Internal Control Program Management System

This amendment is issued to clarify the government’s request for information regarding the Internal Control Program Management System.

To support our market research and requirements development, we request that vendors provide a capabilities statement and respond to as many of the specific questions listed in this RFI description as possible. Your input will help us better understand available solutions and inform us better on this requirements.

Please continue to submit your information as the end date has not changed. It is still 03 April 2026

Thank you for your cooperation and support.

Internal Control Program Management System

Customs and Border Protection (CBP) is looking to acquire, develop, and implement either a Commercial Off-The-Shelf (COTS) or tailored solution to automate the current manual workload of managing large amounts of repetitive control and testing data across an estimated 90+ Microsoft Excel workbooks with around 165 individual excel tabs. Once developed, this tool would facilitate collection of all Office of Management and Budget (OMB) Circular A-123 control data in one central location and populate deliverables for submission to Department of Homeland Security (DHS) Risk Management and Assurance (RM&A), house the deficiency management process, and provide for management reporting. Currently the Audit Oversight and Internal Controls Division utilizes a mix of Microsoft products (Excel, Power BI, PowerApps, etc.) to manage this workload.

1. What is the pricing model for your solution? Are licenses required for all user types?
2. How is the software hosted? If cloud hosted, is it Federal Risk and Authorization Management Program (FEDRAMP) certified?
3. What are the technical requirements for your solution?
4. What options do you have available to ingest and leverage defined templates from an outside source (for example, Department of Homeland Security defines the data elements that must be populated and reported on)? What options are available for exporting information into user defined templates? How easily modifiable are these capabilities should the defined templates change (new fields, remove fields, new risks/control objectives, etc.)?
5. What options for management reporting and dashboarding are available in your solution? Are they easily customizable and/or modifiable?
6. Describe how your solution integrates with Microsoft PowerApps and other Microsoft products (SharePoint, Teams, Outlook).
7. Describe user interface options available.
8. Does your solution facilitate the various phases of an internal control program (walkthrough, Test of Design and Test of Effectiveness test plans, deficiency management, reporting)? If so, please describe capabilities for each phase included.
   • Test of Design (TOD)
   • Test of Effectiveness (TOE)
9. What real-time, in-application help is available on-screen (during a transaction)? Can in-application help be customized, and if so, how?
10. Does your application leverage any artificial intelligence (AI) models available to federal users, specifically to Department of Homeland Security and Customs and Border Protection users? If so, please describe how these capabilities are integrated into your solution.
11. Visually, what options do you offer to modify the format (or layout, structure) of your solution?
12. What maintenance requirements are needed for your solution?
13. Please describe your solution's integration capabilities with SAP ECC, SAP S4/HANA, SAP Business Warehouse and/or SAP Governance, Risk, and Compliance (GRC) Process Control.
14. Does your solution include version control for data housed within? If so, please describe document retention capabilities.
15. What user roles are used to manage your solution, for example, Administrator, Content Manager, Reports Only, etc.? Please describe each role.
16. What training, documentation, and support would you provide to Customs and Border Protection resources who will implement and support the solution?
17. Please describe the support your solution provides for mobile devices. Specifically, indicate which operating systems (for example, Apple iOS, Google Android) and device types (for example, smartphones, tablets) are supported, and whether the solution offers native mobile applications, responsive web interfaces, or other mobile access options.
18. What authentication methods does your solution support (for example, username/password, multi-factor authentication, certificate-based authentication)? Does your solution integrate with Single Sign-On (SSO) platforms? Please describe the Single Sign-On capabilities and any limitations.
19. Does the solution have the ability to ingest control population datasets (for example, manual upload, system interface, data connection, etc.) and determine samples using different methods (random, judgmental, etc.)? If so, please describe the capabilities.
20. Does the system have the ability to generate emails, due outs, and reminders to process owners for Test of Design/Test of Effectiveness Provided By Client (PBC) items to include tracking completion and storing responses/documents? If so, please describe the capabilities.
21. Does the solution have the ability for workflows for the testing of a key control to include both internal (internal control team) and external users (program offices responsible for providing Provided By Client items)? If so, please describe the capabilities.
22. Can the solution automate or perform certain testing plans on behalf of the internal control assessment team? If so, please describe capabilities and provide examples.