Population Completeness Guide should be considered a living document and the Contractor should assist with necessary updates until population completeness for the DAF is achieved. Upon completion, the Guide Framework should be updated yearly to ensure critical updates to processes and data elements are incorporated into the Guide Framework.

· The Contractor shall assist SAF/FMF and AFMC with participating in working groups related to UoT.

· The Contractor shall update the UoT Narrative at least once a year, and more frequently if there is significant change.

2.7.2 The contractor shall support DAF in the translation of UoT transactions into the quarterly QDD with necessary reconciliations of subsidiary systems to the financial statement general ledger systems (GAFS-R and DEAMS).

2.7.3 Contractor shall develop timely reconciliations to assist with attestation of completeness and accuracy of all UoT for financial reporting analysis, audit remediation, and population sampling:

· Manual reconciliation for all required Mission Critical Asset data reconciliations for both General Funds and Working Capital Funds from the APSR to the general ledgers.

· Manual reconciliation for all required Financial Management data reconciliations for both General Funds and Working Capital Funds from the source systems to the general ledgers.

· Collaborate with stakeholders for data analysis and audit requirements.

· Create queries, workbooks, and procedures to assist in identifying data variances and abnormalities.

· Create methodology for providing auditable populations as required by IPA for review and sampling.

· Ensure auditability of automation scripts, document all business rules and business process changes, and continuously maintain and/or improve upon queries and reconciliation workbooks.

· Provide training as necessary to ensure that users of reconciliation products and reports understand the information.

· Maintain all documentations, procedural SOPs, and reconciliations within approved government servers and databases.

2.7.4 The Contractor shall support DAF with implementing recurring controls and ad-hoc data analytics requests over financial statement information.

2.7.5 The contractor shall track and facilitate metrics reporting; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task.

2.8 Task 8: Data Analytics, Robotics Process Automation.

2.8.