DRAFT SOW - Financial Statement Audit Services.pdf

DEPARTMENT OF COMMERCE

STATEMENT OF WORK

1 | Page

STATEMENT OF WORK:

FINANCIAL STATEMENT AUDIT SERVICES

FOR

OFFICE OF INSPECTOR GENERAL

2 | Page

1.0 Background

1.1 Department Summary

a. The Department of Commerce (DOC) is a cabinet-level agency of the Executive Branch of the U.S. government. Established in 1903 to promote U.S. business and trade, the DOC’s broad range of responsibilities includes predicting the weather, granting patents, registering trademarks, measuring economic growth, gathering and disseminating statistical data, expanding U.S. exports, developing innovative technologies, helping local communities improve their economic development capabilities, promoting minority entrepreneurial activities, and monitoring the stewardship of national assets.

b. DOC’s mission is to create the conditions for economic growth and opportunity.

c. DOC is headquartered in Washington, D.C. and has approximately 48,500 employees. In addition, DOC has field offices in all states and U.S. territories. It also maintains offices in 86 countries worldwide.

d. The Department is composed of the following bureaus and offices:

Bureau of Economic Analysis (BEA) Bureau of Industry and Security (BIS) Bureau of the Census (Census) Economic Development Administration (EDA) International Trade Administration (ITA) Minority Business Development Agency (MBDA) National Institute of Standards and Technology (NIST) National Oceanic and Atmospheric Administration (NOAA) National Telecommunications and Information Administration (NTIA), which includes the

First Responder Network Authority (FirstNet), an independent authority within NTIA National Technical Information Service (NTIS) Office of the Secretary (OS), often referred to as Departmental Management Office of Inspector General (OIG) United States Patent and Trademark Office (USPTO)

e. Additional information about the Department can be found on its website at www.commerce.gov and the Fiscal Year FY 2024 Agency Financial Report at Agency Financial Reports | U.S.

Department of Commerce.

1.2 DOC Financial Management

a. Within the DOC Office of the Secretary’s Office of Financial Management (OFM), the Financial Reporting, Policy, Internal Controls and Travel Directorate formulates and prescribes department-wide financial management, accounting, and fiscal policies, procedures, and controls; assists DOC bureaus in its implementation; and reports on financial management programs; coordinates preparation of financial statements, and other external reporting, and the annual financial statement audit; monitors the resolution of audit findings; and oversees the Department’s assessment of A-123 internal controls over financial reporting.

b. NOAA and NIST provide accounting services to several DOC bureaus/offices. NOAA provides services to BIS and EDA. NIST provides services to BEA, ITA, MBDA, NTIA (including the

3 | Page

First Responder Network Authority), NTIS, OS, and OIG. Census does not provide accounting services.

1.3 Commerce Financial and Business Systems

a. DOC’s Office of the Chief Financial Officer and Assistant Secretary for Administration, in collaboration with the Office of the Chief Information Officer, is responsible for providing strategic direction, planning and oversight for the DOC’s financial and business systems.

b. OFM’s Office of Financial Management Systems Directorate is responsible for managing Commerce Business Systems (CBS), which is currently the Department’s primary financial management system. CBS consists of a core financial system, which includes a purchase card system and a budget and execution data warehouse. CBS is interfaced with the Commerce Standard Acquisition and Reporting system, Agriculture’s National Financial Center’s payroll system, and Treasury’s Automated Standard Application for Payments. CBS contains six integrated modules: general ledger, accounts payable, accounts receivable, cost management, funds management and workflow management. The financial information in CBS is integrated in a Corporate Database, which is a commercial off-the-shelf software used for consolidating financial data and producing reports.

c. CBS is used by all DOC operating units, except for NOAA and USPTO, and is deployed in two separate and distinct instances within the Department—at Census and NIST.

d. CBS is maintained at the OFM’s Commerce Business Systems Solution Center in Gaithersburg, Maryland, which is responsible for the requirements identification, design, programming, testing, software configuration management, CBS system documentation, and other activities associated with the development and maintenance of the CBS software. For additional information on CBS, see CBS.

e. DOC is currently undergoing a financial system modernization, the Business Applications Solution (BAS) program, to replace CBS. This program is a DOC modernization initiative to deploy an integrated suite of financial and business management applications in support of the DOC mission. The DOC BAS support team is generally located in Gaithersburg, MD. Accenture Federal Services is the integrator and host for the BAS applications, which include Oracle Enterprise Business Suite, Unison PRISM, Sunflower Asset Management, Tableau for Enterprise Data Warehouse, and ServiceNow Portal. The systems are provided to DOC through that integrator contract award. The scope of the BAS program includes dedicated DOC business applications for: Core Financial Management, Acquisitions Management, Property Management, Enterprise Data Warehouse and Business Intelligence reporting, Data archiving solutions, and related administrative system interface services.

