Sources Sought HUD OIG Financial Audit Support Services.pdf

The Bureau of the Fiscal Service (FS) Division of Procurement Services, on behalf of US Department of Housing and Urban Development, Office of the Inspector General (HUD‐OIG), is seeking sources to establish a capable and interested vendor pool to provide audit support services for the Federal Housing Administration’s (FHA) stand-alone financial statements, HUD’s Consolidated Financial Statements, and the Government National Mortgage Association’s (GNMA/Ginnie Mae) stand-alone financial statements via the Open Market.

This Sources Sought Notice, and any resulting solicitation, will utilize NAICS 541211. This opportunity is posted to SAM.gov utilizing the identifier SoS‐HUD‐23‐040.

In your response, please provide your DUNS, business size designation, capability statement illustrating capability and one previous government project that shows similar or comparable complexity.

Respondents to this Sources Sought Notice shall be able to perform all of the duties/requirements listed in the attached Performance Work Statement (PWS). The attachments noted in the PWS are not applicable to this Sources Sought Notice but will be applicable in any future solicitation. Respondents shall provide their capability statement fully illustrating their ability to meet the PWS requirements to purchasing@fiscal.treasury.gov with the subject line Richards/Johnson: SoS‐HUD‐23‐040 – HUD-OIG Financial Audit Support Services, no later than Tuesday February 21, 2023, by 10 00 am EST. Submissions received after this date will not be considered.

INSTRUCTIONS FOR PROSPECTIVE RESPONDENTS

Interested firms are asked to provide the following in their response to this Sources Sought Notice:

1. The name, location, Unique Entity Identifier (UEI), and point-of-contact information for the respondent's firm.

2. A brief capabilities statement, including a description of the respondent firm's standard line of business and relative experience as well as an example of one previous government project performed by the respondent firm of similar or comparable size and complexity.

3. The respondent firm's business size under 541211 (Offices of Certified Public Accountants) with a Small Business size standard of $26.5 Million.

4. If your firm holds any Government Wide Acquisition Vehicle (GWAC) or GSA Schedule Contracts, that information shall be included in the submission of your capability statement.

Any questions about this Sources Sought Notice will not be entertained, as a vendor pool is all that is being sought at this time. Questions and Answers will be fielded during the solicitation period in the future.

Quotations/proposals will not be accepted at this time.

OFFICE OF INSPECTOR GENERAL (OIG)

U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT (HUD)

OFFICE OF AUDIT (OA)

GOVERNMENT NATIONAL MORTGAGE ASSOCIATION (GNMA), FEDERAL HOUSING

ADMINISTRATION (FHA) and HUD CONSOLIDATED Financial Statement Audit Support Performance Work Statement (PWS)

1. GENERAL

1.1. BACKGROUND

The Office of Inspector General of the U.S. Department of Housing and Urban Development (HUD OIG) is an independent government entity established to prevent waste, fraud, and abuse within HUD and its programs.

A large part of HUD OIG’s financial management oversight role is compliance with the Chief Financial Officers Act of 1990, as amended (CFO Act). HUD OIG is responsible for conducting an annual financial statement audit of HUD and its component entities, including the Federal Housing Administration (FHA) and the Government National Mortgage Association (GNMA/Ginnie Mae). By law, HUD OIG is required to issue an independent auditor’s report by mid-November of each year.

1.2. SCOPE

The objective of this contract is to obtain the services of an independent public accounting firm (Contractor) to complete an audit of FHA stand-alone financial statements (referred to as Task A), HUD’s consolidated financial statements (referred to as Task B), and Ginnie Mae stand-alone financial statements (referred to as Task C) for fiscal year 2023 (including the fiscal year 2022 comparatives) and up to four (4) subsequent option periods beginning with fiscal year 2024, in accordance with the CFO Act. All requirements in this contract apply to all option years and all deliverables must be submitted every option year.

Ginnie Mae’s and FHA's financial statements are a major component of HUD’s consolidated financial statements. The audit of Ginnie Mae’s and FHA’s stand-alone and HUD’s consolidated financial statements must be conducted in accordance with the current version of GAO’s Government Auditing Standards, commonly referred to as generally accepted government auditing standards (GAGAS), issued by the Comptroller General of the United States, and the current version of the following:

• Generally accepted auditing standards (GAAS), as established by the American Institute of

Certified Public Accountants (AICPA) and promulgated in its Statements on Auditing Standards (SAS) and its Auditing Standards Clarified (AU-C);

• All volumes of the Financial Audit Manual (FAM), issued by the Government Accountability Office (GAO) and the Council of the Inspectors General on Integrity and Efficiency (CIGIE);

• Federal Information System Controls Audit Manual (FISCAM), issued by GAO;

• National Institute of Standards and Technology (NIST) standards and guidelines; and

• Office of Management and Budget (OMB) Bulletin 22-01, Audit Requirements for Federal

Financial Statements, as amended, or its successor, and other related amendments and memorandum issued by OMB.

1.3. Contract Type

The Government anticipates this solicitation to result in a Firm Fixed Price-type contract.

