@f Audit MANAGEMENT T@ Tfca For IINMF1 -1§-0032-2100300 March ------- Inspector General Division Conducting the Audit: Regior. Covered: Program Offices Involved: Technical Assistance staff Washington, D.C. Agencywide Office of Administration and Resources Management ------- 3 UNITED STATES ENVIRONMENTAL PROTECTION AGENCY '/ WASHINGTON. D.C. 20440 MAR 3 | 1S92 THE INSPECTOR GENERAL MEMORANDUM SUBJECT: Report Of Audit - CONTRACT MANAGEMENT: EPA Needs To Strengthen The Acquisition Process For AOP Support Services Contracts Audit Report No. iINMFl-15-0032r2100300 FROM: //- Kenneth A. Konz I Assistant Inspector General for Audit (A-109) TO: // Christian R. Holm Acting Assistant Administrator for Administration and Resources Manager :nt (PM-208) Attached is our report entitled "CONTRACT MANAGEMENT: EPA Needs To Strengthen The Acquisition Process For ADP Support Services Contracts." This audit was part of an overall audit of EPA's implementation of computer systems integrity requirements for the President's Council on Integrity and Efficiency. Our primary objective was to evaluate EPA's compliance with Office of Management and Budget Circulars A-123, A-127, and A-130 require- ments pertaining to the management of AOP support services contracts. The report contains important findings and recom- mendations regarding that area. Action Required In accordance with EPA Order 2750, you, as the action official, are required to provide this office a written response to the audit report within 90 days of the final report date. For corrective actions planned but not completed by your response date, reference to specific milestone dates will assist this office in deciding whether to close this report. We have no objections to the further release of this report to the public. This audit report contains findings that describe problems the Office of Inspector General (OIG) has identified and corrective actions the OIG recommends. This audit report represents the opinion of the OIG. Final determinations on matters in this audit report will be made by EPA managers in accordance with established EPA audit resolution procedures. ------- Accordingly/ the findings described in this audit report do not necessarily represent the final EPA position. Should you or your staff have any questions concerning this final audit report, please contact me on 260-1106 or Gordon Milbourn, Director, Technical Assistance Staff on 260-4923. Attachment cc: Alvin M. Pesachowitz, Director, Office of Information Resources Management (PM-211) Donald W. Fulford, Director, National Data Processing Division (MD-34) David J. O'Connor, Director, Procurement and Contracts Management Division (PM-214F) Carolyn Levine, OARM Audit Liaison (PM-208) ------- OF CONTENTS Page EXECUTIVE SUMMARY ......................................... i~ CHAPTER 1 INTRODUCTION.... ..................................... 1 PURPOSE .......................... , ................... 1 BACKGROUND ........................................... 1 SCOPE AND METHODOLOGY ................................ 5 PRIOR AUDIT COVERAGE. . . .............................. 7 2 THE AGENCY'S MANAGEMENT OF ADP SUPPORT SERVICES CONTRACTS NEEDS IMPROVEMENT .......................... 9 GUIDANCE FOR ADP CONTRACTING ......................... 9 PROBLEMS REPORTED IN THE PAST ........................ 11 EPA HAS NOT ESTABLISHED AN ADEQUATE CONTRACT MANAGEMENT PROCESS .......................... 12 ADVERSE EFFECTS WERE NUMEROUS ........................ 15 OIRM NEEDS TO ESTABLISH STANDARDS ................... . 19 CONCLUSIONS ......................................... . 22 RECOMMENDATIONS ...................................... 22 AGENCY COMMENTS AND OIG EVALUATION ................... 23 3 THE AGENCY'S PRE-SOLICITATION PHASE OF THE ACQUISITION PROCESS FOR ADP SUPPORT SERVICES CONTRACTS IS NOT IN COMPLIANCE WITH FEDERAL ADP PROCUREMENT REQUIREMENTS ......................... 24 FEDERAL REQUIREMENTS ................................. 24 PRIOR GAO RECOMMENDATIONS ............................ 27 EPA IS NOT PREPARING REQUIRED DOCUMENTS FOR ADP SUPPORT SERVICES ................... 27 NO ASSURANCE THAT ADP SUPPORT SERVICES CONTRACTS ARE LOWEST COST ............................ 28 Audit MO. B1KKP1-15-0032-2100300 ------- Table of Contents PCMD IS NOT ADEQUATELY INVOLVED 29 CONCLUSIONS 29 RECOMMENDATIONS 30 AGENCY COMMENTS AND OIG EVALUATION 31 4 0ARM'S FMFIA PROCESS DOES NOT SUFFICIENTLY ADDRESS THE RISKS ASSOCIATED WITH THE ADP SUPPORT SERVICES CONTRACTS 32 CONCLUSIONS 34 RECOMMENDATIONS 34 AGENCY COMMENTS AND OIG EVALUATION 34 APPENDIXES APPENDIX I: REPORTS AND TESTIMONY RELATED TO EPA'S MANAGEMENT OF SUPPORT SERVICES 35 APPENDIX II: MARCH 27, 1991 INTERIM RESPONSE TO DRAFT AUDIT REPORT FROM THE DIRECTOR, OFFICE OF INFORMATION RESOURCES MANAGEMENT 36 APPENDIX III: ABBREVIATIONS 47 APPENDIX IV: DISTRIBUTION OF REPORT 49 Audit MO. E1NX71-1S-0032-2100300 ------- E1BCUTIVB SUMMARY PURPOSE Effective information resources management (IRM) is crucial to EPA accomplishing its mission. Vast amounts of data are accumu- lated in Agency ADP systems, and used for such things as manage- ment and scientific decision-making, and reporting to Congress and the public. A key component of the Agency's IRM program is the support services provided by contractors. In recent years, EPA has spent hundreds of millions of dollars on ADP support services contracts, and plans to spend like amounts in the near future. Due to the dollars involved and the historical Agency problems with administering contracts, Congress has expressed great interest in EPA contracting activities. Consequently, the Office of Inspector General (016), in conjunction with the President's Council on Integrity and Efficiency (PCIE), performed an audit to evaluate EPA's compliance with Federal requirements related to the IRM contract management process. < BACKGROUND Computer systems integrity is of prime importance in the Federal Government. Federal agencies have significant information technology inventories, and the trend is toward the use of more information technology, especially in the hands of end users. The increased dependence on computer systems to carry out agencies' missions requires significant integrity in these systems. This involves assuring that serious disruption of systems operations will be avoided and that automated information is preserved, useful, accessible, and secure. During fiscal 1992, the Office of Management and Budget (OMB) estimates that the Federal Government will spend over $23.9 billion on information technology. EPA estimates that it will spend about 65 percent of its total ADP budget on commercial ADP services in fiscal 1992. For example, as of February 1992, EPA has six multi-year ADP support services contracts, which are over $30 million each, with an estimated ceiling value of over $930 million. In addition, EPA has four proposed multi-year ADP support services contracts, which are over $30 million each, with an estimated ceiling value of $629 million. There are also numerous other ADP support services contracts under $30 million as well as other ADP contracts which include combinations of hardware and ADP support services. In 1986 the PCIE Computer Committee initiated a project to review controls, security, and other integrity issues relative to Federal computer systems. Their June 1988 report focused on eight agencies' compliance (including EPA) with OMB Circulars Audit NO. E1NMT1-15-0032-2100300 ------- SUMMARY A-123, A-127, and A-130 and noted a number of deficiencies at almost all agencies. Although no deficiencies were identified at EPA in our prior review, our report cited a number of actions being taken by EPA to improve computer systems integrity. our current audit was intended to follow up on those actions taken to improve computer systems integrity since the prior PCIE review, and to evaluate current conditions at EPA. However, since the pre-solicitation process of the IRM contracts we reviewed preceded the 1988 PCIE report, some of the documentation we analyzed was actually dated as early as January 1986. Therefore, our period of audit coverage was January 1986 through February 1992. RESULTS! IN BRIEF Inadequate contract management and non-cdmplianco with some important Federal acquisition requirements have increased EPA's vulnerability to waste, fraud, and abuse in its current and proposed AOP support services contracts valued at over $1.6 billion. As a result of inadequate contract management, EPA cannot be assured that the contracted ADP support services are effectively and efficiently accomplished. And due to the non- compliance with certain key Federal acquisition requirements, EPA has no assurance that the current and proposed ADP support services contracts represent the lowest overall cost to the Government. Specifically, we found that inadequate contract management practices did not assure cost-effective Agency operations. These practices included such things as: (a) insufficient staffing and technical ADP expertise to effectively administer ADP support services contracts; (b) unspecific written delivery order (DO) statements of work (SOWs) which did not ensure quality of contractor performance; (c) inadequate and untimely internal guidance or failure to follow guidance; and (d) insufficient delivery order project officer (DOPO) oversight and/or support by the Office of Information Resources Management (OIRM) and the Procurement and Contracts Management Division (PCMD). Further, the Agency has increased its risk of disruption of normal operations due to its dependency on contractors. All of these issues parallel those in the March 1992 OIG audit report entitled "CONTRACT MANAGEMENT: EPA's Management of Computer Sciences corporation (CSC) Contract Activities." Finally, the Agency's contracting specialists were not adequately involved in and accountable for decisions in the pre-solicitation phase of the acquisition process for ADP support services. ii Audit MO. ElNMri-lS-0032-2100300 ------- BXZCUTIV1 80KMARY In our opinion, thes* weaknesses meet OMB's and EPA's materiality criteria for reporting to the President and Congress in conjunction with OMB Circular A-123 and the Federal Managers' Financial Integrity Act (FMFIA). Because ADP support services are critical to the success of all program activities, these weaknesses could: (1) substantially impair the fulfillment of the Agency's mission; (2) significantly weaken safeguards against the waste and unauthorized use of EPA's funds; and (3) reflect adversely on the management integrity of the Agency, thereby diminishing EPA's credibility and reputation. PRINCIPAL FINDINGS The Agency's Management Of ADP Support Services Contracts Needs Improvement During the past year, OIRM has taken significant actions to improve the Technical and Operational Support Services (TOSS) contract's DOs by providing training, site visits, and a user's guide. Also, OIRM has established an EPA Acquisition Regulation (EPAAR) requirement to include a contract provision for contractors to follow EPA policies for IRM. However, EPA still has not established an effective contract management process for ADP support services contracts. Specifically, two of the most significant ADP support services contracts—the TOSS and Facilities Management contracts with potential estimated ceiling prices of $347 million and $140 million, respectively—did not include: (1) minimum standards or meaningful criteria for acceptance of contractor support services; or (2) sufficiently defined work specifications. As a consequence, OIRM cannot be assured that the contracted ADP support services are effectively and efficiently accomplished, which may result in increased: (1) development and maintenance costs; (2) computer center operations costs; (3) data integrity problems; (4) risk of normal operations disruption; and (5) dependency on contractors. These deficiencies occurred, in part, because OIRM has not established certain key mandatory IRM standards for these contracts, to provide guidance to contractors in a wide range of areas. Further, the DOPOs and the alternate DOPOs did not have the technical ADP skills necessary to effectively administer the TOSS DOs. In addition, there was insufficient staffing to administer contracts of this magnitude and complexity. iii Audit MO. E1NMJ1-15-0032-2100300 ------- EXECUTIVE 8UXXARY The Agency's Pre-sgiicitation Phase Of Tha Acquiait^or) Process For ADP Support Services Contracts la Not In Compliance With Federal ADP Procurement Requirements Contrary to Federal requirements, EPA did not prepare the prescribed requirements analyses, which included the analyses of alternatives, for three current ADP support services contracts and two proposed contracts with a total estimated ceiling price of about $1.2 billion. Further, EPA has been acquiring ADP support services without aggregating the costs on the three current contracts for ADP equipment, proprietary software, maintenance services, and ADP services. Although EPA has prepared individual acquisition plans, the supporting plans' cost estimates were only prepared for the recommended acquisition strategy for each individual contract. Moreover, EPA is currently in violation of its Delegation of Procurement Authority (DPA) for the TOSS contract. The General Services Administration (GSA) approved the request conditional upon receipt of information on the TOSS acquisition analysis of alternatives from EPA. However, EPA has not provided this information to GSA. Without the preparation of these analyses, Agency officials have no objective basis for selecting the recommended alternative. Therefore, the Agency has no assurance that these ADP support services contracts represent the lowest overall cost to the Federal Government. Additionally, without aggregating the costs on these contracts for ADP equipment, proprietary software, maintenance services, and ADP services, EPA may be exceeding its DPA ceiling. Further, by not aggregating these individual costs within each contract and obtaining similar ADP requirements across the contracts, it may appear that EPA is splitting its requirements among multiple contracts to avoid requesting additional DPAs. These problems arose because the Agency's contracting specialists were not adequately involved in and accountable for decisions in the pre-solicitation phase of the acquisition process for ADP support services. This was inconsistent with GSA guidance. RECOMMENDATIONS EPA needs to give more authority to PdfD's contracting officers to properly oversee the activities related to ADP support services contracts, to help preclude fraud, waste, and inadequate contract management. Contracting procedures need to be revised, and senior DOPOs/technical managers should be provided the ADP technical skills needed to effectively