Draft SOW GPO OIG 2026 FSA .pdf

STATEMENT of WORK for FINANCIAL STATEMENTS AUDIT

July 10, 2025

U.S. Government Publishing Office for Fiscal Year 2026

1.0 INTRODUCTION

The Government Publishing Office (GPO) a Legislative Branch agency of the Federal Government was established on June 23, 1860 and began operations on March 4, 1861. For over 164 years, GPO has produced, published, procured, and disseminated trusted information to the American people for all three branches of the Federal Government. This includes Congress and the White House, U.S. passport for the Department of State, and official publications of other Federal agencies and the courts.

As of September 30, 2024, GPO employed 1,647 staff. GPO operates in facilities located in Pueblo, CO, Washington, DC, Laurel, MD, and Stennis, MS. In FY 2024, GPO generated over $1.2 billion in revenue from in-house and commercially procured printing and binding services, reporting a net income of $57.5 million. Total assets were $1.5 billion, with liabilities of $512.8 million. (More information about the Agency can be found in the GPO Annual Report 2024.)

2.0 GPO FINANCES

Reporting Entity

GPO’s financial reporting is governed by Title 44 of the U.S. Code and complies with 31 U.S.C. §3515(b) and 44 U.S.C. §309(e). GPO prepares annual consolidated financial statements in accordance with Generally Accepted Government Auditing Standards (GAGAS) and U.S. Generally Accepted Accounting Principles (GAAP), using the full accrual basis of accounting.

The Agency prepared financial statements using the full accrual basis of accounting. GPO maintains a Business Operations Revolving Fund and a General Fund to account for its various programs and operations. Each of these funds is a distinct fiscal and accounting entity that accounts for cash and other financial resources together with a related liabilities and equities. While GPO is not subject to the Federal Managers' Financial Integrity Act of 1982 (FMFIA) or the Chief Financial Officers Act, GPO's consolidated financial statements are prepared in accordance with GAAP.

Business Operations Revolving Fund. GPO’s Business Operations Revolving Fund is a business-like fund authorized by 44 U.S.C. §309 to be self-sustaining for financing operation and maintenance of the Agency. GPO uses the Business Operations Revolving Fund to pay all costs in performing congressional and agency publishing, information product procurement, and publications dissemination activities. The Business Operations Revolving Fund is reimbursed from Federal agency customer payments, sales to the public, and transfers from two annual congressional appropriations that finance the General Fund.

Congress has also authorized annual appropriations without fiscal year limitation to GPO’s https://www.govinfo.gov/app/details/GOVPUB-GP-7e38302f8f5b01fe89097dcc3973cb08 https://www.govinfo.gov/app/details/GOVPUB-GP-7e38302f8f5b01fe89097dcc3973cb08

Business Operations Revolving Fund for specific purposes. For example, Business Operations Revolving Fund appropriations have been made for building repairs and improvements, security enhancements, and information systems.

General Fund. The General Fund is financed by the Congressional Publishing Appropriation and the Public Information Programs of the Superintendent of Documents Appropriation. These appropriated funds are used to reimburse the Business Operations Revolving Fund for costs incurred to produce congressional work and fulfill statutory requirements to disseminate Federal Government information to the public.

3.0 SCOPE OF THE AUDIT

The contracted independent public accounting firm (IPA) shall audit the consolidated financial statements of GPO in accordance with GAGAS for the FY ending September 30, 2026, and, if applicable September 30 of each year that this contract is extended. GAGAS incorporates by reference the American Institute of Certified Public Accountants’ (AICPA)

Statements on Auditing Standards (SAS).4 As a result, the IPA performing audits of financial statements in accordance with GAGAS should comply with incorporated SAS and any additional requirements of GAGAS.

The IPA will determine whether the consolidated financial statements taken as a whole present fairly, in all material respects, the financial position of GPO and the results of its operations and cash flow in accordance with U.S. GAAP.