1.3.1. Contract Line Item Numbers

0001 Task A base period 0002 Task B base period 0003 Task C base period 0004 Task A option period 1 0005 Task B option period 1 0006 Task C option period 1 0007 Task A option period 2 0008 Task B option period 2 0009 Task C option period 2 0010 Task A option period 3 0011 Task B option period 3 0012 Task C option period 3 0013 Task A option period 4 0014 Task B option period 4 0015 Task C option period 4

1.4. CONTRACTOR PERSONNEL

1.4.1. CENTRAL POINT OF CONTACT

The Contractor shall provide a Central Point of Contact (CPOC) for each Task, who shall be the primary point of coordination, and shall be able to serve as a point of communication and coordination between the Government and the Contractor in general. The CPOC shall be reachable during normal business hours. The CPOC may be designated as an additional role to any senior Contractor staff utilized under this action.

1.4.2. PROJECT/PROGRAM MANAGER/TEAM LEAD(S)

The Contractor shall provide a Project/Program Manager/Team Lead equivalent (PME) for each Task, who shall be responsible for all Contractor work performed under this action.

1.4.2.1. KEY PME

The PME shall be a single point of contact for the Contracting Officer (CO) and the Contracting Officer’s Representative (COR) for the contract, and is designated as “Key.” The PME shall be responsible for all deliverables, staffing, and actions under this requirement.

The name of the PME, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the PME, shall be provided to the Government. During any absence of the PME, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under the contract. The PME and all designated alternates shall be able to read, write, speak, and understand English.

1.4.2.2. PME AVALIABILITY

The PME shall be available to the COR via telephone during normal business hours.

1.4.3. QUALIFIED PERSONNEL

The Contractor shall provide qualified personnel to perform all requirements specified in this PWS. Resumes of qualified personnel for the Key positions identified in Attachment F – Estimated /Anticipated Labor Category Listings shall be provided by the Contractor and will be evaluated by HUD OIG during the technical evaluation of proposals (see Attachment K – Instructions to Offerors/ Evaluation Criteria for Award document). Qualified personnel shall be in accordance with the labor mix and approach described by the Contractor’s proposal. Resumes describing the qualifications of the Contractor’s key personnel shall contain sufficient information to support the qualifications and experience of the personnel proposed for this contract. Once the Contractor’s proposal is accepted, any changes to the Contractor’s key personnel and labor mix (i.e. quantity and quality or personnel assigned) will have to be approved in writing by the COR. On an ongoing basis as new personnel are assigned to the contract or personnel are promoted the Contractor must submit resumes of qualified personnel.

Once COR approves qualified personnel in accordance with Attachment #F, the Contractor must submit the onboarding package for HUD OIG processing prior to commencing work on the contract. At a minimum, the onboarding package must contain completed forms by qualified personnel, including:

• Declaration for Federal Employment OPM Form 306

• Fair Credit Reporting Disclosure and Authorization (FCRA)

• Fingerprint Record Notification

• HUD OIG Background Investigation (BI) Request for Contractors

• OIG PIV Form

1.4.3.1. PERSONNEL QUALIFICATIONS AND CREDENTIALS

The Contractor staff must use qualified personnel to perform the financial statements audit, including the evaluation of information systems that support financial reporting. Qualified specialists must be available to assist with the audit as needed, such as specialists in information technology, statistics, and actuarial estimates. HUD OIG anticipates, but does not guarantee, the labor categories (or similar equivalents meeting appropriate minimum standards) contained in Attachment F will be required under this action.

1.4.4. EMPLOYEE CONDUCT

Contractor employees shall comply with all applicable Government regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of military uniforms, and possession of weapons) when visiting or working at Government and its Contractor’s facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or HUD OIG.

1.4.5. REMOVING EMPLOYEES FOR MISCONDUCT OR SECURITY REASONS

The Government may, at its sole discretion, direct the Contractor to remove any Contractor employee from HUD and its Contractor’s facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under this agreement. The COR will provide the Contractor with a written explanation to support any request to remove an employee.

1.5. KICKOFF MEETING

The Contractor shall be available for a contract kickoff meeting within ten (10) business days of the date of award at 451 7th Street SW, Washington DC, 20410, unless other arrangements are made. All Contractor personnel must have a valid ID for security clearance into the building.

1.6. PERIOD OF PERFORMANCE

Twelve (12) months from date of award, with four (4) one (1) year options for additional audits.

This action will consist specifically of:

• A base requirement for the Financial Statement Audit for Tasks A, B and C

• Four (4) one (1) year performance extensions to allow for exercise of optional audits

• The ability to extend the period of performance under Federal Acquisition Regulation (FAR)

52.217-8.

1.7. PLACE OF PERFORMANCE

The primary place of work shall be the Contractor’s facilities or as directed by the COR. HUD OIG will provide conference space/workspace at secondary worksites, to include HUD OIG Headquarters in Washington, D.C. and other offices located within the Continental United States (CONUS), as necessary.

1.7.1. TRAVEL

The Contractor may be required to travel and conduct fieldwork at Ginnie Mae, FHA and HUD field offices and contractor and/or subcontractor locations, unless otherwise specified. The auditee’s contractor and subcontractor locations outside of the Washington, D.C. area where fieldwork may be required could include, but is not limited to, the following:

• Task A: Philadelphia, PA; Santa Clara, CA; Denver, CO; Stennis, MS; Clarksville, VA;

Atlanta, GA; Oklahoma City, OK; and Albany, NY

• Task B: Parkersburg, WV and Fort Worth, TX

• Task C: New York, NY; Anaheim, CA; Houston, TX; Andover, MA; and Minneapolis, MN

Travel shall be approved in advance by the COR or CO. Travel is subject to the Federal Travel Regulations and FAR 31.205-46 Travel Costs.

