OCFO RMC Remediation RFI.pdf

Federal Emergency Management Agency (FEMA) OCFO Financial Management Division

Corrective Action & Audit Remediation Support Services Request for Information (RFI)

September 9, 2026

REQUEST FOR INFORMATION (RFI) SUMMARY: The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Office of the Chief Financial Officer (OCFO), Financial Management Division, Risk Management and Compliance (RMC) Branch, is conducting market research to identify contractors capable of providing corrective action and audit remediation support services.

The anticipated requirement is focused on corrective action implementation and remediation support after internal control deficiencies, audit findings, risks, or compliance issues have been identified through audits, assessments, monitoring, management reviews, or other oversight activities. Support may include corrective action planning, Mission Action Plan support, Plans of Action and Milestones support, business process and internal control remediation, IT control remediation, remediation documentation, testing and validation of remediation efforts, reporting, stakeholder coordination, and knowledge transfer.

Note: Routine internal control assessment, recurring compliance monitoring, baseline control testing, and A-123 testing activities are outside the primary scope of this requirement and may be addressed through a separate Internal Control and Compliance Support Services requirement.

This separation is intended to preserve clarity of roles, reduce overlap between assessment and remediation activities, and support appropriate objectivity in FEMA’s internal control and compliance environment.

GENERAL INFORMATION: This RFI is issued solely for information gathering purposes to identify sources capable of supporting FEMA OCFO RMC. The anticipated support will supplement Federal resources with technical expertise to strengthen FEMA’s internal control environment, improve audit readiness, address financial, operational, IT, and compliance risks, and align remediation activities with OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, federal financial management requirements, DHS policy, and FEMA guidance.

In accordance with FAR 15.201(e), RFIs may be used when the Government wants to obtain price, delivery, other market information, and capabilities for planning purposes. Responses to these RFIs are not offers and cannot be accepted by the Government to form a binding contract. This RFI shall not be construed as a commitment by the Government for any purpose, nor does it restrict the Government to an ultimate acquisition approach. Respondents are solely responsible for all expenses associated with their RFI response. Respondents will not receive additional information in response to their submittal to the RFI and will not be notified of the resulting market research.

PROPRIETARY INFORMATION AND DISCLAIMERS: Respondents shall identify any proprietary information in its RFI response. Information submitted in response to this RFI will be used at the discretion of the Government. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts. FEMA reserves the right to utilize any non-proprietary technical information in the anticipated PWS or solicitation.

Although it is not necessary to address in their response, respondents shall be aware of any potential, actual, or perceived organizational conflicts of interests. Any real or potential conflicts must be

Corrective Action & Audit Remediation Support Services Request for Information (RFI)

September 9, 2026 sufficiently mitigated prior to a contract award. For further guidance, refer to the Federal Acquisition Regulation, Part 9.5.

NAICS CODE: 541211

PRODUCT SERVICE CODE (PSC): B704

ANTICIPATED PERIOD OF PERFORMANCE START DATE: January 2026

ANTICIPATED ACQUISITION STRATEGY: To be determined

ATTACHMENT: Statement of Objectives

RFI RESPONSE SUBMITTAL INSTRUCTIONS:

Interested contractors shall submit their RFI responses electronically to Janine Bennett, Contracting Officer, at janine.bennett@fema.dhs.gov and Matthew Dusing, Contracting Officer Representative, at matthew.dusing@fema.dhs.gov no later than 3:00PM Eastern Standard Time (EST), September 30, 2026, Questions regarding this RFI are due no later than 3:00PM Eastern Standard Time (EST), September 23, 2026.

“RFI Response for FEMA OCFO Corrective Action and Audit Remediation Support Services” shall be in the subject line of your e-mail. All responses shall be unclassified, with proprietary information clearly marked. The document format shall be either Microsoft Word (.doc or .docx), or Adobe Acrobat (.pdf) formats. Pages shall be 8.5 by 11 inch and shall use a type pitch that is no smaller than a standard 11-point font type, with the exception of charts, graphs, or tables, which shall use a pitch not smaller than 10-point font. Responses shall not exceed (5) pages in length including images, data displays, charts, graphs, and tables. Page limitation does not include: (1) cover page. Do not include promotional materials.

RFI Responses shall include the following information in the order below:

A. Cover Page with the following information:

1. Company Name

2. Company Address

3. UEI Number

4. Company Point of Contact - Name, Title, Phone, and Email address

5. Statement of current business size status (i.e., HUBZone small business concern, service-disabled veteran-owned small business firm, 8(a) contractor, woman-owned small business, small business, or large business concern). Also, business size in relation to the NAICS code size standards assigned to this acquisition.