4.0 INTERNAL CONTROLS

The IPA should obtain an understanding of internal control relevant to the audit by evaluating the design of those controls and determine whether they have been implemented. The IPA should obtain audit evidence about the design and implementation of relevant controls by performing risk assessment procedures. These procedures may include inquiring entity personnel; observing the application of specific controls;

inspecting documentation and reports; and tracing transactions through the information system relevant to financial reporting. However, inquiry alone is not sufficient for such purposes.

The IPA should obtain an understanding of the control activities relevant to the audit to assess the risk of material misstatement at the assertion level and design further audit procedures responsive to assessed risks. An audit does not require an understanding of all control activities related to each significant class of transactions, account balance, and disclosure in the financial statements or to every assertion relevant to them. However, the IPA should obtain an understanding of the process of reconciling detailed records to the general ledger for material account balances.

The IPA should obtain an understanding of the information system, including the related business process relevant to financial reporting, including the following areas:

The classes of transactions in the entity's operations that are significant to the financial statements;

The procedures within both information technology and manual systems by which those transactions are initiated, authorized, recorded, processed, corrected as necessary, transferred to the general ledger, and reported in the financial statements;

The related accounting records supporting information and specific accounts in the financial statements that are used to initiate, authorize, record, process, and report transactions. This includes the correction of incorrect information and how information is transferred to the general ledger. The records may be in either manual or electronic form;

How the information system captures events and conditions, other than transactions, that are significant to the financial statements;

The financial reporting process used to prepare the entity's financial statements, including significant accounting estimates and disclosures; and

Controls surrounding journal entries, including nonstandard journal entries used to record nonrecurring, unusual transactions, or adjustments.

For those controls that have been suitably designed and implemented, the IPA will perform sufficient tests of such controls to conclude whether the controls are operating effectively (i.e., sufficient tests of controls to support a low level of assessed control risk). Thus, the IPA should not elect to forgo control tests because it is more efficient to extend substantive and compliance audit procedures. The IPA shall gather sufficient evidence to support appropriate findings and provide recommendations to improve internal controls that are not suitably designed and implemented or that are not operating effectively.

The IPA should obtain sufficient appropriate audit evidence regarding material amounts and disclosures in the financial statements that are generally recognized to be determined directly by the provisions of laws; regulations; and contracts. The IPA should also perform audit procedures that may identify instances of noncompliance with other laws, regulations, and contracts that may have a material effect on the financial statements. The IPA should respond appropriately to noncompliance or suspected noncompliance with laws, regulations, contracts, and grant agreements.

5.0 INFORMATION TECHNOLOGY GENERAL AND APPLICATION CONTROLS

As part of the audit, the IPA shall perform a review of GPO's information technology (IT) general and application controls which are significant to the financial statements.

Specifically, the IPA's review is intended to support (1) a conclusion as to whether IT general controls are properly designed and operating effectively, and (2) consideration of specific application controls as part of the internal control assessment in the financial statement audit. The IPA shall conduct the IT controls review in compliance with the most recent version of GAO's Federal Information System Controls Audit Manual (FISCAM).

For system applications that are significant to the financial statements, the IPA shall (1) obtain an understanding of the system and related internal controls, and (2) plan and perform applicable tests of application controls. This testing should cover all IT system-related controls documented during the internal controls phase of the financial audit.

https://www.gao.gov/fiscam

For those IT-related controls that the IPA deems to be ineffectively designed or not operating as intended, the IPA shall gather sufficient evidence to support appropriate findings and provide recommendations to improve internal controls. For those IT-related controls the IPA deems to be effectively designed, the IPA shall perform appropriate testing to determine that they are operating as intended through a combination of procedures, including observation, inquiry, inspection, and re-performance.

The IPA shall use IT audit specialists to document and perform all procedures related to IT in this procurement. IT audit specialists provided by the IPA must possess sufficient technical knowledge and experience to understand IT concepts discussed in the proper methodology and the ability to apply those concepts to adequately test the IT-related controls.

