A-123_RFI_OFM_FBO_Notice.pdf

Department of Commerce

REQUEST FOR INFORMATION for A-123 Internal Control Support Services

NAICS CODE: 541611

This is a REQUEST FOR INFORMATION (RFI). This Sources Sought Notice is for informational and planning purposes only and shall not be construed as a solicitation or as an obligation or commitment by the Government. This notice is intended strictly for market research.

1. OBJECTIVE

Department of Commerce (The Department) is seeking assistance to comply with OMB Circular

A-123 throughout the department. The contractor will Support the department in improving and enhancing the A-123 Process through various internal control related reviews, enterprise risk management reviews (ERM), and data analysis.

2. BACKGROUND

The purpose of this notification is identify capable vendors whom can provide services to support the Department’s implementation of Office of Management and Budget (OMB) Circular

A-123, Management's Responsibility for Enterprise Risk Management and Internal Control related reviews. The Circular requires Agencies to develop and maintain internal controls, identify and assess risk, document and monitor the effectiveness of internal controls, and correct deficiencies. Furthermore, the latest Circular, dated July 15, 2016 requires Agencies to modernize and integrate existing efforts by requiring agencies to implement an ERM capability coordinated with the strategic planning and strategic review process established by Government

Performance and Results Act Modernization Act (GPRAMA) and the internal control processes required by FMFIA and Government Accountability Office (GAO)'s Green Book in order to improve mission delivery, reduce costs, and focus corrective actions towards key risks.

The Office of Financial Management (OFM) is the lead office for the implementation and management over OMB Circular A-123, Appendix A, Internal Controls over Financial

Reporting. OFM also is leading the efforts to implement a data analytics program with the objective of developing the capability to identify trends, anomalies and other meaningful patterns in financial programs.

The Office of Acquisition Management (OAM) is the lead office over OMB Circular A-123, Appendix B, Improving the Management of Government Charge Card Program and Conducting

Acquisition Assessments. The Appendix B of the OMB Circular A-123 requires agencies to maintain internal controls that reduce the risk of fraud, waste, and error in government charge card programs.

The Office of Financial Management (OFM) is the lead office over OMB Circular A-123, Appendix C, Requirements for Effective Measurement and Remediation of Improper Payments.

The Department performs annual payment recapture audits of (a) contracts/obligations for many of the Department’s bureaus/reporting entities on a rotational basis; and (b) Department-wide grants and other cooperative agreements (i.e. financial assistance).

The Office of Performance, Evaluation, and Risk Management (OPERM) is the lead office responsible for the implementation and management of the ERM.

3. HIGH LEVEL REQUIREMENTS

The Contractor shall support DOC in complying with OMB Circular A-123 throughout the

Department. The implementation will involve:

a. Improving and enhancing the A-123 Process, including Supporting with evaluating various A-123 processes and providing expert advice and recommendations for best practices such as:

Support DOC in compliance with updated Green Book by implementing framework for programmatic and operational audits/reviews with strong Information Technology tools and information

Support with the planning of A-123 efforts to maximize efficiency and effectiveness

Review, assess and update internal control documentation, handbooks and guidance

Test internal controls at the Entity-Level, Process Level and Transactional Level

Review and assess A-123 work papers at DOC bureaus including reporting, and correcting internal control deficiencies

Evaluate and provide recommendation to the automated compliance tools

Support the Department in evaluating and reporting on the internal controls and financial systems that protect the integrity of Federal programs and operations under

Federal Manager’s Financial Integrity Act (FMFIA)

Support the Department in developing communication and/or training programs relating to internal controls compliance

Support the Department in validation and verification of performance goals and strategic plans

Support the Department in complying with the Improper Payments Information Act

(IPIA) which involves reviewing and identifying programs and activities that may be susceptible to significant improper payments

Support the Department in performing the identification and recovery of erroneous contract and other payments

Support DOC in performing analysis/presentation of revenue/cost data relating to current year final, current year draft, and prior year bureau budgets (Intrafund process)

b. Improve accountability and effectiveness of Federal programs as well as mission support operations through implementation of ERM practices

c. Support DOC in performing data analytics to enhance financial risk monitoring capability on an ongoing and adhoc basis for selected programs and projects

4. IT SECURITY REQUIREMENTS

a. Data transfer

The contractor shall use validated Federal Information Processing Standard (FIPS)

140-2 encryption technology to transfer data to and from the Department.

b. Federal Information and Security Management Act (FISMA) and Federal Risk and

Authorization Management Program (FedRAMP) Compliance:

Contractors shall be subject to complying with all Department of Commerce and

Federal Security standards, policies, and reporting requirements. The contractor shall meet and comply with all Department IT Security Policies and applicable Department and National Institute of Standards and Technology standards and guidelines, other

Government-wide laws and regulations for protection and security of Information

Technology

Contractor shall provide proof of compliance of FISMA and/or FedRAMP security requirements. See attached IT Security Requirements (FISMA and FedRAMP) for details

The purpose of this RFI is to identify potential vendors and to determine availability in the marketplace. This information will be used for planning purposes as we continue to develop our procurement strategy and specifications. No order will be placed at this time against any response received hereunder. However, upon review of the responses received, DOC may, at its own discretion, contact the most highly qualified firms to learn more about their capabilities and products or to follow up on specification comments.

Responses must include the following:

Discussion of “Work activities” and items “Of particular interest” listed in the “3. High

Level Requirements”

Technical capabilities summary that describes the services you provide, a description of your approach, regulatory expertise/know-how, and other relevant assets that your organization could apply to this effort o Preferred vendors will be FISMA compliant and prepared to provide current certifications.

o Preferred vendors will have performed similar work within the FISMA environment o Preferred vendors will be familiar with the DOC and Federal IT security standards o Vendors considering the use of a cloud solution, shall have be compliant and able to provide DOC required Documentation of compliance for both FedRamp and

FISMA IT requirements.

o Can your company offer a FIMSA and/or FEDRAMP certified cloud based solution with full vendor hosting and support?

Discussion of vendor reporting and financial tracking capabilities o What experience does your company have in using software to account for, report on, and control appropriated funds in compliance with federal regulations? If applicable provide details.

o Is your system fully compliant with all federal requirements for the recording, control and expenditure of federal funds?

o Does your system produce data for all required federal reports?

o What level of support, if any does your company offer to keep current with the mandated changes by OMB, how are those changes implemented?

o Does your company have any required OMB system certifications and/or required certification and accreditation audit?

Assumptions, conditions, limitations that would impact your company’s ability to accomplish this effort

Provide any other information that would be beneficial to accomplishing the purpose of this requirement

Business Name, Type/Size, Dun & Bradstreet Number

Identify if applicable, any held IDIQ contract number under a Government Wide

Acquisition Contract (GWAC) or Blanket Purchase Agreement (BPA) number

List the point of contact for receipt of correspondence concerning any future

Solicitation(s) issued by the DOC

Interested parties should respond with a capability statement no more than 10 pages (including coversheet), by 2:00 pm (Eastern Time) on Thursday, February 16, 2017. Your response, and any questions concerning this request for information, shall be directed to the Contracting

Officer, Mr. Jon Gofus by email at jgofus@doc.gov. Please ensure that your response has “RFI-

A-123” in the subject line.

This notice does not obligate DOC to award a contract or otherwise pay for the information provided in response to this RFI or any future requests. Any information submitted in response to this RFI is strictly voluntary. It is the responsibility of capable vendors to monitor this site for the release of any follow-on information. All Documentation shall become the property of the

Government/DOC. All proprietary, classified, or sensitive information must be marked in your response.

mailto:jgofus@doc.gov