1.8. SPECIAL SECURITY REQUIREMENTS

In addition to any security requirements contained in the Terms and Conditions (Attachment E), the Contractor shall adhere to the following:

1.8.1. INFORMATION SECURITY AND CONFIDENTIALITY

The Contractor must comply with all laws, regulations, and federal guidelines; and, HUD OIG and internal HUD, Ginnie Mae and FHA policies regarding the handling, storage, and safeguarding of HUD, Ginnie Mae and FHA information, including HUD, Ginnie Mae and FHA information stored on Contractor’s computers.

1.8.2. CONFIDENTIALITY AGREEMENTS

The Contractor and its employees performing work under this contract are required to submit a non-disclosure/confidentiality agreement (NDA) annually (Attachment D or equivalent).

1.8.3. RECORDS MANAGEMENT

The Contractor shall provide, implement, and adhere to a plan for the protection of all electronic records, and any paper records, field notes, or other documents that contain sensitive or personally identifiable information. The Contractor shall ensure that its employees, subcontractors (at all tiers), and employees of all subcontractor(s) who perform work under this contract/subcontract are trained on data privacy issues and comply with the above requirements. The Contractor shall submit a written plan and assurance for complying with the above requirements at least annually.

1.8.4. DELIVERABLES IN SUPPORT OF 1.7

1.8.4.1. SYSTEM SECURITY PLAN, SOC REPORTS, AUTHORIZATION TO OPERATE, AND

AUTHORIZATION TO USE

The contractor shall provide its current System Security Plan, along with service organization reports for its data centers. The Contractor shall also provide a current Authorization to Operate (ATO) issued by a Federal Government organization, or, if the contractor does not have a current ATO then the Contractor shall provide information necessary to satisfy the requirements to complete an Authorization to Use (ATU) or an ATO if HUD OIG determines a full ATO is warranted.

1.8.4.2. SECURITY AUTHORIZATION DOCUMENTATION

The contractor shall provide documentation to support completion of 1) an Authorization To Use (ATU) based on SP 800-171 self-attestation or 2) Authorization To Operate (ATO) based on SP 800-53.

1.8.4.3. SECURITY TRAINING

The contractor shall require its employees working on the contract to complete required trainings (example: annual security, records management, and privacy training) provided by HUD OIG or HUD (whichever one is more readily available). The COR or ACOR will provide additional instructions on the annual required trainings at the start of the period of performance and annually if options are executed.

1.8.5. RESTRICTION ON OPINION DISCLOSURES

Opinions are not to be discussed with any HUD, Ginnie Mae or FHA personnel without prior approval and presence of the COR, ACOR, and task monitor. Any "potential opinion issues" are not to be discussed with any HUD, Ginnie Mae or FHA personnel without the presence of the task monitor. All contractor reports (both draft and final reports) shall be submitted only to the OIG. The OIG will redact any necessary sections before submitting the reports to HUD, Ginnie Mae or FHA for review.

1.9 General Note on Contract Deliverables

On all deliverables pertaining to this contract, the due date for all deliverables may be re-negotiated between the Contractor and the COR/ACOR. When the due date for deliverables are in dispute, the Contracting Officer has final authority.

2. GOVERNMENT TERMS AND DEFINITIONS

AAP Audit Approach Plan

ACOR Alternative Contracting Officer’s Representative

AICPA American Institute of Certified Public Accountants

AICPA AU-C AICPA clarified audit standard

ARC U.S. Department of the Treasury’s Bureau of Fiscal Service Administrative Resource Center

ASB Auditing Standards Board

Auditee Entity being audited

CFO Chief Financial Officer

CIGIE Council of the Inspectors General on Integrity and Efficiency

CO Contracting Officer

Component Auditor An auditor who performs work on the financial information of a component that will be used as audit evidence for the group audit. In this contract, the auditors of FHA and Ginnie Mae are component auditors.

CONUS Continental United States

COR Contracting Officer’s Representative

CPE Continuing Professional Education

CPOC Central Point of Contact

FHA Federal Housing Administration

FAM U.S. Government Accountability Office’s Financial Audit Manual

FAR Federal Acquisition Regulation

FASAB Financial Accounting Standards Advisory Board

FASB Financial Accounting Standards Board

FCRA Federal Credit Reform Act

FFMIA Federal Financial Management Improvement Act of 1996

Financial Audit Program Manager

HUD OIG Staff responsible for overall conduct of all financial statement audits within HUD

FISCAM Federal Information System Controls Audit Manual

FISMA Federal Information System Management Act

FMFIA Federal Managers’ Financial Integrity Act

GAAP Generally Accepted Accounting Principles

GAAS Generally Accepted Auditing Standards

GAGAS Generally Accepted Government Auditing Standards

GAO Government Accountability Office

Ginnie Mae Government National Mortgage Association

Group Auditor The auditor conducting the audit of financial statements that include the financial information of more than one component. In this contract, the group auditor is the auditor conducting the HUD consolidated audit.