The BAS program is in progress with full deployment expected to be completed in FY 2027. The BAS solution for property management was deployed DOC wide in October of 2022. The BAS solution for finance and acquisition was implemented at NOAA (and their serviced bureaus) in October 2023. Currently, the BAS implementation for Census is planned for October 2025, and NIST (and their service bureaus) in October 2026. The legacy applications will remain until bureaus transition to the BAS solution. See Business Applications Solution (BAS) | U.S.

Department of Commerce for more information about the BAS program.

f. USPTO uses Momentum, a web-based commercial off-the-shelf application that provides all facets of financial accounting. Momentum subsystems include the general ledger, budget

4 | Page execution, planning, acquisitions, accounts payable, accounts receivable, automated disbursements, travel accounting, external reports, and fixed assets. Momentum has internal interfaces to the Fee Processing Next Generation system, the subsidiary ledger and internally developed custom application that facilitates management of revenue collection processing and records.

1.4 Information Processed by Outside Entities

a. DOC relies on three other Federal agencies for the processing of a portion of its financial information.

The U.S. Department of Agriculture’s National Finance Center handles payroll processing for DOC’s civilian workforce.

The U.S. Coast Guard handles payroll processing and retirement annuity services for NOAA’s Commissioned Officer Corps.

The U.S. Department of State provides accounting services for the overseas offices of

ITA.

2.0 Objective

OIG is committed to conducting independent and objective audits and evaluations in the most efficient and effective manner. Thus, the objective of this Statement of Work (SOW) is to contract with a qualified independent certified public accounting firm to conduct annual audits of the DOC’s financial statements and USPTO’s financial statements. Each of the audits shall be conducted as separate and distinct audits under this contract. The contractor shall perform the following audits in the base year, as well as in four subsequent option years, if the options are exercised:

a full-scope audit of the DOC consolidated financial statements (Task 1) a separate full-scope audit of the USPTO’s financial statements (Task 2)

As referenced in section 1.3 (Commerce Financial and Business Systems) subparagraph (e), DOC is currently implementing a financial system modernization project, the BAS program, to replace CBS. OIG anticipates the opportunity to realize efficiencies in audit performance because of the BAS implementation, with potentially significant reductions in effort and cost for future audit performance in the modernized environment.

3.0 Scope

The Chief Financial Officers Act of 1990, as amended by the Government Management Reform Act of 1994, requires the preparation of an annual audited financial statement covering all accounts and activities of each office, bureau, and activity of the Department. The audits shall be performed in accordance with generally accepted government auditing standards (GAGAS), as specified in the current version of the Government Accountability Office’s (GAO’s) Government Auditing Standards, and additional federal audit requirements prescribed by the Office of Management and Budget (OMB). The following applies to both Tasks 1 and 2):

a. The scope of the DOC consolidated financial statement audit shall include all bureaus, funds, programs, activities, and offices within the DOC. Thus, the results of the USPTO stand-alone audit shall be incorporated into the DOC consolidated financial statement audit report. The contractor shall also issue an audit report for the separate stand-alone audit of USPTO’s financial statements.

5 | Page

b. The audits shall determine whether the financial statements have been prepared in conformity with generally accepted accounting principles. The contractor shall perform audit procedures to evaluate the design and effectiveness of the Department’s internal controls that are relevant to the financial statement audit. In addition, the contractor shall also perform audit work necessary to determine compliance with provisions of applicable laws, regulations, contracts, and grant agreements that have a direct effect on the financial statements, including determination of the DOC’s compliance with Federal Financial Management Improvement Act. Further, the contractor work shall consider that DOC relies on other federal agencies for processing a portion of its financial information.

c. The audit methodology used shall, at a minimum, be consistent with the most current version of the GAO’s Financial Audit Manual (FAM). This methodology may be supplemented by the contractor’s audit methodology; however, any methodology other than the FAM must meet or exceed the requirements of the FAM. In cases where the contractor’s methodology differs from the FAM, the contractor must provide documentation to the contracting officer’s representative (COR) on a timely basis, demonstrating how the contractor’s methodology satisfies the requirements of the FAM. The contractor shall provide written request for approval to the COR for any significant deviations from the FAM.

