USPSOIG ADMS SOW 2024.pdf

United States Postal Service Office of Inspector General

Office of Audit Statement of Work Audit Documentation Management System

1. Introduction

The United States Postal Service Office of Inspector General (OIG) intends to award a contract to a vendor who will provide audit documentation management system, including product maintenance, support, upgrades, and training.

The contract type is Firm Fixed Price (FFP).

2. Background

The OIG is an independent federal law enforcement agency within the U.S. Postal Service. Its mission is to:

Conduct and supervise objective and independent audits, reviews, and investigations relating to Postal Service programs and operations;

Promote economy, efficiency, and effectiveness within the Postal Service; and Inform Postal Service and management as well as Congress of problems, deficiencies, and corresponding corrective actions.

In fulfilling its mission to conduct and supervise objective and independent audits and reviews of Postal Service programs and operations, the OIG Office of Audit (OA) performs audits and reviews each year. OA performs these audits over a geographically dispersed environment, which includes auditors and evaluators working in various locations throughout the U.S. The OIG’s audits and reviews are designed to protect Postal Service assets and revenue, ensure efficient and economical mail delivery, and safeguard the integrity of the postal system.

OA performs audits and reviews in compliance with standards published by the Comptroller General of the United States, the American Institute of Certified Public Accountants, the Public Company Accounting Oversight Board, the Institute of Internal Auditors, and the Council of the Inspectors General on Integrity and Efficiency. These standards require OA to prepare, maintain, and protect audit documentation.

3. Scope of Work

The vendor must provide:

1. A commercial off-the-shelf, audit documentation management system solution that facilitates efficient and effective planning, analyzing, organizing, collaborating, communicating, and reporting of audit results, for 300 users.

2. Along with the system, the vendor must provide system maintenance, including regular updates for changes in technology, user documentation (user manuals/guides) with illustrations, knowledge transfer, and remote support for administrators and users of the system.

3. The system must have an easy navigable dashboard and be able to maintain summary audit results in a database with tracking ability since it will be used as a final repository for audit files.

4. The audit system must allow multiple auditors on a team to collaborate on the same audit and multiple levels of management to perform real-time reviews and audit oversight without disrupting the audit’s progress. Working papers and documentation must be easily configurable, with customizable workflows, ad-hoc reports and templates for system functions. Templates and checklists should be customizable to reflect OIG terminologies and audit processes.

5. Ability to provide workflow notifications (e.g. when an auditor responds to a manager’s review comment within an audit step, that manager receives dashboard or email notification, etc.).

6. The vendor will provide help desk support for Tier 2 and 3 services related to supporting the OIG in performing routine system administration, preventative maintenance, troubleshooting, and configuration issues for the duration of the contract and option years.

Tier 2 Services: Deals with more complex issues that Tier 1 couldn’t resolve. They have deeper technical knowledge and access to advanced diagnostic tools to troubleshoot and fix problems.

Tier 3 Services: Handles the most complex and critical issues, often involving in-depth technical expertise and collaboration with developers or engineers. They work on problems that require detailed understanding and custom solutions.

7. The system must have the storage capacity to support the OIG 7 year retention policy. This is estimated at being 1TB of storage.

8. Provide custom reports commensurate with OIG policy and procedures.

The OIG requires a vendor‐hosted solution that is configured for OIG use and requires the infrastructure and system be FedRAMP certified.

The vendor’s solution must include the minimum required functional and technical capabilities outlined in Table A and Table B.

Table A: Minimum Functional Requirement

Requirement No.

Requirement Description Related

Requirements

Project (PROJ)

PROJ0001 The system must organize audit documentation by audit project.

PROJ0002 The system must allow multiple users to collaborate on a project in real-time.

PROJ0003 The system must identify each project by a unique project number.

PROJ0004 The system must allow administrators to assign roles to system users.

PROJ0005 The system must have the ability to grant role-based access to the system, and allow for the specification (to distinguish user type) of internal

vs. external (peer review, contractor, etc.) users as part of a users system profile

DOC0006;

EU0001;

EU0002

PROJ0006 The system must log all user activity including additions, deletions, and modifications with full details of these actions including username, date/time, and details of the action.

PROJ0007 The system must provide the ability to copy audit documentation from one audit project into a new audit project.

PROJ0008 The system must allow any user with a role that allows the editing or reviewing of audit documentation to be able to create an audit project.

Program (PROG)

PROG0001 The system must require the user to input 'Audit Objectives'. (Freeform text field) without character limitations

PROG0008;

PROG0002 The system must require the user to input 'Project Scope'. (Freeform text field) without character

PROG0008

limitations

PROG0003 The system must require the user to input 'Project Methodology'.

