FIAR Performance Work Statement FIAR2.0 8.28 final.docx

Attachment 1

FA5000‐XX-X-XXXX

FA7014‐26-FXXXX

PERFORMANCE WORK STATEMENT

FOR

FINANCIAL MANAGEMENT

FINANCIAL IMPROVEMENT AND AUDIT REMEDIATION (FIAR)Version 1.0

AT

AIR FORCE FINANCIAL MANAGEMENT & COMPTROLLER (SAF/FM),

AIR FORCE MATERIEL COMMAND FINANCIAL MANAGEMENT(AFMC/FM) AND DEFENSE SECURITY COOPERATION AGENCY (DSCA)

3 Sep 2025

Controlled by: AFDW/PK CUI Categories: PROCURE Distribution/Dissemination Controls: FEDCON AFTER AWARD POC: Christine Dolan (christine.dolan@us.af.mil)

Contents

When setting up your Section II please use make your task description name “Heading 2” in the style section. This will update the Table of Contents automatically. If unsure, the AFDW/PK PM Branch will assist.

1.0 Description of Services

1.1 General

The Assistant Secretary of the Air Force, Financial Management and Comptroller (SAF/FM) serves as the overall functional lead for the Department of the Air Force (DAF) Financial Improvement and Audit Remediation (FIAR) program. The Deputy Assistant Secretary for Financial Operations, Financial Management and Comptroller (SAF/FMF) is responsible for the day-to-day implementation of the FIAR program and compliance with annual statements and audit mandates as required by the Chief Financial Officers (CFO) Act of 1990 and the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2024. The FY24 NDAA mandates an unmodified (clean) audit opinion by December 2028.

1.2 Scope

This contract will provide audit and audit system remediation services for beginning-to-end support as it relates to audit remediation, sustainment, and financial statements reporting and analysis for the following customers: SAF/FM (United States Air Force (USAF) and United States Space Force (USSF) for the Department of the Air Force General Fund (GF); Air Force Materiel Command (AFMC) for the Working Capital Fund (WCF); and the Defense Security Cooperation Agency (DSCA) for the DAF Title 22 Security Assistance Accounts (SAA).

While the FY24 NDAA mandates an unmodified (clean) audit opinion by FY28, the Secretary of the Air Force (SECAF) has directed the DAF to accelerate efforts. The contractor shall provide PWS services that aligns with: USSF audit strategy of achieving an accelerated modified audit opinion by FY2026 as directed by the Vice Chief of Space Operations; SAF/FM (USAF/USSF GF) and AFMC (WCF) audit strategy of achieving an accelerated unmodified (clean) audit opinion by FY2027; DSCA audit strategy of achieving an unmodified (clean) audit opinion by FY2028. Sustainment of an unmodified (clean) audit opinion is required once achieved for all customers herein.

1.3 Background.

The DAF, which includes SAF/FM (USAF/USSF GF) and AFMC (WCF), has undergone seven financial statement audits from FY2018-FY2024 with DSCA having two SAA-related financial statement audits from FY2023-FY2024. As of FY2024, the DAF has downgraded/closed six material weaknesses. However, the DAF & DSCA continue to receive a ‘Disclaimer of Opinion’ based on documented processes and system weaknesses. SAF/FM as the executive agent for the DAF’s financial statement audit, along with other DAF partners, continues to manage a comprehensive strategy to align audit remediation efforts across the enterprise. The DAF developed and implemented its Audit Roadmap (PWS Appendix E) and Accelerated Audit Plan (AAP) (PWS Appendix D), which lays out milestones to achieve a modified audit opinion by FY2026 for USSF, an unmodified (clean) audit opinion by FY2027 for the DAF and FY2028 for DSCA financial statements, respectively. (NOTE: Prior years’ Agency Financial Reports (AFRs) can be found within the bidders’ library. These include prior year financial statements, audit reports and details on material weaknesses).

2.0 Task 1: Risk Management and Internal Control (RMIC) and A-123 Programs

2.1a Task 1a (Option) This Option is applicable to SAF/FM (USAF/USSF GF) (refer to PWS Appendix F: Assessable Unit (AU) Listing for task applicability to SAF/FM (USAF/USSF GF)).

In FY25, a Memorandum of Agreement (MOA) was implemented to detail 24 Air Force Audit Agency (AFAA) personnel through August 2027 directly to SAF/FMF in support of the RMIC/A-123 program. A key provision of the MOA allows either party to terminate the agreement with written notice. This option shall be exercised by the government if the MOA is terminated to ensure continuity of these critical services from the contractor if AFAA support is unavailable.

2.1a.1. Annually, the contractor shall review the guiding documentation for the RMIC program and present written recommendations to update the program to maintain compliance with laws, regulations and policy for government review prior to the start of the fiscal year. Once approved the contractor shall implement those changes to keep the program in compliance with the laws, regulations and policy. This may include updates to DAF policy, Instructions, or manuals.

· Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

· Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility Enterprise Risk Management and Internal Control (including Appendix A, Internal Controls Over Financial Reporting)

· OMB Bulletin No 15-02, Audit Requirements for Federal Financial Statements

· Federal Financial Management Improvement Act of 1996 (FFMIA)

· Government Accountability Office (GAO) Standards for Internal Control in the Federal Government (Green Book)

· Federal Generally Accepted Accounting Principles (GAAP) and Office of Management and Budget Circular A-136.

· DODI 5010.40 DoD Enterprise Risk Management and Risk Management and Internal Control Program

· Department of Defense Statement of Assurance Handbook This review will inform the annual A-123 Cycle schedule, both timelines and deliverables, and will result in updated A-123 publications approved by the government and published. Deliverable: Updated A-123 Publications (Air Force Policy Document (AFPD), Air Force Instruction (AFI), RMIC Playbook/Department of the Air Force Manual (DAFMAN))

2.1a.2. Annually, the contractor shall develop written recommendations based on their review of the guiding documentation for the RMIC program on how weaknesses and deficiencies are addressed at the governing bodies and how outputs will be integrated into the RMIC quarterly Statement of Assurance (SOA) submissions to include: the Executive Steering Committee (ESC)/Senior Assessment Team (SAT), Risk Management Council (RMC), Fraud Risk Oversight Council (FROC) and Senior Management Council (SMC). (The charters for these governance bodies can be found in the bidder’s library). These recommendations will be reviewed by the government for acceptance. Deliverable: Risk Profile, Operational Material Weakness template, and the GAO Fraud Risk Management Framework Assessment to complete the Quarterly SoA submission packages

2.1a.3. Annually, the contractor shall solicit inputs through the certification statement process from MAJCOM (major commands)/FLDCOM (field commands), 2 letter organizations, and select Direct Reporting Units (DRU) and Field Operating Agencies (FOA). The Certification Statements attest to Self-Testing, and Sustainment testing, provide information gained through the Manager’s Internal Control Toolset, Quality Assurance Reporting tool, Audits and Inspections. The contractor shall review the inputs from these statements to determine if any reported deficiencies are already being tracked because of an issued Notice of Finding and Recommendation (NFR), observation or if a Self-Identified Deficiency (SID) and associated Corrective Action Plan (CAP) need to be created. This bottom-up approach results in the SID reporting template. Deliverable: Certification Statement Call Letter, create SID if necessary

2.1a.4. Annually, the contractor shall develop training to provide across the Department of the Air Force (DAF). This training will be delivered to the government for review in September. Once approved the contractor will coordinate with MyLearning to post the training to the MyLearning site, making it available to new users and refresher training for system users. The current training and access instructions to the current training on MyLearning can be found in the bidder’s library, “FY25 RMIC Training Module 0_RMIC Overview_v3.pdf.” Training Module 0 is held live on TEAMs and is scheduled to accommodate users in different time zones. Training Module 0 is also recorded and posted for reference. The overview slides provide access instructions for the remaining training modules. Deliverable: Annual RMIC Training

2.1a.5. The contractor shall populate and analyze the Summary of Aggregated Deficiencies (SAD) template to determine if any combination of deficiencies collectively rises to a different level of deficiency or Weakness. This effort will result in the creation of the SAD Template. Deliverable: Summary of Aggregated Deficiencies (SAD) Template

2.1a.6. Annually the contractor shall develop a schedule for the full cycle of A-123, to include timelines and deliverables. The current project plan is located in the bidder’s library. The scheduling effort shall include the following task areas for each A-123 annual cycle and results in an executable Schedule and timeline to achieve reporting requirements and provide audit evidence for a clean audit. Deliverable: Schedule for the full A-123 Cycle

2.1a.6.1. The contractor shall conduct annual Scoping and planning activities that include a documented risk-based assessment of Business Process Cycles and Programs including materiality, status of remediation, consideration of the DAF’s system environment for financially significant systems, applications, spreadsheets, and applicable tools and any relevant subjective considerations. The listing of Tier 1 and 2 DAF systems can be found in the bidder’s library. The scoping activity results in a scoping document that identifies which assessable units are most material and available to test and identifies those that require further remediation. Deliverable: DAF General Fund Scoping Document

2.1a.6.2. Annually, the contractor shall perform documentation and testing to include updating Process Cycle Memorandums (PCMs), process walk throughs, performing Test of Design (TOD) Test of Operating Effectiveness (TOE), performing gap analysis, and conduct three continuous process improvement events to accurately document the process cycle, key controls and eliminate gaps using the AAP to guide priorities. Develop and/or update existing internal control documentation based on business process cycles to include narratives, flowcharts, risk and Control Evaluation Matrices (CEMs). Draft self-identified deficiencies (SIDs) resulting from testing failures, develop corrective action plans to remediate the deficiencies and update CAPs quarterly. All updates are recorded in the enterprise Governance Risk and Compliance (eGRC) system. This effort will result in the data to populate the quarterly SoA deliverables to satisfy the reporting requirements for OUSD(C). Deliverable: Updated Process Cycle Memorandum (PCM) Template, SoA reporting and CAP for A-123 deficiencies, Assessable Unit (AU) PCM Review comments, Updated Control Evaluation Matrix (CEM) Template, AU CEM Review comments, Updated Control Testing Workbook Template, Updated Walkthrough Template, Self-Identified Deficiency (SID) Template, Updated Entity Level Control (ELC) Testing Matrix, ELC Testing results report, ELC SIDs.