d. The contractor shall perform testing of general information technology (IT) controls that are relevant to the financial statement audit. All DOC IT financial processing environments and facilities that support financial reporting are within the scope of the financial statement audit. The work shall be consistent with the guidelines outlined in GAO’s Federal Information System Controls Audit Manual (FISCAM) which describes five major categories of general controls: 1) security management; 2) access controls; 3) configuration management; 4) segregation of duties;

and 5) contingency planning. General controls audit work shall address each of these five areas in each financial statement audit. The contractor shall notify the COR in writing if the review of some categories will be emphasized over others, and provide appropriate and adequate written justification to the COR. However, the contractor must test each FISCAM area as part of the annual financial statement audit.

e. The contractor shall also perform application controls review related to the specific financial applications deployed by DOC to support financial statement reporting and that are relevant to the financial statement audit.

f. DOC data center facilities are included in the scope of the IT work, including:

BAS/NOAA Data Centers NIST Data Center CBS Solutions Center NTIS Data Center Census Data Centers USPTO Data Centers

g. When a specific general IT control area/environment is identified as ineffective, the specific controls pertaining to its ineffectiveness are not required to be reviewed. For such IT areas/environment, the scope of work pertains to follow up of prior year audit findings. The contractor shall notify the COR in writing of the specific general IT control area/environment deemed ineffective, the contractor’s rationale, and audit impact.

6 | Page

4.0 Requirements

The following requirements apply to both Tasks 1 and 2:

4.1 Independence and Quality Control Assurance Statement

To ensure compliance with GAGAS, the contractor and its subcontractors, if any, shall submit the following:

a. An Independence/Quality Control Assurance Statement to address each of the following items:

1. A statement that the firm and all assigned personnel are independent with respect to this reporting entity and that all personnel assigned to this audit maintain the number of required continuing professional education.

2. Any existing or planned non-audit services with respect to this reporting entity.

3. Any lawsuits with this reporting entity.

4. Any relationships with this reporting entity that could impair independence.

5. Explanation of the firm’s current internal quality control system, including such items as audit documentation review procedures, staff independence requirements, and continuing professional education requirements.

6. A copy of the firm’s most recent internal inspection report or equivalent if available, external Peer Review, Letter of Comments, and Management’s response.

7. Results or a copy of the firm’s most recent Inspection Report prepared by the Public Company Accounting Oversight Board and the firm’s response.

b. In addition, throughout the audit, the contractor shall provide the COR with 3 business days notice (via e-mail) if the contractor is considering proposing on any contracts involving DOC or any of its bureaus or offices. In such cases, the contractor shall provide the COR a written statement and rationale representing whether it will remain independent with respect to the reporting entity. The contractor shall notify the COR of the DOC entity, the type of contract services to be provided, the period covered and provide a copy of the applicable SOW describing the requirements.

4.2 Initial OIG Briefing, Entrance and Exit Conferences

a. At the start of each audit, the contractor shall provide the COR and other OIG representatives with an initial briefing to discuss the contractor’s proposed staffing, approach, and any logistical matters for the current year’s audit.

b. For each audit, the contractor shall hold entrance conferences with key DOC officials, for both financial statement and IT work for each audit. The entrance conference provides an opportunity for the contractor to discuss the audit with agency officials and will be held after award and formally initiates the audit. The contractor shall coordinate the entrance conference meeting with DOC point of contact and OIG, as well as provide an agenda for each conference to the COR and DOC point of contact one day in advance of the conference.

c. Upon the completion of the audit, the contractor shall hold one exit conference for each audit with the responsible DOC officials to discuss the results of both the financial statement and IT work for the audit. The contractor shall coordinate the exit conference meeting with DOC point of contact and OIG, as well as provide an agenda for each conference to the COR and DOC point of contact one day in advance of the conference.

