FY23 PREA Contract-RFI - Final.pdf

U.S. DEPARTMENT OF JUSTICE

OFFICE OF JUSTICE PROGRAMS

BUREAU OF JUSTICE ASSISTANCE

OPERATION AND MANAGEMENT OF THE PRISON RAPE ELIMINATION ACT AUDIT

FUNCTION

REQUEST FOR INFORMATION

05/01/2023

The future contract will support the continued operation and management of the Bureau of Justice Assistance’s (BJA’s) Prison Rape Elimination Act (PREA) Audit Function that is directed by the Bureau of Justice Assistance’s (BJA) PREA Management Office (PMO), within the Office of Justice Programs (OJP), U.S. Department of Justice (DOJ). In 2013, DOJ’s PREA Implementation Plan created the PMO, which was assigned to BJA by OJP’s Assistant Attorney General. The PMO carries out DOJ’s PREA implementation responsibilities that are defined in the PREA statute and the PREA standards, including directing and expanding the PREA Audit Function. This Request for Information (RFI) provides an overview of the tasks and expertise that are required to support the PMO’s ongoing efforts to operate and manage the PREA Audit Function.

BACKGROUND

The PREA statute was passed unanimously by both houses of Congress and signed into law in 2003.1 The statute includes numerous mandates to be carried out by DOJ, including creating and implementing national standards to prevent, detect, and respond to sexual abuse in confinement facilities. In 2012, DOJ released these PREA standards, which apply to approximately 13,000 confinement facilities across the country, including: prisons and jails, juvenile confinement facilities, police lockups, and community confinement facilities.2 There are four sets of standards that correspond to these four facility types; each set includes more than 300 specific provisions that facilities and the agencies that oversee them must follow to be in full compliance with the standards.

The topics covered by the PREA standards include prevention planning, responsive planning, training and education, screening for risk of sexual victimization and abusiveness, reporting, official response following an inmate report, investigations, discipline, medical and mental care, data collection and review, and audits and corrective action.

As required by PREA standards, the PREA Audit Function was created and implemented by the PMO in 2013. Since August 2013, DOJ-certified PREA auditors have reported completing more than 8,000 PREA audits in all 50 states, the District of Columbia, Puerto Rico, and Guam.

Following the passage of the PREA statute and promulgation of the PREA standards by DOJ, two amendments to the statute were passed by Congress and signed into law. Both amendments increase the responsibilities and legal authority of the PMO related to the PREA Audit Function. The 2016 PREA Amendment, under the Justice for All Reauthorization Act,3 requires the PMO to request and make publicly available on a website all audit reports for facilities under the operational control of

1 34 U.S.C. § 30301 et seq.

2 28 C.F.R. Part 115.

3 Pub. L. No. 114-324.

states’ and territories’ executive branch of government,4 and authorizes the PMO to request fingerprint-based background checks for PREA auditor candidates and certified auditors seeking recertification.

The 2018 PREA Amendment, under the U.S. Parole Commission Extension Act of 2018,5 names the PMO specifically and requires it to:

• Evaluate DOJ-certified PREA auditors’ performance and conduct, and to take remedial or disciplinary action (including suspension and decertification) when auditors fail to meet the requirements of their DOJ-issued certification.

• Publish the names of auditors who have been decertified, and the reason for decertification.

• Notify impacted agencies and facilities when an auditor is decertified and recommend that the agency repeat any affected audits, if appropriate.

• Establish a system for assigning DOJ-certified auditors to federal, state, and local confinement facilities.

This RFI summarizes the scope of work, tasks, and expertise required to support the PMO’s ongoing efforts to carry out its requirements related to operating and managing the PREA Audit Function, as defined in the PREA statute, the two amendments to this statute, and PREA standards. The primary purpose of this contract is to enhance the quality, objectivity, comprehensiveness, and reliability of PREA audits across the country.

SCOPE

This contract will include an array of mission-critical tasks that were previously funded by BJA via the competitively awarded cooperative agreement called, the National PREA Resource Center.6 This cooperative agreement was awarded in 2019. A majority of the tasks defined herein were required under this cooperative agreement. An overview of these tasks is provided in this section. The Statement of Work will include additional details related to the required tasks to be carried out by the selected contractor, with ongoing oversight and direction from the PMO.

