RFI OIA Internal Audit Software - Final.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

REQUEST FOR INFORMATION (RFI) INTERNAL AUDIT

SOFTWARE

REQUEST FOR INFORMATION (RFI)

Internal Audit Software

02/07/2025

Request for Information (RFI) Internal Audit Software Version 1.2 Page 2

DISCLAIMER:

THIS NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL

OR QUOTE. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A

COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE

GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS

ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO

THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL

DESCRIPTION IS STRICTLY VOLUNTARY.

1. INTRODUCTION

Responses to this RFI may be used to formulate final requirements and/or to identify qualified vendors capable of meeting those requirements. The United States Department of Justice

(DOJ), Federal Bureau of Investigation (FBI), Office of Internal Auditing (OIA) is requesting information and conducting research by process of RFI for an internal audit software that is capable of housing internal auditor testing plans, procedures, and documentation for facilitating the audit process from planning through reporting. As well as, meeting the requirements outlined in section 4. The description below outlines preliminary requirements envisioned for this project. The information gathered may be used to formulate acquisition strategies for competitive solicitations.

2. BACKGROUND

The United States Department of Justice, Federal Bureau of Investigation, internal auditors are responsible for conducting internal audits of many different areas of the organization.

The internal auditors are responsible for review of a variety of documentation and interviews of process owners. They create internal audit plans and procedures and conduct audit work across over 50 physical locations in the United States.

The objective of the RFI is to obtain a software where internal audit work can be centrally managed and used to facilitate the full audit lifecycle from planning, through execution and reporting. The software should allow the proper levels of access to information and provide

Request for Information (RFI) Internal Audit Software Version 1.2 Page 3 for review feedback on draft work products before completion.

Due to the nature of these audits and content sensitivity, all documents must be processed in/on FBI controlled US Government network environments. The software must be able to be installed on the FBI’s Secret enclave. With the software being stored on the FBI’s secret on prem solution or secret azure cloud environment.

3. Objective

The goal of this RFI is to conduct market research to explore available internal audit software solutions that will enable the internal audit team to enhance the efficiency, effectiveness, and oversight of audit processes. The internal audit team is comprised of 50 professionals who conduct a wide range of audits across various departments and functions. The team will need the scalability up to 100 licenses. The team is looking for a software solution that can support and streamline audit management, risk assessment, reporting, and compliance tracking needs.

This Request for Information (RFI) aims to gather detailed information regarding available software solutions, including functionality, capabilities, support services, and pricing. The selected solution will be used by internal audit staff and management to plan, execute, and report on audits, track issues and findings, and ensure compliance with applicable regulations. After reviewing the capability’s packages, the solutions that can meet our requirements will be requested to conduct virtual demonstrations of those software solutions.

4. Requirements

The Office of Internal Auditing are interested in solutions that provide the following features and capabilities:

4.1 Audit Planning and Scheduling

• Ability to create, manage, and track audit plans and schedules for multiple auditors.

• Resource allocation and management (e.g., assigning auditors to specific tasks or projects).

• Support for risk-based audit planning and prioritization.

• Ability to set audit priorities, deadlines, and milestones.

• Capability to manage and track recurring or periodic audits.

Request for Information (RFI) Internal Audit Software Version 1.2 Page 4

4.2 Audit Execution and Documentation

• Comprehensive audit workflow management (e.g., tracking tasks, evidence collection, and audit testing).

• Integrated document management system for storing audit evidence and notes.

• Support for collaboration among audit team members and with stakeholders.

• Ability to record and track audit procedures, findings, observations, and conclusions.

• Support for customizable audit templates and checklists.

4.3 Risk and Issue Management

• Workflow for managing audit issues, findings, and recommendations.

• Ability to assign actions, track resolution progress, and set follow-up reminders.

• Tools for tracking and reporting audit findings, risks, and issues.

• Tools for identifying, assessing, and managing organizational risks.

• Integration with risk management processes to prioritize audit findings based on severity and impact.

• Ability to generate actionable reports for management and stakeholders.

• Risk assessment and mitigation workflows.

• Dashboard and reporting features for real-time risk monitoring.

4.4 Reporting and Analytics

• Dynamic reporting tools that allow custom report creation (e.g., findings, progress, issue status).

• Dashboards for monitoring audit performance, findings, and key metrics.

• Integration with other enterprise systems (e.g., financial systems, compliance platforms) to generate real-time insights.

• Customizable reporting tools for generating audit reports and dashboards.

• Real-time tracking of audit status, open issues, and key performance indicators (KPIs).

• Capability to produce both executive and detailed audit reports.

4.5 Compliance Tracking

• Ability to map and track compliance requirements across regulations and standards.

• Ability to document and follow up on remediation actions.

Request for Information (RFI) Internal Audit Software Version 1.2 Page 5

• Audit trail functionality to track changes, approvals, and other actions taken during the audit process.

• Monitoring and reporting on compliance status.

• Integration with legal and regulatory updates.

