Risk & Controls Self-Assessment Program

The U.S. Department of Housing and Urban Development (HUD) is seeking contractor support for the Ginnie Mae Risk & Controls Self-Assessment (RCSA) Program. This Performance Work Statement (PWS) outlines the need for program management, execution of RCSA reviews across Ginnie Mae’s eight Offices and their Divisions, and annual maintenance of RCSA tools and governance documents. The contractor will identify, assess, report, and monitor operational and information technology risks, update process flowcharts, risk registers, and provide recommendations for remediation. The scope includes both office-level and in-depth process-level reviews, with an emphasis on compliance with federal regulations and standards. The contract includes a 12-month base period and four 12-month option periods, with specific deliverables, performance standards, and qualifications required for key personnel. The goal is to strengthen Ginnie Mae’s risk management framework and enhance internal controls.

The U.S. Department of Housing and Urban Development (HUD), specifically Ginnie Mae's Office of Enterprise Risk, Operational Risk Analysis Division (ORAD), is conducting market research through a Sources Sought Notice (SSN) for a Risk and Controls Self-Assessment (RCSA) Tool and related services. This SSN, RCS-T-2026-00023, aims to identify qualified contractors capable of providing tools and services to identify, assess, report, and monitor risks and controls associated with operational processes, people, systems, and external events. The primary NAICS code is 541611 ($24.5M size standard) and PSC is R408. HUD is seeking contractors holding a Multiple Award Schedule (MAS) SIN 541611. While this is not a solicitation, interested parties are requested to submit capability statements by April 30, 2026, by 2:00 PM EST. Submissions should highlight core competencies, differentiators, and past performance, particularly demonstrating expertise with certifications like CPA, CISA, CIA, CFE, COSO, CGFM, PMP, CISSP, CISM, CCSP, CRISC, CORP, and cybersecurity risk certifications. The contractor will be responsible for reviewing and analyzing governance documentation, updating RCSA documents annually, and providing support for project work, transition services, RCSA program execution, annual maintenance, and special projects. Services will be performed at the contractor's facility.