DATE:	March 27, 2008
MEMORANDUM TO:	Michael E. Bartell, Chief Information Officer and
	Director, Division of Information Technology
	Arleas Upton Kea, Director
	Division of Administration
FROM:	Russell A. Rau [Electronically produced version; original signed by Russell A. Rau]
	Assistant Inspector General for Audits
SUBJECT:	FDIC's Contract Oversight Management of the Infrastructure Services Contract (Report No. AUD-08-008)

The subject final report is provided for your information and use. Please refer to the Executive Summary, included in the report, for the overall audit results. Our evaluation of your response is incorporated into the body of the report. Your comments on a draft of this report were responsive to the recommendations. Sufficient action has been taken to close recommendation 6. The remaining recommendations will remain open for reporting purposes until we have determined that agreed-to corrective actions have been completed and are responsive.

This report contains information that may be proprietary. Accordingly, we request that you safeguard this report to the fullest extent possible and make no disclosures of this report, or information therefrom, outside the FDIC without prior permission of the Inspector General. We will redact proprietary information prior to releasing the final report publicly.

If you have questions concerning the report, please contact me at (703) 562-6350 or Mark F. Mulholland, Director, Corporate Management and Security Audits, at (703) 562-6316. We appreciate the courtesies extended to the audit staff.

Attachment

Background

IT infrastructure services procured through the ISC include (among other things): Mainframe Data Center Operations Local Area Network Management Hardware and Software Procurements Help Desk Operations Telecommunications Support Equipment and Software Maintenance Disaster Recovery Operations Security Operations Wireless Communications Desktop and Server Engineering IT Asset Management

The portion of DIT’s expenditures pertaining to the ISC increased during the initial years of the contract. This occurred as SRA assumed increasing responsibility for the FDIC’s IT infrastructure. As a result of the ISC, DIT was able to eliminate 36 individual IT infrastructure contracts.

According to financial information provided by DIT, the FDIC had expended $191,401,707 of the ISC’s $341,766,035 ceiling amount as of December 31, 2007.

The FDIC’s assessments of SRA’s performance under the ISC have been favorable.

As of October 2007, the FDIC had awarded [Material Redacted] fees available at that date under the ISC.

Audit Objectives and Approach

• The objectives of the audit were to assess:
  • the FDIC's contract oversight management of SRA and its subcontractors, including subcontractor selection and performance, and
  • support for payments made by the FDIC for IT goods and services provided by SRA and its subcontractors.
• To accomplish our objectives, we:
  • interviewed officials from FDIC, SRA, and the GSA’s FEDSIM Center;
  • analyzed relevant reports, documents, and policies and procedures; and
  • observed key meetings related to the ISC.
• We engaged the Defense Contract Audit Agency (DCAA) to audit selected invoices submitted by SRA and two of its subcontractors ( [Material Redacted] ).
• Key criteria used in the audit included relevant regulations, FDIC policies and procedures, the ISC (and its deliverable products), and government and industry-recommended practices.
• We performed our audit work from October through December 2007 in accordance with generally accepted government auditing standards.
• Details on our objectives, scope, and methodology are in Appendix 1.

Overall Results

• The FDIC implemented a framework of controls designed to ensure effective contract oversight management of SRA and its subcontractors. However, the FDIC can strengthen its oversight management of SRA in some control areas.
• DCAA found that, except for a minor amount of labor and applied indirect costs that did not meet the labor qualifications of the contract, costs for IT goods and services invoiced under the ISC were allowable, allocable, and reasonable. The minor questioned costs have been forwarded to DIT for appropriate action through GSA.
• The FDIC has implemented several contract oversight management controls that are based on government and industry-recommended practices. Such controls include:
  • A Program Manager, Technical Monitors, and Subject Matter Experts who monitor work and assess performance
  • A comprehensive award fee determination process that evaluates contractor and subcontractor performance
  • A DIT Procurement Management Board that reviews budgets and procurement actions for items procured through the ISC
  • Regularly scheduled reports and meetings with SRA
  • A formal process that assesses risks associated with contract service providers, such as SRA
• SRA selected subcontractors consistent with the Federal Acquisition Regulation and the terms and conditions of the ISC.
• The FDIC can strengthen its contract oversight management of SRA in the following control areas:
  • ISC Oversight Roles and Responsibilities
  • Acquisition Policies
  • Award Fee Determination Process
  • Contractor and Subcontractor Integrity and Fitness
  • Review of Contractor and Subcontractor Invoices
• Management attention to these areas will strengthen ISC governance and promote transparency and communication (throughout the ISC program).
• Notably, corrective action is ongoing in a number of areas.

