OCFO_RMC_Corrective_Action_RFI.pdf

Federal Emergency Management Agency (FEMA) OCFO Financial Management Division

Corrective Action Implementation and Audit Remediation Support Request for Information (RFI)

October 9, 2026

REQUEST FOR INFORMATION (RFI) SUMMARY: The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Office of the Chief Financial Officer (OCFO), Financial Management Division, Risk Management and Compliance (RMC) Branch, is conducting market research to identify contractors capable of providing corrective action and audit remediation support services.

The anticipated requirement is focused on corrective action implementation and remediation support after internal control deficiencies, audit findings, risks, or compliance issues have been identified through audits, assessments, monitoring, management reviews, or other oversight activities. Support may include corrective action planning, Mission Action Plan support, Plans of Action and Milestones support, business process and internal control remediation, IT control remediation, remediation documentation, testing and validation of remediation efforts, reporting, stakeholder coordination, and knowledge transfer.

Note: Routine internal control assessment, recurring compliance monitoring, baseline control testing, and A-123 testing activities are outside the primary scope of this requirement and may be addressed through a separate Internal Control and Compliance Support Services requirement.

This separation is intended to preserve clarity of roles, reduce overlap between assessment and remediation activities, and support appropriate objectivity in FEMA’s internal control and compliance environment.

GENERAL INFORMATION: This RFI is issued solely for information gathering purposes to identify sources capable of supporting FEMA OCFO RMC. The anticipated support will supplement Federal resources with technical expertise to strengthen FEMA’s internal control environment, improve audit readiness, address financial, operational, IT, and compliance risks, and align remediation activities with OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, federal financial management requirements, DHS policy, and FEMA guidance.

This RFI is issued solely for market research and acquisition planning under RFO FAR 10.001(c) and (e), as implemented by DHS FAR Class Deviation 25-06, and RFO FAR 15.101(c), as implemented by DHS FAR Class Deviation 26-08. The Government does not currently intend to award a contract on the basis of this RFI or otherwise pay for the information requested. Responses are information only, are not proposals or offers, and cannot be accepted by the Government to form a binding contract. This RFI does not commit the Government to an acquisition, solicitation, or award, or restrict the Government to an ultimate acquisition approach. Respondents are solely responsible for all expenses associated with preparing and submitting a response. Respondents will not receive individual feedback on their submissions or notice of the results of the market research.

PROPRIETARY INFORMATION AND DISCLAIMERS: Respondents should clearly identify any information in their RFI responses that they consider proprietary or confidential and identify the specific portions for which protection is requested. FEMA will handle submitted information in accordance with applicable law and Government policy; marking information as proprietary or confidential does not guarantee that it will be withheld from disclosure. FEMA reserves the right to use nonproprietary technical information in the anticipated PWS or solicitation.

Corrective Action Implementation and Audit Remediation Support Request for Information (RFI)

October 9, 2026

Respondents should consider whether their current or past work could create an actual or potential organizational conflict of interest related to this requirement. Any conflict identified for a future acquisition will be evaluated and addressed before award, as appropriate. For further guidance, see FAR subpart 9.5, Organizational and Consultant Conflicts of Interest, as implemented by DHS FAR Class Deviation 25-27, Revision 3.

NAICS CODE: 541211

PRODUCT SERVICE CODE (PSC): B704

ANTICIPATED PERIOD OF PERFORMANCE START DATE: January 2026

ANTICIPATED ACQUISITION STRATEGY: To be determined

ATTACHMENT: Statement of Objectives

RFI RESPONSE SUBMITTAL INSTRUCTIONS:

Interested contractors shall submit their RFI responses electronically to Janine Bennett, Contracting Officer, at janine.bennett@fema.dhs.gov and Matthew Dusing, Contracting Officer Representative, at matthew.dusing@fema.dhs.gov no later than October 30, 2026. Questions regarding this RFI are due no later than October 16, 2026.

“RFI Response for FEMA OCFO Corrective Action Implementation and Audit Remediation Support” shall be in the subject line of your e-mail. All responses shall be unclassified, with proprietary information clearly marked. The document format shall be either Microsoft Word (.doc or .docx), or Adobe Acrobat (.pdf) formats. Pages shall be 8.5 by 11 inch and shall use a type pitch that is no smaller than a standard 11-point font type, with the exception of charts, graphs, or tables, which shall use a pitch not smaller than 10-point font. Responses shall not exceed (5) pages in length including images, data displays, charts, graphs, and tables. Page limitation does not include: (1) cover page. Do not include promotional materials.

RFI Responses shall include the following information in the order below:

A. Cover Page with the following information:

1. Company Name

2. Company Address

3. UEI Number

4. Company Point of Contact - Name, Title, Phone, and Email address

5. Statement of current business size status (i.e., HUBZone small business concern, service-disabled veteran-owned small business firm, 8(a) contractor, woman-owned small business, Pierce, Sarah Unsure of all these

Corrective Action Implementation and Audit Remediation Support small business, or large business concern). Also, business size in relation to the NAICS code size standards assigned to this acquisition.