7 | Page

4.3 Status Meetings and Progress Reports

a. For each audit, the contractor shall conduct periodic status meetings with the COR and applicable DOC representatives. During the status meeting, the contractor shall discuss work accomplished to date, delays, upcoming work, information needed from each DOC bureau and office, audit findings, and other relevant information. The first meeting should be held within 30 days of the entrance conference and shall continue throughout the audit on a biweekly basis or as mutually agreed to in writing by the COR and contractor.

b. The contractor shall provide a written status meeting agenda to the COR and applicable DOC point of contact one day in advance of each meeting. In the event the contractor believes that a scheduled status meeting is not needed, the contractor shall provide a written request and rationale to the COR for approval.

c. The contractor shall submit written progress reports to the COR on a biweekly basis or as decided mutually by the COR and the contractor. These reports shall summarize the progress of each audit and problems encountered during the preceding period. The reports, at a minimum, shall include:

Summaries of the status and other meetings occurring during the biweekly period, including discussions and comments on significant problem areas, dates that key information requests are promised, and information provided by OIG, bureaus, offices, and/or contractor.

Significant accomplishments for the reporting period and action items for the next period.

A summary showing the status of each major segment of the audit (e.g., comparison of planned to actual completion dates).

A discussion of significant problem areas including a plan and target dates for resolving each problem, and any impact on the deliverable due dates.

Matters that have come to the contractor’s attention that may impact the audit opinion or may be reported as internal control finding or instance of noncompliance with laws and regulations.

Status of prior year’s material weaknesses or significant deficiencies.

Description of draft and final audit findings that have been issued in written form.

Any information which the contractor believes could affect the deliverable due dates.

A complete list of all overdue materials and data requested by the contractor to be provided by DOC bureaus and offices, as well as the impact of the delays on the audit.

Opportunities identified for potential efficiencies in audit performance because of the

BAS implementation.

d. In addition to status meetings, the contractor shall keep the COR informed of all findings, delays, and other issues as they arise. During the audit, the contractor shall discuss with COR and agency officials matters that come to the auditor's attention that would affect the opinion on the financial statements, issues that could be a potential material weakness, significant deficiencies, or noncompliance, and other matters that warrant attention.

4.4 Audit Planning Documents

a. For each audit, the contractor shall submit audit planning documents that are consistent with FAM guidance, including a crosswalk describing how the contractor’s audit planning documents satisfy the FAM planning guidance. At a minimum, the audit planning documents shall include the following:

8 | Page

Entity profile, audit strategy, cycle matrix, risk assessments/analysis, and other audit phase documentation.

Audit plan/programs for all audit areas, including IT controls and application control assessments.

Sampling plan/approach describing all internal control and substantive audit testing.

Audit materiality amounts and basis for determination, including legal letter materiality level.

Highlight the adjustments made in the audit planning documents (e.g., audit plan/programs) to account for BAS implementation and operations in a modernized environment.

Planned efficiencies in the audit related to the BAS implementation and operations in a modernized environment, including consideration of the audit strategy, audit program procedures, and requirements and identification of the reduction in planned audit efforts by audit phase (i.e., current year vs. prior year) and cost savings.

b. These documents will be reviewed by the OIG and any comments or questions will be provided to the contractor for response and resolution within five (5) business days. Upon satisfactory response, the COR will notify the contractor regarding acceptance of the planning documents.

4.5 Audit Findings

a. For each audit, the contractor shall develop a process of notifying the DOC bureaus, offices, and the COR, in writing, of all audit findings as they become known.

b. Each draft and final audit finding shall:

Include the condition, criteria, cause, effect, and recommendation.

Indicate concurrence or non-concurrence by the applicable DOC bureau or office, reason and support for non-concurrence, as well as signoff by contractor and applicable DOC official.

Be provided to the applicable DOC bureau/office, OFM, and OIG.

4.6 Audit Documentation

a. For each audit, the contractor shall prepare audit documentation in accordance with Government Audit Standards. Audit documentation not complying with the requirements under Government Auditing Standards shall be returned to the contractor for correction at no additional cost to the Government. Contractor audit documentation must also be equivalent to the FAM.

b. At a minimum, the financial statement audit documentation shall be consistent with the FAM guidance and shall also:

1. Include documentation related to

a) Planning the audit including overall audit strategy, audit plan/programs, materiality, sampling methodology, and analytical procedures.

b) Cycle memos or flowcharts, significant control evaluations, internal control assessments and testing including determination of overall effectiveness of internal control.

c) Substantive audit procedures including the methodology, results of testing (including evaluation of sampling), and conclusion reached on each significant audit area, 9 | Page process/cycle, account balance.

d) Summary memos by audit area, audit adjustments, audit differences, conclusions on significant issues/estimates/judgments, and overall summary of audit work.

e) Completed FAM 1003 Checklist.

f) CPE compliance summary for all audit team members including subcontractors..

