Section I_Attachment 1_Statement of WorK_SOW_SCHEDULE B_ PPPL _OAC_Final_12022025.pdf

STATEMENT OF WORK

FOR

Internal Audit Services

CATEGORY: EXEMPT

DATED: December 2, 2025, Rev 0

TECHNICAL: Albana Cejne Title: _Assistant Director, Sponsored Research Audit

Signature: __________________________________

TECHNICAL: Lerato Barney Title: Vice President & Chief Audit and Compliance Officer

Signature: __________________________________

PRINCETON UNIVERSITY

PRINCETOM PLASMA PHYSICS LABORATORY

P.O. BOX 451

PRINCETON, N.J. 08543

609-243-2000

RECORDS OF CHANGES PAGE

Date Description Affected Section Revision no.

1.0 INTRODUCTION & SCOPE

1.1 Princeton Plasma Physics Laboratory (PPPL), a Department of Energy (DOE) Management and Operating (M&O) Contractor operated by Princeton University, requires internal audit services under the oversight of the University’s Office of Audit and Compliance (hereinafter referred to as “OAC”). The audits are co-sourced by OAC in partnership with a qualified service provider.

The intent of acquiring the services of internal audits is to ensure Princeton University’s compliance with the Department of Energy Acquisition Regulation (DEAR) clause 970.5232-3, which is incorporated into PPPL’s prime contract. Specifically, DEAR 970.5232-3(i) mandates that the Contractor must establish and maintain an internal audit plan and organization. Furthermore, by June 30 of each contract performance year, the Contractor is required to submit an annual audit plan to the DOE Contracting Officer. This plan must outline the internal audit activities for the upcoming fiscal year and be designed to evaluate the costs incurred and the effectiveness of contractor management systems.

970.5232-3(i) Internal Audit. The Contractor agrees to design and maintain an internal audit plan and an internal audit organization….

(3) By each June 30 of the contract performance period, the Contractor must submit to the Contracting Officer an annual audit plan for the activities to be undertaken by the internal audit organization during the next fiscal year that is designed to test the costs incurred and contractor management systems described in the internal audit design.

1.2 Annual Risk Assessment

The Subcontractor shall perform (1) the annual risk assessment and development of internal audit work plan for FY 2027 and (2) execute the approved internal audit work plan. Subsequent years’ audit plans will be developed after conducting a risk assessment each year. Internal audit planning and risk assessment methodology includes the following, but is not limited to:

1.2.1 Consider and discuss relevant guidance from DOE Office of Inspector General (OIG) workplan and reports; memo from DOE Office of Financial Services in the DOE Office of Science Consolidated Service Center;

changes to relevant Federal Acquisition Regulations (FAR), Department of Energy Acquisition Regulations (DEAR), Cost Accounting Standards (CAS); PPPL’s DOE prime contract DE-AC02-09CH11466 and other relevant industry related guidance.

1.2.2 Interview stakeholders to obtain feedback and perspective on key areas of risk and opportunity for PPPL. Discussions also focus on providing insights into PPPL’s regulatory requirements and compliance environment.

1.2.3 Consider the following criteria for determining the risk level for areas/functions that have been audited in prior years and/or could be considered for a potential audit in future years:

1.2.3.1 Quality of internal controls

1.2.3.2 Financial exposure/materiality

1.2.3.3 Results of prior audit activities from other laboratories

1.2.3.4 Enterprise Risk Management (ERM) Profile

1.2.3.5 New systems and related controls, programs, or operations

1.2.3.6 Time since last audit

1.2.3.7 Areas of potential fraud, waste, and abuse

1.2.3.8 Other factors such as high inherent risk and DOE requirements (e.g., current political environment, Executive Orders, evolving compliance requirements)

1.2.4 Consider the likelihood and impact for certain risks identified, including both inherent risks and residual risk, and prepare a draft audit plan that is focused on the areas that you determine could benefit from internal audit activities.

Note: The internal audit work plan is finalized after conversation with DOE Princeton Site Office (PSO), PPPL senior management and personnel from the office of Vice President for PPPL (OVP). Formal approval of the plan is obtained from the DOE-PSO.

2.0 APPLICABLE DOCUMENTS

2.1 All work performed by the Subcontractor shall be subject to the requirements set forth by, but not limited to, the following documents, as applicable and appropriate for each audit/project. In the event of a conflict between documents, the Subcontractor shall promptly bring the matter to the attention of the Princeton Technical Representative for the Subcontract (hereinafter referred to as “PTR”) or designee and shall follow his/her guidance in establishing precedence.