GTAS Governmentwide Treasury Account Symbol Adjusted Trial Balance System

HUD U.S. Department of Housing and Urban Development

IT Information Technology

LIRA Line Item Risk Analysis

LLG Loan loss guarantee

LLR Loan loss reserve

MBS Mortgage-Backed Securities

MD&A Management Discussion and Analysis

NDA Non-Disclosure Agreement

NFR Notice of Finding and Recommendations

NIST National Institute of Standards and Technology

NQCR NFR Quality Control Record

OIG Office of Inspector General

OMB Office of Management and Budget

PBC Prepared by Client

PME Project/Program Manager/Team Lead Equivalent

PWS Performance Work Statement

QASP Quality Assurance Surveillance Plan

ROA Return on Assets

RSI Required Supplementary Information

RSSI Required Supplementary Stewardship Information

SAS Statements on Auditing Standards

SCE Specific Control Evaluation

SFFAS Statements of Federal Financial Accounting Standards

SOC Service Organization Control

SSAE Statement on Standards for Attestation Engagements

3. GOVERNMENT FURNISHED RESOURCES

The Government shall furnish necessary access to employees, facilities, and information systems as necessary for the Contractor to complete the required work. The Contractor will be required to sign a Non-Disclosure Agreement (NDA) with the submission of the initial onboarding package and annually if the option year is exercised. In order to comply with information security requirements, the government may provide computer equipment, at its discretion. The Contractor staff shall only use this equipment to request and receive audit related information requests. This equipment should also be used to participate in or conduct video conferences unless utilizing telephones. Only this equipment should be used to conduct all email communication. After the contract ends or a Contractor is removed from the contract, the Contractor(s) must return the GFE and PIV to the Government within 30 days.

4. CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all resources necessary to complete the requirements, excluding those items specified in 3.0.

5. REQUIREMENTS

For Task A, B and C, the Contractor must conduct the financial statement audit in accordance with section 1.2 SCOPE for the purpose of expressing an opinion on the fairness of the presentation of the financial statements in accordance with GAAP which is included as part of the final audit report. The fiscal year under audit covers the period from October 1 through September 30. It is HUD OIG’s intention to submit to HUD management the final audit reports on or before November 14 to allow sufficient time for inclusion in HUD’s Agency Financial Report that is generally due by November 15 of each year. To the extent identified, the Contractor will prepare a report on internal control over financial reporting, including all material weaknesses and significant deficiencies identified through audit testing or reported by HUD as part of its FMFIA process.

For Task A, B, and C, the Contractor, working with the auditees, must identify and assess the information technology (IT) general and application controls of major information systems and feeder systems, in support of the financial statement audit. The evaluation of IT systems must be performed in accordance with FISCAM. Work will be performed according to the most current issuances of GAGAS, OMB policy, and applicable guidance from NIST. The Contractor must also consider the user controls detailed in the applicable service agency’s Service Organization Control (SOC) reports during its IT and internal control testing. The Contractor must review and test the user controls discussed in applicable SOC 1 reports to the extent considered necessary to support the Contractor’s opinion on the financial statements.

For Task A, B, and C, the Contractor must also conduct testing and report on the auditee’s compliance with laws, regulations, contracts, and grant agreements that have a direct and material effect on the entities’ financial statements, including compliance with FFMIA and FMFIA, as applicable. This contract does not require an expanded review of performance data beyond that which is required under GAO and AICPA standards. For Task B, the Contractor will serve as the Group Auditor, and therefore must consider the effects of identified noncompliance findings identified at the component entities and determine if those instances of noncompliance with laws, regulations, contracts, and grant agreements have a direct and material effect on the consolidated financial statements.

Specific details for each task are outlined below:

Task A: Audit of the FHA Stand-alone Financial Statements The Contractor must conduct an audit of the FHA stand-alone comparative financial statements in accordance with GAGAS. The Contractor must provide the necessary qualified personnel, materials, and travel (if requested by the COR/ACOR), to conduct a financial statement audit for the purpose of expressing an opinion on the fairness of the presentation of FHA’s financial statements in accordance with generally accepted accounting principles (GAAP). The Contractor must obtain sufficient, appropriate evidence in order to attest to the account balances either in existence on the close of the fiscal year or for the transactions during the fiscal year and related prior year comparatives. The Task A Contractor performing the FHA stand-alone financial statement audit is considered a component auditor under AU-C 600, Audits of Group Financial Statements. The Contractor, as a component auditor, will follow the requirements for a component auditor and coordinate its work with the HUD Group Auditor.

Task B: Audit of the HUD Consolidated Financial Statements The Contractor must conduct an audit of the HUD comparative consolidated financial statements in accordance with GAGAS. The Contractor must provide the necessary qualified personnel, materials, and travel (if requested by the COR/ACOR), to conduct a financial statement audit for the purpose of expressing an opinion on the fairness of the presentation of HUD’s consolidated financial statements in accordance with GAAP. The Contractor must obtain sufficient, appropriate evidence in order to attest to the account balances either in existence on the close of the fiscal year or for the transactions during the fiscal year and related prior year comparatives.

The Contractor performing the audit of HUD’s consolidated financial statements will be the Group Auditor, as described in AU-C 600, Audits of Group Financial Statements. As part of Task B, the Contractor will be required to follow the requirements for a Group Auditor and coordinate with the component auditors.

