CMS Enterprise Risk Management (ERM)

This acquisition was conducted under the authority of the Multiple-Award Schedule Program in accordance with FAR 8.405-6(c). The Office of Strategy, Performance, and Results is responsible for the establishment and management of the Centers for Medicare and Medicaid's (CMS) Enterprise Risk Management Program (ERM). The ERM Program was established in 2020 as one of the Chief Operating Officer's (COO) top priorities, further supported by the July 2016 Office of Management and Budget (OMB) Circular No. A-123 which mandates the Department of Health and Human Services (HHS) to have an ERM program. As an operating division of HHS, CMS, along with other operating divisions have established ERM to not only align with HHS program but also to realize similar benefits and value as the department. The ERM Program at CMS has made substantial progress since inception. To help guide the program direction and provide a structured process to approach risk management, CMS has developed an ERM Framework, Governance and Operating Model, grounded in the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. A CMS Enterprise Risk Profile has also been established by developing a CMS Risk Appetite and conducting a Top-Down Enterprise Risk Assessment. To help oversee the efforts of the CMS ERM Program, an Enterprise Risk Council (ERC) was established as a governing body and supported by the Office of the Chief Operating Officer and managed by the OSPR ERM Team. The ERM Program is in the middle of standardizing and integrating ERM across CMS, including developing risk responses for the identified CMS Enterprise risks; evolving the ERC, which is chaired by the Deputy Chief Operating Officer; expanding and socializing the CMS Risk Appetite throughout CMS; executing and scaling the Risk Advisors program throughout CMS; and tackling high-profile risk assessments for the CMS Chief Operating Officer and Deputy Chief Operating Officer. The avoidance of a disruption will allow CMS to continue to fully realize ERM across CMS. Further, it is essential to utilize and leverage the contractors deep understanding of interdependencies to ensure any changes are well targeted and minimize disruption to overall agency effectiveness, which will allow CMS Leadership a better awareness/understanding of the risks that threaten the achievement of CMS strategic objectives. The incumbent contractor has guided the OSPR ERM team with the activities mentioned above. The incumbent contractor has also been communicating and building relationships with stakeholders along with and on behalf of the OSPR ERM team for the past 3 years; these relationships and requisite knowledge is not quickly transferred, duplicated, or matured with a new contractor. The three years of constant connection, communication and dedication of the incumbent has led CMS to where the program is present day. If this program were to lose the incumbent before the program is at a point of transition, CMS would lose a preponderance of all the institutional knowledge, specific to developing the direction of the ERM Program at CMS. In addition, the relationships that have been built in the development/establishment of ERM within CMS would be difficult to replicate. Without the continued use of the incumbent's expertise, there is a major risk to the integrity of the ERM program. In the interest of economy and efficiency, the incumbent contractor needs to continue working with the ERM Program for the next 18 months at which point ERM is expected to have reached a point where a contract transition would not degrade the performance of the program and would be ready to be transitioned to a contractor for the next phases of integration and sustaining. It is the full intent of OSPR ERM that the ERM Program matures over the next 18 months to a point that consideration of competing the contract would be an option. The program, while still in an infancy stage, should be able to assume greater tasks and capabilities over the next year, allowing CMS to confidently say the program has reached initial operational capability. The Period of Performance for services is estimated to be September 24, 2023 - March 04, 2025.