monitor the development of ADP DOs. Further, EPA needs to complete prescribed alternatives analyses on current and proposed ADP support services contracts iv Audit MO. B1NMJ1-1S-0032-2100300 ------- BXECUTIV1 SUMMARY to he.'p ensure that the Agency chooses the most cost-effective acquisition alternatives and meets GSA's DPA requirements. AGENCY COMMENTS The Acting Assistant Administrator for Administration and Resources Management did not respond in writing to our draft report. However, the Director, OIRM, provided an interim written response on March 27, 1992. Further, we had exit conferences on March 24 and 26, 1992, with representatives of OIRM, the National Data Processing Division (NDPD), and PCMD. In summary, the Agency agreed with most of our findings and recommendations. To provide a balanced understanding of the issues, we have summarized the Agency's position at appropriate locations in the report. We have also appended to our report the interim response transmittal memorandum and its key attachment, a matrix of responses to our recommendations. Due to their volume, we have not appended the additional attachments, but we will make them available upon request. Audit MO. E1NKJ1-15-0032-2100300 ------- (This page was intentionally left blank.) ------- CHAPTER 1 INTRODUCTION PURPOSE Effective IRM is crucial to EPA accomplishing its mission. Vast amounts of data are accumulated in Agency ADP systems, and used for such things as management and scientific decision-making, and reporting to Congress and the public. A key component of the Agency's IRM program is the support services provided by con- tractors. In recent years, EPA has spent hundreds of millions of dollars on ADP support services contracts, and plans to spend like amounts in the near future. Due to the dollars involved and the historical Agency problems with administering contracts, Congress has expressed great interest in EPA contracting acti- vities. Consequently, the OIG, in conjunction with the PCIE, performed an audit to evaluate EPA's compliance with Federal requirements related to the IRM contract management process. This report is the first of several audit reports on EPA's implementation of computer systems integrity requirements. This audit was part of a Governmentvide PCIE audit. The objective of this audit was to evaluate the overall effectiveness of the Agency's compliance with OMB Circulars A-123, A-127, and A-130. This phase of the audit specifically addressed the Agency's compliance with requirements relative to the IRM contract management process. In meeting our objectives we reviewed the contract management process for three multi-year ADP support services contracts with a total estimated ceiling price of over $651 million, and two proposed multi-year ADP support services contracts with a total estimated ceiling price of $535 million. BACKGROUND Computer systems integrity is of prime importance in the Federal Government. Federal agencies have significant information tech- nology inventories and the trend is toward the use of more information technology, especially in the hands of end users. The increased dependence on computer systems to carry out depart- ments' and agencies' missions requires significant integrity in these systems. This involves assuring that serious disruption of systems operations will be avoided and that automated information is preserved, useful, accessible, and secure. During fiscal 1992, OMB estimates that the Federal Government will spend over $23.9 billion on information technology. EPA estimates that it will spend about 65 percent of its total ADP budget on commercial ADP services in fiscal 1992. For example, Audit NO. B1NMT1-15-0032-2100300 ------- as of February 1992, EPA has six multi-year ADP support services contracts, which are over $30 million each, with an estimated ceiling value of over $930 million. In addition, EPA has four proposed multi-year ADP support services contracts, which are over $30 million each, with an estimated ceiling value of $629 million. There are also numerous other ADP support services contracts under $30 million as well as other ADP contracts which include combinations of hardware and ADP support services. In 1386 the PCIE Computer Committee initiated a project to review controls, security, and other integrity issues relative to Federal computer systems. This resulted in a June 1988 report focuscid on eight agencies* (including EPA) compliance with 0KB Circulars A-123, A-127, and A-130. The June 1988 report noted several deficiencies which required actions by 0KB, GSA, Office of Personnel Management (0PM), and National Institute of Standards and Technology (NIST). Although no deficiencies were identified at EPA, our prior report cited a number of actions being taken by EPA to improve computer systems integrity. Our current review was intended to follow up on those actions to improve computer systems integrity since the prior PCIE review, and to evaluate current conditions at EPA. However, since the pre-solicitation process of the current IRM contracts we reviewed preceded the 1988 PCIE report, some of the documentation we analyzed was actually dated as early as January 1986. Therefore, our period of audit coverage was January 1986 through March 1992. During the past several years, the Agency has embarked upon significant systems modernization and data integration efforts. In the hardware management area, EPA has centralized its larger systems by moving them from the regional offices to the NDPD's compviter center. In the software management area, EPA has begun modernizing existing systems and establishing a framework for improving facilities for standardization and sharing of data. Systems modernization is a structured approach to building new systems and/or revitalizing EPA's mission critical systems by setting Agencywide IRM priorities. Systems modernization, including data integration as a primary objective, will result in both horizontal integration (integration of various adminis- trative and programmatic data bases across multiple disciplines) and vertical integration (integration among various organiza- tional levels within a related functional area). Enhanced public access and improved performance of EPA's basic mission are primary goals of the systems modernization initiative. The successful accomplishment of EPA's IRM operations and systems modernization activities is highly dependent on the Agency's infrastructure and framework established for managing ADP contract support. The EPA IRM program and systems modernization initiative are largely dependent on support services contracts, 2 Audit HO. E1MM71-15-0032-2100300 ------- which currently have an aggregate estimated ceiling price of over $1.5 billion. The existing and planned multi-year ADP support services contracts, each valued at over $30 million, are shown below. Other contracts; below $30 million, are not shown. ADP SUPPORT SERVICES CONTRACTS AS OF FEBRUARY 1992 (DOLLARS IN MILLIONS) EXISTING CONTRACTS ESTIMATED CEILING PRICE Technical and Operational $347.0 Surport Services (TOSS) Facilities Management/Primary Support 139.71 General Programming 116.0 Scientific Applications, Statistical Support and 129.7 Laboratory Automation Services (SASLAS) Analysis, Feasibility Studies, 33.1 Systems Designs and Systems Evaluation Mission Oriented Systems Engineering Support (MOSES) TOTAL PLANNED CONTRACTS ESTIMATED CEILING PRICE Facilities Management Recompete $431.0 Replacement Telecommunications 104.O1 Scientific Relational Database 34.0 Management System (RDMS) OTS—Right to Know 60.0 TOTAL $629.0 1 Conditional upon approval of $17 million increase for the Facilities Management and $31 million for the Replacement Telecommunications contracts by GSA. Audit MO. B1NKT1-15-0032-2100300 ------- Federal In 1965, the Congress passed the "Brooks" Act (Public Law 89-306) which identified ADP equipment, software, maintenance, and support services as commodities that were to be obtained under the management control of GSA. GSA publishes the Federal Infor- mation Resources Management Regulation (FIRMR), which governs the acquisition, management, and use of ADP and telecommunications resources, and is used in conjunction with the Federal Acqui- sition Regulation (FAR). The FIRMR relies on the FAR's general policies and procedures, and where necessary, contains policies and procedures that supplements the FAR. The main Federal policies for management of Federal resources are OMB circulars A-130, A-123, and A-127. OMB Circular A-130, Management of Federal Information Resources, prescribes that Federal agencies acquire information technology in a competitive manner that minimizes total life cycle costs and in a manner that facilitates compatibility. Further, OMB Circular A-123, Internal Contra.', Systems, establishes a Federal policy that agencies shall set up and maintain cost-effective systems of internal controls to assure Federal resources are protected against waste, fraud, or misnanagement, and activities are efficiently and effectively managed. OMB Circular A-127, Financial Management Systems, establishes a policy for financial systems that each agency should have an integrated framework for budgeting and accounting including single entry of data. All contracting activities by agencies should comply with these directives. EPA's IFederal Information Processing (TIP) Contracting Structure OIRM, 'under the Assistant Administrator for Administration and Resources Management, is organized with three divisions and two staff offices. OIRM is functionally responsible for: (1) estab- lishing EPA IRM policy and guidance; (2) developing, coordi- nating, and/or managing EPA's administrative, scientific, and certain of the Agency's program information systems; and (3) pro- viding IRM budget and contract management services to the rest of the Agency. The Director of OIRM has also been designated as the authorized procurement official for FIP procurements. The Management Planning and Evaluation Staff (MPES) within OIRM: (1) administers several contracts which allow EPA offices to procure ADP support services centrally; (2) formulates and executes the IRM budget; and (3) manages the funds control and reporting services for OIRM. Located at Research Triangle Park (RTP), NC, NDPD is functionally responsible for acquiring, managing, and performing operational oversight for the Agency's information processing resources. Subject to national program policy and technical guidance from 4 Audit MO. E1HMJ1-15-0032-2100300 ------- OIRM, NDPD plans for and acquires, or approves for acquisition, all general purpose and scientific computers and telecom- munications facilities required *.o meet the needs of EPA programs and regions. NDPD also manages the National Computer Center (NCC), which is co-located with NDPD at RTP. NCC is a contractor operated facility housing EPA's primary mainframe computers and serving as the Agency's telecommunications focal point. PCMD, within the Office of Administration, is functionally responsible for developing, conducting, and coordinating the Agency contracts management program PCMD is also responsible for: (1) developing Agency procurement policies and regulations; (2) providing technical guidance to all field contracting operations; and (3) conducting a contracts management technical review and internal evaluation program. The Procurement Operations Branch of PCMD is responsible for conducting Headquarters programs for ADP contract placement, modification, post-award administration, and termination. These respon- sibilities include advertising, location of sources, negotiation, award, in-process monitoring, and termination settlement. SCOPE AND METHODOLOGY This review covered the pre-solicitation and administration phases of the acquisition process for the five largest ADP support services contracts valued at over $30 million. These contracts include: (1) the Facilities Management contract (contract number 68-01-7437), known also as the Primary Support contract for NDPD, which was awarded to UNISYS Corporation in August 1987; (2) the TOSS contract (contract number 68-WO-0043), which was awarded to CSC in September 1990; and (3) the MOSES contract (contract number 68-W1-0055), which was awarded to Science Application International Corporation in September 1991. In addition, we reviewed two pending contracts, the Facilities Management Recompete Request for Proposals (RFP), known also as the ADP/Telecommunications Support and Facilities Management RFP (RFP number W001963A3); and the replacement Telecommunications Services RFP (RFP number W002846A3). The audit fieldwork was performed from May 1991 through March 1992 primarily at: (1) EPA Headquarters; (2) the National Data Processing Division; (3) Region 3 Information Resources Manage- ment Branch within the Assistant Regional Administrator for Policy and Management; (4) Region 4 Information Management Branch within the Assistant Regional Administrator for Policy and Management; (5) three EPA laboratories (Atmospheric Research and Exposure Assessment Laboratory, RTP, NC; the Chesapeake Bay Program, Annapolis, MD; and Environmental Research Laboratory, Athens, GA); (6) Office of Air Quality Planning and Standards, Audit MO. E1NM71-1S-0032-2100300 ------- RTF, NC; and (7) Information Resources Management Division, Cincinnati, OH. The overall objective of this audit was to evaluate EPA'a compliance with OMB Circulars A-123, A-127, and A-130, relative to the IRM contract management process. To accomplish this objective, we evaluated EPA's compliance with the FAR and FIRMR and EPA's resolution of prior OIG, General Accounting Office (GAO), and GSA recommendations to strengthen the Agency's management of ADP support services contracts. Specific objectives included to: 1. Evaluate the adequacy of EPA's pre-solicitation phase of the acquisition process for major ADP support services contracts to ensure that the Agency has obtained the necessary authorizations from GSA for acquisition of ADP support services. 2. Determine whether EPA acquisitions of major ADP support services complied with Federally prescribed requirements analyses and analyses of alternatives based on cost. This i» needed to ensure that the Agency procures ADP support services at the lowest overall cost to the Government. 