PWS FIAR AUDIT Source of Sought.pdf

Department of Defense Defense Health Agency

Performance Work Statement

Financial Improvement & Audit Remediation (FIAR) and Audit Services Support

Defense Health Network National Capital Region (DHN-NCR)

PART 5

5.0 SPECIFIC TASKS

Specific Tasks: The following constitute the tasks to be performed under this Performance Work Statement. The exact scope of actual subtasks required in a year can only be estimated. The Contractor shall provide Financial Improvement & Audit Remediation (FIAR) and Audit Services Support for the Defense Health Network National Capital Region.

5.1 Financial Improvement & Audit Remediation (FIAR) and Audit Services Support to multiple DHA organization: The contractor shall provide Program Management Support for the services provided under this contract. In order to meet this requirement, the contractor is required to provide:

• Provide General Accepted Accounting Principles (GAAP) support to (ERP) commercial and/or federal Healthcare organizations of similar size and complexity as the DHN-NCR

• Provide financial statement audits and examinations to organizations of similar size and complexity.

• Assist in remediating audit-related material weaknesses to help achieve or sustain a clean audit opinion at CFO act agencies, or publicly held companies, of similar size and complexity.

• Assist in advising and evaluating compliance with Federal “Green Book” and Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control— Integrated Framework

• Assist in internal management control program under DoD Instruction (DoDI) 5010.40, · “Managers' Internal Control Program Procedures

Experience of all Enterprise Resource Planning systems within the MHS

• Provide change and communication management for Audit, RMIC and transition items within the MHS/NCR

• Assist in NDAA implementation and impact to Defense Health Program

5.2 Focus Areas:

The DHN-NCR requires support with a deep understanding of Health Network-aligned technical domains, while also having the flexibility to respond to changes in priorities across a continually evolving mission. To provide mission critical resources and support across the DHN-NCR, the following support services are required for technical expertise, leading edge process, and specialized support for the specific needs of the DHN-NCR. DHN-NCR’s approach for structuring and sequencing this work promotes effective coordination and support of the DHA, while also optimizing limited Health Network resources. Support is required across multiple key focus areas including but not limited to:

5.2 Program Management: The contractor shall provide Program Management Support for overseeing the performance of all requirements under this PWS Program Management Support consists of, but is not limited to, the following:

• Responsible for completing contractor responsibilities associated with phase in, phase out transition periods, on and off boarding, invoicing, security, travel, personnel time off request, etc.

• Plan Site Assessment / Support Visits Coordination

• Responsible for Strategy Development and Governance, to support a recommended strategy or procedures that ensure effectiveness and compliance of actions taken.

• Contractor shall advise Executive Advisor Support

• Suggested language: Contractor shall ensure Agency personnel are knowledgeable and kept current about records management principles and requirements, Change Management and that they receive records management training appropriate to their needs.

• In-Progress Reviews (IPR). The contractor shall conduct a monthly, formal IPR to report overall project performance and contract status to the COR. The IPR shall discuss issues and recommend courses of action pertaining to tasks specified in the PWS. The IPR is intended to address information and issues at a higher level than the MSR (Monthly Status Report) and provides the contractor the opportunity to present and discuss topics that may require decisions by the COR and/or contracting officer. Following each IPR, the contractor shall prepare and distribute minutes with an Action Item Status Report. The contractor or COR may schedule additional formal and informal progress reviews/project briefings to discuss tasks and deliverables, address and eliminate potential issues, or for general discussions regarding the contract.

• Mandatory Contractor Manpower Reporting (CMR): The Contractor shall report ALL Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor is required to fill in completely all required data fields using the following web address https://sam.gov. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2025. Contractors may direct technical questions to the help desk at: https://sam.gov.

5.2.8 FIAR Program:

Assist in Audit & IPA Liaison and Audit & IPA Remediation. Attend Audit Training & Meeting Support, prepare and conduct training and report compliance. Estimate between 5- 8 training sessions per year and provide Executive Level Support/Metrics for the client. The contractor support shall utilize Microsoft (MS) Office to include MS PowerPoint, MS Word, MS Access, and MS Excel.

