ITGCIM SSJ 26-12 LSJ.pdf

U.S. Department of Homeland Security Sole Source Justification (SSJ) Federal Emergency Management Agency (FEMA) February 2026

SSJ Template > SAT 2- 1 - SSJ No: 26-112

Sole Source Justification (SSJ) For orders or BPAs exceeding the Simplified Acquisition Threshold

SSJ No.: 26-112

This acquisition is conducted under the authority of the Multiple-Award Schedule Program, 41 U.S.C. 152(3), Competitive Procedures, and 40 U.S.C. 501, Services for Executive Agencies.1

Pursuant to the Federal Acquisition Regulations (FAR) 8.4, FAR Class Deviation 25-20 and in accordance with the requirements of RFO 8.4, the justification for the use of the authority under GSAM 538.7104-3 is justified by the following facts and rationale required under RFO 8.4 and

HSAM 3008.401-71.

1. Identification of the agency, contracting activity, and specific identification of the document as a “Sole Source Justification.”

The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Office of the Chief Financial Officer (OCFO), Risk Management & Compliance Division (RM&C) proposes to award an order pursuant to HSAM 3008.401-71, Sole source justifications, and GSAM 538.7104-3, Sole source justifications.

2. Nature of the action being approved (Contractor name, contract type, and total estimated value with options).

(a) Nature of action: FEMA intends to procure a contract, on a sole source basis, to continue critical activities and responsibilities inherent to the OCFO, and the Agency on a whole.

(b) Name and address of the contractor: Guidehouse Inc.

1676 International Drive Ste. 800 McLean, VA 22102-3600

(c) Contract type: FEMA intends to procure a firm-fixed price contract.

1 In this document, citations to RFO Part 6, RFO Part 8, RFO Part 25, and HSAR Part 3006 are citations specifically to Federal Acquisition Regulation (FAR) Class Deviation 25-11 for FAR Part 6, FAR Class Deviation 25-20 for FAR Part 8, FAR Class Deviation 26-09, Revision 1, for FAR Part 25, and Homeland Security Acquisition Regulation (HSAR) Class Deviation 25-01 for HSAR Part 3006, which were issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025.

http://uscode.house.gov/

SSJ Template > SAT 2- 2 -

(d) Estimated total value (including options). Provide breakdown as shown below:

Period Unit Price Total

Base Year

12 mo.

n/a

$1,623,206.64

Price Rationality: FEMA prepared an Independent Government Cost Estimate (IGCE) for this order using not-to-exceed hourly ceiling rates from Buy.GSA.gov as the predominant input. The proposed labor mix is based on the prior task order (70FA4025F00000356), current program needs, and the proximity to the end of the fiscal year. The Contracting Officer determined that the price is fair and reasonable by comparing the proposed labor rates to the contractor’s awarded Multiple Award Schedule (MAS) rates. Further comparison of the proposed rates to prices under the DHS Financial Management and Operations (FMO) Support BPA and the Assessment of Internal Controls Support Services (AICSS) BPA was conducted to ensure reasonableness. This effort confirmed that the proposed rates fall within the not-to-exceed hourly ceiling rates obtained from Buy.GSA.gov for comparable labor categories.

3. A description of the supplies or services required to meet the agency’s needs.

The required contract support delivers specialized expertise within FEMA’s legacy data environment to perform Information Technology General Controls (ITGC) assessments over FEMA’s core accounting, insurance, and grant systems, and to perform Internal Controls Assessment over the Federal Insurance Division’s National Flood Insurance Program (NFIP).

These assessments help maintain the confidentiality, integrity, and availability of federal data and associated internal control processes. Testing support is critical for identifying and diagnosing instances of financial fraud, waste, and abuse within federal monetary and procurement platforms. These functions include understanding and applying Internal Controls Over Financial Reporting (ICOFR) assessments routinely provided to the FEMA Finance Center, Financial Assurance, and Audit Liaison offices which oversee management of undelivered orders and ensure timely financial oversight. These assessments allow the Secretary of DHS to attest to the Departments Annual Statement of Assurance.