(Freeform text field) without character limitations

PROG0008

PROG0004 The system must allow the user to input audit program steps which

DOC0005;

PROG0008;

FIND0009

Project (PROJ) consist of the following fields, at a minimum:

‘Audit Step Number’ (Numeric – prefer that the system automatically generate the number)

'Audit Step/Purpose' (Freeform text field)

'Source' (Freeform text field) 'Scope/Methodology' (Freeform text field) 'Background/Criteria' (Freeform text field) 'Details of Work Performed'

(Freeform text field) 'Conclusion' (Freeform text field)

‘Assignee’ (Prefer selection of staff name from list of team members but can be freeform text field)

'References to Supporting Documentation' (List of unique identifiers)

PROG0005 The system must not limit the number of audit program steps and groups.

PROG0004;

PROG0008

PROG0006 The system must allow project creator to add assigned staff with their appropriate role to the audit project.

PROJ0005;

PROJ0008

PROG0007 The system must allow the user to input project milestones (planned, revised, and actual — all in date format) for at least 20 agency-defined milestones.

PROG0008;

PROG0008 The system must provide a means to document management approval of the

PROG0001;

PROG0002;

Project (PROJ) following, in aggregate, prior to the start of audit fieldwork:

Audit Objectives (PROG0001) Project Scope (PROG0002) Project Methodology

(PROG0003)

All Audit Program Steps

(PROG0004 & PROG0005)

Project Staffing (PROG0006) Project Milestones

(PROG0007)

PROG0003;

PROG0004;

PROG0005;

PROG0006;

PROG0007;

PROG0008

PROG0009 The system must record a full audit trail for changes made to 'Audit Objectives'.

PROG0001;

PROG0010

PROG0010 The system must allow the user to document 'Reason' for any changes made to 'Audit Objectives'.

PROG0009

PROG0011 The system must allow users to categorize audit program steps into the following categories, at a minimum:

Planning Fieldwork Reporting

Audit Documentation (DOC)

DOC0001 The system must allow users to categorize audit documentation into the following categories, at a minimum:

Planning Fieldwork Reporting

DOC0002 The system must not limit the quantity, type, size or content of audit

DOC0003 The system should retain all comments, notes and discussions made in the project.

Project (PROJ)

Actual' date or closing out the project, supervisors sign off on as reviewed and approved any audit documentation that supports findings, conclusions, and recommendations in the audit report.

DOC0004 The system must allow users to input 'Purpose', 'Source', 'Scope', 'Conclusion' (all in Freeform text field);

and 'Related Documentation' (list of unique identifiers for audit documentation) for each unit of audit documentation.

DOC0008

DOC0005 The system must allow users to show relationships between audit documentation and the findings, conclusions, and recommendations it supports.

FIND0009

PROG0004

DOC0006 The system must provide role-based access controls to audit documentation and associated data within audit projects.

PROJ0005

DOC0007 The system must allow the project teams to restrict access to specific files given their sensitivity, at the project teams discretion.

DOC0010 The system must provide document versioning and the ability to recover a prior version of a unit of audit documentation while the project is being actively used.

DOC0011 The system must provide the ability to include the agency’s required audit

Project (PROJ) planning program steps in every project based on project type.

DOC0012 The system must allow the user to document individual audit program steps along with their purpose, source, scope, conclusion; and a list of related audit documentation.

DOC0013 The system must allow the user to add an unlimited number of audit documents with large or unlimited file sizes to the project.

DOC0002

DOC0014 The system must protect audit documentation using encryption technology.

DOC0016 The system must allow the user to add an unlimited amount of dynamic reference to all statements of fact, figures, or dates within any type of audit documentation (including, but not limited to, audit procedure steps, findings, MS Word documents, MS Excel spreadsheets, and Adobe PDF files). The dynamic reference shall be to any other statement within another audit document within the same project (including, but not limited to, audit procedure steps, findings, MS Word documents, MS Excel spreadsheets, and Adobe PDF files).

REP0006;

REP0007

DOC0017 The system must allow the agency administrator to control the size of audit

Supervision (SUP)

SUP0001 The system must have the role of 'Reviewer' (or similar role) which allows users with this role to approve audit

PROJ0004

Project (PROJ) documentation and other project data which requires review and approval.

SUP0002 The system must allow users with the 'Reviewer' role the ability to document evidence of supervision including 'Reviewer Name', 'Date', and 'Time' of approval (or similar) or disapproval (or similar) action.

SUP0003

SUP0003 The system must display a listing of approvals for each unit of audit documentation All project approvals must be able to be captured in a report.

SUP0002

SUP0004 The system must allow users the ability to document guidance, direction, or significant problems encountered (review comments or similar) to other users.