5.2.9 RMIC Program & DHN-NCR Compliance:

Contractor shall assist in the functions of this contract in addition to:

• Provide Risk Management and Internal Controls Implementation

• Provide Risk Management & Internal Controls Governance & Reporting – Statement of

Assurance

• Provide Risk Identification and Assessment

• Provide Risk Mitigation and Corrective Action Plan Development

• Provide Risk Monitoring & Testing

• Provide Risk Profile & Dashboarding

• Provide Fraud Risk Management Integration

• Provide Transitional Management Support

• Establish and maintain Business Process Improvement, Documentation & Standardization

• Provide on-going Sampling, Data Analytics, Special Projects

• Provide and maintain Strategic Communications, Change Management, and Training

5.2.10 Military Treatment Facility Support:

• Walter Reed National Military Medical Center (WRNMMC) Direct Support

• Alexander T. (AT) Augusta Military Medical Center Direct Support

The DHN-NCR requires support that possesses not only technical expertise, but also deep experience delivering value within the MHS. All mission support areas have mutual dependencies and must be closely coordinated throughout execution, utilizing specific relevant experience. The DHN-NCR would benefit from organizational capabilities across a wide range of skillsets to support the volume and complexity of this work. These skill sets include but are not limited to program management, supporting risk management activities, supporting financial statement audits, conducting audit remediation activities in the DHN-NCR business environment, experience supporting processes in DHN-NCR in conjunction with DFAS, experience building and executing OMB Circular A-123 Programs in Federal Agencies, and experience performing activities in Army-owned ERP systems.

5.3 Program Management:

The contractor shall provide support to assist the Government in designing and implementing disciplined, comprehensive, and flexible portfolio, program, and project management processes.

The Program Manager(s) will manage the contract staff and the Government Point of Contact will manage the Program Manager(s). Specific areas of support include but are not limited to:

• Proactively manage quality and integration of support across all key focus areas

• Develop briefs and executive planning sessions as needed by DHN-NCR leadership.

• Facilitate / support DHN-NCR Action Teams coordination and project plans execution.

• Monitor trends and focus areas across initiatives to identify gaps and potential points of coordination.

• Proactively identify, manage, and communicate key program risks and dependencies relevant to DHN-NCR support.

• Support the development, review and presentation of position papers and technical guidance on topics, as identified by DHN-NCR leadership.

• Prepare and adhere to a Quality Control Plan (QCP). The QCP will initially be submitted within 30 days of contract award and within 30 days of option period renewal. The QCP shall document how the Contractor will meet and comply with the quality standards established in this statement of work. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in this solicitation. The plan should be updated and submitted as deliverable to the COR, annually at renewal of each option year.

• Develop and submit a Contingency Operations Plan to the Government. The Contingency Operations Plan shall be due within 15 calendar days after the contract award and updated on quarterly basis. The Contingency Operations Plan shall document Contractor plans and procedures to maintain DHN-NCR support during an emergency. The Contingency Operations Plan shall include the following: A description of the Contractor’s emergency management procedures and policy; A description of how the Contractor will account for their employees during an emergency and how the Contractor will communicate with DHN-NCR during emergencies.

Contingency operation plans shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve (12) hours of activation, and shall be sustainable until the emergency is resolved, and normal conditions are restored, or the contract is terminated, whichever comes first. In case of a life-threatening emergency, the COR shall immediately contact the Contractor Program Manager to ascertain the status of any Contractor personnel who is in Government controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the Contractor Program Manager shall promptly open an effective means of communication and verify:

• Key points of contact (Government and Contractor)

• Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

• Means of communication available under the circumstances (e.g., email, webmail, telephone, FAX, courier, etc.)

• Essential work products expected to continue production by priority.