3. Evaluate the adequacy of EPA's administration phase of the acquisition process for major ADP support services contracts to ensure that contractors are provided sufficient formal direction and that the performance evaluation process for IHM support activities is based on meaningful criteria. This is needed to protect the Agency from fraud, waste, and abuse and to minimize the Agency's inherent risks associated w;lth systems modernization and data integration. To accomplish our audit objectives, we reviewed the following: the Facilities Management contract, applicable requirements analysis, the individual Acquisition Plan, the management work plan, and the performance evaluation process for various trimester periods; the Agency Procurement Request (APR), the DPA, and 40 of 192 DOs issued by September 5, 1991 (selected on a judgmental basis to include all DOs with "IRM" titles in the Regions in our scope), related to the TOSS contract; the MOSES RFP, contract and associated amendments, and individual Acquisition Plan. We did not review DOs because at the time of our review only a minimum amount of activity—approximately $80,000—had occurred on the contract; and 6 Audit MO. B1NM71-15-0032-2100300 ------- two proposed ADP support services contracts—Facilities Management Recompete and the replacement Telecom- munications Services contracts—tnd related docu- - mentation, including Agency internal review comments, the APR, requirements analysis, individual Acquisition Plan, and the DPA received from GSA. we interviewed various DOPOs, alternate DOPOs, project officers, and contracting officers regarding their roles and responsi- bilities, and analyzed the supporting documentation and files for the areas reviewed. Also, we interviewed various senior OIRN and PCMD officials regarding the Agency's system development process, IRM standards, and organizational infrastructure in support of these contracts. Further, we reviewed prior GAO and GSA reports on their reviews of EPA's IRM contracting activities and interviewed GSA officials regarding their fiscal 1990 Information Resources Procurement and Management Review and GSA policy requirements. We conducted the audit in accordance with Government Auditing standards (1988 revision) issued by the Comptroller General of the United States. Our audit included tests of management and related internal controls, policies, and procedures specifically related to the audit objectives. The report identifies signifi- cant and longstanding control weaknesses in the acquisition process for major FIP support services. These significant control weaknesses have been identified in prior GAO and GSA reviews dating back to 1980 and should be reported to the President as material internal control weaknesses under FMFIA. Because this review disclosed material weaknesses related to EPA's ADP support services contracts, we also reviewed the FMFIA evaluation process for PCMD, OIRM, and OARM-RTP to determine why these weaknesses were not identified internally. No other issues came to our attention which we believed were significant enough to warrant expanding the scope of this audit. PRIOR AUDIT COVERAGE « EPA has a longstanding history of numerous contracting problems identified in prior OIG and GAO reports. These problems are similar to the ones discussed in this report. Many of these prior reports discuss EPA's extensive use of contracting and several address contracting deficiencies specifically involving ADP support services. See Appendix I for a list of reports we reviewed. OIG Reports In September 1991, we issued an audit report entitled "Audit of Region 8 Management Of Computer Sciences Corporation Activities." In the report we described problems with the TOSS contract 7 Audit NO. E1NM71-15-0032-2100300 ------- involving: (1) evidence of pe.-sonal services; (2) inadequate management controls; and (3) no background investigations of contractor personnel handling sensitive data. Based on the preliminary results of that Region 8 audit, a nationwide audit of CSC contracts was initiated and a report— "CONTRACT MANAGEMENT: EPA'a Management Of Computer sciences Corporation Contract Activities"--was issued in March 1992. The audit disclosed that inadequate contract management and control of CSC activities permitted illegal/deficient contract management practices such as: (1) personal services relationships between CSC and EPA staffs; (2) contractor performance of inherently governmental functions; (3) potential conflict of interest situations; (4) loss of EPA staff expertise resulting in potential loss of Agency control of major program operations or information systems; (5) unqualified contractor staff; (6) in- adequate assurance of cost-effective Agency operations; and (7) lack of accountability for hundreds of thousands of dollars of EPA property in CSC's possession. DOPOs also approved improper direct and indirect charges to CSC contracts. * GAP Reports One of the earliest reports addressing AOP support services probiens was issued on March 10, 1980, by GAO. The report, entitled "Stronger Management of EPA's Information Resources is Critical to Meeting Program Needs," discussed many similar problems and included recommendations to: strengthen controls and enforces standards; ensure that project officers are sufficiently knowledgeable and experienced; require contracting officers to verify SOWs; and require project officers to thoroughly review the AOP technical content of deliverables. GAO hais issued numerous other reports on contracting problems at EPA since the 1980 report. For example, GAO recently addressed contractors performing inherently EPA functions in a report entitled "Are Service Contractors Performing Inherently Governmental Functions?" dated November 18, 1991. Agency officials responded that they recognized the need to strike a balance between performing work in-house and contracting. EPA also pointed out that the Agency issued policies in April and October of 1990 to better control contracting activities. GAO said that the primary reason for contracting is a lack of staff or staff with insufficient expertise, which results in a relinquishing of Government controls to contractors. Audit MO. E1NMT1-15-0032-2100300 ------- CHAPTER 2 THE AGENCY'S MANAGEMENT^ ADP SUPPORT SERVICES CONTRACTS NEEDS IMPROVEMENT During the past year, OIRM has taken significant actions to improve the TOSS DOs by providing training, site visits, and a TOSS User's Guide. Also, OIRM has established an EPAAR require- ment to include a contract provision for contractors to follow EPA policies for IRM. However, despite these efforts, Federal and Agency guidance, and GSA and GAO recommendations, EPA still does not have an effective contract management process for ADP support services contracts. Specifically, our review of two of the most significant ADP support services contracts—the TOSS contract with a potential estimated ceiling price of $347 million and the Facilities Management contract with a potential estimated ceiling price of $140 million—showed that the contracts did not include: (1) minimum standards or meaningful criteria for accep- tance or rejection of contractor support services; or (2) suf- ficiently defined work specifications. Also, the TOSS contract management process did not provide for adequate review and approval of DOs. As a consequence, OIRM cannot be assured that the contracted ADP support services are effectively and efficiently accomplished, which may result in increased: (1) development and maintenance costs; (2) NDPD operational costs; (3) data integrity problems; (4) risk of normal operations disruption; and (5) dependency on contractors. These deficiencies occurred, in part, because OIRM has not established certain key mandatory IRM standards for ADP support services contracts, to provide guidance to contractors in a wide range of areas. Further, the DOPOs and the alternate DOPOs did not have the technical ADP skills necessary to effectively administer the TOSS DOs. In addition, the project officer and the contracting officer did not have sufficient staffing to administer contracts of this magnitude and complexity. * GUIDANCE FOR ADP CONTRACTING FIRMR Part 201-30, Management of ADP Resources (Amendments 12 and 13, July 1988), prescribes that appropriate performance criteria should be employed in acquisitions, and that ADP specifications should describe agency requirements based on need. This part defines specifications for ADP systems as including a description of the data output and its intended uses, the data input, the data files and record content, the volumes of data, the process- ing frequencies, timing, and such other facts as may be necessary 9 Audit NO. E1NMJ1-15-0032-2100JOO ------- to provide for a full description of tue ADP mission need to be satisfied. GSA's Overview Guide-Acquisition of Information Resources (dated January 1990), reflects the Federal regulatory requirements of the FJiR and the FIRMR. These requirements state that fixed-price contacts, as opposed to cost-reimbursement contracts, are most advantageous to the Federal Government, primarily because they pose the least risk and administrative burden on the Federal Government and promote price competition. The guide states that tfirm-ifixed-price contracts are appropriate whens specifications are fJLrmly established and clearly defined; realistic cost estimates are possible; and adequate competition exists. The guide further states that cost-reimbursement contracts are used when uncertainties of performance cannot be reasonably estimated. When using cost-reimbursment contracts, however, the guide states that the Government must closely monitor both costs and technical perfoinnance of the contractor. FIRMR Part 201-20, Acquisition, prescribes mandatory Federal policies and procedures for acquisition of ADP hardware and sup- port services. FIRMR Subpart 201-20.103-3 (dated October 1990), Description of Requirements, directs agencies to: (1) describe requirements in terms of functions to be performed (i.e., work specifications) and performance to be achieved (i.e., acceptance criteria); and (2) document in the requirements analysis the quantitative or qualitative requirements that must be met and why those requirements are necessary to meet the mission, needs. Several EPA guidance documents address preparing the SOW. Chapter 2 of the Contracts Management Manual. EPA Directives 1900, requires that the procurement request package for DOS expected to exceed $10,000 include a SOW. The directive refers to the Project Officer's Handbook (dated April 1984) for guidance on preparing the SOW. Chapter 3 of the Prelect officer's Handbook, which concerns individual acquisition planning and scheduling, discusses developing the SOW. Additional Agency guidance was available in the November 1990 draft; TOSS User'a Guide, issued in final in August 1991. The project officer stated that the draft guide was provided to the DOPOfii as interim guidance until the final guide was issued. These guides state that the SOW outlines the details of the work to b«! performed under the DO. Among other things, the SOW should describe the work the contractor is to perform. This is the most important section of the SOW and must clearly outline what is to be done. The contractor is only responsible for tasks described in the SOW and must be able to work from these descriptions, independent of the DOPO. In addition, EPA's Contract Adminis- tration; A Guide For Project Officers (dated August 1991) provides a general description of the SOW stating "Assignments must be specific in terms of the end product(s) required, and 10 Audit Mo. B1NM71-1S-0032-2100300 ------- number and types of reports to be submitted. Any other specific requirements involved must also be specified...." These guides also require that the SOW describe the deliverables, identify the criteria for accepting the deliverable, and provide a schedule for tasks and deliverables. For acceptance pro- cedures, the guides prescribe that the criteria for acceptance should address the "recompensed use criteria" (outlined in the TOSS User's Guide) for th« 30 pricing arrangements in the TOSS contract, and identify sources of opinions (contractor versus others), references, and other points used to judge the contractor's results. In the case of completed software, the deliverables might be deemed acceptable only after a successful operation for a 3-month trial period. In addition, a final EPAAR rule establishing EPAAR coverage on EPA policies for IRM was issued on August 27, 1991. The rule incorporates EPA IRM policies into a contract clause. The intended effect of this rule is to assure that contractors perform IRM-related work in accordance with EPA policies. PROBLEMS REPORTED IN THE PAST EPA has had similar problems reported in the past. GAO's 1980 report, entitled "Stronger Management of EPA's Information Resources is Critical to Meeting Program Needs," included many of the same issues we are reporting and made the below listed recommendations to the Agency. Although these 1980 recommen- dations pertained to acquisitions of systems, not support services, they parallel the concerns we identified in this review. Specifically, GAO recommended that EPA: strengthen controls over and enforce standards for major systems development; ensure that project officers are sufficiently knowledgeable and experienced in ADP and contract management; require contracting officers to verify that SOWs are detailed; and require project officers to thoroughly review the ADP technical content of contractor deliverables. GSA's 1985 report entitled "Procurement Management Review" recommended that EPA initiate several actions for improved management and acquisition of information resources. In its written comments, EPA agreed with the GSA analysis and recom- mendations and prepared a detailed action plan to address each of 11 Audit MO. E1HM71-15-0032-2100300 ------- the recommendations. Specifically, GSA recommended that the Agency;: develop unified IRM acquisition policies and guidelines rather than issue different procedures depending upon the type of IRM resource to be acquired; establish an oversight organization within OIRM responsible for the development and enforcement of IRM policies, procedures, and guidelines; develop and implement an Agency standards compliance program which includes the development of a set of guidelines to ensure that appropriate standards are included in solicitation documents; and provide better oversight and direction to ADP users and project officers, with particular emphasis on controls for service contracts. EPA HAS NOT ESTABLISHED AN ADEQUATE CONTRACT MANAGEMENT PROCESS • Contrary to Federal and Agency guidance and GSA and GAO recom- mendations, EPA has not established an effective contract management process for ADP support services contracts. Discussed below are the results of our review of documents used in pro- curing ADP support services from two contracts—the TOSS contract with an estimated ceiling price of $347 million and the Facilities Management contract with an estimated ceiling price of $140 million. Together, these contracts account for approxi- mately 50 percent of the total estimated ceiling price of $930 million for the six