OCFO Risk Management and Compliance Division, Internal Control and Compliance Support Services

The Federal Emergency Management Agency (FEMA), under the Office of the Chief Financial Officer (OCFO) Financial Management Division, has issued a Request for Information (RFI) to conduct market research for Corrective Action and Audit Remediation Support Services. The primary goal is to identify qualified contractors capable of providing technical expertise to implement corrective actions and remediate internal control deficiencies, audit findings, and compliance issues. The anticipated scope of work focuses on corrective action planning, IT and business process control remediation, testing and validation of remediation efforts, and stakeholder coordination. To maintain objective oversight, routine internal control assessments and OMB Circular A-123 baseline testing are excluded from this requirement. Interested parties must submit their capability statements and responses to the eight core RFI questions, which cover experience in audit remediation, root cause analysis, IT control remediation, and organizational conflict mitigation. Additionally, respondents can optionally address contract strategy questions regarding performance metrics, staffing approaches, and requirement structuring. Responses are due by September 30, 2026, at 3:00 PM EST, with clarifying questions due by September 23, 2026. Submissions must be sent electronically to the designated Contracting Officer and Contracting Officer Representative, adhering to a five-page limit for the core response. The anticipated start date for the period of performance is January 2026, under NAICS code 541211.

This Statement of Objectives (SOO) outlines a requirement by the Federal Emergency Management Agency (FEMA) Office of the Chief Financial Officer (OCFO) to secure specialized contractor support for its Financial Management Division (FMD), Risk Management and Compliance (RMC) Branch. The primary objective is to obtain analytical, technical, and advisory services to evaluate, document, test, monitor, and report on internal controls and compliance activities. Key performance areas include OMB Circular A-123 business process and IT general control testing, flood insurance controls, and general financial management support. Notably, corrective action implementation and audit remediation are excluded from this scope. The period of performance consists of a 12-month base period with four 12-month option periods, totaling up to five years. Work will be performed at the contractor’s facilities, FEMA Headquarters in Washington, D.C., or in Winchester, Virginia. The contractor must adapt to FEMA's planned transition to modernized core financial, procurement, and asset systems in early FY 2027. Additionally, the document details strict operating constraints, organizational conflict of interest protocols, and extensive IT security, privacy training, and Controlled Unclassified Information (CUI) safeguarding requirements in compliance with DHS and FEMA policies.