Questions_for_ODO_IT_RFP_HE125418R9000_Responses_Final_12_20.pdf

Questions for ODO IT RFP - HE125418R9000

1. Section 3.2.9 of the PWS states “At the beginning of each period of performance, the

Contractor is required to provide an annual self-certification memo to the DoD OIG providing assurance and addressing how the Contractor intends to meet the information safeguards required by NIST SP 800-171, as applicable. The self-certification must include but is not limited to assuring that patches and anti-virus software on each of the

Contractor provided user hardware is current and will continuously remain up-to-date throughout the entire performance of the contract. The Contractor will present scan results upon request.”

Can the Government specify what its looking for in this self-certification memo?

RESPONSE: THE SELF-CERTIFICATION MEMO ADDRESSES

INFORMATION SAFEGUARDS REQUIRED BY NIST SP 800-171, CHAPTER 3.

2. Section 2.5.4 Memorandum on Controls “The Contractor shall provide a memorandum no later than ten (10) business days after the completion of the planning phase. The memorandum shall contain the Contractor’s initial conclusions on the fairness of the presentation and suitability of design of key controls to achieve the examination control objectives, and to the extent possible the operating effectiveness of the controls specified by the DoD as of the date the memorandum is prepared.”

Can the Government specify which Task Order(s) this Deliverable will be required for?

RESPONSE: IT WILL APPLY TO ALL TASK ORDERS, AS APPLICABLE.

3. Can the Government specify what authoritative standards PWS will be performed under, agreed upon procedures, examination (AT-C standards), program audit?

RESPONSE: THE PWS SHALL BE PERFORMED UNDER

PERFORMANCE/PROGRAM AUDIT STANDARDS.

4. Section 3 of the PWS states “The Contractor shall provide references within each deliverable to identify the specific section within Contractor-prepared working papers and supporting documentation that support the deliverable content (including all statements of fact, conclusions, and opinions).”

Can the Government specify what this means? Is the Government looking for every sentence of a deliverable to be referenced?

RESPONSE: YES, EVERY SENTENCE OF A DELIVERABLE SHALL BE

REFERENCED.

5. Section 3 of the PWS states “At a minimum, the engagement documentation shall:

Document the procedures of how the work was performed by describing the purpose, source, scope, methodology, criteria, conclusions, and recommendations.”

Normally recommendations are not included in engagement workpapers, but in Notice of

Findings and Recommendations (NFRs). Can the Government specify what recommendations are to be included in engagement workpapers other than NFRs?

RESPONSE: SECTION 3.1, FIRST BULLET HAS BEEN UPDATED TO

REMOVE RECOMMENDATIONS FROM THE ENGAGEMENT

DOCUMENTATION.

6. Section 3.5 of the PWS states: “All six labor categories in the contract are considered key personnel. The contractor shall adhere to the qualification requirements in the PWS for each labor category. The six labor categories are; Partner, IT/IS Senior Manager, IT

Audit Manager, Senior IT/IS Auditor, Senior Accountant, Staff Accountant.” In addition, Section 3.2.3 states “Non-Key Personnel shall at a minimum possess an INTERIM-

SECRET clearance.”

Can the Government revise Section 3.5 to only identify the IT/IS Manager and above as the labor categories that are Key Personnel as this is a normal practice in Government solicitations?

RESPONSE: NO, THE GOVERNMENT WILL NOT REVISE SECTION 3.5, KEY

PERSONNEL.

7. For the following systems/assessible units noted in Attachment 3 (General Fund

Enterprise Business System (GFEBS), Auditable Universe of Date – Intelligence Tool

(AuD-IT), Fund Balance with Treasury (FBWT) Treasury Reconciliation and, Defense

Finance and Accounting Service (DFAS) Accounting) can the Government specify if they are expecting the Contractor to perform and SSAE 18 Examination of these systems/ assessible units?

RESPONSE: THE GOVERNMENT IS NOT EXPECTING THE CONTRACTOR

TO PERFORM AN SSAE 18 EXAMININATION OF THE (GENERAL FUND

ENTERPRISE BUSINESS SYSTEM (GFEBS), AUDITABLE UNIVERSE OF DATE –

INTELLIGENCE TOOL (AUD-IT), FUND BALANCE WITH TREASURY (FBWT) TREASURY

RECONCILIATION AND, DEFENSE FINANCE AND ACCOUNTING SERVICE (DFAS)

ACCOUNTING) SYSTEMS/ASSESSABLE UNITS. THE CONTRACTOR IS

EXPECTED TO COMPLETE THE SUPPORTING TASKS LISTED IN SECTION

2.1.