current ADP support services contracts (individually priced over $30 million). TOSS Contract; The TOSS contract did not include minimum standards or meaningful criteria for acceptance or rejection of contract deliverables. We reviewed 40 TOSS DOS, totaling $12.6 million, which pertained to ADP support services provided in Headquarters and Regions 2, 3, 4, !5, and 6. Our analysis showed that: Twenty-one DOs (priced at $6.11 million) did not contain any acceptance criteria in the SOWs. Nineteen DOs (priced at $6.49 million) had limited acceptance criteria, as follows: o Fourteen DOs (priced at $4.39 million) had acceptance criteria for the deliverables in the 12 Audit MO. B1NKJ1-1S-0032-2100300 ------- SOW. The criteria, however, vac broad and vague (a* opposed to being task specific and detailed). For example, DO 023 SOW set forth that: (1) all document processing activities performed under the contract shall be evaluated by the DOPO; (2) the project .plan should be provided for review and comment; and (3) if DO requirements are not fulfilled the DOPO will notify the contractor in writing. Although the DO's SOW tried to define acceptance criteria, it did not identify or describe specific deliverables. Therefore, it would be very difficult for the DOPO to objectively determine whether the DO requirements were fulfilled. The remaining 12 DCs in this category had language similar to DO 023. o Five DOs (priced at $2.10 million) contained acceptance criteria not relevant to the deliverables. For example, DO 10 referred to criteria that was no longer in Agency use at the time the DO was issued (i.e., the ADP Manual), or to criteria of which the current DOPOs had no knowledge. Also, DO 10 (priced at $478,673) was awarded to support the Atmospheric Research and Exposure Assessment Laboratory (AREAL), and required adherence to AREAL documentation standards. However, when we inquired about these standards, the DOPO was initially unfamiliar with them and after further research informed us that these standards were no longer the accepted criteria. Seventeen of the 40 TOSS DOs selected for review were over $250,000, and all of these were priced on a price-ceiling or cost reimbursable basis rather than a firm-fixed-price basis. Also, our review showed that the contract management process did not ensure that DOs provided clear and specific guidance to allow the contractor to operate independently and to enable the preparation of independent cost estimates. For instance, DO 089 (priced at $1.08 million) was awarded to support EPA's Integrated Financial Management System (IFMS). The IFMS is a mission critical and complex Agencywide system consisting of several major automated systems. The services under this DO included maintenance and operation tasks; system design and development; user and software support; system enhancements, revisions, and testing; oversight of communications; and data center support. However, no acceptance criteria was provided for any of the tasks. In addition, insufficient details were provided to describe the tasks. The system design and development tasks only stated that the contractor should perform analysis of proposed modifications to the existing system; revise or develop documentation for new or existing systems; and convert system components to run on 13 Audit MO. E1HXF1-15-0032-210030Q ------- upgraded or new hardware and software operating systems, This was not enough detail to allow the contractor to work on an independent basis or to enable the preparation of an independent cost estimate. The contracting officer agreed that these sows were generally not adequate. Additionally, the TOSS contract management process did not provide for adequate review and approval of DOS. Based on our revievr of the 40 DOs, only four had evidence of detailed technical review comments. Furthermore, we found cases where the contracting officer requested specific changes which were not addressed by the TOSS project officer. Thus, the OOs were not revised prior to issuance. For instance, we identified a draft DO 062! (for Region 5 for Technical Support Services) that had been reviewed by the contracting officer, who had annotated the draft with a substantial number of recommended changes and returned the draft to the project officer for revision. Most of these recommended changes were needed to improve the clarity, conciseness, and completeness of the SOW, because the contracting officer could not tell what services were really needed. For example, the contracting officer questioned the extent of the described "system analysis" task specification and inquired whether the task was either a large software development effort or software maintenance activity. The project officer's files showed that this draft DO was issued in April 1991 without any of the recommended changes. We inquired why this DO had not been revised prior to issuance. The contracting officer stated that this DO, along with seven others, had been returned to the project officer for necessary revision prior to issuance. The contracting officer stated that, primarily because of the urgent need to acquire the ADP support services in the field, the DOs were subsequently conditionally approved and issued without the revisions. As of December 1991, however, these DOs had not been revised to fully resolve the contracting officer's requested changes. Facilities Management Contract To determine the adequacy of this contract management process we could not review DOs,* because DOs do not apply to facility management contracts. So we reviewed the Facilities Management contract itself, which includes over 40 ADP service areas, and various trimester management work plans and corresponding performance evaluation reports. Also, we reviewed the proposed replacement contract RFP as of December 1991, which includes over 90 ADP service areas. Overall, we concluded that the management process for the exist- ing Facilities Management contract does not provide: (1) mean- ingful acceptance criteria for the functional service areas; and (2) sufficiently detailed work requirements for each of the 14 Audit MO. ElMXri-15-0032-2100300 ------- technical areas and specific functions/activities. PCMD's quality review of the draft replacement Facilities Management solicitation document also raised similar concerns regarding these issues. Under the Facilities Management contract, NOPD has directed the contractor to prepare a management work plan every four months to list specific tasks for each of the functional service areas. Each task is assigned a priority code, total estimated staff hours, and a projected completion date.. This document, however, does not provide formal contractual authority and sufficiently detailed specifications to efficiently administer the contract. Further, procedures for tracking and reporting expenditures for ADP support services do not correlate these expenditures to the specific activities listed in the work plans and other work assignments outside the work plans. For example, during the trimester period of June through September 1991, one of technical managers for this contract was responsible for monitoring and evaluating 77 priority tasks encompassing over 19,000 hours. The work plans for these tasks contained primarily scheduling information with very general descriptions of the tasks to be accomplished, because the contract does not require the detailed information needed for an objective evaluation for performance. Furthermore, the award fee evaluation was not tied to specific, measurable accomplishments of the contractor. The technical manager's evaluation addressing all activities assigned to the contractor, which included the work plan tasks, consisted of about two and half pages of narrative using only subjective criteria (e.g., attitude, cooperation, high level of effort, etc.). Finally, budgeted costs were not included in the work plans and we found no correlation of existing cost reports to the tasks in the work plans. Moreover, the replacement Facilities Management RFP more than doubles the number of support services areas to be performed, and requires the contractor to provide support for the preparation of the management work plan. Nevertheless, this proposed plan is still only a scheduling mechanism and will not provide the needed acceptance criteria and detailed task specifications. ADVERSE EFFECTS WERE NUMEROUS Without certain key mandatory IRM standards, clearly defined work specifications, and meaningful criteria for the performance evaluation of the contracted activities, management cannot be assured that the ADP support services provided by the TOSS and the Facilities Management contracts are effectively and efficiently accomplished. The weaknesses in this contract management process may also adversely affect other ADP support 15 Audit Me. E1NMJ1-13-0032-2100300 ------- services contracts. For example, the Agency has four other existing ADP support services contracts, priced individually over $30 million, which have a total aggregate estimated ceiling price of over $443.5 million. In addition, the Agency has a proposed Facilities Management Recompete contract and replacement Telecommunications Support Services contract with a GSA DPA total price of $535 million. Further, in the near future the Agency plans to award two additional ADP support services contracts, each over $30 million, with a total maximum price of $94 million. These conditions on the TOSS contract and the existing and proposed Facilities Management contracts could result in additional and unwarranted: (1) systems development and main- tenance costs; (2) NDPD operational costs; (3) problems with the accuracy and completeness of data within the Agency's information systems; (4) risk of normal operations disruption from software changes or from contractor support personnel changes; (5) depend- ency on incumbent ADP support contractors; (6) complexity related to the systems modernization and data integration initiatives; and (7) risk of contractors performing inherently Governmental activities. For example, in the March 1991 OIG audit report entitled "Inte- grated Financial Management System: Managing Implementation Of The New Accounting System,11 we criticized the Agency's lack of system development standards (i.e., management oversight, decision-making process, software testing, and system documen- tation) in the development of IFMS. As a result, software development and maintenance costs had escalated from an estimated $7.7 million to almost $20 million. Moreover, significant problems existed with IFMS data quality and user satisfaction. Additionally, the lack of formal work specifications for the existing Facilities Management contract increases the potential for contract administration breakdowns and increased costs. For example, the management work plan for June through September 1991 identified a task to implement and enhance the Security Program, working on 6 items and budgeting 100 staff hours. However, no schedule and work specifications existed as to what should be done and there were no related cost estimates (e.g., materials, travel, training, and other indirect costs) other than staff hours. These staff hours did not identify specific labor categories and could be billed at a higher rate than needed. While NDPD management has stated that the reason EPA has expended funds on this contract at a faster rate than originally planned was the increased demand for services, we believe that the lack of detailed specifications and related cost estimates for this contract was also a significant factor. Another significant factor was the shortage of EPA employees for ADP support services necessitating the use of more contract employees. These latter two areas of concern were also previously discussed in EPA's 1985 requirements analysis for the existing Facilities Management 16 Audit NO. B1NMT1-13-0032-2100300 ------- contract, and were considered by NDPD senior management as key success factors to be resolved. Not only has the Facilities Management contract expended funds at a faster rate than originally planned, but significantly more total funds have been expended than the approximately $72.9 million originally planned. Specifically, we identified significant cost growth near the end of the contract life, as follows. As of October 1, 1991, the contract ceiling was increased to $122.3 million or about $49.4 million above the original ceiling. The contractor's February 1992 status report confirmed a maximum ceiling value of about $122 million with commitments of approximately $111 million. NDPO officials did not have docu- mentation regarding this additional $49.4 million, and referred us to PCMD. We reviewed the contract file with a PCMD official and concluded that we could only determine the total contract ceiling amount. We could not document the approved ceiling amounts for the appropriate option periods after April 1991, because the contract files were missing key documents which we were told modified the contract ceiling. We believe that if the requirements were not incorporated into the contract through modifications until after April 29, 1991, when new Federal requirements took effect, -an APR should have been prepared requesting a DPA from GSA. However, a PCMD official stated that the requirements only needed to be "established" by April 1991, not documented in the contract. The PCMD official then said he believed that the requirements had been established prior to April 1991, but was unable to produce documentation to fully verify this. Therefore, we could not resolve the issue. There also was a question of the correct amounts obligated on the contract. The contracting officer asked the Commodities Payment Section to review its payments records, because $4.5 million more funds were disbursed than obligations recorded in the contract records. The correct payment amounts were being researched at the time of our review. NDPD officials advised us they had recently requested a DPA to extend the current contract for 5 month* at an estimated cost of $17.4 million. The increase was needed because of the delays in issuing the replacement contract, which had been planned for February 1992. 