2.1a.6.3. Quarterly the contractor shall prepare the SoA deliverables and deliver them to the Office of the Undersecretary of Defense (Comptroller) (OUSD(C)) in the prescribed format and manner found in the Department of Defense Statement of Assurance Handbook. Deliverable: Quarterly Statement of Assurance Packages and the final signed memorandum from the SECAF.

2.1a.7. Service Provider work. The Contractor shall develop and maintain a framework for the management of DAF’s third-party risk as it impacts DAF FIAR business processes. Third parties are outside organizations that perform services on behalf of the DAF. For example, Defense Finance and Accounting Service (DFAS) manages military and civilian pay, contractor payments and accounting services for the DAF. This support shall include:

2.1a.7.1. The contractor shall maintain a Service Provider stakeholder point-of-contact list and update it as changes occur. The contractor shall submit the updated Service Provider Stakeholder Contact List to the government lead quarterly for review. This maintained stakeholder list ensures effective communication channels for third-party risk management activities, supporting clean audit opinion requirements by facilitating timely distribution of critical compliance documentation and assessments. Deliverables: Service Provider Stakeholder Contact List

2.1a.7.2. The contractor shall attend all bi-annual Service Provider Working Groups and distribute the working group invitations to all stakeholders prior to each meeting. The contractor shall upload the working group slides to the applicable SharePoint site within five business days of each working group meeting and shall review and understand slide content to support ongoing third-party risk management activities. This systematic participation and documentation process ensures consistent stakeholder engagement and knowledge management for third-party risk oversight, supporting clean audit opinion requirements by maintaining comprehensive records of service provider monitoring activities. Deliverable: Service Provider Working Group Slides

2.1a.7.3. The contractor shall collect System and Organization Control (SOC) 1 Reports and Bridge Letters from OUSD (C) and upload them to SharePoint in appropriate folders, marking CUI as necessary, within three business days of receipt. The contractor shall distribute SOC reports and Bridge Letters to stakeholders within five business days of receipt. The contractor shall maintain a SOC Reports and Bridge Letters Tracker of all reports expected to be received and update the government lead immediately when any reports or bridge letters are not received by expected deadlines. This systematic collection and distribution process ensures timely stakeholder access to critical third-party control documentation, supporting clean audit opinion requirements by enabling prompt review and reliance assessment of service provider controls. Deliverables: SOC Report and Bridge Letter Tracker

2.1a.7.4. The contractor shall maintain, update, and build the Service Provider Assessments during the first quarter and distribute to stakeholders for completion by the end of the first quarter. The contractor shall establish completion timelines during the build phase and distribute the Service Provider Assessment Timeline with each assessment. The contractor shall submit the finalized Service Provider Assessments and associated timelines to the government lead for approval before distribution. The contractor shall review assessment submissions for completion and accuracy and submit submission feedback comments to the government lead for approval. This systematic assessment process ensures comprehensive evaluation of third-party service providers, supporting clean audit opinion requirements by providing structured documentation of service provider control effectiveness and risk assessment. Deliverables: Service Provider Assessment Template, Service Provider Assessment Feedback, Service Provider Assessment Timeline

2.1a.7.5. Once internal control testing is complete, the contractor shall complete the SOC 1 Monitoring Reports incorporating the results of the Service Provider Assessments. These reports shall document the DAF’s ability to rely on SOC reports and the Service Provider Team's oversight of third-party risk assessment. The contractor shall complete the SOC 1 Monitoring Reports by the end of the fiscal year or within 45 days upon receipt of the final assessment results, whichever is earlier, and submit to the government lead for review and signature. This comprehensive monitoring and reporting process ensures documented evaluation of third-party control reliance, supporting clean audit opinion requirements by providing auditors with evidence of the USAF/USSF GF’s assessment of service provider control effectiveness. Deliverables: SOC Monitoring Reports

2.1a.7.6. The contractor shall continue to build out the Service Provider Assessment and Monitoring Reports functionality into eGRC and submit quarterly progress reports to the government lead documenting development milestones and timeline updates. The contractor shall work toward the goal of establishing eGRC as the central repository for all third-party risk assessments by the end of the contract period. This systematic integration enhances third-party risk management capabilities and data centralization, supporting clean audit opinion requirements by providing a comprehensive, auditable repository for all service provider risk assessment documentation. Deliverable: eGRC quarterly progress reports, Automated Service Provider deliverables (Development)