The Program Manager(s), in coordination with the COR, must make use of the resources and tools available to continue DHN-NCR contracted functions to the maximum extent possible under emergency circumstances. The Contractor must obtain approval from the COR and Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

5.3.1 Site Assessment / Support Visits Coordination:

In support of this effort, the contractor shall be required to plan, coordinate and support site assessment visits of across the enterprise. Purpose of visits may include but not limited to:

• DHN-NCR business performance/improvement

• Audit preparation and audit readiness

• Training and coaching of DHN-NCR and MTF Leadership

• Assessing risk, compliance, and corrective action

5.3.2 Strategy Development and Governance:

Effective governance is critical to managing and monitoring strategic and operational priorities.

In support of this effort, the contractor shall support the DHN-NCR in strategic development and planning for priorities to drive measurable performance improvement, in alignment with DHA guidance for each area of support. This includes providing the resources and oversight to enable standardization and effective performance improvement to meet targets and goals. The contractor shall work with DHN-NCR leadership to:

• Facilitate strategic planning sessions for the DHN-NCR and MTFs to align mission, vision, goals, and objectives.

• Facilitate governance meetings to include calendar and agenda development, compilation of pre-read materials, and tracking action items.

• Develop and update charters.

• Develop information and decision briefs.

• Assist DHN-NCR in developing effective strategy and performance planning for focus areas such as:

DHN-NCR Business performance/improvement Audit preparation and Audit Readiness Training and coaching of DHN-NCR/MTF Leadership Assessing risk, compliance, and corrective actions Fraud, waste & abuse

1. Update initiative goals based on industry best practices and alignment to DHA strategic priorities.

5.3.3 Executive Advisor Support:

The contractor shall provide executive advisory support as needed, providing industry leading insight and knowledge to DHN-NCR leadership.

• Provide access to a deep bench of subject matter expertise to provide strategic insights and recommendations.

5.3.4 Communications, Change management, and Training:

Contractor tasks shall include conducting an annual training needs assessment and schedule and developing and delivering training courses. The contractor shall design/develop, provide broad-based communications, and change management support for program management, business process improvement, standardization and other matters related to this effort. The contractor’s strategic communication efforts will enable the DHN-NCR to achieve the following:

• Proactively analyze the progression of audit readiness/sustainment for financial statement audits and provide strategic and implementable solutions to address gaps.

• An integrated and coordinated approach to execute this initiative through the development of communication and change management strategies.

• Develop a Communications Plan to include outreach strategies, approaches, and forums used internally and externally to support collaboration.

• Development/sustainment of open consistent communications to build and maintain awareness and support.

5.3.5 Project Progress & Reporting:

Monthly Progress Report (MPR):

The MPR shall include the completed tasks and actions, upcoming tasks and actions, and any problems/ issues encountered in the performance of this these tasks and actions The MPR is due to the government within 45 days of contract award and monthly, NLT 15th of following month.

5.3.6 Program Management Plan:

The Contractor shall develop a Program Management Plan within 30 days of start of work and within 30 days of option period renewal. The Program Management Plan shall consist of control procedures in accordance with standard industry practices for project administration, execution, and tracking. The plan should be updated and submitted as deliverable to the COR, annually at renewal of each option year. The Program Management Plan shall include the following: detailed plan describing the Contractor’s overall management approaches, policies and procedures including suggested project metrics along with a detailed staffing plan.

5.4 FIAR Program Support:

5.4.1 Audit & IPA Liaison:

The contractor shall support the DHN-NCR review, analyze, distribute, track, and respond to external audit requests received from the Department of Defense Inspector General (DoDIG), Government Accountability Office (GAO), and Independent Public Accountant (IPA). As the largest hospital system within the DHP, the DHN-NCR receives a substantial number of audit requests throughout the fiscal year. It is crucial that audit requests are completed in a timely and accurate manner and undergo quality reviews to support the agency’s goal of achieving a clean audit opinion. The contractor shall assist with audit response while monitoring remediation efforts. Critical outputs include preparation of audit packages, audit trainings, site visits and walkthrough support. The contractor shall facilitate key audit activities and work products, such as:

• Audit Response Center (ARC) Strategy Plan to outline the DHN-NCR’s approach to efficiently manage multiple requests for information, data and supporting documentation during their financial statement audit, including timelines and roles and responsibilities.

