AOS Call for Solutions_AUP_Q and As.pdf

Question No. Question Topic Question Draft Gov't Answer

1 General/Other Subcontractor eligibility. May a NAICS 541512 / 541519 information-technology firm participate as a subcontractor on a CPA-prime's Solution Brief, where the technology firm provides audit-permanence infrastructure (anchoring of test-evidence hashes) and the prime performs the AUP / GAGAS testing?

NAICS code 541211 applies to the prime contractor. Subcontractors are not required to meet the prime's NAICS. The prime is responsible for assigning the subcontractor a NAICS code that best describes the specific work the subcontractor will perform, provided the Prime remains the lead entity for the AUP/GAGAS testing and overall project management. The call for solutions has been updated for clarity.

2 Security

CMMC 2.0 Level 2 scope. Section 6.1.1.e requires CMMC 2.0 Level 2 certification of the offeror. Does this requirement extend to all subcontractors handling Government data, or is it satisfied when held by the prime offeror only? Are there allowances for subcontractors whose role is limited to one-way anchoring of government-furnished evidence hashes (i.e.,subcontractor never receives plaintext Government data)?

CMMC certification requirements flow down to subcontractors based on the type of information they process, store, or transmit; the requirement is not satisfied by the Prime Contractor alone if the subcontractor's environment handles Controlled Unclassified Information (CUI).

3 Technical

Audit-permanence and the AUP/GAGAS framework. Section 3 states that "the associated control environment will not be tested." Is independent audit-permanence — third-party, public-blockchain anchoring of test-evidence hashes so future auditors can verify the evidence has not been altered post-test — considered (a) a permitted enhancement within the AUP/GAGAS framework, (b) out-of-scope under the control-environment boundary, or (c) something the Government would prefer not be included in the Phase 1 Solution Brief?

The Government considers this a permitted enhancement to the Offeror's audit methodology and it should be included in the Solution Brief if the Offeror believes it provides value.

The limitation in Section 3 regarding the 'control environment' refers to the scope of the audit procedures to be performed on Army systems and processes; it does not preclude the Offeror from employing its own advanced techniques to ensure the integrity of the evidence gathered.

Such a feature is not considered out-of-scope. The Government is seeking innovative technical approaches that directly support the goal of increasing confidence/reliance on audit evidence as stated in the Problem Statement and Required Attributes.Offerors are encouraged to propose innovative solutions that enhance the quality, integrity, and efficiency of the AUP/GAGAS engagement.

4 Format/Submission Requirements

Phase 2 bypass and Phase 1 demonstrations. Section 6 reserves the right to bypass Phase 2 — Pitch Session. May a Phase 1 Solution Brief include embedded static graphics that reference live verification URLs (for evaluator self-service confirmation outside the brief, not as inserted text-box content), or should all demonstration material be reserved for Phase 2 if invited?

As stated in section 6.1.1 of the Call for Solutions, 'The Government will not consider... internet links to additional information as part of the Solution Brief.' Offerors may use static graphics to illustrate their process or technical architecture in Phase 1.

Evaluators will not navigate to external URLs for 'self-service confirmation' or any other purpose. Offerors should fully describe their verification capabilities within the text and static imagery of the Phase 1 Solution Brief. All demonstration material must be reserved for Phase 2, if invited.

5 Format/Submission Requirements

The Solution Briefs are currently due on 05 May 2026 at 1600 EDT. Given that questions are due on 28 April 2026, would the Government consider extending the Solution Brief due date to 08 May 2026 to allow sufficient time for responses to questions and for offerors to adjust their submissions accordingly?

The Government has extended the due date to 8 May 2026 at 1600 EDT. The Call for Solutions has been updated to reflect this change.

6 Technical The Call emphasizes targeted, materiality-focused testing. Will the Government provide materiality thresholds and sampling expectations for each process area, or should offerors propose a methodology for determining sample sizes and selection criteria?