6.0 OVERSIGHT

The GPO Office of Inspector General’s (OIG) Assistant Inspector General for Audit (AIGA) or designee will serve as the Contracting Officer's Representative for this project. The AIGA or designee will oversee the progress of the audit and ensure the IPA is performing in accordance with the terms and conditions stated herein. The IPA shall keep the AIGA or designee apprised of the audit's progress and any impediments being encountered through regular status briefings. Status briefings shall be held at least monthly or more at the request of the AIGA or designee. At least one business day prior to each status briefing, the IPA shall provide an agenda to the AIGA or designee.

The IPA shall promptly inform the AIGA or designee of any potential compliance issues as well as delays in access to GPO staff and/or records which may adversely impact the IPA’s ability to complete the audit within established time frames. The AIGA or designee will serve as the principal liaison between the IPA and GPO personnel. The IPA shall inform the AIGA or designee of any meetings or interviews with GPO personnel by including the AIGA or designee on all meeting invitations with GPO personnel. The AIGA or designee may decide whether they will attend or establish another mutually agreeable process to meet with GPO personnel. Any instances or indications of potential or actual fraud, misappropriation, or other irregularities identified during the audit will be immediately reported to the AIGA or designee.

7.0 TIMING AND DELIVERABLES

The IPA shall hold an entrance conference to begin the audit no later than May 15, 2026, and, if applicable by May 15 of each year that this contract is extended (if the designated date falls on a weekend/holiday day, the previous business day applies). The audit, including preparation, completion, and review of audit working papers and the submission of a preliminary draft of the IPA’s combined report to the AIGA or designee shall be completed by December 1, 2026. The audit working papers shall be made available for an interim review beginning on July 31, 2026, and for year-end review no later than November 20, 2026. If this contract is extended, all dates apply for each year the contract is extended (if the designated date falls on a weekend/holiday day, the previous business day applies).

The IPA shall deliver the following documents to the AIGA:

7.1 Combined Report. A combined report that includes the following elements:

a. An opinion on the financial statements of GPO as of the FY ending September 30 for each year, including the related notes;

b. A report on internal controls over financial reporting; and

c. A report on compliance with applicable laws and regulations and other matters.

The combined report shall contain a description of all reportable conditions identified during the audit including recommendations, conditions, criteria, and, to the extent possible, cause and effect. The report shall include all findings, including those concerning internal controls as well as information system controls. The IPA shall prepare the audit report in accordance with GAGAS requirements and guidance.

The IPA shall issue its combined final report to the AIGA no later than December 15, 2026, and December 15 of each year that this contract is extended (if the designated date falls on a weekend/holiday day, the previous business day applies).

7.2 Management Letter. A management letter or report.

A preliminary (discussion) draft management letter / report, if applicable, is due to the AIGA or designee by December 1, 2026. If this contract is extended, all dates apply for each year the contract is extended (if the designated date falls on a weekend/holiday day, the previous business day applies).

The draft management letter / report shall contain a description of all reportable conditions identified during the audit including recommendations, conditions, criteria, cause, and effect. The management letter / report shall include all findings, including those concerning internal controls. The IPA shall prepare the management letter / report in accordance with GAGAS requirements and guidance.

The IPA shall provide the final management letter/report to the AIGA no later than December 15, 2026, and December 15 of each year that this contract is extended (if the designated date falls on a weekend/holiday day, the previous business day applies).

7.3 Management Letter –Information Technology. A separate IT management letter/report addressing the review of IT controls in support of the consolidated financial statements audit.

A preliminary (discussion) draft IT management letter / report, if applicable, is due to the AIGA or designee by December 1, 2026. If this contract is extended, all dates apply for each year the contract is extended (if the designated date falls on a weekend/holiday day, the previous business day applies).

The draft IT management letter / report shall contain a description of all reportable conditions identified during the audit including recommendations, conditions, criteria, cause, and effect. The IT management letter / report shall include all findings, including those concerning internal controls. The IPA shall prepare the IT management letter / report in accordance with GAGAS requirements and guidance.

The IPA shall provide the final IT management letter/report to the AIGA no later than December 15, 2026, and December 15 of each year that this contract is extended (if the designated date falls on a weekend/holiday day, the previous business day applies).