Pursuant to guidance from OMB, the audit coverage required for Task B may go beyond the work required to meet GAGAS requirements. The Contractor must also test for and report on compliance with the Federal Financial Management Improvement Act of 1996 (FFMIA) and the Federal Managers’ Financial Integrity Act (FMFIA). Note that the FFMIA compliance determination made in Task B must also include FHA and Ginnie Mae systems. The Contractor must determine that HUD is adhering to all OMB Circular guidance related to financial reporting by considering the results of components’ notices of findings and recommendations, and consultation with component audit staff, the COR, and HUD OIG.

Task C: Audit of the Ginnie Mae Stand-alone Financial Statements The Contractor must conduct an audit of the Ginnie Mae stand-alone comparative financial statements in accordance with GAGAS. The Contractor must provide the necessary qualified personnel, materials, and travel (if requested by the COR/ACOR), to conduct a financial statement audit for the purpose of expressing an opinion on the fairness of the presentation of Ginnie Mae’s financial statements in accordance with generally accepted accounting principles (GAAP). The Contractor must obtain sufficient, appropriate evidence in order to attest to the account balances either in existence at the close of the fiscal year or for the transactions during the fiscal year and related prior year comparatives. The Task C Contractor performing the Ginnie Mae stand-alone financial statement audit is considered a component auditor under AU-C 600, Audits of Group Financial Statements. The Contractor, as a component auditor, will follow the requirements for a component auditor and coordinate its work with the HUD Group Auditor.

Task D: Special Supplements for Financial Statement Audits Audits are intended to identify discrepancies and concerns with an auditee’s processes or programs. As a result, during the course of an audit, issues may be identified that could not be reasonably anticipated at the start. In order to address this and similar situations, additional advisory services in support of these Tasks may be required, to include: special supplemental analyses of financial and management controls, including automated systems, and other issues related to the annual FHA, Ginnie Mae, or HUD consolidated financial statements audit. The Contractor shall ensure staff is available to meet the labor category requirements as described in Attachment F (section covering Task D). In the event actions under Task D are required, the COR and CO will specifically activate and authorize Task D work, based on discrete efforts, to include an initial request by the Government and a Contractor response to said request before full performance is authorized. Work under this section is not expected (but not guaranteed) to exceed $100,000.

DELIVERABLES IN SUPPORT OF Section 5-Requirements. The deliverables in support of 5.0 are detailed below in 5.1-5.25. In carrying out these tasks, HUD OIG anticipates a collaborative effort between the Component auditors and Group Auditor; as the contractors and HUD OIG strive to ensure standards are met and audit findings are communicated in the most effective manner. HUD OIG will review the deliverables and the Contractor will incorporate HUD OIG’s comments into the final work products, including Notices of Findings and Recommendations (NFRs) and reports, and resubmit them to HUD OIG for final review prior to releasing them. If unable to make suggested HUD OIG edits, the Contractor shall discuss the matter with the COR/ACOR and provide justification for its decision. See Section 7, Deliverable Schedule and Quality Assurance Surveillance Plan, for a list of deliverables, due dates, acceptable quality standard, etc. If the due date falls on a weekend or holiday, the deliverable(s) will be due the next business day. All deliverables apply to Tasks A, B and C. Unless discussed and approved with the COR or CO, the Contractor shall provide separate deliverables for each Task.

5.1. DELIVERABLE, PRE-AUDIT PREPARATION AND KICK-OFF MEETING

For Task A, B, and C, the Contractor must attend the contract Kick-Off Meeting that is scheduled by OIG once the contract is awarded or option year is exercised. The purpose of the meeting is to aid both OIG and Contractor to achieve a clear and mutual understanding of contract requirements.

However, this is not a substitute for the Contractor’s full understanding of the contract requirements.

As part of the pre-audit preparation documents and if not already provided during the pre-award and contracting process, for Task A, B, and C, the Contract must provide the following documents:

a) Project Management Plan

b) Staffing Plan that is detailed by audit area, staff assignments, and staff hours

c) Firm Independence Statement

d) Firm CPA License

e) Latest Peer Review Report (within last 3 years), letter of comments and response to the peer review report. Upon request, inspection report that documents the firm’s ongoing monitoring of the audit and accounting practice’s systems of quality control.

For all contract personnel, the Contractor must provide the following documents annually:

• Non-Disclosure Agreement

• Staff Independence Statement

• Details of Continuing Professional Education (CPE) as required by GAGAS

As the Contractor adds new personnel (at any level) or promotes personnel on the contract, the Contractor must submit to the COR/ACOR for approval, a resume for new personnel in accordance with Section 1.3.3 Qualified Personnel. Once resume is approved (for new and promoted personnel) and new personnel is cleared by personnel security, the Contractor must submit the following documents:

• Updated Staffing Plan, as applicable to Task A, B, and C

• Staff Independence Statement (only for new personnel, not for promoted personnel)

• Details of Continuing Professional Education (CPE) as required by GAGAS (only for new personnel, not for promoted personnel)

5.2. DELIVERABLE, ENTRANCE CONFERENCE

For Task A, B and C, the Contractor must hold the entrance conference meeting with the appropriate auditee management officials prior to the start of the fieldwork. The purpose of the entrance conference is to (1) inform management of the audit objectives, scope, and methodology; (2) describe the auditor’s and management’s responsibilities as well as prior year report findings, current year timeline, and auditor staffing; (3) establish points of contact (audit liaison) for the audit: and (4) coordinate administrative matters. The entrance conference PowerPoint presentation and agenda shall describe the overall audit approach and schedules. The presentation is due to HUD OIG for review before the scheduled meeting. Copies of the meeting minutes as well as official sign-in sheet are to be kept in the Contractor’s workpapers to document significant discussions.

