Risk & Controls Self-Assessment Program

Performance Work Statement (PWS)

To strengthen Ginnie Mae's Risk and Controls Self-Assessment (RCSA) Program, promoting an enterprise-wide holistic view of operational and IT risk, and ensuring a risk-informed approach to internal controls.

The contractor shall provide program management support for the enhancement and execution of the RCSA Program across Ginnie Mae's eight offices. This includes identifying, assessing, reporting, and monitoring risks and controls associated with operational processes, people, systems, and external events. Key activities include:

• Reviewing and analyzing governance documentation, manuals, and other materials.

• Updating Process Flow Charts, Risk Register Control Matrices, and Narratives annually.

• Supporting RCSA Program Execution, Annual Maintenance, and Special Projects.

• Performing individual assessments and reviews in all eight Ginnie Mae offices.

• Supporting the Operational Risk Analysis Division (ORAD) in determining risks, gaps, and mitigation strategies.

• Project Work Plan (PWP) must be accurate, up-to-date, and accessible, including all significant activities and milestones.

• Scope assessments must be thorough, accurate, and completed within specified deadlines.

• Weekly Status Reports and Meeting Minutes must be completed, delivered, accurate, and actionable.

• Deliverables must conform to established requirements with minimal revisions for spelling and grammatical changes.

• AQL (Acceptable Quality Level) is zero deviation unless agreed upon by all parties.

• Period of Performance: 12-month base period with four 12-month option periods.

• Place of Performance: Contractor's facility.

• Non-Personal Services: Government will not supervise contractor employees or control methods.

• Qualifications: Primary and/or Sub-Contractor employees must possess relevant industry certifications (e.g., CPA, CISA, CIA, PMP, CISSP, CISM, CRISC).

• Personnel: Contractor shall designate a Project Manager and alternate PM as Key Personnel.

• Transition: Requires 30-day transition-in and transition-out services.

• Compliance: Adherence to Federal Managers’ Financial Integrity Act, GPRA Modernization Act, FISMA, PIIA, Federal Agency Performance Act, OMB Circulars (A-123, A-11, A-136), COSO ERM Framework, GAO Standards, NIST Cybersecurity Framework, NIST SP 800-53, HUDAR, FAR, and other relevant regulations.

• Deliverables: Numerous deliverables are specified, including Project Work Plans, Scope Assessments, Status Reports, various RCSA documentation (flowcharts, risk registers, reports), testing results, and transition plans.

Sources Sought Notice

This Sources Sought Notice (SSN) is issued by the Department of Housing and Urban Development (HUD), Ginnie Mae Office of Enterprise Risk, Operational Risk Analysis Division (ORAD) to conduct market research for a Risk and Controls Self-Assessment (RCSA) Tool Services requirement. The goal is to identify potential vendors capable of providing services to identify, assess, report, and monitor risks and controls associated with operational processes, people, systems, and external events. The results will help determine the procurement method.

• Services to identify, assess, report, and monitor risks and controls.

• Annual review, analysis, and assessment of governance documentation, manuals, and other materials from Ginnie Mae's eight offices.

• Updating Process Flow Charts, Risk Register Control Matrices, Narratives for each Office, and other RCSA documents.

• Support services include Project Work Plan, Transition Services, RCSA Program Execution, RCSA Annual Maintenance, and Special Projects.

• Specific tasks and deliverables are detailed in Section 5 of the Draft PWS.

• NAICS Code: 541611 – Administrative Management and General Management Consulting Services (Size Standard: $24.5M).

• PSC Code: R408 Program Management Support.

• Seeking contractors holding MAS SIN 541611.

• Contemplated place of performance: Contractor's facility.

• Contemplated dollar value: N/A.

• This is a request for capability information, not a request for proposals.

• Vendors should provide information highlighting competencies, differentiators, and past performance.

• Specific certifications required include CPA, CISA, CIA, CFE, COSO, CGFM, PMP, CISSP, CISM, CCSP, CRISC, CORP, and Cybersecurity risk-related certifications.

• Vendors must provide: organization name, address, email, website, phone number, size, and ownership type.

• Tailored capability statements addressing the effort, with supporting documentation, are required.

• Address anticipated subcontracting or teaming arrangements.

• The government will evaluate market information for capacity, resource application, project management plan implementation, and performance-based acquisition capability.

• Interested potential offerors must specify: UEI, business size (NAICS), socioeconomic categories, GSA contract number (if applicable), and GWAC numbers.

• Responses may lead to a set-aside for socio-economic programs, small business competition, full and open competition, or GSA procurement.

• Submission Deadline: April 30, 2026, on or before 2:00 PM EST.

• Submission Method: Email responses to Cheri Redding (Cheri.L.Redding@hud.gov) and Diane Toledo-Gaskins (Diane.e.Toledo-Gaskins@hud.gov).

• No telephone inquiries will be accepted.

• Contracting Officer: Cheri Redding.

• Contract Specialist: Diane Toledo-Gaskins.