The financial and insurance management services procured through this solicitation have been provided to FEMA by Guidehouse since 2019. BPA 70FA4019A00000001 previously supported this work but expired in the Fall of 2024. An individual task order (70FA4025F00000356) from MAS GS-00F-045DA, was input in the Fall of 2025 to continue this support. This order expires May 29, 2026.

Guidehouse has been the sole performer of internal control assessments over the National

Flood Insurance Program’s (NFIP) business processes, claims, and IT systems since FY 2010. Over this span, they have strengthened NFIP’s overall control environment to improve financial reporting accuracy, elevate actuarial rigor, and facilitate adoption of new technologies. Specifically, this work now includes testing NFIP’s new financial accounting

SSJ Template > SAT 2- 3 -system (Taurus), including evaluation of control design and operating effectiveness. This work helps program personnel prepare for significantly larger transitions from legacy data systems which are imminent and engrained in the OCFO Financial System Modernization (FSM) directive.

The intent of this requirement is to continue the specialized support from Guidehouse for 12 months. This period of performance is needed as the services under this order are aligned to FEMA’s annual internal control assessment cycle. For FY 2026, this assessment cycle is directly related to preparations for the OCFO FSM directive which has a targeted go-live date of October 1, 2026. With a requested contract start date of May 30, 2026, the RMC program is submitting this justification, in part, to ensure continuity of operations through the end of the fiscal year and so that NFIP-related internal control testing and ITGC work are completed and documented for the Statement of Assurance and FY 2026 audit opinion.

A staff transition and training period in May 2026 and onward would severely delay all current Test of Design (TOD) and Test of Effectiveness (TOE) functions being performed across the Agency. FEMA did not intend to position itself where a contract so closely related to overall financial assurance would expire during the most critical time of the year.

However, given contract funding conditions enacted in recent years, and broader funding interruptions across DHS which resulted in a partial operational shutdown of 76 days, the earliest possible acquisition plan has been utilized for this requirement. This accelerated plan includes the utilization of this justification for the maintenance of specialized operations.

Outside of program needs, reduced timelines, and modernization efforts, this requirement requests a 12-month period of performance based on the procurement strategy of the RMC Division for beyond FY 2026. The timing of this sole source action reflects the impact of recent funding interruptions, which delayed acquisition planning and shortened the window in which a competed follow-on vehicle could be reasonably developed and awarded. The program anticipates implementing a new Blanket Purchasing Agreement (BPA) for financial management services over the next 12 months, with an open competition for subsequent requirements. FEMA intends to structure the follow-on competition and associated contract terms to reduce dependence on any single vendor and to ensure that operational assets, documentation, and tools are maintained in a form that will facilitate future competition.

4. The statutory exception and supporting rationale (see GSAM 538.7104-3(b)(1))) and if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

GSAM 538.7104-3(b)(1)(ii) Only one source is capable of providing the products, services, or solution required at the level of quality required because the products, services, or solutions are unique or highly specialized.

SSJ Template > SAT 2- 4 -

This notion was underscored during a market research exercise in January 2026 when FEMA issued an industry-wide Request for Information (RFI) solicitation which outlined the needs of the ITGC and Insurance Management requirement. Through this effort, the RMC program identified several MAS contractors as somewhat capable of performing A-123 internal control assessments and ITGC work.

However, there was no capable vendor positioned to assume the specialized in-progress work within the current, accelerated timeline of the RMC and NFIP programs. This timeline is especially pertinent in FY 2026 given two funding-related shutdowns which have significantly altered the operational landscape of FEMA and DHS. Only the incumbent, Guidehouse, has the combination of long-standing NFIP-specific internal control experience, embedded tools and work products, and current engagement in the FY 2026 assessment cycle necessary to perform the requirement at the needed level of quality, and within the necessary timeframe.