5.3. DELIVERABLE, ENGAGEMENT LETTER

For Task A, B and C, the Contractor must prepare an engagement letter addressed separately to HUD OIG and those charged with governance that communicates among other things its responsibilities in the financial statement audit as well as its responsibilities for testing and reporting on compliance with laws, regulations, contracts, and grant agreements, and internal controls over financial reporting. The engagement letter must comply with the requirements and format specified by the GAO and described in the FAM and AICPA Auditing Standards. Further, the letter shall cover any additional testing of compliance and internal controls required by laws, regulations, contracts, and grant agreements, or otherwise requested. The proposed engagement letter is due to HUD OIG for review before sending to the auditee for signature.

5.4. DELIVERABLE, CORRECTIVE ACTION PLANS (CAP) EVALUATION AND AUDIT FOLLOW-UP

OF PRIOR YEAR’S AUDIT FINDINGS

For Task A, B and C, the Contractor must evaluate the proposed management decision(s) from the prior year audit report and recommend to HUD OIG to accept or reject. HUD, FHA or Ginnie Mae may submit a management decision for accepting or rejection any time between when the prior year audit report is issued and 104 days after. HUD OIG will provide the Contractor management decision information within three (3) business days after it is submitted by HUD, FHA or Ginnie Mae in the Audit Resolution and Tracking System (ARCATS). The Contractor must evaluate the proposed management decision and recommend to HUD OIG to accept or reject the proposed management decision(s) within ten (10) business days. If the Contractor recommends to reject the management decision, the Contractor must provide an explanation indicating the reason for rejection that has been communicated with the auditee.

Additionally, to adequately plan the current year's audit, the Contractor must provide an interim and final report to HUD OIG on the status of the prior year’s audit findings (i.e. material weaknesses, significant deficiencies, and management letter comments). The interim report must contain the status of the prior year's audit findings, including what has been done or implemented since the last audit. The final report must contain information that ensures accurate reporting in the final audit report, including year-end follow-up on implementation of CAP, the results of testing, and the Contractor's final disposition on the status of corrective action plans for all open recommendations.

In addition to the reports described above, if the auditee enters a revised management decision, once the OIG provides the revised management decision to the Contractor, the Contractor must respond within 6 business days to OIG indicating its position to accept/reject and include an explanation indicating the reason for rejection.

5.5. DELIVERABLE, FINANCIAL STATEMENT AUDIT STRATEGY and OTHER PLANNING

DOCUMENTS.

For Task A, B and C, the Contractor must submit detailed audit planning documents that conform with the requirements of the GAO FAM and subsequent revisions and Section 5.25 WORKPAPER

DOCUMENTATION.

The planning phase activities and documentation must provide equivalent information and content as specified in the FAM. For Task A, B and C, at a minimum, the Contractor must provide the following:

a) Audit Strategy

b) Entity profile

c) Cycle Matrix

d) Line Item Risk Analysis (LIRAs) for all significant line items- only planning phase portion completed

e) Materiality for the financial statements taken as a whole, performance materiality, tolerable misstatement, and clearly trivial amounts

Note: At this stage, the Audit Strategy, Entity Profile, Cycle Matrix, and Materiality documents above must be finalized, and second level reviewed and approved in the audit workpapers. Further, the planning portion of the LIRAs must be finalized and reviewed and approved. However, if new information is discovered during the planning phase that impacts these deliverables, the impacted deliverables should be revised and resubmitted with 5.8.

Where the Contractor’s planning documents and/or methodology differ in format with the auditing standards promulgated by the AICPA ASB or FAM, a crosswalk from the Contractor’s documents/methodology to AICPA Auditing Standards or the FAM must be submitted to and approved by HUD OIG. Unless specifically agreed to in writing by the COR, the financial audit planning documents shall include audit procedures that the AICPA Auditing Standards or the FAM, and subsequent revisions, state “must,” “should,” or “generally should” be performed.

Special Planning Considerations for Task A- FHA Stand-Alone Financial Statement Audit The Contractor must demonstrate an understanding of the of the following: a) FHA’s insurance programs: single family (forward and reverse), multi-family, and healthcare; and related program requirements; and b) Mortgage insurance life cycle (e.g., underwriting , premium collection, refunds, claims processing, and foreclosure)

• Federal Credit Reform: FHA follows the Federal Credit Reform Act (FCRA) to account for its loan and loan guarantee programs. The FCRA establishes the use of the program, financing, and general fund receipt accounts for loan guarantees committed and direct loans obligated after September 30, 1991 (Credit Reform). It also establishes the liquidating account for activity relating to any loan guarantees committed and direct loans obligated before October 1, 1991 (pre-Credit Reform). These accounts are classified as either budgetary or non-budgetary in the Combined Statement of Budgetary Resources.