2.1.1 Prime Contract No. DE-AC02-09CH11466 between Princeton University and the DOE for operating PPPL

2.1.2 The Institute of Internal Auditors (IIA) Global Internal Audit Standards

2.1.3 Relevant portions of the following regulations DEAR, FAR, and CAS.

2.1.4 DOE’s Office of Inspector General (OIG) Audit Manual

2.1.5 DCAA Contract Audit Manual (CAM), published by Defense Contract Audit Agency (DCAA)

3.0 APPLICABLE DRAWINGS

Not applicable.

4.0 RESPONSIBILITIES

4.1. PRINCETON PLASMA PHYSICS LABORATORY

4.1.1 OAC will provide guidance and oversight.

4.1.2 PPPL will provide requested documents necessary for the subcontractor to conduct the internal audits.

4.2. SUBCONTRACTOR

4.2.1 General Requirements

The Subcontractor is responsible for complying with all items included within the Statement of Work and OAC’s inspection, review, or approval of the Subcontractor’s items, services, or documents shall not relieve the Subcontractor of responsibility for full compliance with Federal, State, local laws and regulations, and Subcontract requirements.

4.2.2 Performance Requirements

The Subcontractor’s performance should provide the following criteria with respect to the work performed:

4.2.2.1. Adherence to the IIA Global Internal Audit Standards in the conduct of all work;

4.2.2.2 Demonstrate an efficient, effective, qualitative, and responsive internal audit function;

4.2.2.3 Ensure that all auditor qualifications, training, and audits performed are in accordance with IIA Global Internal Audit Standards; annually, the Subcontractor shall certify that staff assigned to each project shall meet staff qualifications and continuing professional education requirements prescribed by the IIA Global Internal Audit Standards. Additionally, if requested by the PTR or their designee, the Subcontractor shall provide documentation to support such certification;

4.2.2.4 Ensure that Subcontractor personnel who are new to PPPL assignments are reviewed and approved by the PTR or their designee; no new personnel shall be assigned to PPPL without the written concurrence of the PTR; note that Subcontractor shall not utilize any lower tier subcontractors or temporary staff;

4.2.2.5 Demonstrate cooperation and excellent interpersonal skills with PPPL and OAC;

4.2.2.6 Conduct a thorough risk assessment and annually develop an effective risk-based audit plan for PPPL that satisfies applicable requirements and agreed upon internal audit process and methodology;

4.2.2.7 Complete the audit plan and issue audit reports to DOE within the plan’s fiscal year;

4.2.2.8 Ensure that the audit program and procedures for all audits are performed to satisfy the requirements of applicable regulations;

4.2.2.9 Ensure that audit reports are objective, factual, and free from errors and omissions;

4.2.2.10 Ensure all material findings1 identified at or affecting PPPL are included in audit reports and workpapers;

4.2.2.11 Implement an audit follow up process for timely resolution of audit findings and recommendations;

4.2.2.12 Ensure timely planning and communication;

4.2.2.13 Demonstrate excellent written and verbal communication skills; and

4.2.2.14 Ensure that there is a thorough quality assurance review process for all internal audit work performed including audit reports.

4.2.2.15 Ensure that confidential or sensitive information and/or documentation including work papers, PPPL or Government property is kept in a locked secured place when not in use by those assigned to work on this SOW by the Subcontractor; the Subcontractor is also required to ensure that data maintained in electronic format is adequately protected by adhering to PPPL data protection requirements including data encryption.

OAC will discuss with the Subcontractor annually or more frequently if necessary, whether the work performed meets the above and/or if there are areas for improvement.

4.2.3 Notification Requirements Off-Normal Events and Issues

1 A material finding is (1) a failure or shortcoming which is a violation of the prime contract applicable laws and regulations, (2) a violation of internal controls significant enough to cause a serious case of mismanagement, (3) the charging of unallowable costs, or (4) a situation that misstates the facts.

5.0 REQUIREMENTS

All auditing and reporting direction for the Subcontractor will come from OAC. Suggestions, needs, or requests must be coordinated through OAC. OAC will provide oversight of all audit work performed and deliverables (audit reports and other reports issued to PPPL). The Subcontractor will conduct internal quality assurance reviews of all audit work performed and audit reports issued in accordance with the IIA Global Internal Audit Standards prior to providing their work to OAC.