7.4 Prior Year Follow Up. By July 31 of each year, the IPA shall complete (including documenting and reviewing the results) its follow-up on the comments, suggestions, and recommendations from the prior FY’s financial statement audit. The IPA shall follow up and document the status of management's corrective actions on the audit findings. The documentation shall include (1) a description of each prior audit finding, (2) management's current assessment of the status of the findings and related corrective action, and (3) the auditor's plans for follow-up tests or other work as part of the current financial audit. This documentation, in the form of a reviewed and approved working paper memorandum, shall be completed and submitted to the AIGA or designee by July 31 of each year.

7.5 Key Audit Documentation. To evidence progress in completing the work required and to facilitate review of the IPA's work given the limited timeframe for the audit, the IPA shall provide a copy of key documentation which has been prepared and reviewed to the AIGA or designee. Key documentation includes, but is not limited to, the client profile, the account risk analysis, planning documents, the specific control evaluations, cycle memos, work programs, notification of findings and recommendations (NFR), a completed checklist (Financial Audit Manual (FAM), Volume 2, 1003-Financial Statement Audit Completion Checklist or equivalent) documentation), and an audit summary memorandum as described in FAM, Volume 1, Reporting Phase, 590-Documentation.

The IPA shall issue NFRs, when appropriate. Prior to issuance of NFRs to GPO, the IPA shall provide draft NFRs to the AIGA or designee for review and comment.

7.6 Other. Prior to commencing work, the IPA shall also provide the AIGA or designee with the following items:

a. a copy of the IPA’s latest peer review and a description of the IPA’s system of quality control;

b. a statement of independence from the IPA and all personnel assigned or those who will perform work for the audit (including specialists); and

c. a resume (including professional designations) and training history of continuing professional education for each auditor assigned to the audit.

7.7 Exit Conference. After the issuance of the final combined report and management letters, the IPA shall hold an exit conference no later than https://www.gao.gov/assets/gao-24-107279.pdf https://www.gao.gov/assets/gao-24-107279.pdf https://www.gao.gov/assets/gao-24-107278.pdf https://www.gao.gov/assets/gao-24-107278.pdf

January 20, 2027, and January 20 of each year that this contract is extended (if the designated date falls on a weekend/holiday, the next business day applies)

7.8 Deliverables/ Milestone Dates

Deliverable SOW Reference Due Date* Entrance Conference 7.0 No later than May 15, 2026 Planning documents 7.5 45 calendar days after entrance conference Status of Prior Year findings 7.4 July 31, 2026 Audit working paper – Interim (available for review)

7.0, 7.5 Starting July 31, 2026

Audit working paper – Year – End (available for review)

7.0, 7.5 Starting November 22, 2026

Combined Report – Preliminary draft 7.0 December 1, 2026 Combined Report – Final 7.1 December 15, 2026 Management Letter – Preliminary draft 7.2 December 1, 2026 Management Letter – Final 7.2 December 15, 2026 Management Letter (Information Technology) – Preliminary draft

7.3 December 1, 2026

Management Letter (Information Technology) – Final

7.3 December 15, 2026

Notice of Findings and Recommendation 7.5 On-going, as identified Progress/ status meetings 6.0 Monthly Exit Conference 7.7 January 20, 2027

* If this contract is extended, all dates apply for each year the contract is extended (if the designated date falls on a weekend/holiday day, the previous business day applies).

8.0 AUDIT CONSIDERATIONS

8.1 Financial Statement Audits. The audit of GPO's FY 2025 consolidated financial statements is performed under contract by an IPA. The audit is performed in accordance with GAGAS and FAM. In accordance with the terms and conditions of the contract, the IPA’s working papers are available for review by the IPA selected under this Statement of Work. Those working papers will be made available to the IPA selected.