• Use of Shared Services in Financial Reporting: FHA relies heavily on work performed by contractors in the conduct of its day-to-day operations. To the extent that work of independent third parties can be relied upon, the Contractor shall develop an audit approach taking into account an analysis of the evaluation of audit risks associated with the control activities performed by FHA alone and the control activities performed by its contractors on FHA’s behalf (typically in scope as part of Statement on Standards for Attestation Engagements (SSAE) 18, etc.)The Contractor should review the SSAE 18 to ensure that all of the services that the U.S. Department of Treasury’s Bureau of Fiscal Service Administrative Resource Center (ARC) is providing to HUD are included. If upon the Contractor’s review it is determined there are significant processes that are not covered by the SSAE18, the Contractor must design and execute audit procedures in those areas. In addition to any items that are not covered under the SSAE 18, the Contractor must review FHA’s complementary controls to determine if they are designed and implemented and achieve the objective intended.

Special Planning Considerations for Task B HUD Consolidated Financial Statements Audit The Task B Contractor is the Group Auditor as defined by AU-C Section 600, Audits of Group Financial Statements. As part of Task B, the Contractor will be required to obtain an understanding of HUD’s component entities, FHA and Ginnie Mae. The Contractor will determine, after consulting with and concurrence of the COR and HUD OIG’s Financial Audit Program Manager, the extent of the Task B Contractor’s involvement in HUD’s component entities’ (FHA and Ginnie Mae) financial statement audits and the degree of responsibility the Contractor will assume for the component auditors’ work. As the Group Auditor, the Task B Contractor will regularly communicate with the component entities’ auditors or contractors to ensure required information on the status of the component audits is being communicated to the Group Auditor in a timely manner.

For Task B, the Contractor, must demonstrate an understanding of the following:

• Departmentwide determination and reporting of Compliance with Laws, Regulations, Contracts, and Grant Agreements: A required element of Task B is the determination and reporting of departmentwide compliance with certain financial management laws, regulations, contracts, and grant agreements. Working with the component auditors, the Task B Contractor must include in its planning documents a coordination plan for the identification and testing of financial management laws, regulations, contracts, and grant agreements relevant to HUD and its components.

• Departmentwide determination and reporting of material weaknesses and significant deficiencies reported in the Report on Internal Controls Over Financial Reporting: A required element of Task B is the determination and reporting of departmentwide material weaknesses and significant deficiencies in internal controls over financial reporting. Working with the component auditors, the Task B Contractor must include in its planning documents a plan for the identification of findings in internal controls over financial reporting reported at the component entities, assessment of significance of those findings at the HUD consolidated financial statement level, and consolidation and reporting of findings at the Group Auditor level.

• Consolidation of Component Entities: Task B includes the financial statement audit of

HUD’s programs, as well as consolidation of results of FHA and Ginnie Mae financial statements audits. As such, FAM 630, Audit of Group Financial Statements, must be considered in audit planning and reporting, along with the following:

FASB and FASAB Accounting Standards: For its stand-alone financial statements, FHA considers FASAB the accounting standards-setting body, while Ginnie Mae considers the Financial Accounting Standards Board (FASB) the accounting standards-setting body.

Ginnie Mae performs adjustments to its FASB trial balance in order to follow FASAB standards for Governmentwide Treasury Account Symbol Adjusted Trial Balance System (GTAS) reporting. ARC uses Ginnie Mae’s GTAS data for consolidation. As the Group Auditor, Ginnie Mae’s FASB to FASAB adjustments must be reviewed, along with other elements and eliminations in the consolidation process.

• Statement of Budgetary Resources: Ginnie Mae’s Statement of Budgetary resources also must be audited by the Group Auditor because the stand-alone Ginnie Mae audit does not include the audit of budgetary accounts. The entity profile includes additional detail regarding the consolidation process (Attachment G).

• Significant Estimates: HUD uses estimates primarily to estimate its 1) loan guarantee liability, 2) prepayments to PHAs in the Housing Choice Voucher and Indian Housing Block Grant programs, and 3) grant accruals in accordance with Statements of Federal Financial Accounting Standards (SFFAS) 5, Technical Release 12, Accrual Estimates for Grant Programs.

• Federal Credit Reform: HUD follows the Federal Credit Reform Act (FCRA) to account for its loans and loan guarantees. The FCRA establishes the use of the program, financing, and general fund receipt accounts for loan guarantees committed and direct loans obligated after September 30, 1991 (Credit Reform). It also establishes the liquidating account for activity relating to any loan guarantees committed and direct loans obligated before October 1, 1991 (pre-Credit Reform). These accounts are classified as either budgetary or non-budgetary in the Combined Statement of Budgetary Resources.

Although Ginnie Mae’s Mortgage Backed Securities (MBS) guarantee program does not follow FCRA, it uses a program, financing, liquidating, and capital reserve account to process its cash receipts and disbursements through the U.S Department of the Treasury.

Ginnie Mae established this fund structure at the direction of OMB in 2012. Under this structure, OMB also instructed Ginnie Mae to annually record an upward or downward re-estimate and negative subsidy payment for only budgetary purposes. Based on these estimates, Ginnie Mae transfers money between its accounts. These transfers are reflected in the spending authority from offsetting collections and new obligations and upward adjustments financial statement line items on the Statement of Budgetary Resources and impact the amount held in fund balance with Treasury versus investments on the balance sheet. Therefore, although HUD accounts for Ginnie Mae’s MBS guarantee program in accordance with SFFAS 51, Insurance Programs for FASAB reporting, it also performs a modified credit reform accounting at the direction of OMB.