5.1. PERFORMANCE REQUIREMENTS

5.1.1. AUDIT SCOPE/WORK PLAN DEVELOPMENT

The Subcontractor shall prepare a scope statement and work plan for conducting all necessary steps described in the scope statement. The Subcontractor’s work plan shall include the project team, milestone and labor-hour schedules, statement of independence, and a detailed cost estimate based on the agreed-upon hourly rates and other direct costs included in the Subcontract (and shall confirm these charges with OAC).

5.1.2. PROCESS REVIEW

The Subcontractor shall document the business process and assess the design of internal controls. Prior audit work papers may be referenced to complete this process. The understanding of the business process should be updated, reviewed and validated with process owners.

5.1.3. FIELD WORK

5.1.3.1 The Subcontractor shall leverage data analytics as a foundational element in developing a comprehensive and risk-informed audit approach. This includes identifying potential areas of elevated risk – such as atypical expenditure patterns or emerging trends – and using these insights, along with input from validation sessions with PPPL management, to inform the selection of transactions for detailed review.

5.1.3.2 The Subcontractor shall design audit procedures to assess whether selected costs charged to PPPL’s DOE prime contract are allowable, allocable, and reasonable in accordance with applicable DOE prime contract provisions, and relevant DEAR, FAR, and CAS requirements. Additionally, the Subcontractor may evaluate a sample of transactions to assess the operating effectiveness of key internal controls, including those embedded within information systems.

5.1.3.3 The Subcontractor shall maintain open communication with OAC and promptly notify OAC of any potentially unallowable cost or material internal control weakness identified in the course of an audit prior to the reporting phase of the audit.

5.1.4. REPORTING

5.1.4.1 Draft audit reports will be discussed with PPPL senior management, VP for PPPL and OAC. Final audit reports will be issued after validating observations and obtaining management responses from PPPL and discussing with the DOE Princeton Site Office Contracting Officer.

5.1.4.2 The format to be followed by the Subcontractor for the transmittal letter, the title page, and the report body is provided as attachments to the Statement of Work (refer to Attachment).

5.1.4.3 In addition, a report of Internal Audit Activity is required to be issued to the DOE annually.

5.1.5. RISK ASSESSMENT AND ANNUAL AUDIT PLAN

The Subcontractor shall perform an annual Risk Assessment to include, but not be limited to, the following activities:

5.1.5.1 Consider the guidance outlined in memo from DOE Office of Financial Services in the DOE Office of Science Consolidated Service Center.

5.1.5.2 Consider the relevant DOE OIG Semiannual Reports to Congress and DOE OIG audit reports for applicable calendar years.

5.1.5.3 Interview PPPL and University management personnel for perspective on key areas of risk (6-8 interviews). This list of personnel is validated by PPPL management, OVP and DOE personnel.

5.1.5.4 Interview DOE Princeton Site Office personnel regarding regulatory requirements/insight/issues.

5.1.5.5 Review prior year internal audits performed at PPPL, including procedures performed and findings noted.

5.1.5.6 Prepare the proposed internal audit work plan.

5.1.5.7 Discuss the risk assessment strategy and proposed internal audit work plan with PPPL management, OVP and DOE Princeton Site Office personnel.

5.1.5.8 Finalize the audit plan with scope statements for each audit and issue to the DOE.

5.1.6. CONDUCT STATUS REPORT MEETINGS

During the course of audit work, the Subcontractor shall, on a periodic basis, update OAC on (1) progress/status of audits, (2) significant problem areas including a definitive plan and target dates for resolving each problem, (3) any impact on the deliverable due dates including budget to actual comparison, and (4) any impact to overall cost of the audit.

6.0 TEST & INSPECTION REQUIREMENTS

6.1. PERFORMANCE TESTS

6.1.1 The Subcontractor shall prepare all work papers in accordance with the IIA Global Internal Audit Standards. OAC shall have access and be provided copies of the Subcontractor’s work papers and other analytical documents during the course of the engagement and upon completion of the work.

6.1.2 All audit work papers shall be prepared and delivered to OAC for review after all work has gone through the Subcontractor's quality assurance process.

6.1.3 Based upon OAC’s review and any finding of substandard work, the Subcontractor will be required to perform corrective action or additional work within the work order’s scope at the Subcontractor’s expense.

6.1.4 The Subcontractor shall deliver complete signed work paper files, including the Subcontractor’s internal quality assurance review notes, in final form to OAC. OAC will share work papers with DOE, OIG, and PPPL management, as required.

