Risk & Controls Self-Assessment Program

The Department of Housing and Urban Development's Ginnie Mae Office of Enterprise Risk is seeking a contractor to provide Risk and Controls Self-Assessment (RCSA) Tool services to identify, assess, report, and monitor risk and controls across all eight of Ginnie Mae's offices. The procurement falls under NAICS code 541611 (Administrative Management and General Management Consulting Services) with a PSC code of R408 (Program Management Support). Contractors must hold or be eligible for a GSA Multiple Award Schedule (MAS) SIN 541611 and must demonstrate core competencies through relevant certifications including CPA, CISA, CIA, CFE, COSO, CGFM, PMP, CISSP, CISM, CCSP, CRISC, and CORP. Key contract requirements include providing comprehensive program management, RCSA execution across office and division levels, process-level reviews with control testing, annual maintenance of RCSA tools, and optional special projects on a time-and-materials basis. This is a sources sought notice with responses due by April 30, 2026 at 2:00 PM EST, and interested parties should submit organizational information, capability statements, and documentation of core competencies to Cheri Redding and Diane Toledo-Gaskins at HUD.

No set-aside designation has been designated for this procurement, though HUD indicates that based on responses received, the procurement may potentially be set aside for socioeconomic programs, small business, full and open competition, GSA, or other vehicles. The contract will be structured as a 12-month base period with four optional 12-month renewal periods, indicating a potential five-year contract engagement. The NAICS code 541611 carries a $24.5 million small business size standard, providing context for the anticipated contract value range. All work must be performed between 8:00 AM and 5:00 PM Monday through Friday at the contractor's facility, with key personnel including a full-time Project Manager and Senior Associates/Subject Matter Experts who must hold relevant certifications and demonstrate experience in risk management audits, internal controls, cybersecurity, and mortgage finance. The contractor must furnish all facilities and equipment and comply with federal regulations including the Federal Managers' Financial Integrity Act, FISMA, OMB Circulars A-123 and A-136, and NIST cybersecurity frameworks.