2.1a.7.7. The contractor shall complete the biannual OUSD(C) Complimentary User Entity Controls (CUEC) Summary Assessment Surveys by the deadline listed in the annual SoA Handbook and submit to the government lead for approval at least five business days prior to the OUSD(C) deadline. Once approved, the contractor shall submit the surveys according to the instructions provided by OUSD(C) and provide confirmation of submission to the government lead within one business day of submission. This timely completion and submission process ensures DAF compliance with OUSD(C) reporting requirements, supporting clean audit opinion requirements by demonstrating adherence to DoD-wide third-party risk assessment protocols. Deliverable: OUSD(C) CUEC Summary Assessment Surveys

2.1a.7.8. The contractor shall establish and maintain Audit Support Memorandums of Understanding (MOUs) through coordination with relevant stakeholders. The contractor shall review and update all 19 audit support MOUs based on individual MOU review requirements and ensure renewals are completed prior to expiration. The contractor shall coordinate MOUs with internal stakeholders and submit finalized MOUs to the government lead for GS-15 or SES signature. The contractor shall maintain the MOU Tracker documenting review dates, expiration dates, and actions completed, and submit tracker updates to the government lead monthly, or weekly if requested. This systematic MOU management maintains current audit support agreements with third-party service providers, supporting clean audit opinion requirements by providing documented frameworks for audit access and cooperation. Deliverables: 19 Audit Support MOUs (GFI), Audit Support MOU Tracker

2.1a.7.9. The contractor shall annually update the Service Provider Module training. The contractor shall develop the updated Service Provider Module training and deliver it to the government lead for review by September of each fiscal year. Once the government lead has approved the module updates, the contractor shall deliver the approved updates back to the government for completion of statement 2.1a.4. This collaborative training development process ensures DAF personnel maintain current knowledge of service provider risk management processes, supporting clean audit opinion requirements by enhancing staff competency in third-party risk assessment and monitoring procedures. Deliverable: Service Provider Module for RMIC Training

2.1a.7.10. The contractor shall maintain and annually update the Service Provider Monitoring Guide and submit it to the government lead for approval and signature by the end of August of each fiscal year. Once signed, the contractor shall store the Guide on SharePoint and distribute the updated Service Provider Monitoring Guide to stakeholders within five business days of signature. This comprehensive guidance document ensures consistent application of service provider monitoring procedures by DAF stakeholders, supporting clean audit opinion requirements by providing standardized processes for third-party risk assessment and oversight activities. Deliverable: Service Provider Monitoring Guide

2.1a.7.11. The contractor shall coordinate with the AU leads to review Process Cycle Memorandums (PCMs) for applicable third-party service providers, SOC reports and CUECs annually during the first quarter of each fiscal year. The contractor shall use this information to build out the annual Service Provider Assessments and provide input to support the PCM development activities outlined in statement 2.1a.6.2.a. This collaborative review process ensures Service Provider Assessments incorporate current control information and that third-party service provider risks are properly reflected in AU PCM documentation, supporting clean audit opinion requirements by maintaining assessments that reflect the most recent third-party control environments and risk profiles integrated into the overall internal control framework. Deliverable: PCMs discussed in Section 2.1a.6.2 and Service Provider Assessment in Section 2.1a.7.4

2.1a.7.12. The contractor shall coordinate the annual SOC 1 Feedback Data Call issued by OUSD(C) with internal USAF/USSF GF stakeholders and submit the template to the government lead for approval at least five business days prior to the OUSD(C) submission deadline. Once approved, the contractor shall submit the template to OUSD(C) according to the SoA Handbook deadline. The contractor shall distribute the final feedback from Service Providers to stakeholders within five business days of receipt from OUSD(C) and provide a distribution confirmation summary to the government lead. This coordination facilitates comprehensive input on SOC 1 reporting requirements and official communication between the USAF/USSF GF and third-party service providers, supporting clean audit opinion requirements. Deliverable: OUSD(C) SOC 1 Feedback Results

2.1a.7.13. The contractor shall coordinate with the FIAR IT Team annually during the first quarter to review and revise the FIAR IT System Listing. The contractor shall review third-party systems and DAF systems hosted by third-party service providers for accuracy and submit the revised FIAR IT System Listing to the FIAR IT government lead for approval by the end of the first quarter. Once approved, the contractor shall post the final FIAR IT System Listing on the FMFA Teams channel within five business days of approval. This systematic review maintains accurate documentation of third-party technology dependencies, supporting clean audit opinion requirements by providing auditors with current information on system hosting arrangements and third-party IT service provider relationships. Deliverable: FIAR IT System Listing

2.1a.7.14. Annually during the 2nd quarter, the contractor shall coordinate with third-party service providers to inquire about scope updates and remediation activities for prior year exceptions and request crosswalks of any Complementary Subservice Organization Controls (CSOCs) from subservice providers that produce SOC reports. The contractor shall consolidate all information into a Third-Party Service Provider Annual Update Summary and submit to the government lead for approval before distributing it to stakeholders by the end of the second quarter. This coordination provides stakeholders with current third-party risk information for accurate assessments, supporting clean audit opinion requirements. Deliverable: Third-Party Service Provider Annual Update Summary

2.1a.8. The contractor shall track and facilitate metrics reporting for monitoring and oversight; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures (SOP) for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task. All deliverables shall comply with Air Force Handbook (AFH) 33-337, Tongue and Quill, and are subject to government approval to ensure quality standards are met. Deliverables: Metrics, meeting agendas, briefing materials, and minutes, SOPs, training.