8.2 Financing Sources. All GPO activities are financed through the Business Operations Revolving Fund which is reimbursed by payments from Federal agency customers, sales to the public, and transfers from two appropriations--the Congressional Publishing Appropriation and the Public Information Programs of the Superintendent of Documents Appropriation. These annual appropriations reimburse GPO for costs incurred while performing Congressional work and fulfilling statutory requirements associated with the distribution of Government publications. All transactions initially go through the Business Operations Revolving Fund, which operates similar to an industrial fund activity, with a determination made later as to whether the Business Operations Revolving Fund should charge the appropriations. Reimbursements from the appropriations to the Business Operations Revolving Fund are recorded as revenues.

The Congressional Publishing Appropriation covers all printing and binding done directly for Congress and the Public Information Programs of the Superintendent of Documents Appropriation is used to pay for government publications authorized by law for distribution without charge to recipients.

8.3 Management. The Director of GPO, appointed by the President and confirmed by the U.S. Senate, directs and manages GPO through a senior management team consisting of a Deputy Director, General Counsel, Chief Financial Officer, Superintendent of Documents, and Chief of Staff. While GPO deals with Congressional Committees much like other Federal agencies, it has a special relationship with the Joint Committee on Printing (JCP). The JCP has the authority to issue resolutions and regulations binding on GPO.

8.4 Wage Determinations. In 2024, GPO employed approximately 1,600 personnel. Most of GPO's employees are represented by various labor unions that have been accorded collective bargaining rights by statute, including wage negotiations in most cases. The unions include the Joint Council of Unions/GPO (an organization that unites twelve labor organizations representing GPO's skilled trades’ people), the Fraternal Order of Police, and a machinists’ union. The American Federation of Government Employees (GPO's white-collar workers) is also a member of the Joint Council of Unions but bargains separately.

8.5 Accounting Systems. GPO’s Business Information System (GBIS) (GPO’s financial system).

GBIS is an Oracle-on-Demand financial management major application to provide a suite of financial applications for GPO’s agency-wide use. In addition to producing the agency’s financial statements and other important tasks in the Office of Finance, GPO uses GBIS to support Business Units such as Government Integrated Print Services, Library Services and Content Management, Government Secure and Intelligent Documents, and Government Publishing and Print Procurement. GBIS includes various modules such as the General Ledger, Fixed Assets, Public Sector Payables, Receivables, Purchasing, Inventory Management, Order Management, and Oracle Project (Work-in-Progress). GBIS interfaces with other GPO information systems for the collection of transactions and activities significant to the financial statements.

8.6 Procurement. GPO’s regulations governing the procurement of printing are found in the GPO Printing Procurement Regulation 305.3, dated May 1999. For purchases other than printing, GPO follows GPO’s Materials Management Acquisition Regulation (MMAR).

8.7 Internal Control Policies. GPO established policies and standards and assigned responsibility to managers for conducting vulnerability assessments and internal control reviews of programs and activities of GPO.

8.8 Other Considerations

Revenues from GPO's in-house printing and binding operations, although not the material component of GPO's total revenues, significantly affect the financial statements because of the subjectivity involved in GPO determining the costs and prices of its various products.

GPO has significant inventories of paper, material, and supplies for in-house printing services and passport production. These include materials and supplies used in the production process or in administrative areas.

9.0 PERIOD OF PERFORMANCE

Base plus four option periods Base Period: April 12, 2026 through April 11, 2027 Option Period 1: April 12, 2027 through April 11, 2028 Option Period 2: April 12, 2028 through April 11, 2029 Option Period 3: April 12, 2029 through April 11, 2030 Option Period 4: April 12, 2030 through April 11, 2031

10.0 PLACE OF PERFORMANCE AND TRAVEL

All accounting transaction documents are located at GPO's central office in Washington, D.C. The IPA may find it necessary to visit other GPO facilities located outside of Washington, DC. To the extent that the work under this procurement requires any IPA staff to travel outside the Washington, DC metropolitan area, the related travel needs are to be approved in advance by the AIGA or designee and must be incurred in accordance with the Federal Travel Regulations.