• Use of Shared Services in Financial Reporting: HUD uses a shared service provider, Treasury’s ARC, for various financial management services, including the consolidation and preparation of its financial statements. ARC is audited annually and provides HUD with its Statement on Standards for Attestation Engagements (SSAE) 18. The Contractor should review the SSAE 18 to ensure that all of the services ARC is providing to HUD are included.

If upon the Contractor’s review it is determined there are significant processes that are not covered by the SSAE18, the Contractor must design and execute audit procedures in those areas. In addition to any items that are not covered under the SSAE 18, the Contractor must review HUD’s complementary controls to determine whether they are properly designed and implemented to achieve the intended objective.

Special Planning Considerations for Task C Ginnie Mae Financial Statements Audit Ginnie Mae relies heavily on the work performed by its contractors in the conduct of its day to day operations. To the extent that work of independent third parties can be relied upon, the Contractor shall develop an audit strategy taking into account an analysis of the evaluation of audit risks associated with the control activities performed by Ginnie Mae alone and the control activities performed by its contractors on Ginnie Mae’s behalf (typically in scope as part of SSAE 18 SOC 1, Contract Assessment Review, etc.) in planning and scoping the audit for audit efficiency.

For Task C, the Contractor, must demonstrate an understanding of the following:

• Ginnie Mae Mortgage-Backed Securities (MBS) Guide and program requirements;

• The loan life cycle (e.g., modifications, claims processing, foreclosure);

• Mortgage servicing operations, including use of service organizations;

• The role of insurers/guarantors including, FHA or guaranteed by the U.S. Department of

Veterans Affairs (VA). Other guarantors or Issuers of loans eligible as collateral for Ginnie Mae MBS including the U.S. Department of Agriculture’s Rural Development (RD) and HUD’s Office of Public and Indian Housing (PIH);

• Ginnie Mae models and model governance.

5.6. DELIVERABLE, INFORMATION TECHNOLOGY STRATEGY AND OTHER PLANNING

DOCUMENTS.

For Task A, Band C, the Contractor must develop and submit to HUD OIG for review and approval detailed IT audit planning documents including a) IT Audit Approach Plan and b) IT Audit programs.

The IT planning documents should conform to the requirements and methodology of the FISCAM, and any subsequent revisions, as well as the workpaper documentation requirements in section 5.25 WORKPAPER DOCUMENTATION REQUEST/ ACCESS TO CONTRACTOR’S WORKPAPERS. The steps in FISCAM shall be performed in coordination with the related steps in the FAM, as noted in Deliverable 5.0 above. At a minimum, the IT planning documents must include related FISCAM steps for audit planning (e.g. IT risk assessments), internal control testing (general and application system controls), and reporting the results of the IT controls audit work, as described in FISCAM Appendix

VI and subsequent revisions. Unless specifically agreed to in writing by the COR, the IT planning documents must include audit procedures that the FISCAM and subsequent revisions state “must,” “should,” or “generally should” be performed.

The IT planning documents described above must provide equivalent content as specified in the FISCAM. Where the Contractor’s planning documents and/or methodology differ in format from the FISCAM, a crosswalk from the Contractor’s documents/methodology to FISCAM must be submitted to and approved by the COR/ACOR.

5.6.1. IT PLANNING

The auditees (FHA, HUD and Ginnie Mae) rely on the work performed by contractors in the conduct of their operations. To the extent that control test work performed by independent third parties can be relied upon, the Contractor shall develop an audit strategy, taking into account an analysis of the evaluation of audit risks associated with the IT control activities performed by the auditees alone. The Contractor should also consider the IT control activities performed by their contractors on their behalf (typically in scope as part of SSAE 18 SOC 1 Type ii reports, etc.) in planning and scoping the audit for audit efficiency. At a minimum, the IT planning documents must demonstrate that the Contractor has, for each auditee:

• Obtained sufficient understanding of the end-to-end IT architecture process flow related to business processes that are used to generate data that flows to the financial statements.

• Obtained a sufficient understanding of the overall audit objectives and related scope of the IT control audit.

• Obtained a sufficient understanding of the entity, its operations, and key business processes.

• Obtained a sufficient understanding of management decisions, either agreed to, proposed or in draft, for prior year finding.

• Identified key areas of audit interest (files, applications, systems, locations).

• Identified critical control points (for example, external access points to networks).

• Obtained preliminary understanding of IT controls.

• Determined the nature, timing, and extent of control tests.

• Obtained a general understanding of (a) the auditee’s and its service organization’s computer structure and/or computer network schema (flowchart preferable); (b) auditee’s IT personnel roles and responsibilities in managing auditee and third-party owned computer systems; and (c) the adequacy and appropriateness of the assigned roles and responsibilities and the level of oversight performed in monitoring the IT contracts.

• Reviewed the SSAE18 SOC 1 reports (prior years and current year if available) and NIST/FISCAM crosswalk analysis (Contractor to prepare the crosswalk analysis if not yet already available) for completeness and adequacy of audit scope, as well as audit procedure testing plans, etc.