2. Clearly show the condition, cause, effect, criteria, and recommendations for all findings, whether material or not.

3. Follow-up procedures on the status of prior year findings.

c. The IT audit documentation shall be consistent with the FAM guidance and provide sufficient detail to provide a clear understanding of the work performed, the evidence obtained and its source, and the conclusions reached. At a minimum, the IT audit documentation shall include:

1. A description of the network environment including identification of significant ingress/egress points, publicly accessible network segments, and significant financial systems and their location within the entity’s network. Significant changes to the entity’s environment should be identified and documented.

2. For general controls testing, a summary that describes the nature, timing, and extent of tests performed by each FISCAM area, along with results and conclusions as to whether the controls were designed properly and operating effectively.

3. For application controls testing, a summary that describes how specific application controls were selected as significant for review and how the controls were tested, along with results and conclusions as to whether the controls were designed properly and operating effectively.

4. All findings identified by the contractor. Each finding shall include discussion of the condition, cause, criteria, and effect, along with recommendation(s) for improvement.

5. A summary of audit follow-up which documents the status of prior year findings.

d. The OIG, GAO, and other Government representatives, as determined by the COR, shall have access to the contractor’s audit documentation on an on-going basis to facilitate: (1) the understanding of the planning, testing, results, and conclusions for the DOC and USPTO audits,

(2) the timely issuance of the reports, and (3) the Government-wide annual financial statement audit. During and after the audit, upon request by the COR, the contractor shall provide access to and/or copies of (at no additional cost to the Government) all contractor audit documentation, findings, and reports developed in connection with the audits. Notwithstanding the foregoing, the contractor’s audit documentation shall not be subject to an examination or copying if not permissible under applicable professional standards.

e. Upon request from the COR, the contractor shall provide OIG with audit documentation, completed forms, questionnaires, or checklists, and responses to other inquiries necessary to assist GAO in its work related to the Government-wide annual financial statement audit. Further, for information requests initiated by other Government representatives, the contractor shall provide OIG with information based on its audit in order for OIG to fulfill such requests.

f. The OIG will conduct periodic reviews of the contractor’s work (audit documentation, as well as

10 | Page other information to verify contractor’s compliance with GAGAS) and provide feedback (questions and comments) to the contractor, as needed. The contractor shall satisfactorily resolve these items within five (5) business days. All contractor audit documentation must be made available for OIG review during audit fieldwork and processing of audit reports, as well as post-report resolution or follow-up that may occur after the performance period.

g. Audit documentation prepared by the contractor for each task is the property of the contractor.

However, the contractor shall maintain all audit documentation for a period of eight years from issuance date of the report. The documentation shall be available during this period for review by authorized representatives of the OIG, GAO, as well as the COR and Contracting Officer.

4.7 Audit Reports

a. For each audit, the contractor shall issue the following draft and final audit reports/management letters for each audit:

A report on each financial statement audit containing:

o An opinion as to whether the financial statements are fairly presented in all material respects in conformity with U.S. generally accepted accounting principles.

o A section on internal control over financial reporting.

o A section on the reporting entity’s compliance with applicable laws, regulations, contracts, and grants agreements.

A financial statement management letter for each audit disclosing the findings and recommendations that are not included in the required audit report, as well as any other areas of improvement that the contractor considers necessary to communicate to DOC management.

An IT management letter for each audit summarizing its IT findings, recommendations, and conclusions. The IT management letter reports shall:

o Discuss the impact of general IT control areas/environments deemed ineffective

(if applicable), including the status of specific corrective actions to address effectiveness and the status of prior fiscal year audit findings in the ineffective IT environments that contributed to the overall Department-level significant deficiency or material weakness.

o Include other IT matters that warrant the attention of DOC management.

o Address the status of all prior fiscal year audit findings and recommendations, as well as significant changes in the IT environment.

o Include a table of contents, executive summary/introduction, the scope and methodology for information system testing, a summary of findings by FISCAM category.

o Include a section for each DOC bureau/office, which describes its IT-specific findings and recommendations.

b. All draft and final report/management letter deliverables submitted to the COR must be 508 compliant.