17 Audit HO. E1NH71-1S-0032-2100300 ------- Together these increases would bring the potential ceiling value of the contract to about $140 million, 100 percent greater than the original contract. The lack of firmly established and clearly defined specifications can result in the Agency using cost-reimbursable contracts which are more risky and more costly to the Federal Government. For example, all 17 TOSS DOS over $250,000 previously discussed were issued on a cost-reimbursable basis primarily because of the lack of specificity in the SOW. If some or all of these 17 TOSS DCs were priced on a firm-fixed-price basis, as provided for under the TOSS contract, the Agency could have shifted the risk of performance to the contractor. Finally, EPA's inadequate review and approval process of the performance of the contracted support services provided under both the TOSS and Facilities Management contracts could potentially result in the Agency approving payments for: (1) services it may not have received; (2) inferior services; and (3) the sane services twice. In effect, an unacceptable basis exists for the DOPO acceptance process on the TOSS contract and the Facilities Management contract performance evaluation process. The absence of certain key minimum IRM standards for ADP support services contracts has resulted in increased risk of normal operations disruption from software changes or from contractor support personnel changes and dependency on incumbent ADP support contractors. For example, in our recent report on EPA's contract with CSC, we stated that no adequate system documentation existed for thia National Contract Payment System and that all primary technical knowledge of the system essentially resided with contractor support staff. We found that EPA heavily relied on contractor support personnel for system knowledge, operation, and maintenance, and that EPA managers could not answer basic questions about the system's design. The lack of certain IRM standards, in our opinion, has also contributed to EPA not properly developing information systems for cross-media information needed to support mission critical systems. GAO testified about concerns with EPA's data integration efforts before the Committee on Governmental Affairs on Junn 19, 1991. GAO said that in spite of EPA°s actions to date to support critical missions, such as enforcement, the Agency still does not have the ability to enforce the environmental laws on a cross-functional basis. What is not discusued by GAO is that most IRM operations at EPA are being performed by various contractors under support services contracts without adequate IRM standards. Further, the lack of clear and formal work specifications for both o!.' these contracts increased the risk that the contractor employees will perform policy-making decisions and other 18 Audit HO. E1NMY1-1S-OOS2-2100300 ------- inherently Governmental activities. For example, the security activities provided under the TOSS contract and Facilities Management contract were not independent of the system administration duties provided, and did not have sufficient EPA formal direction to ensure that contractors did not perform inherently Governmental activities. Also, in our March 1991 report entitled "Improvements Needed in EPA's Resource Access Control Facility (RACF) Security Software," we reported that NDPD was not providing sufficient guidance, oversight, and active monitoring of contractor personnel who are responsible for RACF security. We concluded that the contractor was in a policy- making role, which is an inherently Governmental activity, because the contractor personnel designed the RACF control mechanism to meet the security needs of the Agency. This area will be discussed in detail in a separate report on security. OIRM NEEDS TO ESTABLISH STANDARDS OIRM has not established mandatory IRM standards for ADP support services contractors to follow in a wide, range of areas, but instead has published optional standards only. For example, detailed mandatory minimum standards do not exist for: (1) sys- tem hardware and software maintenance; (2) concept feasibility studies; (3) requirements definition; (4) system design; (5) application software programming; (6) application software implementation and testing; (7) systems training; and (8) system documentation. Further, the Agency has not established a mandatory System Development Methodology (SDM) with minimum requirements. The SDM was previously cited as critically needed for EPA by GAO in its 1980 report and by NDPD senior management in the 1985 requirements analysis for the existing Facilities Management contract. These minimum mandatory standards do not exist primarily because some key OIRM managers (one Division Director and one Acting Deputy Division Director) consider themselves as consultants for the program offices, and do not consider themselves responsible for managing ADP activities that cross organizational lines. Another significant factor is the process for establishing EPA Directives (i.e., "green border process"). OIRM's Director, Information Management and Services Division, who is responsible for EPA IRM policies and procedures, considers this process too cumbersome and time consuming, because of the current philosophy that a "consensus" is needed between all organizations before a Directive can be issued. Nevertheless, considering the signi- ficant expenditures incurred for ADP support services, as well as other IRM activities, mandatory standards are a matter of prime importance. In March 1992, after to our meetings with OIRM managers regarding IRM standards, they initiated a task force to: (1) review the 19 Audit HO. BlNXfl-lS-0032-2100300 ------- Agency's IBM policies and standards; (2) ensure that EPA programs and contractors are aware of the EPAAR requirements; and (3) pur- sue an enforcement strategy. We encourage the task force to specifically address the concerns related to the minimum mandatory IRM standards discussed above. Effective EPA oversight of contractor activities is difficult to achieve under both of the ADP support services contracts re- viewed, due to the magnitude and complexity of these contracts and tho limited resources available to review, approve, and manage the extensive contract workload. For example, on the TOSS contract, approximately 200 DOS a year are reviewed and approved by one contracting officer supported by two contracting special- ists. The contracting officer stated that the workload is too great for the staffing assigned to effectively administer the TOSS contract. Specifically, the contracting officer added that his workload included 16 active contracts involving between 2200 and 2600 action items at the time of our review. In addition, even though these DOs are managed by a project officer and 12 supporting staff members, 200 DOPOs, and, 200 alternate DOPOs, in most cases it is on a part-time basis. In many instances, a DOPO is responsible for tasks which span several organizational boundaries and are performed in several different locations within given regions. The existing Facilities Management contract provides for approxi- mately 500 contractor support employees with 45 EPA employees responsible for managing the contract execution. The 1985 requirements analysis for the existing Facilities Management contract addressed the need to hire more qualified technical employees and concerns about delegating more work to contractors than in prior contracts. NDPO senior management also stated that adequate Government staffing does not exist and in time will not allow management of all functions at the level in prior contracts. Although NDPD management requested additional staffing in fiscal 1992 to handle the increased IRM activities related to contracting, no additional staff slots were authorized. NDPD management informed us that they have implemented other management tools outside the Facilities Management .contract to enhance NDPD's ability to effectively maintain control over contractor activities. These management controls include: (1) a Telecommunications Service Request system; (2) a centralized Problem Management system; and (3) individual service level agreements with EPA customers. While we agree that these controls will help, we believe the additional controls related to the management work plan and the award fee evaluation process, discussed previously, are necessary. 20 Audit MO. B1NX71-1S-0032-2100300 ------- Additionally, the.TOSS contract DOPOs assigned to write and to review the DOs for AOP support services did not have the commen- surate technical skills to effectively manage these activities. We interviewed managers, AOP Systems Coordinators, and DOPOs at Headquarters, National Computer Center, Cincinnati Data Center, two regional offices, and four laboratories and determined that the Agency did not have sufficient contract administration staffing, formally trained in ADP, to handle the existing and proposed ADP support services contracts. For instance, we found that the individual position descriptions and performance evaluations for the above positions were not explicitly defined with respect to the DOPO and management responsibilities for contract monitoring. Further, the contracting officer agreed that the Agency does not have sufficient contract administration staff trained in ADP to handle ADP support services contracts. Another factor that contributed to the breakdown in effective contract management for the TOSS contract was the user guidance developed in support of the contract. The TOSS User's Guide was not finalized until August 1991, eleven months after the effective date of the TOSS contract. In addition, when this guide was published it did not clearly define: (1) roles and responsibilities for the Technical Manager position in the TOSS contract; (2) roles for the DOPO and contracting officer in monitoring the development of ADP DOs; and (3) minimum technical expertise requirements for DOPOs and Alternate DOPOS. Although OIRM has provided general guidance and some training for DOPOs and Alternate DOPOs, OIRM personnel and the contracting officer have generally not performed substantive reviews of the DOs sampled. The project office files did not include evidence of detailed technical reviews with the exception of several detailed reviews conducted by the contracting officer. Since 1984, the ADP procurement workload had grown from an average of $2.9 million for each contracting office staff member to an average of $6.4 million. As a consequence, the contracting office did not have the time and resources to perform detailed reviews of the TOSS contract DOs. One solution would be to use independent evaluation contractors to perform the technical reviews of DOs. This is a widely used activity for system development projects.* Finally, the Facilities Management contract only referenced the EPA security guidelines and did not incorporate a requirement for a detailed task plan. Although management initiated the management work plan as a scheduling device, we believe that a detailed task work plan is needed to manage a contract of this magnitude and complexity. 21 Audit MO. E1NK71-15-0032-2100300 ------- CpKC1^ SIGNS EPA does not have an effective contract management process for ADP support services contracts. Our review of two major ADP support services contracts with an aggregate ceiling price of $487 million showed that the contracts did not have minimum standards for acceptance or rejection of contractor support services and sufficiently defined work specifications. The weaknesses in this contract management process may also adversely affect other existing and pending ADP support services contracts totaling almost $1.1 billion. In addition, the TOSS contract management process did not provide for adequate review and approval of DOs. As a consequence, EPA can not be assured that contracted ADP support services are effectively and efficiently accomplished. RECOMMENDATIONS We recommend that the Acting Assistant Administrator for Administration and Resources Management: 1. Add to the Agency's contract management program Agencywide mandatory and formal IRK standards, project management guidance, and SDM requirements to efficiently manage ADP support services contracts and information resources. 2. Perform a study to determine the appropriate procurement office staffing to administer the current and proposed ADP support services contracts. 3. Establish senior DOPO/technical manager positions with ADP technical skill requirements commensurate with the skill levels needed to technically monitor the development of ADP DOs and deliverables, or consider the use of independent evaluation contractors to perform the technical reviews of DOS. 4. Revise the proposed Facilities Management Recompete RFP to specify that the: management work plan incorporate technical documents which include detailed work requirements and meaningful acceptance criteria; award fee evaluation procedure include an objective evaluation of achievement of detailed work requirements against the acceptance criteria; and procedures for tracking and reporting expenditures for ADP support services correlate to the work plans and other work assignments outside the work plans. 22 Audit MO. E1NKP1-15-0032-2100300 ------- 5. Request General Counsel to determine if an additional OPA friio GSA is heeded on the current Facilities Management contract for any costs incurred to date which exceed the blanket OPA amount. AGENCY COMMENTS AND QIC EVALUATION In their response, Agency officials generally agreed with our recommendations and provided additional information. Based on their comments, we adjusted one recommendation. They stated they were taking the following actions: (1) OIRM is currently reviewing IRM policies and standards which include the concerns expressed in this report; (2) PCMD will perform the staffing study and will review its present allocation of resources to determine if they are deployed optimally. Should the study indicate that additional resources are necessary, PCMD will request them through the budget process; (3) OIRM will study the most appropriate manner in which to conduct an independent evaluation of DOs, and build an operational capability for AOP support services to ensure sufficient technical skill is available; and (4) NDPD plans to revise the existing Facilities Management contract and the recompete RFP to incorporate improved internal controls for the management work plans, award fee evaluation process, and tracking and reporting costs in correlation to work plans and other work assignments. These corrective actions are appropriate and should, when fully implemented, respond adequately to our recommendations. In addition, after our last meeting with Agency officials on March 26, 1992, NDPD officials presented new information to us regarding the ceiling price of the Facilities Management contract. After discussing this information with PCMD officials, we have added a fifth recommendation which was not present in our draft report. 