• Tightly coordinate and interface with DHA FR&C, DHP Financial Statement Auditors, Service Providers, and other stakeholders specifically in support of preparing for entrance/exit conferences and tracking ongoing PBC/Sample requests.

• Supplemental support in designing, implementing, and executing quality assurance reviews across the audit response life cycle.

• Supporting DHN-NCR on audit response for both Business and IT processes and resulting key supporting documents.

• A reporting approach utilizing data analytics to provide a status of the program, objectives, and areas for improvement.

5.4.2 Audit Remediation:

The contractor shall provide support all non-inherently governmental activities related to internal validation and reporting of remediation, including evaluation of Notices of Findings and Recommendations (NFR)/deficiencies, developing Corrective Action Plans (CAP) to remediate IPA findings, monitoring implementation as prioritized by DHN-NCR leadership, and tracking and reporting the status of remediation efforts to stakeholders. The contractor shall support DHN-NCR and CAP action officers throughout the CAP lifecycle as well as perform validation procedures on evidentiary artifacts as part of internal controls evaluation. The Contractor will support the remediation of deficiencies discovered by the DoD OIG or IPA by locating and presenting the required source documentation, confirming DHP’s position through remediation activity execution, analysis, and results reviews. Critical outputs include comprehensive status briefings and plans for corrective action and remediation while leveraging the ODCFO NFR database. In performance of this task, the contractor shall:

• Conduct root cause analysis on audit findings and known audit weaknesses, including IPA NFRs.

• Coordinate NFR feedback from Subject Matter Experts (SME) to determine any necessary revisions to draft NFRs.

• Track and report NFR and deficiency response status, collecting source files and performing crosswalks to previously identified deficiencies to inform the root cause analysis and CAPs.

• Develop and/or coordinate written recommendations based upon the cited conditions.

• Provide technical assistance in developing CAPs to address deficiencies and ascertain the root cause of the deficiency is resolved.

• Test controls upon completion of CAPs.

• Maintain reconciled NFR dashboards routinely with documentation of concurrence or non-concurrence to the NFR with an explanation and/or proposed corrective action.

• Conduct training workshops on CAP development and implementation tools, processes, and best practices such as Standard Operating Procedure (SOP) development, control design, test script development and execution, and sampling procedures to support sustainment.

Due to the technical nature of support for this task, DHN-NCR requires a team comprised of experienced individuals. The contractor’s professionals supporting this task will have appropriate industry recognized certifications such as CPAs, CISAs, CGFMs and/or PMP with financial statement audit readiness/response experience, in order to better anticipate and respond to identified issues, and to assist in development of technically sound corrective actions for audit identified deficiencies that meet accounting guidance and pronouncements from regulatory bodies.

5.4.3 Audit Training & Meeting Support:

The contractor shall support DHN-NCR in training and meeting logistics. The contractor shall develop a training curriculum, aligned to key audit areas of improvement and sustainment. The contractor shall consider the best training approach to provide support to all applicable levels and stakeholders within DHN-NCR. Trainings will be focused on but not limited to: General Audit knowledge, key audit response processes, key remediation areas, document retention, and lessons learned.

The contractor tasks shall include conducting an annual training needs assessment and schedule and developing and delivering training courses. The contractor will support DHN-NCR audit stakeholders address compliance weaknesses by interpreting and applying guidance and financial reporting requirements promulgated by FASAB, OMB A-136, DoD FMR, and other regulatory bodies. To include, scheduling training sessions, developing presentation materials, and conducting requirements training with DHN-NCR stakeholders.