2.1b Task 1b: Risk Management and Internal Control (RMIC) and A-123 Programs

This task is applicable to AFMC (WCF) and DSCA.

(refer to PWS Appendix F: Assessable Unit Listing for task applicability to AFMC/FM (WCF), and DSCA).

The contractor shall sustain the current A-123 and RMIC programs by incorporating the control environment to manage risk and shall advance and achieve goals surrounding the financial statement audit as it evolves.

2.1b.1. The contractor shall implement and maintain compliance with:

· Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

· Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility Enterprise Risk Management and Internal Control (including Appendix A, Internal Controls Over Financial Reporting)

· OMB Bulletin No 15-02, Audit Requirements for Federal Financial Statements

· Federal Financial Management Improvement Act of 1996 (FFMIA)

· Government Accountability Office (GAO) Standards for Internal Control in the Federal Government (Green Book)

· Federal Generally Accepted Accounting Principles (GAAP) and Office of Management and Budget Circular A-136.

· DODI 5010.40 DoD Enterprise Risk Management and Risk Management and Internal Control Program

· Department of Defense Statement of Assurance Handbook

2.1b.2. Annually, the contractor shall develop a schedule for the full cycle of A-123, to include timelines and deliverables. The scheduling effort shall include the following task areas for each A-123 annual cycle and result in an executable Schedule and timeline to achieve reporting requirements and provide audit evidence for a clean audit.

Deliverable: Schedule for the full A-123 Cycle

2.1b.3.The contractor shall conduct annual scoping and planning activities that include a documented risk-based assessment of business areas including materiality, status of remediation, consideration of the DAF’s system environment for financially significant systems, applications, spreadsheets, and applicable tools and any relevant subjective considerations. The listing of Tier 1 and 2 DAF systems can be found in the Bidder’s Library. The scoping activity results in a scoping document that identifies which assessable units are most material and available to test and identifies those that require further remediation. Deliverable: DAF WCF Scoping Document, 2.1b.4 The contractor shall annually perform Test of Design (TOD) and Test of Operating Effectiveness (TOE), performing gap analysis, and conduct process improvement. Develop and/or update existing internal control documentation based on business process cycles to include Process Cycle Memorandum (PCM) narratives, flowcharts, and Control Evaluation Matrices (CEMs), or equivalent. Draft Self-Identified Deficiencies (SIDs) resulting from testing failures and monitor corrective action plans to address the deficiencies. Report testing results to AU process owners. Populate the Enterprise Governance Risk and Compliance (eGRC) system with deliverables. Deliverable: Process Cycle Memorandums (PCM), Control Evaluation Matrix (CEM), Control Testing Documentation, Self-Identified Deficiency Documentation, Test Result Briefing

2.1b.5 Service Provider work. The Contractor shall develop and maintain a framework for the management of DAF’s third-party risk as it impacts DAF FIAR business processes. Third parties are outside organizations that perform services on behalf of the DAF. For example, Defense Finance and Accounting Service (DFAS) manages accounting services for the DAF. This shall include:

2.1b.5.1 The contractor shall complete the Service Provider Assessment Workbook quarterly to evaluate the internal control environment of assigned third-party service providers according to the timeline established by SAF/FMFA. The contractor shall submit the completed workbook to the government lead for review and approval prior to the suspense date. This assessment ensures proper evaluation of reliance on external service providers, supporting clean audit opinion requirements by providing documented evidence of third-party control effectiveness. Deliverable: Service Provider Assessment Workbooks

2.1b.5.2 The contractor shall submit AFMC (DAF WCF) and DSCA responses for inclusion in the OUSD(C) CUEC Summary Assessment Survey by the deadline specified in the annual SoA Handbook. The contractor shall coordinate with AFMC and DSCA to collect their responses and submit the consolidated inputs to the government lead for approval at least five business days prior to the survey deadline. This coordination ensures comprehensive DAF representation in the CUEC Summary Assessment Survey, supporting clean audit opinion requirements by providing complete organizational input for DoD-wide third-party risk assessment protocols. Deliverable: CUEC Assessment Summary Survey

2.1b.5.3 Annually, the contractor shall monitor and review SOC-1 reports applicable to the WCF control environment. The review shall include analyzing control objectives, CUECs, and control exceptions, with the review demonstrated in the Service Provider Assessment. The contractor shall assess CUECs and compensating controls and collect and maintain supporting documentation according to WCF practices. The contractor shall use all findings to update the assessments, PCMs, and CEMs and submit the updated deliverables to the government lead according to established timelines. This thorough SOC-1 review ensures accurate assessment of third-party service provider controls within the WCF environment, supporting clean audit opinion requirements by providing comprehensive analysis that impacts financial reporting processes. Deliverable: Service Provider Assessment, PCMs, CEMs