Task 1: Training, certifying, and recertifying PREA auditors

PREA standard 115.402(b) mandates that DOJ must develop a process to train and certify PREA auditors. To date, the PMO has directed the training and certification process for more than 1,000 auditors. There are currently 267 DOJ-certified PREA auditors, and approximately 75 auditor candidates are currently pursuing certification. A DOJ-issued PREA auditor certification lasts for three years. The selected contractor will work with oversight and direction of the PMO to:

• Manage the auditor candidate application process beginning with a new cohort of 50 auditor candidates;

• Track the certification status of every PREA auditor;

• Conduct auditor candidate trainings and administer related exams;

• Manage probationary certification for newly-certified auditors;

4 See https://data.ojp.usdoj.gov/stories/s/PREA-Dashboard/e58i-aehm/.

5 Pub. L. No. 115-274.

6 See https://www.prearesourcecenter.org/audit/overview.

https://data.ojp.usdoj.gov/stories/s/PREA-Dashboard/e58i-aehm/ https://www.prearesourcecenter.org/audit/overview

• Offer mandatory continuing education opportunities to auditors. LearnUpon is the learning management system (LMS) that supports the administration, automation, and delivery of courses, training, or learning programs for PREA auditors;

• Administer the recertification process for every auditor every three years;

• Manage the process that allows auditors to go on “inactive” status, or to voluntarily relinquish their DOJ-issued certification on their recertification date;

• Coordinate the PMO’s communications with auditors who are not recertified, because they do not pass the required recertification exam, or they do not carry out other recertification requirements imposed by the PMO; and

• Administer the process that allows auditors who are not recertified by the PMO to appeal this decision.

For more information about training, certifying, and recertifying PREA auditors, see the PREA Auditor Handbook.7

Task 2: Supporting the PREA Audit Oversight Program to Enhance the Quality and Integrity of Audits

As described above, the 2018 PREA Amendment explicitly requires the PMO to evaluate the work of all DOJ-certified PREA auditors to determine if they are carrying out their auditing responsibilities, as defined in the PREA Auditor Certification Agreement in the PREA Auditor Handbook. To fulfill this legal obligation, the PMO has created and implemented a comprehensive, data-driven process to evaluate the work of all DOJ-certified auditors and has established several interventions to use when auditors’ work is not consistent with their responsibilities. These interventions include peer review, disciplinary review, suspension of a DOJ-issued certification, remediation, and decertification. The selected contractor will be responsible for supporting the PMO in carrying out these interventions.

For more information about these interventions, please see the PREA Auditor Handbook.

The contractor will work with oversight and direction from the PMO to:

• Analyze the extent to which auditors’ work reflects the audit methodology defined in the PREA

Auditor Handbook;

• Collect and manage information collected via the “Auditor Feedback Form,”8 a formal method the PMO uses to gather information about the work and conduct of auditors;

• Carry out detailed reviews of the audit documentation submitted to DOJ by PREA auditors9 to identify instances in which auditors misapplied the PREA Standards (i.e., made compliance determinations that are inconsistent with the audit documentation they collected and provided to DOJ) or failed to follow the audit methodology;

• Manage the peer review process, including overseeing a robust peer mentoring program;

• Support the remediation program, including the provision of targeted support and assistance to

PREA auditors; and

• Draft needed correspondence to PREA auditors whose work is evaluated by the PMO.

7 See https://www.prearesourcecenter.org/resource/prea-auditor-handbook.

8 See https://www.prearesourcecenter.org/audit/auditor-feedback-form.

9 PREA Standard 115.401(j) states: “The auditor shall retain and preserve all documentation (including, e.g., video tapes and interview notes) relied upon in making audit determinations. Such documentation shall be provided to the Department of Justice upon request.”

https://www.prearesourcecenter.org/resource/prea-auditor-handbook https://www.prearesourcecenter.org/audit/auditor-feedback-form