5.4.4 Strategic Communications:

The DHN-NCR requires support developing strategic communication plans to support conformance with policies and procedures. The Contractor shall assist in the development of information and communications to internal and external audiences that are releasable within the guidelines of DoD and DHA regulations. Strategic communication activities and work products include, but are not limited to:

• Develop communication plans, messaging, and supporting media and products for target audiences.

• Develop and disseminate information regarding MHS/DHA programs, policies, and services.

• Provide strategic guidance to senior executives, including the development of speeches and briefings.

• Develop engaging network-specific content including information graphics and audiovisual materials.

• Utilize data and feedback to enhance healthcare websites.

• Coordinate with various medical organizations, military service organizations, veterans service organizations, as well as other federal and non-governmental organizations at the regional level.

• Provide crisis communications planning support and recommendations on the impact of activities.

5.4.5 Executive Level Support / Metrics:

The contractor shall support executive level meetings, advising on current status of the DHP financial statement audit, audit progress, areas of consideration, and performance metrics.

5.5 RMIC Program & DHN-NCR Compliance:

5.5.1 Risk Management and Internal Controls Implementation:

The DHN-NCR requires support to build upon and enhance its existing Risk Management and Internal Control (RMIC) program. The objective of the RMIC is to identify, manage, and monitor mission critical risks in operations, policies, and procedures, and to establish and maintain an effective internal control system in accordance with Standards for Internal Control in the Federal Government, GA0-14-704G "Green Book," September 10, 2015. In support of DHN-NCR RMIC, the contractor should utilize a prioritized risk-based approach to enable more effective decision-making and obtain reasonable assurance through risk-based analysis, remediation, and continuous monitoring that operations are effective and efficient, that financial reporting is reliable and timely, and support the determination that DHN-NCR is compliant with applicable laws and regulations.

The contractor will support the implementation of the DHN-NCR’s RMIC across the organization based on Office of Management and Budget (OMB) Circular A-123 requirements for Internal Controls over Reporting (ICOR), including ICOR-Financial Reporting (ICOR-FR), ICOR-Operations (ICOR-O), and ICOR-Financial Systems (ICOR-FS). In performance of this task, the contractor shall:

• Effectively execute the implementation of OMB A-123 “Management’s Responsibility for Enterprise Risk Management and Internal Control” and all the provisions of a robust process of risk management and internal control via the DHN-NCR RMIC and reports in the Statement of Assurance (SoA).

• Evaluate the effectiveness and efficiency of the implementation of OMB A-123 program, to include identifying and documenting end-to-end business processes, performing integrated risk assessments, evaluating internal controls, and reporting deficiencies.

• Govern and enhance the financial and Information Technology (IT) controls framework to identify, standardize, and test internal controls over reporting per OMB A-123. Evaluate the Test of Design (ToD) and Test of Effectiveness (ToE) of DHN-NCR controls.

• Effectively track and report RMIC program status utilizing advanced data analytics and dashboarding to provide DHN-NCR leadership oversight of organizational risks and vulnerabilities as well as areas business process and control improvement.

5.5.2 Risk Management & Internal Controls Governance & Reporting – Statement of Assurance (SOA):

The contractor shall build upon the existing DHN-NCR RMIC framework to develop and execute a RMIC strategic plan for governance and compliance that integrates Enterprise Risk Management (ERM), internal control testing, fraud risk management and data analysis, and evaluation and reporting. The contractor shall incorporate best practices to implement a top-down approach that supports ERM and control assessment across all applicable levels and stakeholders within the DHN-NCR, and provides effective and efficient management, oversight, and reporting of compliance with OMB Circular A-123. The contractor shall facilitate key audit activities and work products, such as:

• Develop an annual RMIC strategic plan detailing the RMIC governance structure, roles, responsibilities, goals, and objectives of the Internal Control and Risk Committees to sustain DHN-NCR wide top-down program.