SUP0005 The system must allow users with the 'Reviewer' role (or similar) the ability to read all audit documentation and project data within the project.

SUP0006 The system must provide 'Reviewers' a dashboard, viewer, or report that displays work papers ready for review and approval and the dates they were submitted for review and approval and the aging on those dates to ensure timely reviews.

SUP0007 The system must limit reviewer signoffs to those who did not author the documentation and those with the appropriate project role.

Independence documentation (IND) IND0001 The system must require users to add independence documentation to each project prior to the start of fieldwork.

Project (PROJ)

Findings and Recommendations (FIND)

FIND0001 The system must allow the user to document findings.

FIND0002 The system must require the user to input 'Condition' for each finding. (Freeform text field)

FIND0003 The system must allow the user to input ‘Cause' for each

FIND0004 The system must allow the user to input 'Criteria' for each

FIND0005 The system must allow the user to input 'Effect' for each finding. (Freeform text field)

FIND0006 The system must allow the user to document one or more 'Recommendation' for each finding.

FIND0007;

FIND0008;

FIND0009

FIND0007 The system must require the user to input 'Recommendation Addressee’ for each ‘Recommendation’. (Prefer selection of name from list but can be freeform text field)

FIND0006

FIND0008 The system must require the user to input 'Recommendation Detail' for each ’Recommendation.’ (Freeform text field)

FIND0009 The system must allow the user to show the relationship of each finding to supporting audit program steps and audit documentation.

PROG0004;

DOC0005;

FIND0010 The system must allow the user the ability to send individual findings for review.

Phase Meetings (MTG)

Project (PROJ)

MTG0001 The system must allow a user to designate specific audit steps as 'Planning'.

MTG0002 The system should alert users when audit steps designated as 'Planning' are not completed 30 days or more following the project start date.

MTG0003

MTG0003 The system should notify project 'Reviewer' to review audit steps designated as 'Planning' at an agency-defined number of days following the project start date.

MTG0002

Audit Reports (REP)

REP0001 The system must allow the user to prepare and store the draft audit

REP0002 The system must allow the user to prepare and store the final audit

REP0003 The system must not limit the file type and content of the draft and/or final audit report.

REP0004 The system should generate a draft report that includes data from multiple fields including but not limited to:

'Audit Objectives' 'Project Scope' 'Project Methodology' Findings and related recommendations

PROG0001,

PROG0002,

PROG0003,

FIND0001,

FIND0002,

FIND0003,

FIND0004,

FIND0005,

FIND0006,

FIND0007,

FIND0008

FIND0010

Project (PROJ)

REP0005 The system must include the unmodified GAGAS compliance statement in the audit report.

REP0006 The system must allow the user to reference each statement of fact, figure, and date in the draft audit report to supporting evidence in the audit

REP0007 The system must allow the user to reference each statement of fact, figure, and date in the final audit report to supporting evidence in the audit

REP0008 The system must allow the user to input the views of responsible officials of the audited entity concerning the findings, conclusions, and recommendations in the audit report as well as any planned corrective actions in a field. This field will be used when generating a final report. In addition, the system must allow documentation of these views to be included.

Management Reports (MGT)

MGT0001 The system must allow for the creation of ad-hoc reports consisting of various fields from across the universe of audit projects and the ability to modify the reports.

MGT0002 The system shall allow editable, ad-hoc reports consisting of various fields from within the audit project. (For example, a report containing assigned audit staff along with the audit program steps they will execute for a project.)

Project (PROJ)

Quality Control and Assurance (QCA)

QCA0001 The system must require users to input 'Termination Reason' if a project is terminated prior to completion.

QCA0002 The system must allow retention of engagement documentation for at least 7 years.

QCA0003 The system must allow individuals who are not a part of the engagement team to have read-only access to audit documentation in the project.

External Users

EU0001 The system must allow individuals who are external to the organization to have read-only access to project documentation. Exact permissions are decided by ADMS admin who can set the limitations for what can be accessed.

PROJ0005;

DOC0006

EU0002 The system must allow individuals who are external to the organization the same project creation and edit abilities as an internal user with limitations set forth by the ADMS admin. For example, limited access to what projects they are able to see/ access.

PROJ0005;

DOC0006

EU0003 The system must provide the ability to export audit documentation and associated project data.

General (GEN)

GEN0001 The vendor must offer complete user documentation including manuals with illustrations.

GEN0002 The vendor must offer complete knowledge transfer via documentation sharing and/or oral communication.

The vendor’s solution must include the minimum required technical capabilities outlined in Table B.