Task 3: Administering the PREA Online Audit System

The PREA Online Audit System10 is designed to help DOJ-certified PREA auditors, and facilities and agencies receiving PREA audits, to streamline, organize, and automate much of the PREA audit process in a secure, user-friendly environment. The use of the PREA Online Audit System became mandatory for all DOJ-certified PREA auditors, and all facilities/agencies receiving PREA audits on June 30, 2022. The use of the PREA Online Audit System will remain mandatory, and the selected contractor will work under the direction of the PMO to:

• Ensure that the Online Audit System continues to reside in a highly secure environment by maintaining its Authority to Operate (ATO). The Online Audit System shall continue to meet the federal “moderate” security requirements mandated by the Federal Information Security Management Act (FISMA);

• Provide a safe and secure electronic platform for facilities/agencies and DOJ-certified auditors to communicate about, share, review, and store sensitive audit documentation, such as personally identifying information (PII) and personally identifying health information (PHI);

• Deliver robust, comprehensive technical support to facilities/agencies and auditors who are using the Online Audit System; and

• Maintain and renew, as required by the Office of Justice Programs’ Office of the Chief Information Office, a formal Authorization to Operate, which confirms ongoing compliance with

FISMA.

The Online Audit System is a web-based system which utilizes Drupal and the Zend Framework.

Drupal is an open-source content management software written in PHP. Salesforce is the primary database for many forms of communication regarding the Online Audit System. The Online Audit System helpline, which includes the email address and voicemail box for the Online Audit System Tech Support team, feeds directly into Salesforce. These communications appear in Salesforce as “cases” that are responded to by the Online Audit System Team within one business day. Case layout pages include details such as the requestor, the date it was submitted, the date the request was responded to, and the request itself. These requests range from login issues, audit updates, Online Audit System content/functionality issues, and general questions. Any additional communications that occur outside of Salesforce are manually recorded by the Online Audit System Team in Salesforce’s chatter feature. In addition, many form submissions are submitted straight into Salesforce. These include the Audit Initiation Forms, Supervisor Confirmation Forms, Online Audit System Feedback Forms, and Audit Information Change Forms.

Every audit that is created in the Online Audit System has an identical audit record that matches in Salesforce, and is linked via a unique Audit ID. The pertinent audit information from Salesforce is replicated into the PREA Online Audit System manually by the Online Audit System Tech Support Team. The Salesforce audit record houses additional details surrounding the validation of the audit and the audit contract review. From a security standpoint, Salesforce is crucial because it is where information about all users who receive access to the Online Audit System is vetted, documented, and managed. For agency/facility users, Salesforce houses their completed Supervisor Confirmation Forms that explicitly grant facility/agency personnel access to their corresponding accounts. For

10 See https://www.preaaudit.org/.

https://www.preaaudit.org/ auditors, Salesforce houses up-to-date certification statuses and Information Security Awareness courses.

LearnUpon is where auditors and administrators complete their Information Security Awareness courses which are required annually to access the Online Audit System. LearnUpon is integrated with Salesforce to track course completions to trigger automations as appropriate. If the course has expired and a new one is not yet completed, the user will automatically change to a “suspended” status in Salesforce which, as a result, prompts the manual suspension of their Online Audit System account.

Task 4: Administering the PREA Audit Assignment System

As explained above, the 2018 PREA amendment requires the PMO to establish and administer a system for assigning certified auditors to federal, state, and local facilities. The PREA Audit Assignment System was implemented by the PMO on June 30, 2022, in collaboration with the National PREA Resource Center,11 to uphold this statutory requirement. In order to receive approval from the PMO to proceed with an audit, an auditor must submit a copy of the audit contract with the audited facility/agency, and confirm they are a party to the contract or other agreement with the audited agency. This system, which is a part of the PRC website, is enhancing transparency related to PREA audits by allowing the PMO to make information about audits publicly available online that may be of interest to corrections practitioners, advocates, families of incarcerated individuals, and other members of the public. The information that is collected in the system is also enabling the PMO to identify PREA auditing trends that can inform its ongoing work to enhance the quality and integrity of the PREA Audit Function. With oversight and direction from the PMO, the contractor will:

• Manage and administer the PREA Audit Assignment System;

• Use the system to make information about upcoming PREA audits publicly available; and

• Collect and analyze data from the system to enhance the PMO’s understanding of auditing practices and trends, and position the PMO to take steps to enhance the quality, objectivity, comprehensiveness, and reliability of PREA audits across the country

The Audit Assignment System is built in Salesforce and is the Online Audit System’s (see Task 3) single case management system. It is where all facility/agency accounts, active user information, and facility/agency audits are stored and managed. Salesforce has been thoroughly customized to meet the needs of the PREA Audit Function. Salesforce is used by the Online Audit System Team, and it enables DOJ-certified auditors and audited confinement facilities/agencies to carry out their PREA auditing responsibilities, as defined in the PREA standards and the PREA statute.