• Aggregate RMIC outputs to produce a consolidated and complete SoA on an annual basis in compliance with the Office of Under the Secretary of Defense (OUSD) SoA reporting requirements.

• Develop executive-level SoA Summary Report for DHN-NCR leadership providing a report on RMIC program status and compliance with applicable laws and regulations.

• Integrate Enterprise Risk Management (ERM) concepts into the governance approach and strategy.

5.5.3 Risk Identification and Assessment:

The contractor shall perform recurring enterprise Risk Assessments over internal controls;

analyze departments, risk types, risk rankings, and responses in coordination with RMIC leadership.

• Apply industry leading best practices to facilitate risk identification and analysis across the DHN-NCR.

• Facilitate risk identification and assessment workshops with DHN-NCR stakeholders.

• Develop Risk Reports for the DHN-NCR Internal Control and Risk Committee on a quarterly basis.

• Maintain DHN-NCR risk assessment and risk profile.

5.5.4 Risk Mitigation and Corrective Action Plan Development:

The contractor shall provide technical assistance to DHN-NCR in developing and managing sound and feasible CAPs to address operational weaknesses, process deficiencies, and audit findings.

• Coordinate with applicable DHN-NCR stakeholders to develop CAPs for internal and external findings and control deficiencies.

• Conduct training workshops on CAP development and implementation tools, processes, and best practices such as Standard Operating Procedure (SOP) development, control design, and test script development and execution to support sustainment.

5.5.5 Risk Monitoring & Testing:

The contractor shall sustain the DHN-NCR RMIC testing program that supports the DHA and IPA through assessment over core business processes, high-risk areas, and relevant financial information systems. The contractor shall also sustain remediated controls for the DHN-NCR internal control program.

• Conduct interviews and walkthroughs with key stakeholders and business process owners.

• Identify key performance indicators and develop test scripts and procedures.

• Perform tests of design and operating effectiveness over internal controls.

5.5.6 Risk Profile & Dashboarding:

A key functionality of a mature RMIC/ERM program and the output of the risk assessment should result in the development and maintenance of a DHN-NCR Risk Profile Dashboard. The Risk Profile Dashboard should contain elements to illuminate the complex relationship that risk exhibits throughout the enterprise. The Risk Profile Dashboard will allow functional process owners to continually manage their respective risks, while also allowing leadership the ability to target remediation efforts where most applicable. The contractor shall manage the Risk Profile Dashboard and provide continual briefs to DHN-NCR leadership and the Internal Control and Risk Committee to the support the prioritization of corrective actions.

• RMIC dashboards should align to and integrate with SoA reporting requirements to streamline the consolidation process and promote timely and accurate reporting.

• Provide support to the DHN-NCR in developing of a RMIC/ERM program tools to facilitate effective implementation and monitoring of OMB Circular A-123:

Management’s Responsibility for Enterprise Risk Management and Internal Control program.

• Required analytic and other skills include SQL, Python, Tableau, Microsoft Access, SoA compilation, and ERM.

5.5.7 Fraud Risk Management Integration:

As a key requirement of NDAA 2022 and part of A-123 and RMIC guidance’s, DHN-NCR requires support to implement an integrated Fraud Risk Management (FRM) program. As risk management requirements continue to evolve DHN-NCR needs to continually prioritize active fraud risk identification, mitigation, and internal controls as fraud risk can escalate quickly, especially during emergencies, such as the COVID-19 public health emergency. Managing the risk of fraud is essential for the DHN-NCR to ensure its mission, resources, and integrity are not compromised. The Fraud Reduction and Data Analytics Act of 2015 (FRDAA) requires agencies to establish financial and administrative controls and procedures to prevent, detect, and respond to fraud. The contractor will integrate FRM into the annual RMIC strategic plan, implement fraud controls, execute a Fraud Control Assessment (FCA), and perform data analytic activities, including data mining and matching techniques, to effectively analyze trends and business areas more susceptible to fraud schemes. FRM activities and work products will include:

• Support the implementation of ELCs, including fraud controls, across all levels of the organization.