The Department of War, Office of the Under Secretary of War (Comptroller) (OUSW-C), has set capitalization thresholds for the agency-wide statements and the consolidated audit at $15 million for GPP&E. The new consolidated audit will be fully substantive, with minimal, if any, reliance on internal controls. The Army has prioritized its list in the Call for Solutions based on materiality to the agency-wide consolidated statements. Sampling expectations from a possible vendor will be whatever is necessary to substantively test the balance and confirm its auditable and capable of passing the financial statement assertions. Offerors should propose a methodology for determining samples sizes and selection criteria, clearly annotating all assumptions made to develop the technical solution.

7 Technical

The Call indicates that the Government will provide populations for testing. Can the Government clarify whether these populations will be pre-validated for completeness and reconciled to the general ledger and applicable financial statement line items, or whether the contractor’s procedures should include validation of population completeness and traceability?

The contractor’s procedures should include validating population completeness and traceability.

8 Technical Can the Government clarify expectations for “confirming balances” under the procedures (e.g., transaction-level vouching, recalculation, independent recomputation, or other substantive techniques), and the level of rigor expected to support reliance on the results?

The vendor should be prepared to substantively test all balances in accordance with GAGAS guidelines and confirm to the Army that these balances will meet all financial statement assertions. The offeror should provide in their technical solution the best approach to meet that objective.

9 Technical The Call requires documentation of procedures performed, evidence reviewed, and factual findings with root cause. Can the Government clarify whether the scope includes only identification of exceptions and root causes, or also evaluation of whether existing corrective actions are sufficient to address identified issues?

The vendor should focus solely on identifying exceptions and the associated root causes. Since corrective actions are already underway, any exceptions found by the vendor performing the AUP will be incorporated into the ongoing remediation efforts.

10 Technical For Military Payroll, can the Government clarify the expected scope of systems and data sources to be used in testing, and whether procedures should include reconciliation across multiple systems or focus on a single authoritative source for Military Payroll?

Expected Scope of Systems: IPPS-A and DJMS

The vendor will be expected to take the Army's reconciled data set and test LES's and personnel actions.

The Call for Solutions, section 6.1.1 c., has been updated with this information for clarity/context.

11 ROM/Pricing In that Agreed-Upon Procedures must be mutually agreed upon prior to execution, will the offeror’s ROM be permitted to undergo revision once final procedures, scope refinements, and acceptance criteria have been established?

The Rough Order of Magnitude (ROM) provided in the initial Solution Brief is to be a high-level estimate based on the initial understanding of the requirements and the assumptions outlined. As noted in the 'Call for Solutions,' the government will evaluate the ROM for compliance with the call's instructions during Phase 1, but a formal price evaluation is not performed at this stage.

Given that the nature of Agreed-Upon Procedures (AUP) requires mutual agreement on the final procedures and scope, we anticipate the ROM will be refined. The multi-phased approach allows for this refinement. A more detailed/definite price proposal is requested in Phase 3, if invited. The ROM is not considered a final, binding price.

12 Security Is the government requesting CMMC level 2 self-certification or CMMC level 2 C3PAO certification? Will the government accept solution briefs in advance of one or both types of level 2 certification (i.e. on the assumption that certification is a condition of award eligibility, not solicitation eligibility)?

The government is requesting CMMC level 2 self-certification and will accept solution briefs in advance of certification;

however, achievement of the certification is a condition of award eligibility. The Call for Solutions, section 6.1.1 e., has been updated for clarity.

13 General/Other How should offerors with existing business relationships with the named NGA contractor (Guidehouse) mark submissions in order to avoid potential OCI?

Per Section 8, 'Organizational Conflict of Interest (OCI),' of the Call for Solutions, all offerors are required to perform and submit a formal OCI analysis as part of their Solution Brief. This requirement applies to any relationships with the named non-government advisor, Guidehouse, as detailed in Section 7. Offeros are required to conduct an OCI Analysis and submit the required documentation:

If an OCI is identified: provide a formal OCI mitigation plan as part of your submission.