Drupal syncs the Online Audit System with the Audit Assignment System to pull PREA audit information from Salesforce audit records, including the audited confinement facility/agency, the lead PREA auditor, the dates of the onsite portion of the audit, and completion status. Drupal then displays the information on the Public Audit Directory12 as filterable and interactive tiles. Drupal also syncs the Final PREA Audit Report as a downloadable PDF for any audits where the report has been synced to Salesforce.

Task 5: Managing the Use of and Enhancing the PREA Audit Instrument

11 See https://www.prearesourcecenter.org/audit/prea-audit-assignment-system.

12 See https://www.prearesourcecenter.org/audit/directory.

https://www.prearesourcecenter.org/audit/prea-audit-assignment-system https://www.prearesourcecenter.org/audit/directory

The PREA Audit Instrument, which is integrated into the PREA Online Audit System, provides critical, step-by-step guidance to DOJ-certified auditors on the conduct and contents of PREA audits.

The instrument is organized based on the PREA standards and provides vital information to auditors about the information that must be collected and analyzed to make a compliance decision about the more than 300 specific provisions/requirements contained in the standards. The PREA Audit Instrument includes: the Pre-Audit Questionnaire; the Auditor Compliance Tool; Interview Guides/Protocols for agency and facility staff members, persons who are confined, and facility volunteers; Site Review Instructions; and the Audit Report Template. With oversight and direction from the PMO, the contractor will:

• Serve as a proactive, responsive resource for DOJ-certified PREA auditors who are using the

PREA Audit Instrument to guide their auditing work; and

• Revise and update the Instrument components listed above on an as needed basis, with the goal of enhancing the quality, objectivity, comprehensiveness, and reliability of PREA audits across the country.

Task 6: Administering the Process for Governors to Submit Certifications and Assurances to DOJ

The PREA statute provides that if a governor is not able to certify to DOJ that his or her state or territory is in full compliance with the PREA standards, the governor has the option to submit an assurance form to DOJ that not less than 5 percent of certain DOJ grant funds will be used solely for the purpose of enabling the state to achieve and certify full compliance with the standards in future years.13 If a governor is not able to certify to DOJ that the state is in full compliance with the standards and elects not to submit an assurance, the state will be subject to the loss of 5 percent of certain DOJ grant funds that it would otherwise receive. To comply with the PREA statute, governors must, each year on October 15, submit either a certification or an assurance form to DOJ, along with additional materials that are required by the 2016 Amendment to the PREA Statute.

The selected contractor will provide significant support to the PMO each year in carrying out DOJ’s statutory responsibilities related to PREA submissions that are made by the nation’s governors. The contractor will, with oversight and direction from the PMO, manage:

• All communications with governors about their PREA-specific obligations and their annual

PREA submissions to DOJ;

• The collection and review of all PREA submissions from the nation’s governors;

• Necessary follow up with governors regarding questions related to their PREA submissions;

and

• The process of making all PREA audit reports for facilities under the operational control of governors publicly available, as required by the 2016 Amendment to the PREA Statute.

Task 7: Developing and Supporting an “Excellence in PREA Auditing Consortium”

13 See 34 U.S.C. § 30307(e)(2). The two DOJ grant programs impacted by PREA are BJA’s Edward Byrne Memorial Justice Assistance Grant Program and the Office of Juvenile Justice and Delinquency Prevention’s Title II Formula Grants Program.