Roles and Responsibilities

Procurement Management

Acquisition Policies

Award Fee Determinations

Contractor Integrity and Fitness

Recommendations

With regard to ISC oversight roles and responsibilities, we recommend that the Director, DIT:

1. Segregate the duties of the ISC Program Manager position, where appropriate, when DIT completes ongoing efforts to hire an Infrastructure Project Manager and Service Delivery Manager in the Infrastructure Services Branch.
2. Update the FDIC’s memorandum to FEDSIM regarding Technical Monitor and Subject Matter Expert duties and responsibilities to reflect current practices, and incorporate these duties and responsibilities into a formal DIT policy.

With regard to the Award Fee Determination Process, we recommend that the Director, DIT, in coordination with FEDSIM:

3. Update the Award Fee Determination Plan to reflect current practices, including clarifying criteria used to assess SRA’s performance under the ISC and requiring Technical Monitors to vote on each award fee evaluation, and appoint a Secretariat to maintain the Award Fee Determination Plan and related documentation.
4. Coordinate with the Technical Monitors and Subject Matter Experts to determine whether certain SLAs need to be revised in order to achieve more optimal contractor performance outcomes.

With regard to acquisition policies, we recommend that the Director, DOA:

5. Address performance-based acquisitions in the FDIC’s Acquisition Policy Manual.
6. Work with the Corporate University to develop performance-based contract management training.
7. Document DOA’s internal control of conducting periodic on-site inspections of procurement files to review contractor procurement practices.
8. Clarify DOA’s role in connection with ISC procurement actions.

Corporation Comments and OIG Evaluation

On March 19, 2008, the CIO and Director, DIT, and the Director, DOA, provided a written response to a draft of this report. The Corporation’s response is in Appendix 2. Management concurred with our recommendations and provided planned, ongoing, and completed corrective action. A summary of management’s response to each recommendation is in Appendix 3.

Sufficient action has been taken to close recommendation 6. The remaining recommendations are resolved but will remain open until we determine that the agreed-to corrective actions have been completed and are responsive.

Objectives and Scope

The objectives of the audit were to assess (1) the FDIC’s contract oversight management of SRA and its subcontractors, including subcontractor selection and performance and (2) support for payments made by the FDIC for IT goods and services provided by SRA and its subcontractors. We conducted this performance audit from October through December 2007 in accordance with generally accepted government auditing standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

The scope of our audit focused on assessing the FDIC’s management controls that were designed to ensure effective contract oversight management of SRA and its subcontractors. Our audit did not assess contract administration services provided by the GSA. With respect to payments made by the FDIC for IT goods and services, we engaged DCAA to perform appropriate audit procedures to determine whether such payments were adequately supported consistent with the terms and conditions of the ISC and the Millennia contract. DCAA conducted its work in accordance with GAGAS.

Methodology

To achieve our objectives, we:

• Interviewed DIT and DOA representatives regarding their roles and responsibilities for the ISC and the controls the FDIC had in place to help ensure effective contract oversight management of SRA and its subcontractors. We also interviewed SRA management officials to obtain their perspective on the FDIC’s oversight management practices with respect to the ISC. Further, we met with contracting officials at GSA’s FEDSIM Center to obtain an understanding of their role in the ISC program.
• Analyzed relevant reports and contract-specific documents, such as SRA status reports and award fee determination reports.
• Observed key ISC-related meetings, including meetings of the DIT Procurement Management Board and the Award Fee Determination Board.
• Selected a non-statistical sample* of 40 subcontractor employees to determine whether required background investigations, confidentiality agreements, and preexit clearance forms had been completed consistent with FDIC policy. We selected the sample from the same four invoices reviewed by DCAA. We included SRA and subcontractor employees that were in the FDIC Virginia Square location and various field offices.
• Selected a non-statistical sample of six SRA subcontractors to determine whether integrity and fitness certifications had been completed as prescribed by FDIC policy. We selected the sample from the same four invoices reviewed by DCAA.
• Considered FDIC and DIT-specific policies related to contract oversight management and IT procurement, including:
  • The FDIC’s Acquisition Policy Manual, including the Letter of Oversight Manager Confirmation and Letter of Technical Monitor Confirmation.
  • Circular 1610.2, Security Policy and Procedures for FDIC Contractors and Subcontractors, dated August 1, 2003.
  • DIT Policy No. 05-002, Procuring IT Assets, dated May 25, 2005.
  • DIT Internal Policy Memorandum, Receiving of IT Assets Policy, dated February 12, 2003.
  • DIT Memorandum to GSA, Technical Monitor and Subject Matter Expert Designations, Duties, and Responsibilities, dated October 2, 2007.
• Considered federal regulations, policies, and recommended practices pertaining to interagency and performance-based contracting. Such criteria included applicable sections of the Federal Acquisition Regulation (FAR), guidance published by the Office of Federal Procurement Policy, and reports issued by the Government Accountability Office.
• Engaged DCAA to determine whether charges for IT goods and services contained in selected invoices submitted under the ISC were adequately supported consistent with the terms and conditions of the ISC and Millennia contract. Specifically, DCAA assessed whether charges for IT goods and services provided by SRA and two of its subcontractors were supported with adequate, original documentation consistent with the terms and conditions of the ISC and Millennia contract. DCAA’s audit procedures included, for example, examining timesheets to verify that the hours billed were actually worked and reviewing qualifications, experience, and education for a sample of contractor and subcontractor employees to ensure the employees satisfied the minimum requirements of the ISC and Millennia contract.

The FDIC OIG selected the following four ISC invoices for DCAA’s detailed review.

Invoice Number	Period of Performance	Amount
600231193	December 1-31, 2006	$ 7,739,724.44
600240511	January 1-31, 2007	$11,601,627.29
600278697	May 1-31, 2007	$ 4,448,444.71
600294828	June 1-30, 2007	$ 7,646,601.36

Internal Control

We assessed key FDIC internal controls related to the oversight management of the ISC, including:

• Relevant FDIC and DIT policies, procedures, guidance, and training.
• The roles and responsibilities of key ISC stakeholders, including the ISC Oversight Committee, Program Manager, Technical Monitors, and Subject Matter Experts.
• The ISC governance structure.
• The ISC award fee determination process.

In addition, DCAA performed appropriate tests of contractor internal controls for the purpose of planning and conducting its audit work.

Reliance on Computer-processed Data. Our audit objective did not require that we separately assess the reliability of computer-processed data to support our significant findings, conclusions, and recommendations. Additionally, in performing this audit, we did not consider it necessary to evaluate the effectiveness of information systems controls in order to obtain sufficient, appropriate evidence.

Performance Measurement. We determined that DIT’s performance measures under the Government Performance and Results Act were not significant to our audit objectives.

Compliance with Laws and Regulations

The following regulations were relevant to our audit objectives:

• 12 Code of Federal Regulations (C.F.R.) Part 366, Minimum Standards of Integrity and Fitness for an FDIC Contractor – establishes the minimum standards of integrity and fitness that contractors, subcontractors, and employees of contractors and subcontractors must meet if they perform any service or function on the FDIC’s behalf. Part 366 implements sections 12(f)(3) and (4) of the Federal Deposit Insurance Act (12 United States Code sections 1822(f)(3) and (4)) regarding contractor conflicts of interest and disapproval.
• FAR Subchapter G, Contract Management – establishes uniform policies and procedures for contract management by all executive agencies, including contract management, subcontracting, and quality assurance. We used the FAR as criteria because the ISC is a task order awarded under the FEDSIM’s Millennia contract, which is based on the FAR.

We assessed the risk of fraud related to the audit objectives in the course of evaluating audit evidence.

Prior Coverage

We considered the following reports previously issued by the FDIC OIG in planning and conducting our work:

• Evaluation Report No. EM-08-002, Information Technology Procurement Integrity and Governance, dated March 4, 2008.
• Evaluation Report No. EM-07-003, Follow-up Work Related to FDIC’s Contract Assessment Report, dated May 30, 2007.
• Audit Report No. 07-004, Interagency Agreement with the General Services Administration for the Infrastructure Services Contract, dated January 10, 2007.
• Evaluation Report No. 06-026, FDIC’s Contract Administration, dated September 29, 2006.

This table presents the management response on the recommendations in our report and the status of the recommendations as of the date of report issuance.