If no OCI is identified: submit a description of your analysis methodology.

Offerors should not simply 'mark' their submissions. They must provide the complete OCI analysis, and if applicable, the OCI mitigation plan as required by Section 8 of the Call for Solutions.

14 Format/Submission Requirements

Note 2 states: “Please advise the Contracting Office as soon as possible via the Microsoft Forms link if your organization intends to submit a Solution Brief in response to this Call for Solution. The Forms link can be found in the “Links” section of the SAM.gov posting.”

A Microsoft (MS) Forms link is not available on the SAM.gov posting. Would the Government update the SAM.gov posting to include this link or remove this note from the Call for Solutions?

The SAM.gov posting has been updated to remove this note.

15 Format/Submission Requirements

Would the Government allow Offerors to include a Table of Contents and List of Exhibits (i.e., tables and graphics) to aid the Government in navigating the Offeror’s response? If so, then would the Government confirm these sections will be excluded from the page count?

No, the Government does not require and will not accept a Table of Contents or a List of Exhibits. Offerors must adhere to the specific section structure, formatting instructions, and exact page limits as detailed in Section 6.1.1 of the Call for Solutions. Any pages submitted that are not explicitly requested or that exceed the maximum allowed limits will be removed and will not be evaluated.

16 Format/Submission Requirements

Would the Government confirm the requested “industry feedback on the most effective pricing structure” is excluded from any page limitations? If not, we request an additional page be added to the page count to accommodate this response.

The Government has added an additional page to the page count in section 6.1.1 d of the Call for Solutions. Limit of one page for ROM, one page for schedule, and one page for industry feedback on pricing structure (total of 3 pages). See revisions to the Call for Solutions.

17 Format/Submission Requirements

Would the Government consider increasing the page limits for the Rough Order of Magnitude (ROM)/Schedule such that Offerors may fully address the requirements?

See answer to question 16. The Government has increased the page limit for the ROM/schedule. The Call for Solutions has been updated to reflect this change.

18 ROM/Pricing Would the Government confirm that travel costs will be determined upon award, and therefore, offerors should not include travel costs in their ROM?

The Rough Order of Magnitude (ROM) submitted in Phase 1 is to be a high-level, preliminary estimate based on your initial proposed solution. Offerors may choose to exclude specific travel costs from their initial ROM if they believe those requirements cannot yet be defined; however, offerors must clearly annotate all pricing and execution assumptions within their Solution Brief.

If your ROM assumes that travel costs will be determined at or after award, this must be explicitly stated as an assumption in your submission.

19 General/Other

The requirement for another contractor to review the firm’s work or proposal on this engagement is unusual and introduces potential Organizational Conflicts of Interest (OCI) and independence concerns that may affect both the integrity and the perceived objectivity of the effort and evaluation process. Allowing a third party reviewer access to proprietary information, methodologies, and deliverables presents risks related to competitive positioning and the protection of sensitive intellectual property. This structure may also create inefficiencies due to additional coordination and review cycles, which could affect the quality of the overall execution. Additionally, allowing a direct competitor of the submitting contractor is inherently a conflict.

In this situation, the contractor involved in the evaluation process—Guidehouse—is also subject to the Agreed Upon Procedures (AUP) and performance audits that may occur. This presents an inherent Conflict of Interest (COI). Accordingly, Guidehouse should not participate in the process beyond providing documentation and assistance during the audit execution.

If the third-party evaluator remains in place, then we recommend establishing appropriate safeguards to mitigate associated risks. Specifically:

sharing, and

• Individuals involved in the review should be appropriately firewalled to protect independence and prevent COIs.

Given these considerations, we respectfully request the Government reconsider the use of Guidehouse as the third-party evaluator. However, if Guidehouse remains in that role, we request the Government provide Guidehouse’s OCI mitigation plan and guidance on how to execute an NDA between Guidehouse and the submitting vendor.