7.0 SUBCONTRACTOR QUALIFICATIONS

7.1 Subcontractor:

7.1.1 The Subcontracting firm must have qualified staff, such as Certified Public Accountants (CPAs), and proper legal structure. The Subcontract must be registered with relevant professional bodies, maintain independence, and comply with auditing standards. The firm must ensure its staff possesses the knowledge, skills, and abilities to perform audits in accordance with professional and legal requirements. In addition, the Subcontracting firm must have a minimum of 10 years of experience providing internal audit services for federally funded research and development centers, DOE laboratories, or similar entities, including experience in risk-based audit planning, reporting to management and DOE oversight bodies and auditing cost-reimbursable contracts.

7.1.2 Annually, the Subcontractor shall certify that staff assigned to each task shall meet staff qualifications and continuing professional education requirements prescribed by the IIA Global Internal Audit Standards. Additionally, if requested by the PTR or DOE, the Subcontractor shall provide documentation to support such certification. Subcontractor personnel who are new to PPPL must be interviewed by the PTR. No new personnel shall be assigned to PPPL without the written concurrence of the PTR.

7.2 Subcontractor Personnel:

Professional and staff requirements

7.2.1 Qualifications: Staff must have the necessary academic education, professional experience, and training in accounting, auditing, and ethics to perform audits competently.

7.2.2 Certifications: Professional certifications, such as Certified Internal Auditor (CIA), Certified

Public Accountant (CPA) and other relevant certifications are strongly preferred.

7.2.3 Competence: The firm must ensure its staff possesses the knowledge, skills, and experience to perform audits in compliance with professional standards. Personnel qualifications should align with their roles and include:

7.2.3.1 Strong understanding of IIA standards, FAR, DEAR, and CAS regulations

7.2.3.2 Ability to apply DOE-specific cost principles and performance criteria

7.2.3.3 Relevant certifications and experience

7.2.3.4 Excellent written and verbal communication skills, including the ability to present findings to management and DOE-oversight bodies.

8.0 ENVIRONMENT, SAFETY, AND HEALTH

The Subcontractor shall comply with:

8.1 The specific PPPL documents, requirements, permits and courses listed in this Statement of Work; and

8.2 All applicable Federal, State, and local laws, regulations and requirements whether or not they are specifically listed in the Statement of Work or Subcontract.

9.0 QUALITY ASSURANCE REQUIREMENTS

The Subcontractor shall conduct and provide documentation to OAC of its own independent peer review, in order to fulfill the IIA Global Internal Audit Standards Quality Assurance requirement.

10.0 SHIPPING STORAGE AND HANDLING

11.0 WARRANTY

12.0 ATTACHMENTS

1. Report Title Page Format (Showing Subcontractor name in footer)

2. Report Body Format (Showing Subcontractor name in footer)

3. Report Transmittal Letter Format (Issued on Subcontractor’s letterhead, authored by Subcontractor’s responsible partner)

4. Subcontractor Nondisclosure Form Template

13.0 DOCUMENTATION & DELIVERABLES

13.1. Statement of Independence

13.1.1 The Subcontractor shall provide the PTR a written statement certifying that it and its personnel (including the Subcontractor, its principals, and its employees) are free both in fact and appearance from personal, external, and organizational impairments to independence in all matters relating to the engagement as described in the IIA Global Internal Audit Standards. Specifically, the Subcontractor shall certify that it (1) is not biased because of its past, present, or currently planned interests (financial, contractual, organizational, professional, individual, or otherwise) which relate to the task, (2) is not providing services to PPPL that may compromise their independence as required by the IIA Global Internal Audit Standards, and (3) does not obtain any unfair competitive advantage over other parties by virtue of its performance of this work. After the task has commenced, the Subcontractor shall immediately notify the PTR of possible impairments to independence.

13.1.2 The Subcontractor shall consider not only whether it is independent and whether its attitudes and beliefs permit it to be independent, but also whether there is anything about its situation, which might lead others to question its independence.

13.1.3 Subcontractor and Subcontractor Employee Independence Statements and Nondisclosure forms are required to be signed by each member of the Subcontractor’s proposed audit team.

13.2. Subcontractor Personnel Credentials

13.2.1 Prior to assigning personnel to PPPL work, the Subcontractor shall submit a biographical statement for each individual, describing that individual’s educational experience (including formal degrees and majors), and relevant employment experience.

13.2.2 Employment experience should be arranged in chronological order, starting from most recent and giving start and end dates by month and year.

13.2.3 The PTR shall review this submittal and approve in writing each candidate for assignment before the candidate commences work on the Subcontract.

13.3 Audit Reports

13.3.1 Following the conclusion of fieldwork and validation of observations with relevant PPPL personnel, the draft report with observations and recommendations will be discussed with OAC and subsequently presented and discussed with PPPL management and OVP in order to complete management action plans as necessary.