2.1b.5.4 The contractor shall monitor remediation of deficiencies and gaps identified during review of third-party control environments and track progress on corrective actions through follow-up reviews and testing. This systematic monitoring ensures timely resolution of service provider control deficiencies, supporting clean audit opinion requirements by maintaining effective third-party controls that impact financial reporting processes. Deliverable: Correspondence with Service Provider on Corrective Action Plan

2.1b.5.5 The contractor shall contribute to the ongoing assessment of needs for Audit Support MOUs where WCF has reliance on others or where DAF serves as a service provider by providing WCF requirements during annual reviews and updates. The contractor shall submit WCF MOU draft updates and inputs to the government lead according to established timelines and track and maintain final signed MOUs. This contribution to MOU management ensures WCF requirements are properly represented in formal audit support agreements, supporting clean audit opinion requirements by ensuring third-party audit access and cooperation arrangements address WCF operational needs. Please see 2.1a.7.8.for more information. Deliverable: Audit Support MOUs

2.1b.6 The contractor shall track and facilitate metrics reporting for monitoring and oversight; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task. All deliverables shall comply with AFH 33-337, Tongue and Quill, and are subject to government approval to ensure quality standards are met. Deliverables: Metrics, meeting agendas, briefing materials, and minutes, SOPs, training

3.0 Task 2: Assessable Unit Control Environment and Accelerated Audit Plan (AAP)

This task is applicable to SAF/FM (USAF/USSF GF), AFMC (WCF), and DSCA.

The Contractor shall work with each Assessable Unit (AU) Lead to execute control activities, corrective actions and project /critical action plan/AAP activities for all assessable units defined in the AU listing (refer to PWS Appendix F: Assessable Unit Listing). The contractor shall perform all DAF owned control activities as defined within the AU Control Evaluation Matrix. The contractor shall monitor and assess changes to systems, processes, and files related to established controls and make updates to controls as necessary CAPs shall comply with internal and external policies (i.e., CAP development within 6 weeks of NFR issuance and entered into the ODCFO database).

3.1. The contractor shall develop CAPs for all NFRs within 6 weeks of NFR issuance using the CAP template and continuously look for ways to improve CAP/NFR processing to gain efficiencies. In developing the CAP, the contractor shall confirm with AFAA the root cause analysis correctly identifies the issue written by the Independent Public Accountant (IPA) (SAF/FM (USAF/USSF GF) only). Upon completion of all milestones within the CAP the Contractor shall prepare the CAP validation package and submit to AFAA and are submitted within 6 weeks of June 30 in the year remediation activity is completed. June 30th is the deadline for submission of final packages to the independent auditor. The contractor will continuously evaluate the effectiveness of CAPs to ensure they are sufficient to resolve the deficiencies. Deliverable: CAP Packages

3.2. Monitor & Report: The contractor shall report progress at regular intervals (occurs throughout all phases of the CAP process). This effort will result in the monthly updates to CAP reports that are generated from the ODCFO database and project /critical action plan/AAP activities for all assessable units defined in the AU listing. The contractor shall ensure all CAP milestones are current in the Office of the Deputy Chief Financial Officer (ODCFO) database/DoD NFR database (DSCA) and perform regular reconciliations between milestones in the critical actions/AAP, ODCFO database and NFR database (DSCA), coordinating with stakeholders to update. Deliverable: Update to ODCFO database

3.3. The contractor will maintain the Accelerated Audit Plan (AAP) to include executing control activities, corrective actions and project /critical action plan/AAP activities (PWS Appendix D) for all assessable units defined in the AU listing (PWS Appendix F). The AAP is the plan to organize, manage, and track progress on remediation activities for critical actions necessary to achieve an unmodified (clean) audit opinion. The contractor shall provide developers with the necessary changes to the SharePoint/Power BI environment and support users with questions regarding the use of the tools. Tools developed shall be non-proprietary and part of or able to be integrated to the existing government IT infrastructure at no additional cost. The contractor shall maintain/update the AAP, ensuring task owners are providing progress updates every two weeks. Deliverable: AAP updates in SharePoint

3.4. The contractor must produce monthly progress metrics/dashboards for the audit as directed by DAF Leadership. These metrics will include actual vs. planned progress/completion, and status of critical actions/AAP, and major objectives. These metrics must align with the audit goals outlined in Section 1.2 of the PWS. Deliverable: Metrics

3.5. (This task is applicable only to AFMC (WCF) and DSCA). The contractor shall track, monitor, and report on all notices of findings and recommendations (NFRs) received from the IPA, self-identified deficiencies, and financial management findings from the Government Accountability Office (GAO), Department of Defense Inspector General (DoDIG), and Air Force Audit Agency (AFAA). Deliverable: Metrics

3.6. The contractor shall track and facilitate metrics reporting; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps (i.e., accounting standards, current processes, etc.), and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions leveraging automation as much as possible during the day-to-day workings of activities associated with this task. All deliverables shall comply with AFH 33-337, Tongue and Quill, and are subject to government approval to ensure quality standards are met. Deliverables: Metrics, meeting agendas, briefing materials, and minutes, SOPs, training.

