RFI DCP Internal Controls Review.pdf

SOURCES SOUGHT/REQUEST FOR INFORMATION (RFI)

THIS SOURCES SOUGHT/REQUEST FOR INFORMATION (RFI) IS NOT A REQUEST

FOR PROPOSALS (RFP) AND SHALL NOT BE CONSTRUED

AS A COMMITMENT BY THE FDIC TO AWARD A CONTRACT.

The Federal Deposit Insurance Corporation (FDIC) is seeking to identify a qualified business which can provide Professional Consulting Services for Assessment and Modernization of the Division of Depositor and Consumer Protection’s (DCP) Internal Control and Review Operations.

This sources sought/RFI is for planning purposes and market research only, and shall not be construed as a Request for Proposal or as an obligation on the part of the FDIC to acquire any products or services; submitting a response does not ensure your firm will be solicited on any resulting Request for Proposal. The FDIC does not intend to award a contract on the basis of this request or otherwise pay for the information requested. Submission of a response to this request is entirely voluntary. The voluntary submission of a response to this request shall not obligate the FDIC to pay or entitle the submitter of information to claim any direct or indirect costs or charges or any other remuneration whatsoever.

As a general background, the FDIC maintains stability and public confidence in the nation's financial system by insuring deposits, examining and supervising financial institutions for safety and soundness and consumer protection, and managing receiverships. The FDIC does not use appropriated funds, and is not subject to the Federal Acquisition Regulation (FAR). Policy documents related to doing business with the FDIC can be found at https://www.fdic.gov/buying/goods/acquisition/index.html

The FDIC strongly encourages the participation of minority-owned and women-owned businesses in all the business and contracting activities of the FDIC.

This Sources Sought/RFI is issued for market research purposes. This market research will assist the FDIC in identifying interested and capable sources as well as developing its acquisition strategy. Submitting a response does not ensure your firm will be solicited on any resulting Request for Proposal(RFP).

Vendors capable of fulfilling this requirement are requested to submit documentation addressing the information below. The FDIC reserves the right to use any and all information submitted by, or obtained from, this RFI in any manner FDIC determines is appropriate including, but not limited to, the creation of a competitive solicitation. If responses include business confidential and/or proprietary information, the information must be clearly marked accordingly, and the FDIC will safeguard it appropriately.

Please review the Draft Statement of Work (SOW) attached herein and provide your firm’s response to the questions below. Your firm’s response is limited to 5 pages (measuring 8.5 by 11 inches, with 1 inch margins) and 12-point font size.

SOURCES SOUGHT QUESTIONS

EXPERIENCE

Provide relevant details on the responder providing the same or similar services offered or made to Commercial and/or Government agencies in the last three (3) years. Details to should include, but not be limited to contract value, information regarding the contract number, agency, https://www.fdic.gov/buying/goods/acquisition/index.html responder performing as a prime or subcontractor, size and length of the effort, type of pricing and/or cost, security details, the kinds of factors used to evaluate performance; the kinds of performance incentives; the kinds of performance assessment methods; the qualifications of the people performing the services; and any unique terms and conditions, that can demonstrate the responder’s abilities and capacity.

CAPABILITIES

Please provide responder’s capabilities to meet the proposed requirements, including:

Requirement capabilities that the responder currently possesses. Responses should include the relevant information regarding specific skills, and experience.

Recommended type of pricing for this type of service.

RECOMMENDATIONS

Please provide information and recommendations for fashioning this proposed acquisition.

Recommendation areas may include the type of contract, incentives, variations in delivery schedule, price proposal support, and data requirements, contract pricing, and any other areas that the responder believes is relevant for the Government to achieve its stated objectives.

GENERAL /ADMINISTRATIVE

The FDIC kindly requests that interested sources capable of fulfilling this requirement submit documentation addressing the requested information above. The FDIC reserves the right to use any and all information submitted by, or obtained from, this sources sought/RFI in any manner FDIC determines is appropriate including, but not limited to, the creation of a competitive solicitation. If responses include business confidential and/or proprietary information, the information must be clearly marked accordingly, and the FDIC will safeguard it appropriately.