13.3.2 PPPL management will provide management responses and action plans. Upon receipt of management responses, a draft report with observations, recommendations, and management action plans/responses will be discussed with OAC and subsequently presented and discussed with the DOE Princeton Site Office, OVP and PPPL management.

13.3.3 The final report, including management responses/action plans, will be provided to OAC. OAC will issue the final report to relevant PPPL personnel and with a copy to OVP, the DOE Princeton Site Office Contracting Officer, and other DOE personnel as confirmed with DOE-PSO.

13.3.4 The final report will also be shared with Princeton’s Executive Compliance Committee and select members of Princeton’s management.

13.3.5 An executive summary of the report will be presented to the University’s Trustee Committee on Audit and Compliance.

13.3. Work Papers

See Section 6.0 for work paper document requirements.

14.0 FRAUD, ILLEGAL ACTS, VIOLATIONS OF GRANT AGREEMENTS & ABUSE

14.1 The Subcontractor is responsible for being aware of the characteristics and types of vulnerabilities and potential illegal acts associated with the engagement in order to identify indications that illegal acts, violations of contract provisions, or abuse may have occurred.

14.2 If during the course of the engagement, information comes to the Subcontractor’s attention indicating that fraud, illegal acts, or violations of provisions of agreements that could have a material effect on the subject matter or abuse that could be quantitatively or qualitatively material may have occurred, they shall immediately notify OAC by telephone and confirm the conversations in writing. The Subcontractor shall not discuss the condition with any PPPL personnel without specific direction from OAC. Any further action to be carried out shall be as directed by OAC.

14.3 Types of situations that need to be brought to the attention of OAC are the apparent commission of or intent to commit an illegal or wrongful act or series of acts to achieve a purpose inconsistent with a contract, the law, or public policy in order to obtain money, property, or personal advantage. Specific examples might include, but are not limited to, deceit, cheating, misrepresentation, deliberate misconduct such as destruction of records, concealment of assets, covering up sources of income, and any other conduct that would tend to be misleading or conceal relevant information or data.

15.0 PROTECTION OF CONFIDENTIAL AND SENSITIVE INFORMATION

15.1 To the extent that work under this Subcontract requires the Subcontractor be given access to confidential or sensitive information belonging to Princeton or its supporting subcontractors, the Subcontractor shall after receipt thereof treat such information as confidential and agrees not to use such information for internal purposes or disclose such information to third parties unless specifically authorized by the PTR in writing.

15.2 For knowingly disclosing information in violation of the Privacy Act, the Subcontractor and Subcontractor's employees may be subject to the penalties as set in 5 U.S.C. Section 552(i)(I) to the same extent as employees of Princeton.

15.3 The Subcontractor shall assure that each auditor with access to confidential and/or sensitive information knows the prescribed rules of conduct and is aware that he/she may be subject to criminal penalties for violations of the Privacy Act.

15.4 The Subcontractor shall obtain a written agreement (suggested template to be provided by PPPL) with each auditor permitted access to confidential information, whereby the auditor agrees not to discuss, divulge or disclose any such information or data to any person or entity except those persons within the Subcontractor's organization directly concerned with the performance of this Subcontract who are also authorized access.

15.5 The Subcontractor must ensure that confidential information, documentation materials and equipment, including work papers and Princeton and/or Government property, is kept in a locked, secure place when not in use by Subcontractor staff.

15.6 The Subcontractor is also required to ensure that data maintained in electronic format is adequately protected by adhering to PPPL data protection requirements including data encryption.

15.7 Princeton reserves the right to conduct onsite visits to review the Subcontractor's documentation and in-house procedures for protection of confidential information.

16.0 SECURITY AND TRAINING

16.1 This Subcontract will not involve classified information.

16.2 Subcontractor auditors must be familiar with PPPL site access requirements.

16.2.1 Subcontractor personnel are responsible for complying with PPPL badge requirements and following computer security requirements if computers are brought onsite.

16.2.2 In addition, Subcontractor auditors are responsible for following PPPL policies regarding prohibited articles.

16.3 All Subcontractor employees who are expected to be on site at PPPL for more than 40 hours in the course of the Subcontract are required to complete PPPL General Employee Training (GET) in order to receive a PPPL badge and continue their work on the PPPL site.

16.4 Each Subcontractor employee assigned to PPPL must be a US citizen.

16.4.1 Subcontractor shall include a statement and certify that all proposed employees are US citizens.