8. DFAS Accounting is listed as an Assessible Unit in Attachment 3 of the PWS. Can the

Government provide additional detail on what this assessable unit is?

RESPONSE: THE GOVERNMENT DOES NOT HAVE ADDITIONAL DETAIL

REGARDING THE DFAS ACCOUNTING ASSESSABLE UNIT AT THIS TIME.

9. Attachment 4 of the PWS notes STARS as a system that has undergone a SSAE 16/18 examination. Can the Government confirm, if STARS has undergone an SSAE 18 examination in the past? If yes, what year(s) were the examinations performed, by what

Independent Public Accounting firm(s), and the opinion(s)? If STAR has not previously undergone an SSAE 18 examination will STARS undergo an SSAE 18 examination in

FY2018?

RESPONSE: STARS WILL NOT BE REQUIRED FOR TASK ORDER ONE (1)

AS IT HAS NOT UNDERGONE AN SSAE 18 EXAMINATION. ATTACHMENT

2.3, STARS CUECs, HAS BEEN REMOVED FROM THE PWS.

10. Page 62 of 88 Section 2 of the addendum states DoDEA will serve as the evaluator of the proposals? Will the Department of Defense Office of Inspector General be a part of the evaluation process as well?

RESPONSE: YES, DOD OIG WILL PARTICIPATE IN THE EVALUATION OF

PROPOSALS.

11. Page 65 of 88, Volume I- Technical Proposal (Factor I) Section c.ii. states “The

Government will evaluate the degree to which the offeror’s proposed allocated hours for each labor category outlined in the PWS will promote the successful performance of Task

Order (T/O) one. The Government will also evaluate the offeror’s explanation for the number of hours proposed for each labor category supporting T/O one.”

The Government provided an estimated level of effort in the Government provided

Microsoft Excel worksheet labeled “HE1254-18-R-9000_Price Guide_Final.xls”. Can the Government specify why an explanation is needed for hours proposed in the Pricing

Volume?

RESPONSE: THE HOURS ON THE WORKSHEET ARE FOR THE TOTAL

PRICE OF THE ID/IQ. THERE IS NO NEED FOR AN OFFEROR TO EXPLAIN

THOSE HOUSE AS THEY ARE THE MAXIMUMS SET ON THE ID/IQ. THE

EXPLANATION IS NEEDED FOR THE PERORMANCE OF TASK ORDER

ONE, WHICH IS SCOPED IN ATTACHEMENT 4 OF THE PWS.

In addition, can the Government specify the scope and timeframe of work to be completed for Task Order One?

RESPONSE: SCOPE AND TIMEFRAME FOR TASK ORDER 1 IS IN THE PWS

AND ATTACHMENT 4. ALL OF THE OBJECTIVES OF THE PWS MUST BE

COMPLETED FOR THE ORGANIZATIONS AND SYSTEMS LISTED IN

ATTACHMENT 4 OF THE PWS. NOTE THAT THIS IS ONLY FOR TASK

ORDER ONE. FUTURE TASK ORDERS WILL DICTATE THE SPECIFIC

ORGANIZATIONS AND SYSTEMS REQUIRING AN AUDIT AT WHICH

POINT THE CONTRACTOR WILL BE AFFORDED AN OPPORTUNITY TO

PROVIDE THE NUMBER OF HOURS REQUIRED TO MEET THE

REQUIREMENTS.

12. Section 3.5 of the PWS states “Partners must Bachelor’s Degree & CPA and Certified

Information Systems Auditor (CISA) or Certified Information System Security

Professional (CISSP).”

Would the Government limit this requirement to the Engagement Partner, thus allowing other Partners (IT and Quality Control) to only have one of the three certifications?

RESPONSE: NO, THE GOVERNMENT WILL NOT LIMIT THIS

REQUIREMENT TO THE ENGAGEMENT PARTNER.

13. Section 3.5 of the PWS states the IT/IS Senior Manager “Minimum 6 years of experience in IT/IS with a CPA, CISSP or CISA. Bachelor’s Degree.”

Would the Government limit this requirement to the Project Manager role, thus allowing other Senior Managers (in the non-Project Management role) to have fewer years of IT/IS experience in exchange for the same number of years in a financial audit/audit readiness role?

RESPONSE: NO, THE GOVERNMENT WILL NOT LIMIT THIS

REQUIREMENT TO THE PROJECT MANAGER ROLE.

14. Section 2.1.1a - From page 3 of the Draft PWS, Section 2.1.1 Task 1 (a) states: ‘Obtain assurance of service auditor’s professional competence and independence from the service organization.’ Can the government expand on what procedures should be conducted to meet this task? Typically, independence is determined by the service auditor executing the audit/examination as they would be the only party that would have the knowledge of current or prior work executed by their organization over the auditee.