Contractors interested in providing this service should be registered in the System for Award Management (www.sam.gov) and should also provide the following:

• Other feedback or questions

• A point of contact

The FDIC will evaluate responses to assess solutions that adequately meet the capabilities.

The final solicitation may be by invitation only, and may not be released to the general public.

All responses must be submitted electronically to the Contracting Officer (CO), Jemal Williams, at jemwilliams@fdic.gov, by 12:00p.m. EDT on November 19, 2024. All questions pertaining to this RFI should be directed to the CO at the email address specified. The CO may contact responders to clarify capabilities and other matters.

http://www.sam.gov/

Attachment: DRAFT STATEMENT OF WORK

Professional Consulting Services for Assessment and Modernization of the Division of Depositor and Consumer Protection’s (DCP) Internal

Control and Review (ICR Section’s Operations)

GENERAL

1. BACKGROUND

The mission of the Federal Deposit Insurance Corporation (FDIC) is to maintain stability and public confidence in the nation’s financial system by (1) insuring deposits;(2) examining and supervising financial institutions for safety and soundness and consumer protection; (3) making large and complex financial institutions resolvable; (4) and managing receiverships. The FDIC Headquarters (HQs) is located in Washington, D.C., and Arlington, Virginia, with Regional, and Field Territories and Offices around the country. The Regional Offices are in Atlanta, Chicago, Dallas, Kansas City, New York and San Francisco. The FDIC has a workforce of approximately 6,486 employees, with financial institution examiners as the largest occupational group. This group is mobile and engaged in bank supervision and related activities, and they are often on-site at financial institutions.

The Division of Depositor and Consumer Protection (DCP) helps the FDIC meet its mission of maintaining public confidence in the nation’s financial system by:

(1) Supervising insured financial institutions to ensure they treat consumers and depositors fairly and operate in compliance with federal consumer protection, anti-discrimination, and community reinvestment laws; and

(2) Promoting economic inclusion by helping to build and strengthen positive connections between insured financial institutions and consumers, depositors, small businesses, and communities.

DCP’s Internal Control and Review Section seeks professional services to assess and modernize current operations, policies, procedures and other functions aligned with goals of producing beneficial analyses for FDIC’s Headquarters and Regional/Territory/Field Offices. This also includes ensuring that the Division identifies, mitigates and manages high-risk deposit and consumer protection banking practices through audits, internal and horizontal reviews or other corrective measures, as detailed below.

DCP’S INTERNAL CONTROL AND REVIEW (ICR) SECTION

ICR is responsible for internal reviews of DCP operations and implementation of policies, procedures and guidance to ensure the Division is as effective as possible in meeting our mission of protecting depositors and consumers, as well as compliance to those policies, procedures and guidance. ICR serves as an audit liaison to the Office of the Inspector General (OIG); U.S.

Government Accountability Office (GAO), and FDIC’s Office of Risk Management and Internal Controls (ORMIC).

The vision of DCP’s ICR is to serve as a strategic resource and partner to the Division's program areas, Regions, and other stakeholders by providing expertise in internal control, consumer protection matters, and business process redesign. Finally, ICR’s mission is to support and enhance the DCP's ability to identify and mitigate risks by developing, implementing, overseeing, and coordinating internal control reviews, audits, and operational redesign activities to support examination supervision and deposit and consumer protection programs.

ICR conducts risk-based periodic Reviews within the Regions and Washington to assess management systems; controls; decision-making processes; adherence to outstanding regulatory and Divisional guidance; and to provide constructive feedback regarding the overall effectiveness of operations. There are two types of Reviews: Regional and Horizontal.

Regional Reviews

Regional Reviews are a periodic review of each Region to assess management systems, controls, decision-making processes, adherence to outstanding regulatory guidance, and to provide constructive feedback regarding regional operations. The Regional Review process now places a greater emphasis on risk assessment. ICR utilize historical data; regional profile information; risk inventories; OIG & GAO audits; and Region-specific violation and report data to ensure regional operations are both effective and efficient.