Table B: Minimum Technical Requirements

Requirement No. Requirement Description Related Requirements

Technology (TECH)

TECH0001 The system must be a commercial, off-the-shelf audit documentation management system package.

TECH0002 The system should be a cloud-hosted solution, preferably a System-as-a-Service, Platform-as-a-service, or Infrastructure-as-a- Service.

TECH0003 The system should be a web-based application developed using modern frameworks, follow modern web standards, and optimized for Chromium-based browsers. (Edge, Chrome).

TECH0004 The system should have single sign-on (SSO) capability, including the option for SAML, and OAuth or 2FA for external users

TECH0006 The system must be scalable to at least 600 users, without impacting system performance

TECH0007 The system must use databases and technologies commonly used across the auditing industry.

TECH0010 The system must be compatible with MS Windows 11 and higher.

TECH0011 The system must be compatible with Office 365 64-bit applications (MS Word, MS Excel, etc.).

TECH0012 The system must have the ability to handle slow or latent connections through VPN or remote connections.

TECH0015 The system must make all input fields configurable/customizable by the agency via an administrative tool included with the system.

TECH0016 The system must have workflows that are agency-configurable via an administrative tool included with the system.

TECH0017 The system must have policies that must be centrally managed by the agency via an administrative tool included with the system.

TECH0018 The system must allow the agency to archive audit documentation to view/access it as applicable for at least 7 years after the project is closed.

TECH0019 The vendor must provide live support technicians available during normal business hours = Monday through Friday .

TECH0022 The system must meet either NIST Special Publication 800-53 rev 4 (or rev 5 final version) or NIST Special Publication 800-171 rev 2 (or latest version published by NIST) for compliance.

TECH0023 The system must allow unlimited project size and total storage to support the requirement of at least 7-years retention totaling up to 1TB in total storage

TECH0024 The system must allow team collaboration in documents and procedure steps, without impacting productivity or system performance.

Preferred functional capabilities (value adjusted functional capabilities) are outlined in Table C.

Table C: Preferred Functional Capabilities

Capability Description

Related Requirements

DOC0008 The system should assign a unique identifier that is visible to the user to each unit of audit

DOC0004

Table C: Preferred Functional Capabilities

Capability Description

Related Requirements

DOC0009 The system should create and store user-defined metadata for each unit of audit

DOC0015 The system should provide the ability to search audit documentation in all formats including MS Word, MS Excel, and Adobe PDF formats within a project based on user-supplied criteria.

Preferred technical capabilities (value adjusted technical capabilities) are outlined in Table D.

Table D: Preferred Technical Capabilities

Capability Description Related

Technology (TECH)

TECH0005 The system should have Personal Identity Verification (PIV) integration capability, including the option for SAML, OAuth, MFA and B2B for external users.

TECH0008 The system should provide an Application Programming Interface (API) - preferred RESTful API - as well as documentation and support for bi-directional data sharing with the agency’s customized management information system.

TECH0013 The system should have the ability to work offline, including the ability to create new audit documentation and review/approve existing audit documentation. The system must have controls in place to prevent overwriting data modified online with data modified offline.

TECH0014 The system should have FedRAMP moderate certification for both infrastructure and system.

TECH0020 The system should be compatible with SharePoint Online and Power

BI.

TECH0021 The system should support chromium based iOS browsers (mobile Edge, mobile Chrome) using

SSO.

TECH0022 Mobile capabilities should include the ability to approve and reject work.

To accomplish the above scope, the vendor shall perform the following tasks:

i. Deliver licenses, system maintenance, including system fixes, upgrades, patches, and technical support (to include Tiers 2 and 3) for the eCase for 300 users.

4. Deliverables

The vendor’s proposal shall include the deliverables outlined in Table E.

Table E: Deliverables Deliverable

Number Description Due

Date(s) Reference

SOW

Section

4a . Functional system that meets the minimum requirements as outlined. This will include licenses for 300 users upon commencement.

)3.1

4b Knowledge transfer for OA and OCIO staff on all new technologies implemented.

3.2

4c

Provide helpdesk support for Tier 2 and Tier 3 services, related to supporting the OIG

3.6

5. Pricing Instructions

The vendor shall provide pricing for the base year and all option years in accordance with the line item structure outlined in Table F.

1 After contract award.

Table F: Pricing Reference SOW Section

Description

1. Functional system customized in accordance with OIG policy and procedures provided upon commencement of contract. Licenses for 300 users for a period of 12 months provided upon commencement of contract. The 300 licenses should include System Maintenance Support, upgrades, patches, and technical support (to include help desk for Tiers 2, and 3).

3.1, 3.2

2. Storage for current and future projects amounting to 1TB upon the commencement of contract.

3.7