RESPONSE: REMOVED SECTION 2.1.1 TASK 1(a).

15. Section 2.1.1b - Regarding the requirement in the Draft PWS on page 2 under Section

2.1.1 Task 1 (b) ‘to obtain assurance on the adequacy of the standards used for the SOC report’- does this mean the government is concerned that auditors are not using the appropriate attestation standards as required by current contracts? Other than reading the report to determine what audit standards the SOC auditor used, what other procedures is the government expecting the contractor to execute to meet this requirement?

RESPONSE: REMOVED SECTION 2.1.1 TASK 1(b).

16. Section 2.1.3 - Continuing on Page 2 at section 2.1.3 Task 3, the PWS states that the contractor must “perform appropriate tests of controls at the service organization.” Can the government provide the scope of the required tests of controls? Do these tests include testing of all manual and automated controls including complementary user entity controls in place to support the financial statement assertions?

RESPONSE: THE GOVERNMENT WILL RELY ON THE CONTRACTOR TO

DETERMINE THE SCOPE OF APPROPRIATE TEST OF CONTROLS

17. Section 2.2.2a - On Page 3 of the PWS under Section 2.2.2 Task 2 (a), the requirement calls for “evaluating the design and implementation of relevant controls at the user entity that relate to the services provided by the service organization, including those that are applied to the transactions processed by the service organization.” Can the government provide clarification on the distinction between this requirement and the requirement presented on Page 2 of the PWS under Section 2.1.2 Task 2 (c)?

RESPONSE: THE DISTINCTION IS THAT THE CONTRACTOR IS TO

EVALUATE THE SOC REPORT TO ADDRESS THE REQUIREMENT UNDER

SECTION 2.1.2 WHEREAS THE REQUIREMENT UNDER SECTION 2.2.2 IS

TO DETERMINE WHETHER THE CUECs HAVE BEEN IMPLEMENTED BY

USER ENTITIES.

18. Section 2.2.4 and Section 2.3.5 - Continuing on Page 3 of the PWS, in section 2.2.4 Task

4, the PWS cites AICPA AU-C 402.15 as the guidance relating to the requirements that the auditor determine that “sufficient and appropriate audit evidence concerning the relevant financial statement assertions is available from records held at the user entity”

(subsection a), and to “perform additional audit procedures to obtain sufficient and appropriate evidence” (subsection b). However, these requirements refer to AICPA AU-C

330, which is the overall requirement for obtaining evidence on a financial statement audit. In order to conduct these procedures, the auditor would need to follow AU-C 330 rather than AU-C 402.15. This issue arises on Page 4 of the PWS in Section 2.3.5 Task 5 as well.

Can the government confirm that they are requesting a financial statement audit following auditing standards in accordance with a financial statement audit, i.e. AU-C

330?

RESPONSE: THE GOVERNMENT IS NOT REQUESTING A FINANCIAL

STATEMENT AUDIT FOLLOWING AUDITING STANDARDS IN

ACCORDANCE WITH A FINANCIAL STATEMENT AUDIT. REMOVED

REFERENCES TO AU-C 402 IN SECTIONS 2.1 THROUGH 2.3.

19. Section 2.5.9 and Section 3.1 - On Page 7 of the PWS under section 2.5.9 Review Report, no standard is specified. Can the government clarify the standard that must be followed to execute and report on this contract?

At the top of page 8 of the PWS under section 3.1 Engagement (Audit and Examination)

Documentation, the requirement states: ‘The Contractor will prepare engagement documentation in accordance with Government Auditing Standards, AICPA standards, and GAO/PCIE FAM.’

Although it is clear that the government is requiring that engagement documentation follow GAGAS, AICPA, and GAO requirements, it is not clear what standards must be followed to issue the report. Can the government clarify what standards are to be followed for the report?

RESPONSE: THE GOVERNMENT IS REQUIRING A

PERFORMANCE/PROGRAM AUDIT CONDUCTED IN ACCORDANCE WITH

GOVERNMENT AUDITING STANDARDS. SECTION 1.3 HAS BEEN

UPDATED TO REFLECT THIS.

Please note that attestations under AICPA and GAGAS would require that management provide an assertion to the auditor and use suitable criteria..

The government should also note that if they are requiring a financial statement audit in accordance with GAGAS and AICPA requirements, the government should identify which statements are required to be audited.