Guidehouse is not a third-party evaluator, will not review proposals, and will not be granted access to offerors' proprietary information or methodologies via the solicitation process. However, as the Army's audit remdiation consultant, Guidehouse, along with government personnel, will be exposed to the testing procedures/methodologies performed, results, and recommendations provided by the vendor during contract performance as this information will directly impact ongoing remediation efforts being executed by Army and Guidehouse.

Guidehouse’s role is strictly limited to providing consultative support to the Government evaluation team. They may be consulted solely to ensure that the Agreed-Upon Procedures (AUP) align with current operational timelines and ongoing audit remediation activities. The Government retains sole responsibility for evaluating all submissions.

The Government actively manages support contractor OCIs internally in accordance with FAR Subpart 9.5. The Government does not release a support contractor's internal OCI mitigation plans to industry.

20 Format/Submission Requirements

Would the Government please confirm this is not expected to be included within the High-Level Solution/Concept (eight-page limit) section and does not have a page limitation? If not, we request an additional page be added to the page count to accommodate this response.

As detailed in Section 6.1.1 of the 'Call for Solutions,' the 'Organizational Conflict of Interest (OCI) Analysis and Mitigation Plan' is a separate submission requirement (Section 6.1.1.h).

It is not part of the High-Level Solution/Concept section and its eight-page limit. The OCI analysis section is explicitly noted as having 'no page limit.' Therefore, no additional page is needed for the High-Level Solution/Concept section.

21 General/Other

After reviewing the Call for Solutions, we believe the experience requirements in Section 3 may be too narrow and could unnecessarily limit competition. As written, the requirements favor a small group of firms with direct Independent Public Accountant (IPA) experience in DoW component financial statement audits.

That pool of firms is limited, and some may already hold IPA or audit support roles that could create potential OCI concerns under Section 8, particularly because the requested work closely resembles financial statement audit testing.

To broaden competition while still allowing the Government to manage OCI risk, we recommend revising the experience requirement so it can be met through demonstrated DoW experience in any of the following areas:

Material Weaknesses demonstrates a vendor understands IPA-equivalent procedures under AICPA or GAGAS standards.(NFRs) or downgrading material weaknesses.

This approach would allow firms with strong, relevant DoW audit expertise to compete, while preserving the Government’s ability to evaluate OCI considerations on a case-by-case basis under Section 8.

The experience requirements outlined in Section 3 will remain unchanged. The Government specifically requires the direct Independent Public Accountant (IPA) experience as written to ensure the selected vendor possesses the precise level of specialized expertise, independence, and familiarity with DoW component financial statement audits necessary to successfully execute these Agreed-Upon Procedures. While the Government values audit readiness and remediation capabilities, it does not meet the specific threshold of IPA experience required for this particular engagement. Regarding Organizational Conflicts of Interest (OCI), all offerors will still be evaluated in accordance with Section 8.

22 General/Other

Pursuant to Section 7 regarding Non-Government Advisors, would the Government please identify the appropriate Point of Contact at Guidehouse for offerors that wish to coordinate a direct NDA prior to submitting a Solution Brief? Providing this contact information would help offerors comply with the NDA process described in the Call for Solutions and ensure the required documentation is submitted with their proposal.

The Government clarifies that the 'Call for Solutions' does not require an executed Non-Disclosure Agreement (NDA) between offerors and the Non-Government Advisor (Guidehouse) for the submission of a Solution Brief. Guidehouse will not be granted access to offerors' proposals, proprietary information, or intellectual property during the evaluation process. The Call for Solutions has been updated to reflect this change. See also answer to question #19. If an offeror's internal corporate policies mandate an NDA, the offeror is solely responsible for identifying an appropriate contact at Guidehouse and coordinating that agreement independently.

AOS Q&As