11.0 ASSISTANCE TO THE AUDITOR

GPO will provide the IPA working space and access to office equipment such as copy and fax machines. GPO also will prepare the financial statements, including the notes to the financial statements. Upon request, GPO will prepare prepared-by-client (PBC) supporting schedules, worksheets, etc. GPO personnel will be available for meetings and will locate supporting documents for the account balances. GPO will also provide assistance in downloading any accounting information requested by the IPA.

12.0 WORKING PAPERS

All work performed under this procurement may be released to outside parties only with the express written permission of the AIGA or designee except as required by law, legal process or applicable professional standards (in these cases, the AIGA or designee must still be notified). After completion of the assigned work and at the direction of the AIGA or designee, all documents, data, information, and working papers shall be stored by the IPA under secured conditions for a period of eight years from the completion of work and then destroyed.

The GPO OIG shall have access to review any IPA's working papers or supporting/source documents at any time. Based upon the results of this review, the IPA may be required to perform corrective or additional work within the assignment scope which shall be performed at the IPA's expense. After issuance of a report, all working papers shall be retained by the IPA and copies shall be made available or submitted to the GPO OIG upon request at no additional cost to the Government.

13.0 CONTRACTING OFFICER’S REPRESENTATIVE

The AIGA or designee is responsible for the technical aspects of the project and serves as technical liaison with the IPA. The AIGA or designee is also responsible for the final inspection and acceptance of all equipment, services, reports, and such other responsibilities as may be specified in this contract.

The AIGA or designee is not authorized to make any commitments or otherwise obligate the GPO or authorize any changes, which affect the quantity, quality, scope or contract price. All requests for changes shall be referred to the Contracting Officer directly or through the AIGA or designee.

Such changes shall not be made without the expressed prior authorization of the Contracting Officer. If the IPA performs a service that alters the current cost, quantity, or scope without prior written approval from the Contracting Officer, the IPA does so at his/her own risk. The AIGA or designee may designate an alternate designee to act for the AIGA by naming such alternate in writing and transmitting a copy of such designation through the Contracting Officer to the IPA.

14.0 KEY PERSONNEL

The IPA shall assign key personnel who meet the qualifications/experience, as required, and whose resumes were submitted as required to fill this requirement. No substitution or addition of personnel shall be made except in accordance with this section.

The IPA agrees that to ensure continuity, personnel shall remain on the project as long as they are employed with the company and performing satisfactorily.

The IPA shall promptly notify the AIGA or designee of any proposed key personnel changes such as substitutions or additions. All proposed key personnel changes shall be submitted, in writing, to the AIGA or designee at least 10 business days prior to the proposed change.

Each request shall provide a detailed explanation of the circumstances necessitating the proposed change, a complete resume for the proposed substitute and any other information required by the AIGA or designee to approve or disapprove the proposed change(s). All proposed changes shall have qualifications that are equal or higher than the qualifications of the person being replaced. No change in fixed unit prices may occur as a result of key personnel substitution.

15.0 IPA PERSONNEL SECURITY AND SUITABILITY REQUIREMENTS

Performance of this contract requires IPA personnel to obtain a GPO issued, government-issued identification card before being allowed access to a GPO facility and/or information system and meet GPO’s suitability requirements. The AIGA or designee shall be the sponsoring official and shall decide on personal identity verification and card issuance.

Prior to the start of contract performance, the IPA shall provide to the AIGA or designee a listing of all IPA personnel who shall require access for performance of work under this contract. When required, the IPA shall make their personnel available at the place and time specified by the AIGA or designee in order to initiate screening and background investigations. The following forms, or their equivalents, may be used to initiate the suitability and credentialing process:

• OPM Standard Form 85 or 85P

• OF 306

• Fingerprint card

• Release obtaining credit information

• PIV card application

Cards that have been lost, damaged, or stolen shall be reported to the AIGA or designee and Issuing Office within 24 hours. If re-issuance of expired credentials is needed, it shall be coordinated through the AIGA or designee.

At the end of the contract performance, or when an IPA employee is no longer working under this contract, the IPA shall ensure that all identification cards are returned to the AIGA or designee.