4.8 Problem Reports and Basic Audit Requirements Determination Report (BARDR)

a. For each audit, the contractor shall provide written notification to the COR of any significant problems that arises during the performance of this contract within two business days via a

11 | Page

Problem Report. Problems may be current or potential problems that are causing or could lead to audit delays or affect the successful completion of the audits. The contractor shall include a recommended solution to solve or avoid the problem.

b. For each audit, the BARDR is used to document significant deficiencies or concerns that must be corrected, as well as DOC data or documents that must be received, before a financial statement audit report can be successfully issued by the contractor. The contractor must submit a BARDR letter by the conclusion of field work, either identifying deficiencies or confirming that there are no deficiencies that would preclude the successful issuance of the financial statement audit report by the due date.

4.9 Summary of Material Weaknesses, Significant Deficiencies and Non-compliances

a. The contractor shall provide a summary of proposed material weaknesses, significant deficiencies, and non-compliances with applicable laws and regulations found during each audit.

4.10 Summary of Audit Efficiencies

a. The contractor shall provide a detailed summary of efficiencies gained in audit performance because of the BAS implementation and operations in a modernized environment. The summary shall identify how implementation of BAS yielded efficiencies, reduced efforts, and cost savings and include details on the reduction in audit effort realized (by phase) and the planned vs. actual efficiencies and audit effort. Consideration shall be given to the planned audit strategy, audit program procedures and audit requirements. The contractor shall also conduct a briefing to OIG on the summary of audit efficiencies and provide a related agenda to the COR one day in advance of the briefing.

5.0 Place of Performance

a. The place of performance includes DOC sites within the Washington, D.C. metropolitan area;

however, the contractor may also conduct audit work offsite at the contractor’s approved office or remote location(s). No DOC audit work shall be conducted at public locations (such as coffee shops or libraries) or locations outside of the U.S. Based on the nature of the DOC operations, the sources and locations of financial information are primarily located in the Washington, DC metropolitan area and/or are available electronically. Thus, site visits to other DOC domestic or foreign locations are not required to successfully complete the financial statement audits. The Government will not reimburse the contractor for local travel within the Washington, D.C.

metropolitan area, nor any travel to DOC domestic or foreign locations.

b. The contractor must coordinate access to the DOC headquarters location, as well as all other

DOC sites, with the designated DOC bureau/office point of contact. While working on Government premises, the contractor personnel are expected to conform to normal operating hours, unless authorized by the appropriate DOC site representatives. The normal duty hours are 8:00 a.m. to 5:00 p.m. Monday through Friday. However, the contractor will not have access to the government staff or facilities during the observed Federal Holidays or when Federal facilities are closed due to emergencies or Executive Orders.

c. The contractor personnel shall not conduct any other business on Government premises.

Contractor personnel shall abide by the rules and regulations applicable to the Government premises on which they work, including any applicable safety and security regulations.

12 | Page

6.0 Period of Performance

a. The period of performance with all option periods is 5 years. This includes a period of performance for the base period from February 1, 2026, through January 31, 2027, for the FY 2026 financial statement audits. If an option period is exercised, the period of performance shall be extended through the end of that option period.

b. The option periods that may be exercised are as follows:

PERIOD AUDIT YEAR START DATE END DATE

Option Period 1 FY 2027 February 1, 2027 January 31, 2028

Option Period 2 FY 2028 February 1, 2028 January 31, 2029

Option Period 3 FY 2029 February 1, 2029 January 31, 2030

Option Period 4 FY 2030 February 1, 2030 January 31, 2031

7.0 Deliverables

a. All deliverables shall be submitted to the COR on the due date provided in Exhibit 1. The contractor must provide a written request to the COR for revisions to the deliverable due dates.

However, specific dates requested must allow DOC to comply with applicable OMB and Treasury requirements applicable for federal financial statement audits for the fiscal year under audit.

b. Each deliverable is subject to OIG review, and as such the contractor may receive comments or questions on the deliverables. The contractor shall provide a response to OIG feedback within five (5) business days. Once satisfactorily addressed, the COR will notify the contractor that the deliverables are accepted.

c. Only accepted deliverables may be provided to DOC (if applicable). Thus, the COR will provide the contractor with written confirmation of acceptance and whether the contractor will provide accepted deliverables to DOC. In some cases, OIG may decide to formally issue the contractor deliverables to DOC.