23 Attdit MO. B1NXT1-1S-0032-2100300 ------- (This page was intentionally left blank.) ------- CHAPTER 3 THE AGENCY'S PRE-SOLICITATION PHASE OF THE ACQUISITION PROCESS FOR ADP SUPPORT SERVICES CONTRACTS IS NOT IN COMPLIANCE WITH FEDERAL ADP PROCUREMENT REQUIREMENTS Contrary to Federal requirements, EPA did not prepare the prescribed requirements analyses, which included the analyses of alternatives, for three current ADP support services contracts and two proposed contracts with a total estimated ceiling price of about $1.2 billion. Further, EPA has been acquiring ADP support services without aggregating the costs on the three current contracts for ADP equipment, proprietary software, maintenance services, and ADP services. Although EPA has prepared individual acquisition plans, the supporting plans' cost estimates were only prepared for the recommended acquisition strategy for each individual contract. Moreover, EPA is currently in violation of its DPA for the TOSS contract. GSA approved the request conditional upon receipt of information on the TOSS acquisition analysis of alternatives from EPA. However, EPA has not provided this information to GSA. Without the preparation of these analyses, Agency officials have no objective basis for selecting the recommended alternative. Therefore, the Agency has no assurance that these five ADP support services contracts represent the lowest overall cost to the Federal Government. Additionally, without aggregating the costs on these contracts for ADP equipment, proprietary software, maintenance services, and ADP services, EPA may be exceeding its GSA DPA ceiling. Further, by not aggregating the individual costs within each contract and obtaining similar ADP requirements (i.e., ADP equipment, proprietary software, maintenance services, and ADP services) across the contracts, it may appear that EPA is splitting its requirements among multiple contracts to avoid requesting additional DPAs. These problems arose because the contracting office within PCMD was not adequately involved in the pre-solicitation phase of the acquisition process. Instead, this phase was handled almost entirely by OIRM and NDPD officials. This was inconsistent with GSA's Overview Guide-Acquisition of Information Resources (GSA.'s Overview Guide). FEDERAL REQUIREMENTS FIRKR Bulletin A-l, dated January 31, 1991, defines FIP resources as follows: 24 Audit MO. E1NMJ1-1S-0032-21003CO ------- FIP equipment includes data processing and switching equipment such as mainframes, ancillary equipment including disk drives, printers, digital imaging equipment, and telecommunications related equipment; FIP software includes systems programs, application programs, maintenance diagnostic programs, and other commercially available software; FIP maintenance includes preventive and remedial equipment diagnostics and repair services; FIP support services include any commercial non- personal services used in support of equipment, maintenance, software, facility management, systems analysis, systems design, data entry, software conversion, and other activities; and FIP services include teleprocessing, electronic mail, facsimile, and computer time. FIRMR (Amendment 4, June 1985), Subpart 201-23, Delegations of Authority, sets forth that requirements shall not be fragmented in order to circumvent established DPA thresholds„ This Subpart also requires that when Federal agencies are not using GSA contracts to obtain additional DPA approval from GSA when the aggregate costs of: (1) ADP equipment exceed $2.5 million for a competitive purchase or $250,000 for a sole-source purchase; (2) proprietary software exceed $1 million for a competitive purchase or $100,000 for a sole-source purchase; (3) maintenance services exceed 81 million for a competitive purchase or $100,000 for a sole-source purchase; and (4) ADP services exceed $2 million for a competitive purchase and $200,000 for a sole-source purchase. In addition, agencies were provided a blanket approval authority for ADP support services. FIRMR (Amendment 1, October 1990), Subpart 201-20.305-1, Regula- tory Delegations, sets forth that agencies may contract for FIP equipment, software, ADP services, and support services, without prior approval of GSA,* when the dollar value of any individual type of FIP resource, including all optional quantities and periods over the life of the contract, does not exceed $2.5 million ($250,000 for a specific make and model or for require- ments available from only one responsible source). Also, this Subpart sets forth when FIP equipment, proprietary software, ADP services, and support services (or any combination thereof) are combined and acquired under a single contract action, a specific acquisition delegation shall be required when the dollar value of either the equipment, software, ADP services, or support services exceeds the aforementioned applicable dollar threshold. 25 Audit NO. B1NMJ1-13-0032-2100300 ------- The Paperwork Reduction Rtauthorization Act of 1986 (Public Law 99-500) significantly expended the Brooks Act definition of ADP equipment to recognize th-5 ongoing merger of technologies and organizations. The law defines ADP equipment as "any equipment or interconnected system or subsystems of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching interchange, transmission, or reception of data or information." This includes computers; ancillary equipment; software, firmware, and similar procedures; services, including support services; and related resources as defined by the GSA. The Brooks Act (Public Law 89-306), enacted in October 1965, directed that GSA "coordinate and provide for the economic and efficient purchase, lease, and maintenance of automated data processing equipment by Federal agencies." GSA was granted exclusive authority to procure ADP equipment, with the power to delegate procurement authority to Federal agencies to the extent GSA determines necessary or desirable. Within EPA the Director, OIRM has been designated the senior official for approving acquisitions of FIP resources. GSA's Overview Guide, dated January 1990, provides a high level description of the acquisition process, including the roles and responsibilities of the program manager, information resources management personnel, and contracting personnel. FIRKR Part 201-20, Acquisition, establishes mandatory Federal policies and procedures for acquisition of ADP hardware and support services. FIRMR Subpart 201-20.103-3, Description of Pequirements, prescribes that agencies: (1) describe requirements in terms of functions to be performed and performance to be achieved; (2) consider aggregating requirements on organizational or functional bases and conducting a requirements analysis on the basis of the aggregated requirements; (3) document in the requirements analysis the quantitative or qualitative require- ments that must be met and why those requirements are necessary to meet the mission needs; and (4) other requirements FIRMR Subpart 201-20.2,. Analysis of Alternatives, prescribes policies and procedures for identifying and analyzing feasible alternatives that satisfy requirements for Federal information processing resources. The statement of requirements resulting from the requirements analysis is the basis on which the analysis of alternatives is conducted. Agencies shall conduct an analysis of alternatives, commensurate with the size and complexity of the requirement, to identify the most advantageous alternative to the Federal government. In the analysis of alternatives, agencies shall calculate the total estimated cost for each feasible alternative. When the anticipated cost of the acquisition is $50,000 or less, the total estimated cost may be limited to an analysis demonstrating that the benefits of the acquisition will outweigh the costs. 26 Audit MO. E1NM71-15-0032-2100300 ------- The "IKM Support Services DPA Guide" requires in Section 3.0, Process* Overview, that an alternatives analysis provide a comparison of costs including a cost benefit analysis. Section 6.2, Alternatives Analysis, requires that the projected costs for each alternative be calculated. CAP GAO in their report entitled "Stronger Management of EPA's Information Resources is Critical to Meeting Program Needs,11 dated March 10, 1980, recommended various actions to strengthen the pre-solicitation phase of the acquisition process. Specifically, GAO recommended that EPA: perform formal cost benefit analyses of alternative procurement strategies to assure that the Federal government incurs the lowest total life-cycle costs in major ADP systems acquisitions; and assure that top management and the steering committee devote to major ADP systems acquisitions the special attention needed to efficiently and effectively meet future ADP requirements. Although; these 1980 recommendations pertained to acquisitions of systems, not support services, they parallel the concerns we identified in this review. EPA IS NOT PREPARING REQUIRED DOCUMENTS FOR ADP SUPPORT SERVICES Contrary to Federal requirements the Agency did not prepare the prescribed requirements analyses, which includes the analyses of alternatives based on costs and benefits of various alternatives for the TOSS and MOSES contracts which total over $511 million. Additionslly, the Agency did not prepare the prescribed analyses of alternatives portion of the requirements analysis for the Facilitios Management contract with a ceiling price of $140 million. EPA has prepared individual acquisition plans, however, the cost estimates were only prepared for the recommended acquisition strategy. Further, the Agency has been acquiring ADP support services without aggregating the costs on the awarded contracts for ADP equipment, proprietary software, maintenance services, and ADP services. In addition, EPA did not prepare the prescribed analysis of alternatives portion of the requirements analysis for the pro- posed Facilities Management and the proposed Telecommunications Recompete contracts, which have a ceiling price of $535 million. The requirements analysis dated November 9, 1990, for both the 27 Audit NO. B1NMJ1-15-0032-2100300 ------- Recompete contracts, did not meet the above FIRMR Subpart 201-20.2 guidelines because the analysis of alternatives did not cost each alternative. The Agenc> has been contracting for ADP support-services for many years, vhich should provide a historical cost basis to prepare the prescribed requirements analysis. Finally, EPA is currently in violation of its procurement authority on the TOSS contract. In September 1989, the Agency requested a OPA under the TOSS contract for the following areas amounting to $18,078,000: (1) installation of personal computers and related equipment; (2) system diagnostic testing; (3) equip- ment maintenance; (4) local area networks and telecommunications; (5) systems configuration planning; and (6) other capabilities. Subsequently, GSA approved the request conditional upon receipt of information on the TOSS acquisition analysis of alternatives from EPA. However, EPA has not provided this information to GSA. Since EPA has already started executing delivery orders for these requirements, the Agency is in violation of its procurement authority. NO ASSURANCE THAT ADP SUPPORT SERVICES CONTRACTS ARE LOWEST COST Without the preparation of all prescribed requirements analyses, the Director, OIRM has no objective basis for selecting the recommended alternative. Therefore, the Agency has no assurance that the three existing ADP support services contracts discussed in this report, which total over $651 million, represent the lowest overall cost to the Federal Government. Additionally, without aggregating the costs on the existing contracts we reviewed for ADP equipment, proprietary software, maintenance services, and ADP services, EPA may be exceeding its DPA ceiling. Further, by not aggregating the individual costs within each contract and obtaining similar ADP requirements (i.e., ADP equipment, proprietary software, maintenance services, and ADP services) across these contracts the awarded contracts reviewed, it may appear that EPA was splitting its requirements among multiple contracts to avoid requesting additional DPAs. We discussed these conditions with GSA policy officials, who expressed serious concerns. These officials stated that requirements analyses and analyses of alternatives are required for all major acquisitions of FIP resources. If these requirements are not satisfied, these officials stated that Federal agencies would not be complying with their DPAs. 28 Audit NO. E1NMT1-15-0032-2100300 ------- T«; NOT ADEQUATELY INVOLVED PCMD wais not adequately involved in or accountable for the pre- solicitation phase of the acquisition process which is incon- sistent with GSA's overview Guide. This guide suggests specific roles and responsibilities for the program offices, contracting office, and IRM organization. Specifically, the IRM organization should provide technical expertise to the program office and the contracting office in preparing APRs. We believe that the con- tracting office should review and approve the requirements analyses, alternatives analyses, including the analyses of alternatives, and APRs to ensure that these documents are in compliance with the FAR and FIRKR requirements. In fact, EPA's contracting office was not formally involved in the review and approva;, of these documents. Instead, the APRs were prepared, approved, and submitted directly to GSA by NDPD and OIRM officials. OIRM officials told us that PCMD: (l) attended formal planning meetings for the Facilities Management contract; (2) attended GSA meetings for the Facilities Management contract; and (3) reviewed and concurred with major APRs. However, we found no evidence in the contract files regarding PCMD's participation in these or any other pre-solicitation activities. GSA guidance suggests that OARM, which is responsible for both IRM and procurement, would normally designate the responsibility for final review of the APR to the head of the contracting office. However, the Agency has assigned the Director, OIRM as the designated senior official for approving acquisition of FIP resources. Also, the contracting officer would normally have responsibility for formal review of the APR and coordination with GSA, but in EPA he/she only ensures that award of a contract is within the limits of his/her warrant and is authorized by a DPA from GSA. Coordination and approval of specific GSA-required ADP acquisition documents by these different organizations are needed to ensure compliance with the FAR and FIRMR requirements. However, EPA's "IRM Support Services DPA Guide11 is not consistent with the GSA Overview Guide because EPA's guide does not adequately involve the contracting office in the pre-solicitation process. CONCLUSIONS The Agency has not complied with various Federal ADP procurement requirements for ADP support services contracts totaling almost $1.2 billion. Also, EPA has been acquiring ADP support services without aggregating the costs on certain mission support contracts for ADP equipment, proprietary software, maintenance services, and ADP services. Further, EPA is currently in violation of its procurement authority for the TOSS contract, 29 Audit Mo. E1NX71-13-0032-2100300 ------- because it has not complied with GSA's specific request for information. As a result, the Director, OZRM has no objective basis for selecting the recommended contracting alternative. Also, the Agency has no assurance that the AOP support services contracts reviewed represent the lowest overall cost to the Federal government. By not aggregating the individual costs within each contract and obtaining similar ADP requirements (i.e., AOP equipment, proprietary software, maintenance services, and ADP services) for multiple ADP support services contracts, it may appear that EPA is splitting its requirements to avoid requesting additional DPAs. RECOMMENDATIONS We recommend that the Acting Assistant Administrator for Administration and Resources Management: 1. Revise the "IRM Support Services DPA Guide" to provide detailed cost guidance on how to conduct an alternatives analysis and to make the duties and responsibilities consistent with GSA's guidance (i.e., require PCMD to review and approve the requirements analyses, alternatives analyses, and APRs to ensure that these documents are in compliance with the FAR and FIRMR requirements, and to document that approval). 