• Tools to map audit findings to specific risks, regulations, or control frameworks (e.g., SOX, OMB A-123, GAO Government Auditing Standards)

• Integration with risk management and compliance systems to ensure audit findings align with organizational risks and compliance requirements.

4.6 Security and Access Control

• Role-based access to ensure sensitive audit data is protected.

• Compliance with industry security standards (e.g., data encryption, secure access protocols).

• Secure external stakeholder access (if needed) to review audit progress and findings.

4.7 User Experience and Interface

• Intuitive, user-friendly interface for auditors and management to easily navigate.

• Cloud-based or on-premise deployment options

• Customizable user interface for tailored user experiences based on role or function.

• Customization options for the system to fit our organizational needs.

4.8 Scalability and Integration Capabilities

• Ability to integrate with other internal systems (e.g., ERP systems, finance tools).

• Ability to integrate into existing FBI systems for real-time monitoring.

• API or data export capabilities for integration with reporting or BI tools.

• Scalability of the system to support growth in audit activities and team size.

4.9 Support and Training

• Available user training and resources for effective system adoption.

• Ongoing customer support options (e.g., helpdesk, troubleshooting, software updates).

• Availability of training resources (e.g., user guides, webinars, on-site training).

• Software updates and maintenance details.

• Clear pricing structure, including licensing, implementation, and maintenance costs.

Request for Information (RFI) Internal Audit Software Version 1.2 Page 6

5.0 CONTRACTOR QUALIFICATIONS

This RFI is open to all viable companies for market research only to request input from potential providers of an internal audit software.

The Government would like to know which firms can provide the products for this contemplated requirement by identifying themselves and responding to this RFI. The Government requests the following information:

1. Company name and business size.

2. Provide evidence to show that your company can provide the requested services and/or products required (i.e. technical ability, personnel, and experience). Information provided shall be succinct and related to the requested information in this RFI. All submissions shall be unclassified.

3. Address whether your company has a GSA Schedule and if they are capable of providing these services on schedule. If able to provide the services on schedule, provide the schedule and SIN.

4. Address whether your company can provide the services under the NASA SEWP contract vehicle.

5. Any other assumptions, comments, concerns, and/or questions relating to the contemplated services.

Required Information:

Contractor Legal/DBA Name:

Address:

Point of Contact:

Telephone:

Email Address:

DUNS Number:

Cage Code:

Facility Clearance (if applicable):

Applicable NAICS Codes:

Standard Business Size:

Request for Information (RFI) Internal Audit Software Version 1.2 Page 7

GSA Schedule:

NASA SEWP Contract:

6.0 DISCLAIMER and RESPONSES

THERE IS NO COMMITMENT BY THE GOVERNMENT TO ISSUE A SOLICITATION AS A RESULT OF

THIS RFI. THIS IS BEING ISSUED SOLEY FOR INFORMATIONAL AND PLANNING PURPOSES AND

DOES NOT CONSTITUTE A SOLICTIATION. IN ACCORDANCE WITH FAR 15.201(e), RESPONSES

TO THIS NOTICE ARE NOT OFFERS AND CANNOT BE ACCEPTED BY THE GOVERNMENT TO

FORM A BINDING CONTRACT. THIS IS NOT A REQUEST FOR PROPOSAL OR QUOTE. IT DOES

NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY

THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS

UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT.

ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS

STRICTLY VOLUNTARY.

WHAT SHOULD BE INCLUDED IN YOUR RESPONSE

1. All interested parties shall submit capability packages in response to this notice.

2. Do submit succinct, thoughtful responses to the requirements/questions listed in this

RFI.

3. Do submit comments that address the FBI's requirements, assumptions, conditions or contemplated approaches to this future acquisition.

4. Do submit information and suggestions that may encourage new, different, or innovative approaches that would result in products, solutions, and direct savings to the

FBI.

WHAT SHOULD NOT BE INCLUDED IN YOUR RESPONSE

1. Do not submit proposals or offers.

2. Do not submit requests to be considered for award or to be notified of a future solicitation.

3. Do not submit requests to be added to a mailing list or distribution list.

4. Do not submit questions or comments not related to this RFI.

5. Do not respond via telephone.

Request for Information (RFI) Internal Audit Software Version 1.2 Page 8

7.0 Capability Package

As part of the capabilities package for an internal audit software solution, the Government is requesting that vendors include an in-depth overview of the proposed solution, to include its core features and capabilities, and fully describe how the solution would be architected, developed, implemented, operated, and supported.

Vendors have the latitude to structure their capabilities package in a manner that they believe is best suited to convey the capabilities and features of a proposed solution, with the understanding that they ensure that their capabilities package shows how the solution would satisfy the potential requirements, satisfy the purpose and deliverable outlined above, as well as address the additional questions and information being requested in this amendment.

The following is a list of questions/inputs that the Government is requesting responses to in preparation for, and as part of, the capabilities package. Respondents are requested to address these questions/inputs as part of their submission to this RFI, but respondents may expound upon these questions/inputs. Additional questions/inputs may be asked during the product demonstration/presentation, or as a follow-on, to better determine capabilities. In addition, where multiple options or potential deviations may exist for a given question/input, respondents are requested to provide details regarding those options, and the considerations/recommendations that may, or would, factor into the decision point for that item. Please provide the following information about your software solution:

1. Requirements Matrix

• A chart detailing which of the requirements in Section 4 this software meets and does not meet.