• Support the execution of a FCA to monitor fraud control performance and areas for improvement.

• Support advanced data analytics utilizing ADVANA, the DoD’s central repository of enterprise data, to monitor and report on fraud trends.

5.5.8 Transitional Management Support:

As part of supporting DHN-NCR’s RMIC Program, the contractor will support the management of transitional/transformational programs, specifically the resulting risks of such programs/events. The contractor shall work with DHN-NCR leadership to identify needed transitional/transformational programs requiring risk management support. The contractor shall coordinate with key POCs to identify, assess, and monitor/mitigate key risks resulting from major disruptions to the organization.

• Provide support as it relates to financial and non-financial management planning, execution, and operations across the DHN-NCR.

• Support the development and application of a transition risk management strategy and plan. Focus areas may include but are not limited to: Risk management strategy development; Risk mitigation and corrective action facilitation; Coordinate risk monitoring activities.

• Support overall program management for DHN-NCR leadership as required by the priorities of the transition activities.

• Support the development of, reporting and monitoring, and management of transition related financial and performance metrics. Activities may include but are not limited to:

Reporting to DHA; Transition metrics to measure the pace/adoption of transition;

Integration of financial reporting.

• Support the integration of MTFs into the Health-Network construct by supporting the alignment of MTF functional areas and interactions between MTFs and DHN-NCR HQ.

5.5.9 Business Process Improvement, Documentation, & Standardization:

As part of DHN-NCR’s RMIC support, the contractor shall work to document the current business process environment and standardize internal controls. The contractor shall develop core business documents including, process narratives, key control matrixes, system listings, gap analysis, and corrective actions. The majority of process improvement support will be focused on implementing RMIC corrective actions to mitigate risk associated with control gaps, but the contractor will work with DHN-NCR leadership to identify additional areas of focus, as needed.

The contractor shall support DHN-NCR assess the impact of system changes on core business operations as it relates to audit & RMIC.

• Monitor system changes for impact on the control environment.

• Assess the impact of system changes, identifying critical areas of focus related to RMIC and audit, and document changes in key business processes/controls.

• Facilitate end-to-end process walkthroughs with business process owners and key stakeholders.

• Document end-to-end business processes and coordinate with relevant key stakeholders to standardize internal controls for core and prioritized high-risk business operations.

• Identify and document internal control gaps and develop and implement corrective actions to mitigate associated risk.

• Support development of training materials to assist business process owners and key stakeholders effectively and efficiently implement documented business processes and standardized internal controls.

5.5.10 Sampling, Data Analytics, Special Projects

In order to continuously improve data accuracy, completeness, and timeliness to assure uniformity, reduce variance, and promote standardization of information, the DHN-NCR requires a contractor that possesses the functional skills necessary to advance data analytic solutions, data quality and completeness controls. The contractor shall work with DHN-NCR to develop and deploy analytical techniques and tools to support the development and review of data populations and support the remediation of internal and external findings.

• The contractor shall be proficient in query languages and business intelligence programming including Structured Query Language (SQL), Python, Power BI, and R, depending on extracting and compilation of like and unlike data from one or multiple sources.

• The contractor shall support the assessment and design of advanced analytical solutions to support the remediation of internal and external findings (i.e., RMIC and financial statement audit findings).

• The contractor shall provide an assessment of the potential uses cases for implementing advanced analytical solutions in the support of audit, fiscal and business maturity. The contractor shall work with DHN-NCR leadership to identify industry solutions and their applicability/impact for the organization in remediating material weaknesses and significant deficiencies.