2. Establish procedures to accumulate costs on ADP support services contracts for: (1) ADP equipment; (2) proprietary software; (3) maintenance services; (4) ADP services; and (5) ADP support services to ensure that the Agency obtains required approvals from GSA. 3. Conduct a requirements analysis, including an analysis of alternatives based on costs and benefits, for the MOSES contract to determine the most cost effective acquisition alternative, and to ensure that the GSA requirements are satisfied. 4. Revise the alternatives analysis presented in the requirements analysis for the proposed Facilities Management and Telecommunications contracts to cost appropriate alternatives and to help ensure that the selected acquisition strategy represents the lowest overall cost to the government. 5. Submit the required information on the TOSS acquisition alternatives analysis to GSA. 30 Audit NO. E1NMJ1-15-0032-2100300 ------- 6. Establish internal controls, in addition to the "IRM Support Services DPA Guide," to ersure that the prescribed raquirements analyses are properly done on all future procurements of FIP resources. AGENCY COMMENTS AND PIG EVALUATION In their response, Agency officials generally agreed with our recommendations and provided additional information. Based on the additional comments, we adjusted two recommendations. They stated they were taking the following actions: (1) Revise the "IRM Support Services DPA Guide"; (2) Ensure that actual costs for the five categories cited will be accumulated during the administration of ADP support services contracts; (3) Conduct/revise requirements analyses and analyses of alternatives for the MOSES and the proposed Facilities Management Recompete contracts; and (4) Establish internal controls to ensure that the prescribed requirements analyses are consistent with FIRMR requirements on all future procurements of FIP resources. The corrective actions proposed or initiated are appropriate and should, when fully implemented, respond adequately to five of our six recommendations. However, OIRM officials did not agree with the fifth recommendation regarding the TOSS contract, because they believe that they have provided the requested analysis of alternatives information to GSA. However, we believe the Agency has not completed a correct analysis of alternatives, because costs for only one alternative were calculated. 31 Audit MO. E1NM71-15-0032-2100300 ------- CHAPTER 4 MOT SUFFICIENTLY ADDRESS THE RISKS ASSOCIATED WITH THE ADP SUPPORT SERVICES CONTRACTS The FMFIA, Public Lav 97-255, requires each executive agency to (1) periodically evaluate its system of internal accounting and administrative controls, and (2) submit an annual statement of assurance to the President and the Congress on the status of the .agency's system of internal controls. These evaluations are made pursuant to OMB Circular A-123. The annual reports are to state whether the systems meet the objectives of internal control and conform to standards developed by GAO (Standards for Internal Controls in the Federal Government, published in 1983). EPA Resources Management Directive 2560 applies the FMFIA review requirements to financial, administrative, and program activities at all levels of the Agency and designates the Assistant Administrator for Administration and Resources Management as the Agency official responsible for assuring compliance with the FMFIA, GAO standards, and OMB guidance. EPA's "Internal Control Guidance for Managers and Coordinators" provides FMFIA implementation procedures to Agency officials. An agency component (i.e., assessable unit) is defined in OMB Circular A-123 as a major program, administrative activity, organization, or functional subdivision. EPA guidance requires 5-year Management Control Plans (MCP) which summarize the Agency's risk assessments, planned actions, and internal control evaluations to provide reasonable assurance that controls are in place and working. Assessable units are to include event cycles (i.e., functional areas within specific organizational subdivisions). MCPs should be updated annually and used by management to monitor risk assessment activities ensuring that scheduled actions actually occur. Necessary Internal Control Reviews (ICRs) and Alternate ICRs (AICRs) should be listed in MCPs, and should identify internal controls (i.e., control objectives and techniques) that need to be strengthened or streamlined. Based on the results of these reviews, management should implement required corrective actions on a timely basis. The contract management weaknesses identified in this report are material weaknesses which meet OMB's and EPA's materiality criteria for reporting to the President and Congress in conjunction with OMB Circular A-123 and the FMFIA. However, these weaknesses were never identified by 0ARM'S FMFIA process. We reviewed 0ARM'S assessable units (1204, 1210, and 1212) 1991 5-year MCPs (see chart below), and found they identified 12 sub- units for which AICRs were planned. Forty-six ICRs relating to those sub-units were scheduled for fiscal 1991. One hundred and 32 Audit MO. 11NKP1-15-0032-2100300 ------- thirty AICRs are planned for fiscal 199.' through 1996. No ICRs are planned for these periods, as shown below: OFFICE/ ASSESSABLE UNITS PCMD (1204) OIRM (1210) RTF (12:12) TOTAL REVIEW op FMFIA PROCESS FOR SELECTED OARM ASSESSABLE UNITS 5 YR. MANAGEMENT CONTROL PLANS2 1991 ICRs 0 0 AICRs 26 0 J.992-1996 ICRS 0 0 AICRS 35 0 BISK3 AICRS EVENT CYCLE RANKING MEDIUM MEDIUM 46 130 CONTRACT MANAGEMENT CONTRACT MANAGEMENT NONE MED/HIGH Based en this review of the 1991 MCPs, we found no completed or planned ICRs/AICRs specifically addressing the contract management weaknesses for the ADP support services contracts, except for one AICR planned in fiscal 1992 which will address the Facilities Management contract. Furthermore, this area may not be fully covered in any FMFIA reviews planned in the future, because no event cycles or control objectives and techniques expressly related to these weaknesses exist under 0ARM'S assessable units. We also examined 0ARM'S 1991 Annual Report on Internal Controls and found that no material weaknesses related to the ADP support services contracts were identified. We concluded that the material weaknesses presented in this report were not adequately addressed in the FMFIA evaluations. OARM has not determined that these areas are high risk activities and thus, had not (1) covered procurement administration weak- nesses identified in its event cycles or (2) scheduled a suf- ficient number of internal control-related reviews. While the event cyel.es for two of the three assessable units relate to contract management, the control objectives and techniques had The MCP listed a review category entitled "Other" reviews. This category does not meet the qualifications of an ICR or AICR, nor does this type of review contribute towards meeting FMFIA requirements. We found that the above assessable units have 11 reviews categorized as "Other" reviews which address, to a limited extent, ADP support services contracts. However, because these reviows do not contribute to FMFIA, we did not consider this category in our analysis. 3 The "HIGH" risk ranking refers to the National contract Payment Division sub-unit at RTP which would not be responsible for the administration of the ADP support services contracts. 33 Audit Mo. E1NMJ1-1S-0032-21003GO ------- not been established to cover the ADP support services contract weaknesses. During our review, the Financial Management Division's Internal Control Coordinator told us an ICR was planned for fiscal 1992 covering the Facilities Management contract. This ICR resulted from an recent OIG special review report entitled "Procurements Through The Waterside Mall Lessor," on the Waterside Mall Facilities Contract, and wts not listed in the 1991 MCP. The official added that the ICR w.ll be incorporated into the next MCP. CONCLUSIONS The major ADP support services contracts do not receive the requisite extent of coverage deserved under the FMFIA process. Considering these ADP support services contracts provide critical support for the EPA's mission and the magnitude of past and ongoing contract management problems, OARM needs to more adequately address accountability and control in this area within the FMFIA process. RECOMMENDATIONS We recommend that the Acting Assistant Administrator for Administration and Resources Management: 1. Establish an event cycle specific to the ADP support services contract management process and include the appropriate control objectives and techniques. 2. Update the risk assessment for 0ARM'S assessable units 1204, 1210, 1212 to more adequately account for the high risks associated with the ADP support services contracts. 3. Schedule a formal AICR specifically addressing adminis- tration of all major ADP support services contracts in the next MCP. AGENCY COMMENTS AND QIC EVALUATION In their response, Agency officials agreed to implement our recommendations and provided additional information. Their corrective actions are appropriate and should, when fully implemented, respond adequately to our recommendations. 34 Audit MO. E1NMJ1-1S-0032-2100300 ------- (This page was intentionally left blank.) ------- APPENDIX I REPORTS AND TESTIMONY RELATED TO EPA'» MANAGEMENT OF SUPPORT SERVICES QTG REPORTS 1. "Special Review Report of Procurements Through The Waterside Mall Lessor," report no. E6AMG1-13-0035-1400024, June 20, 1991. 2. "Audit of Region 8 Management of Computer Sciences Corporation Contract Activities," report no. E1XMF1-08-0033- 1100441, September 30, 1991. GAP REPORTS 1. "Stronger Management of EPA's Information Resources is Critical to Meeting Program Needs," GAO/RCED-80-18, March 10, 1980. 2. "EPA's Use of Management Support Services," GAO/RCED-82-36, March 9, 1982. 3. "The Environmental Protection Agency Should Better Manage Its Use of Contractors," GAO/RCED-85-12, January 4, 1985. 4. "Status of EPA's Contract Management Improvement Program," GAO/RCED-87-68FS, January 12, 1987. 5. "EPA Needs to Control Contractor Costs," GAO/RCED-88-182, July 29, 1988. 6. "The Environmental Protection Agency's Use of Consultants," GAO/T-GGD-89-5, February 3, 1989. 7. "Sound Contract Management Needed at the Environmental Protection Agency," GAO/T-RCED-89-8, February 23, 1989. 8. "Ineffective Information Management Impedes EPA's Enforcement Mission and Cross-Media Initiatives," GAO/T- IMTEC-91-16, June 19, 1991. 9. "Government Contractors: Are Service Contractors Performing Inherently Governmental Functions?" GAO/GGD-92-11, November 18, 1991. 35 Audit MO. B1NMJ1-15-0032-21003CO ------- (This page was intentionally left blank.) ------- uto UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, O.C. 20460 APPENDIX II MAR 271992 MEMORANDUM OWCEOf ADMINISTRATION AND RESOURCES MANAGEMENT SUBJECT! PROM: TOt Interim Response to Draft Audit Report No. E1NMF1-15-0032;/«^ Needs to Strengthen TheAquisitj Office of Information Resources agement Kenneth A. Konz Assistant Inspector General for Audit This memorandum responds to your correspondence to Mr. Christian Holmes of February 26, 1992. It represents the synthesis of comments from representatives of the Office of Information Resources Management, the Procurement and Contracts Management Division/ and the National Data Processing Division. As you know, these comments and the supporting information attached were extensively discussed by our respective staffs. I have attached to this memorandum several documents which provide our response to the draft report's specific findings, assertions and recommendations. I will use the remainder of this memorandum to address several matters of broad relevance to the report. The Agency'n fr^^lnistration of ADP Support Services Contracta Needs Improvement - I was pleased to note your reference to a number of significant actions that OIRN has undertaken to improve the IRM contract administration in general, and the TOSS DOs in particular. As the CSC audit has so graphically set* forth, much remains to be done, and as you know by the words and actions of Mr. Holmes, OARM and the Agency have mobilized to make the needed improvements. While we take exception to a number of the findings presented in this section, and find some of the assertions made inflammatory in light of their lack of factual basis, we agree that implementing Recommendations 1,2 and 3 will lead to both a Prmto 9* ------- -2- strongeir IRM program and strengthened contract administration. I disagree with Recommendation 4, and have provided additional documentation to describe the Facility Management Contract and the management and control apparatus in place to ensure that contract is effectively administered (Attachment C). I also have attached excerpts from an independent review of NCC by Nolan/ Norton (Attachment D) that indicates that NCC is managed on a cost and performance effective basis compared to other computing facilities of similar size. The Aoenev's Pre-.oUcitation Phase of the Acquisition Process for ADP Support Services Contracts is Not in Compliance with Federal ADP Procurement Requirements - I was pleased that you included reference to GSA's report of their 1991 review of EPA IRM operations and related contracting functions. As you know, the 1991 report found significant progress in implementing GSA's 1985 recommendations. The Agency has always taken seriously its management of the pre-solicitation phase for IRM contracts/ and our modern computing infrastructure is evidence of our success in this arena. Our position is that we have generally complied with the Federal Information Resources Management Regulations in the pre-solicitation phase as a matter of practice/ and continue to do so. OARM'a FMFIA Process Does Not Sufficiently Address The Risks Associated with the ADP Support Services Contracts - The size and scope of contracts employed by EPA to obtain IRM support services is significant. Your recommendations to formalize an-event cycle aind conduct reviews under OMB Circular A-123 are excellent/ and we will implement them. Th-ink you for the opportunity to comment on the draft report. Attachments 37 ------- ATTACHMENT A ESPONSC TO OKJ IMIAFT AUDIT REPORT Of 2/2M2 ON AOP SUPPORT SERVICES CONTRACTS a* CHAPTER 1 nfTflMMTJgJJAmAIM twri !