8.0 Government Furnished Resources

8.1 Government Furnished Property

a. Work areas, telephones, desks, chairs, reproduction, and fax capabilities will be provided by the Government. Equipment such as file cabinets, binders, computers, printers, scanners, and any other office equipment and/or supplies necessary for conducting each audit shall be provided by the contractor.

b. Workspace requirements will be negotiated, as needed, between the contractor and the DOC point of contact for each applicable DOC site.

c. The Government will provide the contractor with up to 4 laptops to facilitate the IT audit work, as well as OIG will store DOC payroll data for contractor sampling and analysis procedures, if requested. The contractor shall be responsible for obtaining any software that may be necessary to

13 | Page perform IT assessments and payroll sampling work. Only contractor personnel that have cleared security requirements and received DOC credentials are eligible to receive laptops.

8.2 Government Furnished Information

a. The appropriate DOC representatives will be available during the audit to provide the contractor with specific records, information, and explanations necessary for the contractor to perform the financial statement audit. DOC personnel will provide accounting records and other documents necessary to support the data included in the financial statements, prepare schedules or other information needed to support the audit, and provide downloaded information from the DOC financial and business systems.

b. Information made available to the contractor by the Government for the performance or administration of this effort shall not be used in any way outside the scope of this contract without the written agreement of the contracting officer (CO).

c. The contractor must ensure that confidential and non-confidential DOC information, audit documentation, and property are kept in a locked and secure location when not in use by contractor personnel. The contractor must implement sufficient security controls to reasonably prevent the compromise of DOC information and property that is obtained and stored in connection with the requirements of this contract.

d. The contractor shall use DOC’s secure file transfer tool to electronically transmit DOC-related confidential, sensitive, personally identifiable information, and business identifiable information between contractor personnel or between the contractor and Government personnel. The appropriate DOC personnel will provide the contractor with access to the secure file transfer tool.

e. The financial statement audits do not require the interconnection of information systems between DOC and the contractor in order to obtain/provide DOC information. However, if the contractor determines this may be necessary, the contractor shall inform the COR, as well as the appropriate DOC OFM point of contact, and provide written justification and third-party assessment results (or similar security documentation) for DOC’s review. Any interconnection of information systems between DOC (or its bureaus/operating units) with contractor managed systems for information exchange must have an approved interconnection security agreement prior to the connections being established.

9.0 Other Terms and Conditions

9.1 Contractor Experience with Applicable Guidance

a. The contractor shall have demonstrated experience, in-depth knowledge, and an understanding in conducting federal financial statement audits using these auditing standards and other applicable authoritative guidance, including the following:

Office of Management and Budget Bulletin, Audit Requirements for Federal Financial

Statements Government Auditing Standards issued by the Comptroller General of the United States Generally accepted auditing standards and other applicable standards established by the

American Institute of Certified Public Accountants GAO Financial Audit Manual GAO Federal Information System Controls Audit Manual

14 | Page

NIST Special Publications Federal Information Security Modernization Act of 2014 Treasury Financial Manual

b. In addition, the contractor shall have demonstrated experience auditing federal agencies that implement the requirements set forth in the following authoritative guidance:

OMB Circular A-123, Management Responsibility for Internal Control Standards for Internal Control in the Federal Government (Green Book) Federal Managers’ Financial Integrity Act of 1982 Federal Financial Management Improvement Act of 1996 OMB Circular A-136, Financial Reporting Requirements

9.2 Professional Qualifications of Contractor Personnel

a. The contractor shall designate a minimum of three (3) contractor key personnel at the Manager level and above, including the following labor categories: Partner, Senior Manager, and Manager, which shall be supplemented by additional contractor support personnel (i.e., other auditors). It is noted that the labor category titles provided here (e.g., “Partner,” “Senior Manager,” etc.) are given only as examples and are not the required labor category titles. The contractor’s labor categories shall be labor categories consistent with the contractor’s GSA Contract, including qualifications for each of the position.

b. The Government reserves the right to review key personnel based on individual resumes and contract requirements. Further, the Government reserves the right to review the resumes of proposed key personnel for work under this contract.

c. The contractor shall appoint a central point of contact to serve as the project manager and coordinate all aspects of the engagement and must be available as necessary to ensure successful contract performance. This person must be a key personnel position.