4.0 Task 3: Audit Liaison and Assessable Unit Support.

SAF/FM executes separate assessable unit support activities for USAF and USSF. In coordination with government personnel, provide audit liaison support for DAF’s financial statement audits, to include supporting other audits in which DAF is a service provider. This includes supporting walkthroughs, preparing and providing key-supporting documentation, crafting position papers or other memos for all DAF audits (i.e., GF, WCF, information technology, 8242 foreign military sales), as well as supporting other DAF associated audits (i.e., DSCA, DHA, SOCOM, TRANSCOM, AFAA, DODIG, GAO).

4.1. The contractor shall research and upload audit documents (PBCs and samples) to the Audit Response Tool (Sharepoint site). The contractor shall provide timely responses and refer to the government for final approval. Deliverables: Key Supporting documentation

4.2. The contractor shall document IPA meeting minutes, decision points, action items, and requests for documentation and submission to IPA. Deliverables: Meeting minutes

4.3. The contractor shall organize site visits and participate in site visits related to the audit and update the site visit tool in SharePoint. Deliverable: update Site Visit tool in SharePoint

4.4. The Contractor shall generate reports to assess the status of IPA requests for support documentation, follow up with applicable owner, and submit requests in the PBC or Sample tools on Sharepoint to ensure requests are delivered on time. Deliverable: report generation, update to PBC and Sample tools

4.5. The contractor shall maintain Standard Operating Procedures (SOPs) and update as necessary to remain in compliance with FIAR Guidance, OMB Circular A-123, and GAO Green Book. Deliverable: SOPs

4.6. (This task is applicable only to AFMC (WCF) and DSCA). Audit liaison support shall include maintenance and execution of audit infrastructure activities as required (Audit Response Tool (ART), NFR Tool, Site Visit (SV) Tool, Audit Acceleration Plan (AAP) Tool, DSCA Audit Response Center (ARC) Tool and NFR database). These tools are necessary to coordinate the IPA activities with the organizations responsible for the control activities being audited. The tools are also integral in supporting and reporting progress for achieving the accelerated audit goals as outlined in Section 1.2 of the PWS. Deliverable: Update to SharePoint Tools

4.7. The Contractor shall, maintain, manage, configure, update and use the centralized audit response tools/DSCA ARC Tool to retain audit documents to facilitate audit liaison activities for financial statement audits. These tools will facilitate the exchange of audit information, including auditor requests for information, samples, and supporting documentation, and financial manager submission of documents in response to auditor requests. Deliverable: Update to SharePoint Tools

4.8. (This task is applicable to AFMC (WCF) and DSCA only). The contractor shall manage the requests from the IPA, sending the request to the applicable organization for fulfillment, review responses, send responses to IPA and answer questions from IPA on requested items. The Contractor shall provide technical support for performing the bulk upload of IPA audit samples into the ART/DSCA ARC Tool and using the ART/DSCA ARC Tool to distribute samples to the appropriate POC for response. This liaison support will include facilitating walkthroughs of audit processes and operation/sustainment of Audit Response Tools/DSCA Audit Response Center facilitating the exchange of audit information, audit samples, and supporting documentation, in response to auditor requests. Deliverable: Update to Sharepoint tools

4.9. The contractor shall monitor audit status, IPA requests for supporting documentation and provide updated status to MAJCOMs/FLDCOMs, SAF/FMF leadership, OSD and Office of the Undersecretary of Defense (Comptroller)(OUSC(C)) or other Department of Defense (DOD) Executive leadership briefings as required. Deliverable: Briefings

4.10 The contractor shall provide training/educating for the IPA on audit processes and tools. Deliverable: Audit tool/process training

4.11. SAF/FM (USAF/USSF GF), AFMC (WCF) Contractor shall provide SharePoint developers that will make the necessary changes to the SharePoint as required and provide a helpdesk to answer questions from personnel regarding the use of the automated audit remediation tools. Deliverable: Help desk capability

4.12. The contractor shall track and facilitate metrics reporting; support the development of meeting agendas, briefing materials, and meeting minutes; and create desk procedures/standard operating procedures for continuity purposes. The contractor shall also work with personnel to identify knowledge gaps, and develop and provide training to personnel (i.e., government and other contractor personnel outside of this contract) when those individuals are assigned to work in tandem on areas related to this task (i.e., assessable unit leads, other contractors assigned as additional resources, etc.). In addition, the contractor shall provide innovative approaches and solutions during the day-to-day workings of activities associated with this task. All deliverables shall comply with AFH 33-337, Tongue and Quill, and are subject to government approval to ensure quality standards are met. Deliverables: Metrics, meeting agendas, briefing materials, and minutes, SOPs, training

5.0 Task 4: Financial Reporting and Analysis.

This task is applicable to SAF/FM (USAF/USSF GF) and AFMC (WCF) unless otherwise noted as an exception below.