-••• • j*nAaTsBsT in* •mw ^rMiTBAf*T MANDATORY AND FORMAL MM STANDARDS. PROJECT MAMAOCMINT GUMMNCE. AND COM REOUMEMENTS TO EFFtOCNUV MANACt ADP MimMT KNVICCS t WITH ACTS AMD MRMIMATMN WCOIMTf • MESrONSf/ ASSIGNMENT fufiMflnin AGREE/ DISAGREE •ABTI V Bt§fQH§t CLAUSE OF THE CPAAM Mf FEMCNCf » MANY OF THESE. MOST OF THESE MMCH RELATE TO DATA CAM M FOUND W THE AGENCY CATALOG OF DATA POUCKS AND •TANOAIMn MOST OF THE8C VWWH NClATt TO HANOWANE AND SOFTWARE CAN W FOUND IN THE MAFT EPA MM HAMDWANE AND SOFTWARE STANDARDS DOCUMENTS. THOSE RELATING TO USE OF THE CtNTHAL DATA BASE ENVMONMEMT CAN SE FOUND M THE Cf MTHAI f>ATA BA4F MAMAnrMFMT FHWMMIMMFIIT STANDARDS. THE EPAAN NEOUMES THAT CONTNACTOttS COMPLY WITH THESE NEOUMEMENTS. M ADDITION. WE ARE ACTIVELY UNDERTAWNO AN EFFORT TO HEWW MM POLICIES AND STANDARDS TO PUT M PLACE THE NECESSARY FRAMEWORK TO ENABLE THE AGENCY'S VALUABLE DATA RESOURCES TO BE MTEGNATED. OMM HAS ALREADY BEGUN THE PROCESS TO REVKW THE AGENCY'S UFE-CVCLE 0WDANCE. ONE OF THE KEY TENETS OF THE PROCESS • TO CLEARLY ESTABLISH MANDATORY MMMUM UFE-CVCLE REOUMEMENTS. A PROJECT MANAGEMENT PLAN FOR EACH SYSTEMS DEVELOPMENT PROJECT tt UKELV TO BE ONE Of THE MMIMtmi MANDATORY REQUMEMCNTS. WE WU. DEVELOP A TRAMMG PROGRAM ON MM POUOES AND STANDARDS. AND JOMTLV WITH PCMD. ENSURE CONTRACT ADMMISTRATION IS MCtUOfO M IT 09 ------- RESPONSE TO OKI OflAFI AUDIT REPORT OF 2/2«S»2 ON AOP SUPPORT SERVICES CONTRACTS U» «0 KCffMMENPATION? CHAPTER 2 TMi AOENCVS ADMMMTRATIOM OF ADT IUPPORT MRMMf* CONTROL* NEED* MPHOVBNBIT. HECOMMiNO AAJOAKM: tCONTMUBH . RESPONSE/ ASSIGMMCNT ACHCEf DISAGREE RESPONSE AN AREA WHICH WE MECOGMZE NEEDS IMPROVEMENT IS THAT OF COMPLIANCE WITH CURRENT HUM POLICIES AND STANDARDS. AS A RESULT. THE DIRECTOR Of OMM HAS FORMED A TASK CROUP WHOSE GOAL IS 'TO DEVELOP A PROCESS BY WHICH EPA'S MM POLKKS AND STANDARDS ARE INCORPORATED INTO ALL AGENCY SYSTEMS UNDER DEVELOPMENT ON ENHANCEMENT" AND WILL APPLY TO SYSTEMS DEVELOPED »Y PROGRAM OFFICES AND CONTRACTORS. TMS TASK CROUP HAS BROAO REPRESENTATION BY PROGRAM OFFICES. MM DIVISIONS. THE REGIONS. THE OOC AND THE INSPECTOR GENERAL. THE TASK GROUP WILL DEVELOP ITS RECOMMENDATIONS AND ISSUE ITS FINAL REPORT WITMN FIVE MONTHS. ------- • TO On DRAFT AUDIT REPORT Of 2/MSS2 ON HOT SUPPORT sERvicts CONTRACTS 1.1 « • ft CHAPTER! RECOMMEND AAJOARM; PERFORM A »TUOV TO MTEMMMf THE APPROPRIATE PROCURE MENT OFFICE »TAmN6 AMD AUTHOMTV TO AOMMISTER THE CURRENT AND PROPOSED AOP SUPPORT KMVKU CONTRACT*. rownoMS «nm AOP TECHMCAI MOU MoumfMiMTS CffMMtMUmATI WITH TMf WUU. If VEU MCEOCO TO TfCNMCAUV MOMTON THi OCVfUOTMBfr Of AOP DO* AMD OaJVENAMfS. Oil CONHOCM THi UK OF MOEHNDEMT CVALUATKW CONTMACTOM TO PUV OHM THt TECHMCAI MVKVM OF DO*. MfspoNsc; ASSIGNMENT rcMo gvmmA ACNCC; DISACKEE AGREE BfSEfiNH rCMO«MJ.rEMFONMTI«S STUDY. M AJMNTION. PCMO «MU MEVKW ITS fMSCNT AUOCATtOM OF NESOtMCES TO OETEMMNE f THEY AME OEP1OVED OfTMAUV. SHOULD THE STUDY MOICATE THAT AOOmONAL MESOUNCES AM NECESSANV. «M VMLL MEOUEST THEM THHOUGH THE MJOOCT PROCESS. WHICH TO CONDUCT AM MOCffMDEMT EVALUATION OF oo«4 AND suuk AN omiATMMiAL CAT AMJTY FOR ADT SUPPORT SERVICES TO INSURE SUFROENT TECHMCAL SKSJ. m AVAMASU. OMM PRESENTLY HAS ASSIGNED A SENIOR TECHNICAL MANAGER TO PERFORM TMS FUNCTION FOR THE MOSES CONTRACT. ------- RESPONSE TO (MO DRAFT AUDIT REPORT OF 2/2C/SZ ON ADP SUPPORT SERVICES CONTRACT* RESPONSE/ ASSICMMfNT AGREE/ DISAGREE RESPONSE CHAPTER 1 THEA00ICVS4 ITRATMN OF ADP SUPPORT 1.4 REVISf THf PROPOSEDF ACRJTKS MANAGEMENT RE- COMPETE RFP TO SPECIFY THAT THi MANAGEMENT WORK PLAN DEFINE M OFT AH THE ACnVfTKS. TASKS. AND RELATED COSTS TO M PERFORMED TO STRENGTHEN THE PERFORMANCE EVALUATION PROCESS. NOPO DISAGREE WE CANNOT AGREE TO REVISE THE FAOUTV MANAGEMENT RE-COMPETE RFP TO ACCOMPLISH THIS. AS OISCUSSEO IN DETAIL M ATTACHMENT C. WE FEEL IT IS INAPPROPRIATE TO HAVE THIS LEVEL OF COST INFORMATION CONTAMEO M THE MANAGEMENT WORK PLAN TASKS. TYPICALLY. ADP SUPPORT CONTRACTS AT EPA ARE FIKED-RATE. INDEFINITE DELIVERY/INDEFINITE QUANTITY* TYPE CONTRACTS. EFFORT UNDER THESE CONTRACTS IS INITIATED BY THE ISSUANCE OF DELIVERY ORDERS. OFTEN. THE ORDER EFFORT IS COMPLETION TYPE OR RESULTS M THE DELIVERY OF END-ITEMS. UNDER COMPLETION TYPE DELIVERY ORDERS. SPECIFIC ACCEPTANCE CRITERIA OEFME THE TERMS UNDER WHICH THE GOVERNMENT WCL ACCEPT THE EMMTEMISI. HOWEVER. UNLKE THE KMO COMPLETION TYPE CONTRACT. THE FACILITY MANAGEMENT SUPPORT CONTRACT IS A COST-PLUS-AWARD-FEE TERM CONTRACT. THE EFFORT INVOLVES SEVERARLE SERVICES, NOT END-ITEMS. RATHER THAN TANGIBLE. DISTINCT ACCEPTANCE CRITERIA. TMS SUPPORT CONTRACT EMPLOYS A METHODOLOGY RV WHICH CONTRACT SERVICES ARE SPECMED IN THE SCOPE OF WORK AND ARE ACCEPTED RY THE GOVERNMENT AT THE CONTRACT LEVEL. TMS METHODOLOGY PROVIDES THE NDPO POLICIES AND PROCEDURES. NOPO PROJECT PLANS. TRIMESTER MANAGEMENT WORK PLANS. SERVICE REPORTING. PROJECT WORK ASSIGNMENTS. FORMAL EVALUATIONS BY THE NDPO TECHNICAL MONITOR. AND FWAUV. THE TRIMESTER EVALUATION AND AWARD FEE PROCESS. THEME ARE SPEOFK PROCEDURES FOR GOVf HNMENT FURNISHED EQUIPMENT IGFEI AND CONINACT ACOUMEO EQUIPMENT 4CAEI WMCH REQUIRE CON1RACTMG OFFICER APPROVAL. ------- RESPONM TO 010 DRAFT AUDIT REPORT OF 2129192 ON ADP SUPPORT WRVICtS CONTRACTS »t a.a (^COMMENDATIONS CHATTER 1 ACOUHfTKM PROCCM FOR AOT SUPPORT SERVICE* CONTRACTS) • HOT M COMPLMRM WHIN FEDERAL ADP irrnftniffflT ftftftmiw M-uttr TltT *MlfeA * 1 WfMT ftFUWIff ft IIPA fitMntf* ¥O fllOVOf DETAUD COST GIMDANCf ON HOW TO CONDUCT AM ALTCHMAT1VES ANALYSIS AND TO MAKE THE OUTKS AND MSTONSIMJTIU CONSISTENT «MTM QCAt OUDANCC ESTAMISM MOCEDUMS TO ACCUMUI ATE COSTS ON AOP surroNT SUVKES COMTNACTS ron in ADP EOUPMENT. |2| MOrMETANV SOFTWARE. |3| MAMTENANCE SfKVKES. Ml AOT SCMVICES. AND |6| AOT SUTTONT SENVKES TO ENSURE THAT THE ACENCV OBTAMS MEOUMEO AITMOVAtS FHOM OSA. RESPONSE/ ASSfiMMiHT jMurn OMM AGREE/ DISAGREE 9AATI V •ABTI V RiSfPNSf AREAS THE FIRST AREA IS TO PROVWf DFTAKED COST CINDANCC ON HOW TO CONDUCT AN ALTERNATIVES ANALYSIS. THE DOCUMENT ADEQUATELY REFLECTS THE FMMH A-M AND A-T* GINDANCE ON THE COST GUIDANCE ON HOW TO CONDUCT AN ALTERNATIVES ANALYSIS. WE WfcL MAKE MORE EXTUCfT — REFERENCES TO THIS CINDANCC M THE CUOC THE SECOND ARE A IS TO MAKE THE OUTKS AND RESPONSMJTIES CONSISTENT WITH OSA'S GINDANCE ON HAVMa THE AGENCY HtOCURCMENT REQUESTS IAF1W ATfROVEOSV THE HEAD OF CONTRACTS INSTEAD OF THE OIRM DMECTOR. OMM, NDTO. AND fCMD WILL MEET ON THIS ISSUE. A FORMAL REPORT WLL RE rROOUCfO OOCUMENTMC THE ANALYSIS AND THE RECOMMENDED ACTIONS. fttlffl ATHMM Aff MIA VAaTM rt^fWBAt^Wtn AffAtlMf AJFMT WE WN4. ENSURE THAT AC 1 UAL COSTS FOR THE FIVE CATEGOfUES CITED WHJ. K ACCUMULATED OURMG THE ADMNOSTRATION OF AGENCY AOT SUPPORT SERVICES CONTRACTS. PROCEDURES WKi. RE PUT INTO PLACE SO THAT THESE ITEMS WILL RE REVKWEO AND APPROVED TAKING INTO ACCOUNT EACH CONTRACTOR'S CEJUNGS AND THE AGENCY'S OVERALL AUTHORITY. K) ------- RESPONSE TO OKI DRAFT AUNT REPORT OF 2119192 ON ADP SUPPORT SERVICES CONTRACTS J.9 — «- CHAPTER 3 TIC AOENCVS PRE-SOUOTATKNI Hiftlt OF TMI CONTRACTS M) NOT IN COMPUANCC WHIN F8WRAL AIM* RECOMMEND AA/OARM: CONDUCT A REQUIREMENTS ANALYSIS. INCtUOINO AN ANALYSIS Of ALTf MNATIVCS BASED ON COST AND PRESENT VALUE OF MONEY. FOR THE MOSES CONTRACT TO DCTERMMK THE MOST COST-EFFECTIVE ACQUISITION ALTERNATIVE. AND ENSURE THAT THE GSA REOUMEMEMTS ARC SATBflBD. RESPONSE/ ASSIGNMENT 0«RM AGREE/ DISAGREE PARTLY *i \ RlSPOftSE THROUGH THE FORMATION OF A TASK FORCE. AT LEAST THREE RETREATS WITH VARIOUS PROGRAM OFFICES FROM AROUND THE AGENCY. MANY MEETINGS. AND AT LEAST ONE WRITTEN SURVEY OF NEEDS. A REQUIREMENTS ANALYSIS FOR MOSES WAS CONDUCTED. ALTHOUGH THE REQUIREMENTS ANALYSIS WAS NOT FORMALIZED IN THE SPECIFIC FWMR FORMAT. OMM RELIEVES THAT THE •SPIRIT* OF THE REGULATION WAS MET. ALL ASPECTS OF THE PROPOSED MOSES CONTRACT' WERE REVKWED AND DISCUSSED. AND ALTERNATIVES WERE ANALYZED AND CONSDCRED. OMM WMJ. DOCUMENT THE RESULTS OF TMS MAJOR EFFORT M A FORMAL REQUIREMENTS ANALYSIS AND ANALYSIS OF ALTERNATIVES. ------- RESPONSE TO 0*0 DRAFT AUDIT REPORT OF 2/2M2 ON ADP SUPPORT SERVICES CONTRACTS a.4 — — •— CHATTtlll TNK AttMCV^S MH^CUCVfAYKMI PMAfll 4V TMB QOMIMhCro H MOV M CO8Bm^tt(CB MWt MD8MAL ADP MCOMMENDAAIOARM; MVISf THf ALTERNATIVES ANALYSIS PRESENTED M THE MOUMUMENTS ANALYSIS FOR THE PROPOSED FACMJTKS MANACf Mf NT M COMTFTE CONTRACT TO CMT ArmomuTE ALTENNATIVES USMC THE MESENT VALUE OF MONEY AND TO MELT ENSURE THAT THE SELECTED ACOWSmON STWATEOV MfmCSENTS THE LOWEST OWENAU. COST TO THE OOVEMNMENT. MESPONSC/ ASSIGNMENT NOTO AGREE/ DISAGREE PANnV RESPONSE WE HAVE fUET AMEO THE ALTENNATIVE ANALYSIS COWIECTLV mWM SiMPAIIT MM tO 1 OtNOFlMfS STATf THAT M THE ANALYSIS Of ALTEHNATMCS. ACENOES SHALL CALCULATE THE TOTAL ESTMATED COSTS. USMQ THE mESENT VALUE OF MONEY. KM EACH FEASMLE ALTEMMTIVE. M THE ALTEMNATIVE ANALYSIS WMKH WAS DONE. ETA FOLLOWED FMM IO1-M.2 WMCH USTS TNI MMMUM SET OF ALTENNATIVES THAT MUST M COttMOEMD. THE ONLY ALTENNATIVE WMCH COULD K CONSKEHED FCASMLE WAS "USE Of COMMCMOAL Hf SERVICE*. THIS ALTERNATIVE WAS EXAMMEO WHEN EM ORIGMALLY DK> THE A->« STUDY WHKH RESULTED IN CONSOUDATINO A CONTRACTED COMMERCIAL SERVICE MTO THE CURRENT OOVERNMEMT-OWNED COMTRACTOR-ONRATED IOOCO) COMTUTER CENTER. SRICE THAT TME. NONE OF THE PARAMETERS THAT WOULD AFFECT THE DECISION HAVE CHANCED. COMMERCIAL FROCESSRIO » NOT FEASHtf DUE TO THf MAM FACTOR OF A IAROC CAflTAL INVESTMENT REOUMED TO ESTARUSH SUCH A SERVICE. ADDITIONALLY. THERE WOULD M A LOSS OF CONTROL OF SUCH ITEMS AS SECURITY AND RESOURCES. WE WILL DO AN ADDITIONAL STUDY TO LOOK WTO THE ALTERNATIVE OF SFUTTMC THE FACUTV MANAGEMENT CONTRACT MTO MULTVU CONTRACTS AND MULTTLE CONTRACT TYPES. ------- RESPONSE TO OKI DRAFT AUDIT REPORT OF 7/ZC/92 ON ADP SUPPORT SERVICES CONTRACTS in RECOMMENDATIONS CHAPTER 3 t PREPARE THE REQUMED INFORMATION ON THE TOSS ACQUnmON ALTERNATIVES ANALYSIS AND SUBMIT IT TO GSA. ESTABLISH INTERNAL CONTROLS. IN ADDITION TO THE •MM SUPPORT SERVICES DPA GUIDE.' TO ENSURE THAT THE PRESCRMED REOUMEMENTS ANALYSES ARE PROPERLY DONE ON ALL FUTURE PROCUREMENTS OF FIP RESOURCES. RESPONSE; ASSIGNMENT OWM OHM AGREE; DISAGREE DISAGREE AGREE IT IS OUR POSITION THAT THE ALTERNATIVES ANALYSIS WAS INCORPORATED WITHIN THE REQUMEMENTS ANALYSIS DOCUMENT PREPARED FOR TOSS IN AUGUST ISSS. THB ANALYSIS WAS NOT EXPLICITLY LABELLED AS AN ALTERNATIVES ANALYSIS. SO WE HAVE REQUESTED GSA TO OENTIFY ANY ISSUES CONCERNING THE TOSS DPA. AND WILL RESPOND TO ANY ISSUES THEY MAY RAISE. AN AGENCY PROCUREMENT REQUEST FOR THE PC MAINTENANCE PORTION OF THE TOSS CONTRACT WAS PREPARED AND FORWARDED TO GSA ON SEPTEMBER JO. IMS. A DELEGATION OF PROCUREMENT AUTHORITY WAS GIVEN TO EPA FOR TOSS ON OCTOBER 1 1. ISM. THIS DELEGATION WAS CONTIGENT ON PROVKNNG ADDITIONAL ••FORMATION. THE MFORMATION WAS PROVIDED TO GSA ON JANUARY 1O. 1MO. INTERNAL CONTROLS WILL BE ESTABLISHED. M ADDITION TO THE 'MM SUPPORT SERVICES OPA GMDE*. TO ENSURE THAT THE PRESCRMED REQUMEMENTS ANALYSIS IS PREPARED CONSISTENT WITH FMMR REQUMEMENTS ON ALL FUTURE PROCUREMENTS OF FT RESOURCES. ------- RESPONSE TO (NO DRAFT AUDIT REPORT OF 20*192 ON ADP SUPPORT SERVICES CONTRACTS 4.1 4 2 4 1 CHAPTER 4 MCOMMENDAAIOAM* ESTABUSH AN EVENT CYCLE SPECIFIC TO THE ADP SUPPORT SERVICES CONTIIACT AOMMBTMATION rnocf ss AND Mctum TMB AfmorMATE CONTMOI OBJECTIVCS AND TECHNMMJU. UfOATE THE MSK ASSESSMENT FON OAHM*S AOCOUATEtV ACCOUNT FON THE MCH WSKS ASSOOATED OHTM THE AOT SUffOUT SENVKES CONTMACTS. THE AOMMBTMATION OF AU. MAJON SUTfONT SENVKES CONTIIACTS M THE NEXT ttCf. RESPONSE; ASSIGNMENT ONIM OMM mftM AGREE/ DISAGREE ACME AGREE * Ksnutsf rso cmmENTLV HAS AN EVENT CYCLE SKOFIC TO AOMMSTRATtON OF THE MOSES CONTRACT. THIS CYCLE VMU. H MERGED MTO AN EVENT CYCLE CMATCO TO COVEN AU OF OAMTS AOT SUPPONT SERVICCS CONTRACTS. meat ARXFJMMFfm MM i •* iiMkAnn mfttrtttm IMTII THB MECOMMENOATION. 0> ------- (This page was intentionally left blank.) ------- APPENDIX III ABBREVIATIONS ADP Automatic Data Processing AICR Alternate Internal Control Review APR Agency Procurement Request AREAL Atmospheric Research and Exposure Assessment Laboratory CSC Computer Sciences Corporation DO Delivery Order DOPO Delivery Order Project Officer DPA Delegation of Procurement Authority EPAAR Environmental Protection Agency Acquisition Regulation FIP Federal Information Processing FMFIA Federal Managers' Financial Integrity Act GAO General Accounting Office GSA General Services Administration ICR Internal Control Review IFMS Integrated Financial Management System IRM Information Resources Management MCP Management Control Plan MOSES Mission Oriented Systems Engineering Support MPES Management Planning and Evaluation Staff NCC National Computer Center NCPS National Contract Payment System NDPD National Data Processing Division 47 Audit NO. BlHXri-15-0032-2100300 ------- APPENDIX III NIST OIG OIRM 0PM OTS PCIE PCMD PO RACF RDMS RFP RTP SASIAS SOW TOS.'J National Institute of Standards and Technology Office of Inspector General Office of Information Resources Management Office of Personnel Management Office of Toxic Substances President's Council on Integrity and Efficiency Procurement and Contracts Management Division Project Officer Resource Access Control Facility Relational Database Management Systems Request For Procurement Research Triangle Park, North Carolina Scientific Applications, Statistical Support and Laboratory Automation Services Statements of Work Technical and Operational Support Services Audit MO. E1NX71-15-0032-2100300 ------- APPENDIX IV OF REPORT Inspector General (A-109) Acting Assistant Administrator for Administration and Resources Management (PM-208) Director, Financial Management Division (PM-226) Comptroller (PM-225) Agency Follovup Official (PM-225) Attn: Director, Resource Management Division Agency Follovup Official (PM-208) Audit Follovup Coordinator (PM-208) Attn: Program Operations Support Staff Associate Administrator for Regional Operations (A-101) 49 Audit HO. B1NX71-15-0032-2100300 ------- |