OCFO Risk Management and Compliance Division, Internal Control and Compliance Support Services

The Federal Emergency Management Agency (FEMA), Office of the Chief Financial Officer (OCFO), Financial Management Division (FMD), Risk Management and Compliance (RMC) Branch, is seeking information from qualified contractors capable of providing specialized support services to assist with internal control assessment, compliance monitoring, control documentation, control testing, risk analysis, insurance management controls, data analysis, information technology control testing, and financial management support. The purpose of this effort is to help FEMA maintain and strengthen its internal control and compliance environment in accordance with applicable federal requirements, including Office of Management and Budget (OMB) Circular A-123, the Government Accountability Office (GAO) Standards for Internal Control in the Federal Government, federal financial management requirements, information technology control guidance, Department of Homeland Security (DHS) policy, and FEMA guidance. The contractor shall provide technical, analytical, documentation, reporting, and advisory support to assist FEMA in evaluating control design, testing control operating effectiveness, monitoring compliance activities, identifying risks and control gaps, assessing compliance requirements, and providing management insight.

The anticipated scope of support may span FEMA's financial management, disaster assistance, grants, flood insurance, information technology, financial reporting, and mission support processes. Specific support may include internal control assessments, compliance monitoring, control documentation, control testing, risk assessments, data analysis, flood insurance controls, information technology general control and application control testing, and general financial management support. Through these activities, the contractor may identify findings, risks, deficiencies, control gaps, and compliance issues and recommend improvements based on assessment, testing, monitoring, and analysis.

Corrective action implementation, remediation execution, and closure support for identified deficiencies are outside the primary scope of this requirement and are expected to be addressed under a separate Corrective Action and Audit Remediation Support Services requirement. This separation is intended to preserve clarity of roles, reduce overlap between assessment and remediation activities, and ensure objectivity in FEMA's internal control and compliance environment.