Guidehouse is currently performing ongoing OMB A-123 internal control assessments and is actively engaged in the current assessment cycle, completing TOD, in coordination with process owners. At this stage in the cycle, the contractor has implemented specialized, program-specific institutional knowledge, including:

- Detailed understanding of end-to-end business processes and control design

- Established working relationships with process owners and control operators

- Familiarity with prior year findings, corrective actions, and repeat issues

- Knowledge of testing strategies, documentation standards, and risk determinations specific to the organization

This specialized knowledge and embedded access are critical, as the assessments are in execution, where continuity and judgment consistency are essential. Individual Guidehouse staff act as highly unique tools now intrinsic to the Agency. Transitioning to a new contractor at this point would necessitate a complete overhaul of ITGC testing and associated Insurance Management programs. It is estimated that this overhaul would require 1-2 years of program re-development, to include rebuilding trust and coordination with internal process owners and external stakeholders. This would result in:

- Duplication of effort and increased cost

- Delays in control testing completion and validation

- Disruption to established communication channels with process owners, reducing efficiency and data reliability

Most critically, such delays would jeopardize FEMA’s ability to meet established Commitment Letter deadlines, which are directly tied to annual internal control reporting requirements. Failure to meet these deadlines would adversely affect Financial Management Health Assessment (FMHA) scoring, as timely and complete internal control reporting is a key performance metric.

SSJ Template > SAT 2- 5 -

Maintaining continuity of operations is essential given the pending onboarding of a new external auditor, which places heightened importance on consistency in methodologies, documentation, and responsiveness to audit requests. Introducing a new contractor during this transition period would create additional risks by:

- Interrupting continuity of evidence and audit support

- Undermining consistency in testing approaches and conclusions across reporting periods

- Increasing the likelihood of audit findings due to inconsistencies or gaps in documentation

FEMA estimates that any new MAS contractor would require approximately 60–90 days to onboard, train, and perform in FEMA’s NFIP control environment. Because this transition period would run through the same months in which the FY 2026 Statement of Assurance must be finalized and key FSM pre-implementation activities must be completed in advance of the October 1, 2026 go-live, there is insufficient time to transition without pausing or duplicating significant portions of the work. On that basis and given the already compressed schedule resulting from recent funding disruptions, the program determined that it is not possible to transition this requirement to a new MAS contractor for the FY 2026 cycle.

For these reasons, no other source can meet FEMA’s needs within the required timeframe without substantial duplication of cost and unacceptable programmatic risk, and a sole source award is justified.

5. FEMA intends to post this justification on SAM.gov pursuant to GSAM 538.7104-

3(b)(3)(ii).

6. Contracting Officer’s Certification. I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Contracting Officer Date

SSJ Template > SAT 2- 6 -

7. Technical/Requirements Personnel Certification. I certify this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Technical Representative Date

APPROVAL:

Contracting Officer Date

Note: The Contracting Officer is the final approving official when the action does not exceed $900K.

Procuring Activity Advocate for Competition Date

Note: The Procuring Activity Advocate for Competition (PAAC) is the final approving official when the action exceeds $900K but is less than or equal to $20M.

Approval by the PAAC is not required if the J&A is reviewed and approved by an official designated by the Component who is a member of the armed services at the general or flag officer level or a civilian in a grade above the GS-15 (or equivalent) level. However, this exception does not apply to justifications citing that cite RFO 6.103-2 Unusual and Compelling Urgency as the authority.

Head of Contracting Activity Date

SSJ Template > SAT 2- 7 -

Note: The HCA is the approving official when the action exceeds $20M but is less than or equal to $90M (less than or equal to $150M for USCG). The HCA is not required to approve the justification if the Component PAAC is a member of the armed services at the general or flag officer level or is a civilian in a grade above the GS-15 (or equivalent) level. HCA may also delegate approval to a member of the armed services at the general or flag officer level or a civilian in a grade above the GS-15 or equivalent level. However, this exception does not apply to justifications that cite RFO 6.103-2 Unusual and Compelling Urgency as the authority per HSAR 3006.104-270 (HSAR Class Deviation 25-01).

Chief Procurement Officer Date

Note: The Chief Procurement Officer is the final approving official when the action exceeds $90M (exceeds $150M for USCG) and must also sign the justification when it results in the invocation of the exception to the Buy American statute at RFO 25.103(b)(2) or 25.202(a)(2), regardless of dollar amount. When CPO approval is required only because RFO 25.103(b)(2) or 25.202(a)(2) is applicable to the procurement, the J&A shall be routed for review and approval using the Buy American Reporting Tool in OCPO’s Enterprise Reporting Application.