The contractor shall perform beginning to end financial reporting and analysis tasks for all of DAF’s financial statements. Currently, there are two sets of financial statements and footnotes that comprise the Annual Agency Financial Report (AFR). USAF and USSF are combined under one set of DAF GF statements and footnotes. The second set of statements and footnotes are reported as DAF WCF. The DAF AFR is one document that reports both DAF GF and DAF WCF financial information.

5.1. Annual Agency Financial Report. The contractor shall compile the DAF AFR in compliance with DoD guidance and OMB Circular A-136. For this task, the contractor shall develop one product that includes: Management’s Discussion and Analysis, Financial Section (inclusive of two separate set of financial statements and footnotes for SAF/FM (DAF GF (USAF/USSF)) and AFMC (DAF WCF)), and Other Information Section. Copies of prior year AFRs can be found in the bidder’s library. As of Fiscal Year End (FYE) 2025, the USSF GF is reported under the DAF GF for financial statement purposes with plans to carve out USSF beginning in FY26. Deliverable: OMB A-136 compliance review

As part of the AFR compilation, the contractor shall:

5.1.1. Review the DoD financial reporting schedule published by OUSD(C) and develop a plan by March 30th of each year to help ensure that the Government stays on track with publishing the DAF AFR by 15 November. Deliverable: Agency Financial Report schedule

5.1.2. Update the AFR schedule as items are completed; and provide bi-weekly updates to the Government from 15 February to 15 July; provide weekly updates to the Government from 15 July to 15 November. Deliverables: AFR status updates

5.1.3. Develop the overall AFR theme and outline for the fiscal year to include at least three options for the Government to choose from by 31 May. This will include recommend graphics (logos, photos, illustrations, maps, etc.) for inclusion in the AFR to improve the presentation of information. The graphics must be obtained from the DOD/DAF website of graphics that have been approved for public release and source references must be available upon request. The contractor shall complete an OMB A-136 compliance review within two weeks of the annual publication of OMB A-136. Deliverables: AFR theme options and outline

5.1.4. Compile draft Management’s Discussion and Analysis (MD&A) ensuring compliance with OMB A-136 and SFFAS 64. Content is written in plain English/understandable to the general public; content is factual and supported; facts and figures reconcile with the actual financial statements (FSs), footnotes and or budget data; contents and graphics are consistent with the AFR theme; only approved graphics and photos from the DOD/DAF website are included; and detect all grammatical and mechanical errors. Reviews and approval are to be completed by the Contractor’s senior leadership prior to the submission to the Government. Deliverable: Draft MD&A

5.1.5. As required in the Annual Financial Report, the contractor shall draft the Agency Head Message, the CFO message, and the Management Response Letters, coordinating with all stakeholders to review. Reviews and approval are to be completed by the Contractor’s senior leadership prior to the submission to the Government. Deliverables: Draft Agency Head Letter, Draft CFO Message, and Draft Management Response Letters

5.1.6. Annually, update the interim and final management representation letters (MRLs) for the General Fund and Working Capital Fund, coordinating with all stakeholders to review. These letters are written representations, required by the Government Accountability Office (GAO) Financial Audit Manual (FAM), for the IPA to obtain as part of their audit procedures. The specific representations requested by the IPA are dependent on the circumstances of the current year audit and will vary year over year. Copies of previous year’s MRLs can be found in the bidder’s library. Deliverables: GF and WCF MRLs.

5.1.7. Review the interim and final Legal Counsel Response Letters (LCRs) and prepare the Management Schedule of Information (MSI) as well as the Contingent Legal Liability Report (CLLR). The LCRs are a listing of all outstanding cases against the DAF that could result in a payout to the claimant. The MSI includes additional details on the cases and must reconcile to the LCRs. The contractor shall also perform the following in support of the LCRs/MSI: review the Unit Report of Contingent Liability Reports (URCLs) from SAF/GCA and compile the CLLR, preparation of the Administrative Claim Payout Analysis; preparation of Roll forward analyses for all reporting offices, the Retrospective Analysis, and Judgement Fund Analysis workbooks. Deliverables: Management Schedule of Information (MSI), Contingent Legal Liability Report (CLLR), Administrative Claim Payout Analysis, Roll forward contingent legal liability analysis, Retrospective Analysis, and Judgement Fund Analysis.

5.1.8. Compile the draft financial statement footnotes and narratives that are in compliance with OMB A-136 and deliver to the government by the 17th business day. Deliverables: Draft Financial Statement footnotes and respective templates.

5.1.9. Compile the draft AFR to ensure information is clear and consistent. Reviews and approval are to be completed by the Contractor’s senior leadership prior to the submission to the government.