5.5.11 Strategic Communications, Change Management, & Training:

In light of changes to organizational structure, key processes and roles and responsibilities throughout the organization, DHN-NCR requires ongoing and continual training to meet standardization needs. The contractor shall support DHN-NCR in strategic communications, change management, and training. The contractor shall develop an RMIC training curriculum, aligned to key RMIC areas of improvement and sustainment. The contractor shall consider the best training approach to provide support to all applicable levels and stakeholders within the organization. Trainings support should be aligned to the RMIC strategic plan and focus on key components of risk management and internal control. Training should specifically focus on:

• RMIC Implementation: Risk Identification, Risk Monitoring/Mitigation, performance measures, process improvements, SOA development, document management, and lessons learned.

• Process Standardization: Changes to enterprise functions, roles and responsibilities, processes, and systems require continual training to ensure standardization, remediation, and sustainment for audit.

The contractor shall support DHN-NCR efficiently and effectively disseminate key information to multiple stakeholders, at each level of the organization. The contractor shall:

• Develop a communications strategy, aligned to key program objectives and stakeholders to disseminate pertinent information quickly and efficiently.

5.6 Military Treatment Facility Support

5.6.1 Walter Reed National Military Medical Center (WRNMMC) Support:

The WRNMMC Chief of Business Analysis and Audit Readiness (BAAR) requires ongoing support with Audit and RMIC initiatives, including risk assessments, control testing, audit response, audit remediation, and communication. Due to its size and location, the WRNMMC consistently receives high numbers of audit requests and walkthroughs from external auditors.

As a result, the WRNMMC requires dedicated support from a team of professionals to prepare for and respond to external audit requests on an ongoing basis. This team of professionals should be experienced with financial statement audit requirements, as well as MHS processes, systems, and internal controls. The WRNMMC BAAR team will coordinate with the WRNMMC Comptroller and resource operations team to build off of existing Audit and RMIC frameworks to manage risk and respond to audit requests. Additionally, this team will coordinate with the NCR Health Network Audit and RMIC teams on a recurring basis to maintain high levels of quality and consistency across the NCR Network. Specific duties/tasks the contractor shall perform but not be limited to include:

• Provided trusted advice to the Government client through applying knowledge of federal guidelines in the areas of FIAR, OMB Circular A-123, FFMIA, and SSAE16 assertions.

• Actively participate in and lead risk assessment discussions.

• Perform testing procedures to identify measures and evaluate the effectiveness of financial and operational controls.

• Collaborate with process owners to document key controls and significant process changes.

• Assist in developing WRNMMC audit plan for multiple independent business functions.

• Assist with the preparation of key departmental communications to business units, executive management and others as directed by the Director of Business Operations and Chief Resource Branch.

• Lead efforts to automate relevant audit processes and to design and implement continuous monitoring efforts for multiple business units.

• Conduct special projects around internal controls and process improvements and other projects, as assigned.

• Provide education and training to supporting Government employees, as applicable.

5.7 Alexander T. (AT) Augusta Military Medical Center Support:

5.7.1 Augusta Military Medical Center Support

AT Augusta requires ongoing audit response and communications support to prepare for and respond to financial statement audit requests. This support should work closely with the AT Augusta Comptroller and resource operations team to develop and implement an audit response framework, as well as key audit communications such as audit training guides, audit response desktop procedures, MTF audit documentation packages, and audit response roles and responsibility charters. This support should also closely coordinate with the NCR Network Audit and RMIC teams to develop and implement standardized policies, procedures, and internal controls. Specific duties/tasks the contractor shall perform but not be limited to include:

• Review audit and compliance work at a detailed level.

• Manage internal control program in coordination with DHN-NCR RMIC to prepare business units and process owners for internal and external audits.

• Develop internal control assessments to test the reliability and integrity of financial and operational information and compliance with regulations.

• Coordinate with business units and process owners to respond to key supporting documentation requests within established guidelines.

• Perform quality assurance reviews of key supporting documentation, including compiling submissions.

• Assist with process improvement projects, including the development and implementation of CAPs.

• Provide education and training to supporting Government employees, as applicable.