Horizontal Reviews

Targeted Horizontal Reviews are usually selected in consultation with DCP senior management and involve reviews of specific areas, which may pose a higher risk to overall Regional and Washington Office operations. For example, often these Reviews test adherence to newly issued guidance, and/or assess effectiveness in internal processes. Horizontal Reviews contribute to accomplishing the mission of providing support and enhancing DCP’s ability to identify and mitigate risks by assessing oversight, controls, decision-making processes, and by providing constructive feedback regarding the overall effectiveness of its operations.

Plain Writing Act

ICR reviews for DCP’s compliance with the Plain Writing Act of 2010 (annually). The Plain Writing Act requires that plain language be used in public documents issued by federal agencies.

CEFILE Review

ICR conducts Contract Electronic File (CEFile) Reviews annually. FDIC Oversight Managers (OMs) are responsible for ensuring that the appropriate contract and related documents are uploaded timely into CEFile. CEFile is the application used by OMs and the Acquisition Services Branch (ASB) to view and maintain contract files.

2. SCOPE OF WORK

DCP ICR seeks Contractor’s assistance to provide internal controls and audit review professional services that are equipped to assess the current infrastructure, research industry standards, and submit recommendations designed to refresh or re-align to mature ICR operations. Through these efforts, ICR staff should become better equipped when analyzing audit findings and recommending corrective measures within DCP.

DCP ICR management envisions part of its re-calibration and maturation involving changes to its structure; standard operating procedures; how it identifies and supplies recommendations when recognizing areas with potential risk; the tools it uses; and how it communicates and collaborates with its stakeholders. For example, ICR strives to model industry auditing standards by conducting entrance and exits meetings and issuing draft and final reports. Through audit and assessment, the current communication strategies, processes, and procedures should be assessed for their current efficacy and efficiency in how they are structured, any identifiable gaps when compared to other agencies, other FDIC divisions, and industry standards, as applicable.

In summary, ICR could likely benefit from more sophisticated, modernized approaches, particularly as the pace of change has quickened. Therefore, the desired services under this contract include consulting services that help ensure ICR is operating in accordance with industry internal control and auditing standards. Specifically, the DCP ICR team envisions achieving a culture and value system where through expertise in Internal auditing/Review results in effective and efficient risk management, strong collaboration and teamwork, quality outputs/products, innovation, and excellent customer service.

3. REQUIREMENTS

The Contractor shall provide all necessary management, supervision, personnel, supplies, materials, and equipment (except for Government Furnished items, if any) to perform the services described in this Statement of Work (SOW). The work under this SOW included the following:

• Deep understanding and expertise related to the auditing rules and regulations, and internal controls discipline, including those applicable to the federal government.

• Experience and expertise in process development and improvement.

• Expertise in business strategy and organizational development.

• Expertise in identifying areas within an operation or protocol that may have potential for adverse risk.

• Expertise in relevant, related information technology solutions, as applicable.

• Expertise in enterprise risk management.

• Excellent project management, business analysis and agile consulting skills.

• Deep experience and expertise in translating business needs and insights into actionable strategies that leads to a well-designed ICR plan and program.

• Ability to, and experience in, implementing actionable internal controls and review findings ensuring appropriate quality control and quality assurance plans/solutions in partnership with clients.

• Expertise in developing and implementing assessment and evaluation solutions.

4. PERSONNEL

The Contractor shall use qualified professionals with experience, training, and education in the skills and disciplines described under section 1.2 Scope of Work of this SOW. The Contractor shall provide qualified personnel to perform all services within the specified timeframes. The Contractor shall determine the number of staff to assign to the project. The minimum requirements for assigned key staff are described below.

4.1 KEY PERSONNEL

Project Manager.

Major Responsibilities: The Project Manager (PM) will provide planning and project direction, involving all aspects of resource management. The PM is responsible for activities including, but not limited to:

(a.) oversight; (b.) management and review of the deliverables for quality assurance; (c.) reporting; (d.)

scheduling of staff; (e.) budget management; (f.) issue management; (g.) risk management; (h.)

procedure development; (i.) staffing and staff management; and (j.) training and staff development.

Minimum Qualifications:

• A bachelor’s degree is required for this position.