2. Overview of Your Software Solution:

• Description of the solution, its key features, and benefits.

• Details on how the solution meets the specific needs of internal audit teams.

• Please provide comprehensive details on how the proposed solution would be architected, developed, implemented, and would operate in support of this objective, being as specific as possible.

2. Deployment Model:

• Are you able to meet the FBI’s requirement for being housed on the FBI’s Secret enclave? Cloud-based or on-premises deployment options.

• Will you be able to support the software being stored on an FBI on prem solution? If so, how will patches and upgrades be supported?

Request for Information (RFI) Internal Audit Software Version 1.2 Page 9

3. System Requirements:

• Hardware and software requirements for installation and use.

• Compatibility with different operating systems and browsers.

4. Scalability:

• Ability to scale for future growth (additional users, departments, or audit processes).

• Options for customization or additional features as the organization grows.

5. Submit a Rough Order of Magnitude (ROM):

• Detailed pricing for the software, including any licensing fees, user-based fees, and other costs.

• Is your product provided via license or subscription?

• What license models exist for your product (i.e. annual license, multi-year license, perpetual license?

• Are your licensing models tied to named user, floating license, enterprise licensing?

• What is the typical cost for each of the licensing models?

• Additional costs for implementation, training, support, or upgrades.

• Provide ROM pricing for likely products/components/services that would comprise the solution and services, minimally breaking down ROM costs by (a) Licensing/Product Costs, (b) Optional Item – Personnel/Services.

Additionally, provide out-year ROM costs that would be anticipated for the proposed solution.

• Where multiple options or potential deviations may exist, provide details regarding those options, and the considerations/recommendations that may/would factor into the decision point for that item. Further, provide an understanding of how the ROM pricing is calculated (for example, the basis of how licenses/subscriptions are calculated for a given solution).

• Additionally, respondents are also requested to provide industry feedback on the ROM requirements and to provide input into what additional information may/would be required to arrive at final pricing. Where applicable, include and annotate any anticipated minimum cost discounts that would be applicable within the ROM pricing.

6. Past Performance References:

• Examples of Federal contracts (preferably within the internal auditing field or similar industries) using the software, including case studies or testimonials. As well as any existing contract information.

Request for Information (RFI) Internal Audit Software Version 1.2 Page 10

• Provide information regarding whether the vendor has provided solutions to other Government entities and/or organizations, particularly similar solution(s) that have been implemented by/for other entities that have similar circumstances as the FBI. Provide specific information regarding solutions that have been implemented elsewhere. If the company does not have an internal audit software solution that has been deployed in an environment that is similar to the FBI, with similar requirements, describe how the solution would be suitable to address, or scale up to, the FBI’s requirements and use case.

7. Implementation/integration:

• Estimated timeline for deployment, including setup, training, and full operational use.

• Any potential implementation challenges or considerations?

• How would the solution be implemented and integrated within the FBI?

If the solution has, or optionally has, any on premises components, please provide complete details on the platforms and the configurations that would be implemented on the FBI secret enclave. Likewise, if the solution has, or optionally has, any cloud components, please provide complete details on the cloud platform(s) that the solution would be (or could be) implemented on for the FBI secret enclave.

8. Client Service and Support:

• What type of client support/help desk access is included with your software?

• How is client help and support handled?

• What services are available with the solutions?

• How are your services packaged?

• What labor categories are used for your implementation and/or service?

• What type of training is provided with your solution, in-house or remote and for how long?

9. Security and Compliance:

• Will your organization provide all information required by the agency's security components to certify and accredit its use?

• Provide examples of projects where your solution has been successfully implemented. Describe the number of customers, and largest number of users per customer. For any U.S. Government customers, was a full authority to operate (ATO) achieved for the solution.

Request for Information (RFI) Internal Audit Software Version 1.2 Page 11

• Are you the sole manufacturer, partner manufacturer, or an Integrator/VAR? Identify any key partners or subcontractors you would work with in support of this RFI’s objectives.

10. Feedback:

• Provide feedback to the Government regarding this RFI and any additional information that would be desired, or required, to be able to fully understand the requirements for, and the ability to be able to propose and provide, an internal audit software solution.

RFI SUBMITTAL INSTRUCTIONS:

The Government requests response to this RFI to be submitted via electronic means to the POC outlined below. Any request for clarification to this RFI are due by 02/14/2025 Noon Eastern

Time to ensure response. The Government reserves the right to respond to questions provided after the deadline. Formal responses to the RFI are due by 02/21/2025 Noon Eastern Time.

Each submission shall not exceed XX pages in length, including cover page, table of contents, and any other information. Submit RFI Information via email to the attention of:

Contracting Point of Contact: Brandon James

Email: bmjames@fbi.gov