9.3 Additional Requirements

The contractor shall provide all services, personnel, facilities, software, equipment, and materials necessary to perform the required tasks.

a. The contractor shall provide the skilled personnel, supervision, management, and administrative services necessary to successfully conduct the audits. All contractor personnel must meet the requirements as set forth in this contract. The supervision of subcontractor employees shall be the responsibility of the contractor. Audit specialists may be needed to support auditors and provide professional expertise in such areas as systems analysis, statistical analysis, etc.

b. The contractor’s audit personnel shall have demonstrated experience, in-depth knowledge and understanding in conducting federal financial statement audits using Government Auditing Standards, OMB requirements, and other applicable authoritative guidance. The contractor shall use IT professionals to perform and document all IT audit procedures in this contract. IT audit professionals provided by the contractor must possess sufficient technical knowledge of federal IT-related authoritative guidance and skills in applying those concepts to adequately test the IT-related controls in a federal financial statement audit.

c. All contractor personnel assigned to the audits must meet DOC security processing requirements

15 | Page stated in the contract. The contractor shall coordinate with the designated DOC bureau/office points of contact to provide all required security information and forms for contractor personnel that will be conducting audit work onsite at DOC bureau/office locations. Due to security processing time frames, this information must be provided 30 days prior to the anticipated onsite start date for contractor personnel. Any DOC credentials provided to contractor personnel must be returned to the designated DOC bureau/office point of contact within five (5) business days for any personnel no longer assigned to the audits. Contractor personnel who have not completed the security processing requirements will not be permitted to work onsite at DOC locations but may be escorted by DOC personnel into the DOC bureau and office sites to attend meetings.

d. All contractor personnel working on the audits shall be required to sign an independence declaration and non-disclosure agreement. The COR will provide the templates for the declaration and agreement to the contractor, and these shall be completed and submitted to the COR prior to accessing any DOC information and prior to performing onsite audit work.

e. All contractor personnel are required to meet DOC’s annual IT security awareness, records management, and controlled unclassified information training requirements. The COR will provide this training to the contractor. Contractor personnel shall complete this training prior to accessing any DOC information and prior to performing onsite audit work. Completion certificates must be provided to the COR.

16 | Page

EXHIBIT 1

Schedule of Deliverables

The following is a list of the deliverables required for each task as part of this SOW.

SOW

Section

Deliverable and Format Due Dates

4.1/4.2 Initial OIG Briefing (Word, PowerPoint, or PDF)

Independence and Quality Control Assurance Statement (Format: PDF)

With 15 days of the start of the period of performance or as mutually agreed to in writing by COR and contractor

4.2 Entrance conferences

- One for financial statement (FS) audit work

- One for information technology (IT) audit work (Format: PowerPoint)

Within 45 days of the start of the period of writing by COR and contractor

4.4 Audit planning documents

(Format: PDF, Word, or Excel)

Within 90 days of the start of the period of writing by COR and contractor

4.9 Summary of material weaknesses, significant

deficiencies, and instances of noncompliance (Format: Word or PDF)

2 weeks prior to the due date for draft FS audit report or as mutually agreed to in writing by COR and contractor

4.7 Draft FS audit report (Format: Word) Base Year: 10/30/2026

OY1: 11/1/2027

OY2: 11/1/2028

OY3: 11/1/2029

OY4: 11/1/2030

Or as mutually agreed to in writing by COR and contractor

4.2 Exit Conference

-Combined for FS & IT work (Format: PowerPoint)

Prior to issuance of final reports, or as mutually agreed to in writing by COR and contractor

4.7 Final FS audit report (Format: PDF) Base Year: 11/6/2026

OY1: 11/5/2027

OY2: 11/7/2028

OY3: 11/7/2029

OY4: 11/7/2030

4.7 Draft FS and IT management letters

(Format: Word)

Base Year: 11/30/2026

OY1: 11/30/2027

17 | Page

OY2: 1130/2028

OY3: 11/30/2029

OY4: 11/29/2030

4.7 Final FS and IT management letters

Base Year: 12/18/2026

OY1: 12/17/2027

OY2: 12/18/2028

OY3: 12/18/2029

OY4: 12/18/2030

4.3 Status meetings and related agendas

Biweekly or as mutually agreed in writing by COR and contractor

4.3 Progress reports

(Format: PDF)

3rd workday following a status meeting

4.5 Notification of draft and final audit findings

(Format: Word or PDF)

With 1 week of identification, as applicable

4.6 Audit documentation

(Format: PDF, Word, or Excel)

Available throughout fieldwork and after issuance of reports

4.8 Problem reports

As needed

4.8 BARDR letter

No later than due date for draft FS audit report

4.10 Summary of Audit Efficiencies and Briefing

to OIG (Format: Word, PowerPoint, or PDF)

After the issuance of final FS audit report