• Possess five to ten (5-10) years of project management experience or a Certified Project Management Professional.

• Possess at least five (5) years of experience in managing consulting projects, supervising teams of five (5) or more, providing planning and project direction involving all aspects of resource management, scheduling and assigning duties to the project team and interfacing with Clients’ project personnel, including the COs, OMs, and TMs.

• Demonstrate experience dealing effectively and communicating with individuals at all levels, including both oral and written communications.

Demonstrated experience with overseeing activities including, but not limited to: (a.) oversight, (b.) management and review of the deliverables, (c.)

reporting, (d.) scheduling of staff, (e.) budget management, (f.) issue management, (g.) risk management, (h.) procedure development, (i.) staffing and staff management, (j.) training and staff development

Consultant/Specialist

Major Responsibilities: Consultant/Specialist will help plan ways to improve overall performance. This may include helping with an internal assessment of needs, suggesting resources related to change management and records management, finding the best way to implement proposed strategies, by gaining a strong understanding of the future state of the change, and guiding members of the organization to achieve that future state.

Minimum Qualifications:

• A Bachelor’s degree is required for this position.

• Demonstrated experience in professionally dealing with, and effectively communicating with, individuals at all levels both orally and in writing.

• Possesses five to ten (5-10) years of experience in assessing how office operate, developing corrective measure action plans, and overseeing implementation of change.

• Possess the ability to create benchmark measurements to obtain change with new systems.

• Familiar with designing, developing, and/or facilitating the creation/transformation of internal control/review programs.

5. POST-AWARD MEETING

Within one (1) to two (2) weeks following the effective date of the award, if requested by the OM, the Contractor shall participate in a post-award meeting to generally review the SOW, technical requirements, rights and obligations of the parties, and the FDIC personnel roles. The post-award meeting may be held via a telephone conference call, MS Teams, or a meeting at the FDIC’s office.

6. DELIVERABLES

The Contractor shall develop a project plan and schedule in coordination with the FDIC’s DCP OM and TM to carry out activities proposed by the Contractor to fulfill this SOW. The final timeline for the development of the schedule is to be determined in partnership between the FDIC and the Contractor post-award.

The table below describes major activities and deliverables expected under this contract, along with a proposed timeline. DCP is open to the bidder’s enhancements/modifications to the deliverables outlined below.

Major Activities and Key Deliverables Timeline Activity: Project post-award / kick-off meeting 1 – 2 weeks post-award Deliverable: Project Plan 30 days post-award Deliverable: ICR Assessment Review – this document should include, but not be limited to, how the Contractor will determine the Program current state by conducting interviews, focus groups, content / document reviews, assessing current use of technology for ICR-related purposes, administering surveys, and/or observations as needed.

TBD

Activity: Collaboration with ICR on the Implementation of recommendations derived from the ICR Assessment Review/ Data Collection

TBD

Deliverable: ICR Internal Operation Assessment Findings Report (Note: This could include communication strategies findings)

15 days post data collection

Deliverable: Five-Year ICR Maturity and Modernization Strategy and Roadmap – this should include, but is not limited to, addressing the

30 days after delivery of ICR Audit and Assessment Report

Program’s structure, workflow, processes, governance, technology, and resources necessary to address current and future ICR-related needs.

Deliverable: Proposed ICR Initiatives and Implementation Strategy TBD

Deliverable: ICR Monitoring and Evaluation Plan 45 days after delivery of Proposed ICR Initiatives and Implementation Strategy

Activity: Implementation of Selected ICR Initiatives TBD Project Close-Out- including all files, content etc., which are the property of FDIC. TBD

All Deliverables shall be free of grammatical and obvious errors. All deliverables that are developed must be provided to the client electronically as Word and PDF files as appropriate; media files should be in accordance with FDIC’s Branding and Style Guidelines and Office of Communications standards (e.g., MP4 for video/audio files, etc., with appropriate captioning for Section 508 compliance).

7. ANTICIPATED PERIOD OF PERFORMANCE

The FDIC anticipates that the period of performance will occur over the period of twelve months and a six month option period.