6. GSA Schedule Number, Contract Number, and Period of Performance and/or DHS Strategic Sourcing Vehicle Category Name and Contract Number, if applicable

Pierce, Sarah Unsure of all these

Corrective Action & Audit Remediation Support Services Request for Information (RFI)

September 9, 2026

B. Contractor Capability Statement - No more than one page in length and included in the (5) page limit.

1. Summarization of relevant projects and experience showing capabilities.

2. Past performance in applicable areas

C. Contractor RFI Responses to questions (No more than 10 pages in length).

The responses received will assist FEMA with identifying the number and nature of the entities that consider themselves potential technical solution providers. Each respondent, by submitting a response, agrees that any cost incurred in response to this RFI, or in support of activities associated with this RFI, shall be the sole responsibility of the respondent. FEMA shall incur no obligations or liabilities whatsoever, to anyone, for any costs or expenses incurred by the respondent in responding to this RFI.

REQUEST FOR INFORMATION (RFI) QUESTIONS

1. Corrective Action and Audit Remediation Experience

What experience does your organization have supporting corrective action implementation and remediation of internal control deficiencies, audit findings, material weaknesses, significant deficiencies, reportable conditions, Mission Action Plans, Corrective Action Plans, or Plans of Action and Milestones for federal agencies or similarly complex organizations? Please describe the types of findings remediated, the scope and complexity of the remediation effort, and outcomes achieved.

2. Remediation Planning and Root Cause Analysis

What is your organization’s approach to developing actionable remediation plans for previously identified deficiencies or audit findings? Please describe your methodology for supporting root cause analysis, identifying corrective actions, defining milestones, identifying dependencies and impediments, establishing measurable outcomes, and supporting management oversight of remediation progress.

3. Testing, Verification, Validation, and Remediation Documentation

What experience does your organization have supporting testing, verification, and validation of remediation efforts for previously identified deficiencies, findings, or risks? Please describe your experience with evidence review, test of design, test of effectiveness, milestone review, closure package development, documentation of remaining risk, and support for management review, audit follow-up, or compliance reporting.

4. IT Control and System-Related Remediation

What experience does your organization have supporting remediation of previously identified IT control findings and system-related risks affecting financial reporting, operational controls, data quality, system interfaces, or compliance? Please describe your experience with IT general controls, application controls, system-generated reports, access-related processes, change management, configuration management, Corrective Action & Audit Remediation Support Services Request for Information (RFI)

September 9, 2026

FISCAM, NIST guidance, POA&Ms, and coordination between business process owners and system owners. Please distinguish remediation support from routine A-123 ITGC or application control testing.

5. Business Process, Reporting, and Data Quality Remediation

What experience does your organization have supporting business process improvement, financial reporting remediation, data quality improvements, reconciliation improvements, financial systems conformance, DATA Act-related controls, or other financial management remediation activities? Please describe the scope, scale, transaction volume, complexity, stakeholders supported, and outcomes of comparable work.

6. Sustained Support, Surge Capacity, and Technical Assistance

How would your organization provide timely and scalable remediation support throughout the fiscal year, including during audit cycles, reporting periods, remediation milestones, surge requirements, and ad hoc technical assistance requests? Please describe your approach to staffing continuity, responsiveness, quality control, and support for concurrent remediation priorities across multiple program areas.

7. Capacity, Partnerships, and Independence Considerations

Does your company have the internal capacity and qualified personnel to perform the full range of anticipated corrective action and audit remediation support services? If partnership with another entity would be required, please describe the proposed structure and the functional areas each entity would support. Please also describe how your organization would identify, avoid, or mitigate potential independence concerns or organizational conflicts of interest related to assessment, testing, remediation, and validation activities.

8. Leading Practices, Tools, and Innovation

How would your company identify and apply leading practices, tools, data analytics, automation, or innovative approaches to improve remediation planning, corrective action tracking, risk identification, documentation quality, management reporting, stakeholder coordination, and knowledge transfer while adhering to applicable DHS and FEMA policies?

OPTIONAL Contract Strategy Questions.

Responses to the following questions are optional and are requested solely for market research and acquisition planning purposes. Responses to these questions are excluded from the page limitation for required RFI responses.

a) Performance Metrics

Based on the draft Statement of Objectives, what performance metrics or service quality measures would you recommend the Government consider to assess successful delivery of corrective action and audit remediation support services?

Corrective Action & Audit Remediation Support Services Request for Information (RFI)

September 9, 2026

b) Staffing Approach

Based on the draft Statement of Objectives, what estimated number of full-time equivalent technical staff would be appropriate to support the anticipated requirement? Please identify approximate labor categories, skill sets, and any key assumptions affecting staffing levels.

c) Requirement Structure

Does your organization recommend structuring this requirement by functional area, such as business process remediation, IT remediation, testing/verification/validation of remediation efforts, reporting, and technical assistance, or as an integrated corrective action and audit remediation support contract?

Please explain your recommendation, including any implications for quality control, staffing, or contract management.