RESPONSE: THE GOVERNMENT IS NOT REQUESTING A FINANCIAL

STATEMENT AUDIT FOLLOWING AUDITING STANDARDS IN

ACCORDANCE WITH A FINANCIAL STATEMENT AUDIT. REMOVED

REFERENCES TO AU-C 402 IN SECTIONS 2.1 THROUGH 2.3.

The following questions were inadvertently left off the original Q&A posting:

20. RFP Section: Paragraph “3.2.2 Facility Security Clearance”

Question: This paragraph states that “DoD OIG will initiate a DD 254 to the prime

Contractor”. However, the same Paragraph also states that “The Contractor shall possess an active facility clearance of SECRET from the Defense Security Service (DSS) Facility

Clearance Branch at the time of its proposal…”.

Would DoDEA and DoDOIG consider the possibility of adding an addendum allowing contractors without an active facility clearance to submit a proposal and to then be processed for a facility clearance if awarded the contract? The current clearance levels of the proposed staff would, of course, be included in the proposal?

If one of the Prime’s subcontractors is a Big Four accounting firm and (1) all work is performed at the accounting firm’s facilities (2) all work is performed utilizing their equipment and (3) the accounting firm has a Secret level facility clearance, would

DoDEA and DoDOIG consider waiving the facility clearance requirement for the Prime contractor?

RESPONSE: THE GOVERNMENT WILL NOT ADJUST THE SECURITY

REQUIREMENTS OF THE RFP

21. RFP Section: Section: 2. (Offeror Structure, Content and Additional Instructions), paragraph i (Proposal Organization, VOLUME II – PAST PERFORMANCE

PROPOSAL (FACTOR II)),Item b.:

Question: This sections states that “The Past Performance information submitted in the proposal should address only previous efforts where the offeror or its subcontractors performed as the Prime Contractor. Past performance information from an offeror or its subcontractors for which the offeror or its subcontractors where not listed as a prime will not be considered relevant.”

Given that this is a 100% small business set aside and that a substantial portion of the projects small businesses perform are typically in a subcontractor capacity, can this clause be modified to allow submission of relevant Past Performance for subcontract projects.

RESPONSE: THE GOVERNMENT WILL NOT ADJUST THE PAST

PERFORMANCE REQUIREMENTS OF THE RFP

22. We understanding that non-CPA firms may submit proposals and be awarded a contract under this solicitation. Could you please confirm?

RESPONSE: YES. CORRECT

23. Would the Government please identify the type of service to be provided? Do we understand that the Government wishes an independent contractor to provide positive assurance over completed SSAE18s and to provide positive assurance as to the design and operating effectiveness of relevant CUECs / CSOCs? Is the Government requesting a performance audit conducted in accordance with Government Auditing Standards?

RESPONSE: THE GOVERNMENT IS SEEKING AN INDEPENDENT

CONTRACTOR TO PROVIDE REASONABLE ASSURANCE OVER

COMPLETED SSAE 18S AND REASONABLE ASSURANCE AS TO THE

DESIGN AND OPERATING EFFECTIVENESS OF RELEVANT CUECS/CSOCS.

YES, THE GOVERNMENT IS REQUESTING A PERFORMANCE AUDIT

CONDUCTED IN ACCORDANCE WITH GOVERNMENT AUDITING

STANDARDS.

24. Please clarify whether the Government is seeking a review report ("Draft Review

Report / Final Review Report") as defined by GAO Government Auditing Standards Ch.

2.09(b).

RESPONSE: SECTION 5, EXHIBIT 1 HAS BEEN UPDATED.

25. Task 2.2 requires “The contractor shall determine whether the applicable CUECs that correspond to the Service Organization’s controls have been implemented by user entities.”

a. Can you provide the list of user entities?

RESPONSE: ATTACHMENT 1 OF THE PWS PROVIDES THE LIST OF USER

ENTITIES.

b. How many user entities must the contractor examine to determine whether CUECs were properly designed and implemented?

RESPONSE: ATTACHMENT 4 OF THE PWS LISTS THE USER ENTITIES FOR

TASK ORDER 1 THAT THE CONTRACTOR MUST EXAMINE.

26. Task 2.3 requires “The contractor shall determine whether the applicable CSOCs that correspond to the Service Organization’s controls have been implemented by the subservice organizations”

a. Can you provide the list of subservice Organizations?

RESPONSE: SUBSERVICE ORGANIZATION - DEFENSE INFORMATION

SYSTEMS AGENCY (DISA) FOR TASK ORDER 1.

b. How many subservice organizations must the contractor examine to determine whether CSOCs were properly designed and implemented?

RESPONSE: ONE (1) FOR TASK ORDER 1.