6. GSA Schedule Number, Contract Number, and Period of Performance and/or DHS Strategic Sourcing Vehicle Category Name and Contract Number, if applicable

B. Contractor Capability Statement - No more than one page in length and included in the (5) page limit.

1. Summarization of relevant projects and experience showing capabilities.

2. Past performance in applicable areas

C. Contractor RFI Responses to questions (No more than 10 pages in length).

The responses received will assist FEMA with identifying the number and nature of the entities that consider themselves potential technical solution providers. Each respondent, by submitting a response, agrees that any cost incurred in response to this RFI, or in support of activities associated with this RFI, shall be the sole responsibility of the respondent. FEMA shall incur no obligations or liabilities whatsoever, to anyone, for any costs or expenses incurred by the respondent in responding to this RFI.

REQUEST FOR INFORMATION (RFI) QUESTIONS

1. Corrective Action and Audit Remediation Experience

What experience does your organization have supporting corrective action implementation and remediation of internal control deficiencies, audit findings, material weaknesses, significant deficiencies, reportable conditions, Mission Action Plans, Corrective Action Plans, or Plans of Action and Milestones for federal agencies or similarly complex organizations? Please describe the types of findings remediated, the scope and complexity of the remediation effort, and outcomes achieved.

2. Remediation Planning and Root Cause Analysis

What is your organization’s approach to developing actionable remediation plans for previously identified deficiencies or audit findings? Please describe your methodology for supporting root cause analysis, identifying corrective actions, defining milestones, identifying dependencies and impediments, establishing measurable outcomes, and supporting management oversight of remediation progress.

3. Testing, Verification, Validation, and Remediation Documentation

What experience does your organization have supporting testing, verification, and validation of remediation efforts for previously identified deficiencies, findings, or risks? Please describe your experience with evidence review, test of design, test of effectiveness, milestone review, closure package development, documentation of remaining risk, and support for management review, audit follow-up, or compliance reporting.

4. IT Control and System-Related Remediation

Corrective Action Implementation and Audit Remediation Support Request for Information (RFI)

October 9, 2026

What experience does your organization have supporting remediation of previously identified IT control findings and system-related risks affecting financial reporting, operational controls, data quality, system interfaces, or compliance? Please describe your experience with IT general controls, application controls, system-generated reports, access-related processes, change management, configuration management, FISCAM, NIST guidance, POA&Ms, and coordination between business process owners and system owners. Please distinguish remediation support from routine A-123 ITGC or application control testing.

5. Business Process, Reporting, and Data Quality Remediation

What experience does your organization have supporting business process improvement, financial reporting remediation, data quality improvements, reconciliation improvements, financial systems conformance, DATA Act-related controls, or other financial management remediation activities? Please describe the scope, scale, transaction volume, complexity, stakeholders supported, and outcomes of comparable work.

6. Sustained Support, Surge Capacity, and Technical Assistance

How would your organization provide timely and scalable remediation support throughout the fiscal year, including during audit cycles, reporting periods, remediation milestones, surge requirements, and ad hoc technical assistance requests? Please describe your approach to staffing continuity, responsiveness, quality control, and support for concurrent remediation priorities across multiple program areas.

7. Capacity, Partnerships, and Independence Considerations

Does your company have the internal capacity and qualified personnel to perform the full range of anticipated corrective action and audit remediation support services? If partnership with another entity would be required, please describe the proposed structure and the functional areas each entity would support. Please also describe how your organization would identify, avoid, or mitigate potential independence concerns or organizational conflicts of interest related to assessment, testing, remediation, and validation activities.

8. Leading Practices, Tools, and Innovation

How would your company identify and apply leading practices, tools, data analytics, automation, or innovative approaches to improve remediation planning, corrective action tracking, risk identification, documentation quality, management reporting, stakeholder coordination, and knowledge transfer while adhering to applicable DHS and FEMA policies?

OPTIONAL Contract Strategy Questions.

Responses to the following questions are optional and are requested solely for market research and acquisition planning purposes. Responses to these questions are excluded from the page limitation for required RFI responses.

a) Performance Metrics

Corrective Action Implementation and Audit Remediation Support

Based on the draft Statement of Objectives, what performance metrics or service quality measures would you recommend the Government consider to assess successful delivery of corrective action and audit remediation support services?

b) Staffing Approach

Based on the draft Statement of Objectives, what estimated number of full-time equivalent technical staff would be appropriate to support the anticipated requirement? Please identify approximate labor categories, skill sets, and any key assumptions affecting staffing levels.

c) Requirement Structure

Does your organization recommend structuring this requirement by functional area, such as business process remediation, IT remediation, testing/verification/validation of remediation efforts, reporting, and technical assistance, or as an integrated corrective action and audit remediation support contract?

Please explain your recommendation, including any implications for quality control, staffing, or contract management.