In light of the PMO’s ongoing concerns related to the quality and integrity of PREA audits being conducted across the nation, the selected contract will, under the guidance of the PMO:

• Establish and implement a data-driven process to identify up to 25 DOJ-certified PREA auditors who are successfully carrying out the requirements in the PREA Auditor Handbook and PREA Auditor Certification Agreement, and who are interested in being part of an “Excellence in PREA Auditing Consortium”;

• Create and utilize an objective process to select confinement facilities/agencies that are committed to successfully achieving and maintaining compliance with the PREA standards, and interested in receiving a PREA audit from one or more (the PMO recognizes the value of auditing in teams) of the DOJ-certified PREA auditors who are part of the consortium;

• Match these confinement facilities/agencies with DOJ-certified PREA auditors who are part of the consortium, and cover all costs associated with the audits that are conducted, including those related to the five phases of the audit:

o Pre-onsite o Onsite o Evidence Review and Interim Report o Corrective Action and Final Report o Post-Audit

• Work collaboratively with the PREA Resource Center to deliver technical assistance to confinement facilities/agencies who receive audits from DOJ-certified PREA auditors in the consortium, and who are interested in receiving support during the Corrective Action and Final Report phase of their audits to achieve compliance with PREA standards that are identified in Interim Reports as out-of-compliance.

• Create and implement a strategy to collect lessons and learnings from the audits conducted by DOJ-certified auditors who are in the consortium, and partner with the PMO to use these to guide needed enhancements and reforms to the PREA Audit Function.

EXPERTISE

It is anticipated that two primary types of expertise will be required to carry out the tasks and related activities associated with this contract:

1. Substantive expertise related to implementation of the PREA Standards and auditing compliance with the requirements defined therein; and

2. Technical expertise associated with the administration of the PREA Online Audit System and related databases, and the collection and analysis of data and information related to PREA audits.

These two types of expertise are vital in supporting the ongoing efforts of the PMO to enhance the quality and integrity of PREA audits, and to evaluate the extent to which PREA auditors are upholding the requirements associated with their DOJ-issued certification that are defined in the PREA Auditor Handbook and PREA Auditor Certification Agreement. Each type of expertise is further defined below.

Substantive Expertise: Implementing the PREA standards, auditing compliance with them

• Knowledge of the content of and requirements in the PREA standards.

• Knowledge of the requirements that DOJ imposes on certified PREA auditors, as defined in the PREA Auditor Handbook and the PREA Auditor Certification Agreement.

• Experience implementing the PREA standards in the four facility types they cover (i.e., prisons and jails, juvenile confinement facilities, community confinement facilities, and police lockups).

• Experience overseeing, and delivering strategic support, technical assistance, and training the PMO funds and directs on a national level to:

o PREA auditor candidates, o DOJ-certified PREA auditors, and o Agencies and facilities with obligations under the PREA standards.

• Experience providing data-driven recommendations regarding steps that can be taken to enhance the quality, effectiveness, and impact of the strategic support, technical assistance, and training on a national level to:

o PREA auditor candidates, o DOJ-certified PREA auditors, and o Agencies and facilities with obligations under the PREA standards.

• Understanding of the common challenges that DOJ-certified auditors have in successfully carrying out DOJ’s auditing requirements that are defined in the PREA Auditor Handbook and the PREA Auditor Certification Agreement.

• Experience collecting, organizing as necessary, and critically reviewing large amounts (i.e., hundreds or thousands of pages per PREA audit) of underlying documentation related to individual PREA audits, to identify instances when auditors’ compliance determinations are inconsistent with the documentation they used to make these determinations.

• Understanding of the training needs of PREA auditors that are essential to position and equip them to carry out DOJ’s auditing requirements that are defined in the PREA Auditor Handbook and the PREA Auditor Certification Agreement.

• Experience addressing the training needs of auditors before and after they are certified by

DOJ.

• Understanding of and experience with the processes used to certify, recertify, and decertify PREA auditors.

• Knowledge of the PREA Audit Assignment System.

• Experience using – and supporting DOJ-certified PREA auditors in their use of – the PREA

Audit Instrument.

• Knowledge of adjustments needed to the Audit Instrument to enhance the quality and integrity of PREA audits, and to increase transparency related to PREA audits across the nation, and experience implementing these adjustments.

Technical expertise: Administration of the PREA Online Audit System and related databases, collection and analysis of data and information related to PREA audits

• Knowledge of and experience using, in the context of PREA auditing, an array of statistical analysis software applications, including, but not limited to, SPSS® Statistics.

• Capacity to collect and analyze data from large numbers of disparate sources focused on

PREA auditing (e.g., DOJ-certified auditors across the country).

• Knowledge of and experience developing, implementing, managing, and expanding web-based applications that are consistent with the requirements of the Federal Information Security Management Act.

• Capacity and technical expertise to administer and provide needed, ongoing technical support to an array of web-based applications and processes that are vital to the successful operation of the PREA Audit Function, including, but not limited to, the following:

o The PREA Online Audit System, o PREA auditor certification and recertification, o Training of PREA auditor candidates and DOJ-certified PREA auditors (including the

PREA Auditor Training and Resource Portal),14 o The PREA Audit Assignment System, o The PREA Audit Oversight System, which includes:

Peer review, Disciplinary review, Suspension of a DOJ-issued certification, Remediation, and Decertification.

• Capacity and technical expertise to manage the appropriate sharing of data and information between and across an array of web-based applications and processes that are vital to the successful operation of the PREA Audit Function. These applications and processes include, but are not limited to, those listed immediately above.

REQUESTED INFORMATION

The Office of Justice Programs (OJP) is gathering information about the latest industry best practices, technologies, and innovations related to this requirement. The objectives and tasks of this requirement must be met by personnel who are highly skilled and experienced in delivering complex integrated solutions. Additionally, the contractor is expected to continuously innovate while aligning with the OJP mission, architecture, programs, and the changing needs of its stakeholders. To this end, OJP requests the following:

14 See https://www.prearesourcecenter.org/user/login.

https://www.prearesourcecenter.org/user/login

1) Describe (in measurable terms) results for an enterprise-wide solution your company has provided in support of the general task areas listed above. Your response must clearly demonstrate the benefits to the process owner and the client.

2) Describe your company’s past or current involvement with the PREA program.

3) Outline your company’s ability to perform the requirements noted in this RFI.

4) Describe your approach to operating in an environment with tight timelines and sometimes unrealistic expectations with respect to delivery schedules.

5) Describe your approach to the simultaneous management of multiple high priority projects.

The response should also include the following information, clearly identified:

• Vendor’s name, address, points of contact information, website, and cage code.

• Vendor’s current business designation and size status.

• Vendor’s applicable GWAC (i.e. Federal Supply Schedule(s)).

• Vendor may offer other applicable North American Industry Classification System

(NAICS) code assignments for these services, if applicable.

• Tailored capability statements do not need to address all general areas of this requirement. Vendors are encouraged to address those requirements which most align with their capabilities by submitting appropriate documentation supporting claims of organizational and staff capability. The vendor should clearly indicate which general areas of this requirement are being addressed in its submission.

o If subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements.

o The capability statement may include suggestions for the type of contract structure that would best suit the broad range of functions and tasks described herein.

SUBMISSION INFORMATION

Responses are due no later than 11:00AM Eastern Time, Wednesday, April 26, 2023, and should submitted electronically (via e-mail) to Mr. Samuel Layton, Contract Specialist, at samuel.layton@usdoj.gov. The vendor may choose the format of response as long as it can be e-mailed (e.g. weblink, slide deck, PDF). Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions.

DISCLAIMER

This notice does not obligate the Government to award a contract or otherwise pay for the information provided in the response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any concern responding to this notice should ensure that its’ response is complete and sufficiently detailed to allow the Government to determine the concern’s qualifications to perform the work.

mailto:samuel.layton@usdoj.gov

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation MAY be published. However, responses to this notice will not be considered adequate responses to a solicitation.

The Government will NOT accept requests for meetings or briefings, and may not answer any questions posed. No phone solicitations or email with regards to the status of a potential solicitation will be accepted prior to its release. Information and materials submitted in response to this notice WILL NOT be returned.

The Government does not intend to award a contract on the basis of responses received nor otherwise pay for the preparation of any information submitted.

As a result of this notice, the Government MAY issue a solicitation. There is no solicitation available at this time. However, should such a requirement materialize, no basis for claims against the Government shall arise as a result of a response to this request or the Government’s use of such information as either part of our evaluation process or in developing specifications for any subsequent requirement.

CONFIDENTIALITY

No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).