oversight

Audit Report No. 20-AUD-06: NARA's Oversight and Management of Information Technology Contracts

Published by the National Archives and Records Administration, Office of Inspector General on 2020-03-31.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

 •a°m mt r OFF ICE of
           INSPECTOR GENERAL
               NAT I O NAL ARC H IVES


                                                                   March 4, 2020

TO:           David S. Ferriero
              Archivist of the United States

FROM:         James Springs
              Inspector General

SUBJECT:      Audit of NARA's Oversight and Management of Information Technology
              Contracts
              OIG Audit Report No. 20-AUD-06

This memorandum transmits the results of our final report entitled, Audit of NARA's Oversight
and Management of Information Technology Contracts. We have incorporated the formal
comments provided by your office.

The report contains seven recommendations, which are intended to strengthen the oversight of
the Office of the Chief Acquisition Officer, improve management of the Contracting Officer’s
Representative (COR) workforce, and strengthen implementation of the Federal Acquisition
Certification Program for Program and Project Managers. Your office concurred with all of the
recommendations. Based on your February 25, 2020 response to the final draft report, we
consider all the recommendations resolved and open. Once your office has fully implemented
the recommendations, please submit evidence of completion of agreed upon corrective actions so
that recommendations may be closed.

As with all OIG products, we determine what information is publically posted on our website
from the attached report. Consistent with our responsibility under the Inspector General Act, as
amended, we may provide copies of our report to congressional committees with oversight
responsibility over the National Archives and Records Administration.

We appreciate the cooperation and assistance NARA extended to us during the audit. Please call
me or Jewel Butler, Assistant Inspector General for Audits, with any questions.

Attachment

cc:    Debra Wall, Deputy Archivist of the United States
       William Bosanko, Chief Operating Officer
       Chris Naylor, Deputy Chief Operating Officer
       Micah Cheatham, Chief of Management and Administration
       LaVerne Fields, Chief Acquisition Officer
       Kimm Richards, Accountability
       United States House Committee on Oversight and Government Reform
Senate Homeland Security and Governmental Affairs Committee
                                              ■
                                              ~




Audit of NARA’s Oversight and Management of
       Information Technology Contracts

              March 4, 2020

      OIG Audit Report No. 20-AUD-06
                                                                                       OIG Audit Report No. 20-AUD-06


Table of Contents


Executive Summary ...................................................................................... 3

Summary of Recommendations................................................................... 4

Objectives, Scope, Methodology .................................................................. 7

Audit Results ............................................................................................... 10

   Finding 1. NARA Needs to Strengthen Oversight of the CAO’s Delegated
   Responsibilities and Authorities ....................................................................................10

   Recommendations..........................................................................................................12

   Finding 2.        Ineffective Management Controls over NARA’s Acquisition Workforce14

   Recommendations..........................................................................................................16

Appendix A – Summary of Monetary Results ......................................... 19

Appendix B – Acronyms............................................................................. 20

Appendix C – Prior Audit Recommendations ......................................... 21

Appendix D – Future Acquisition Audits ................................................. 24

Appendix E – Management Response....................................................... 25

Appendix E – Report Distribution List..................................................... 29




                                                        2
                                  National Archives and Records Administration
                                    Executive Summary
           Audit of NARA’s Oversight and Management of Information Technology Contracts
OIG Report No. 20 AUD 06                                                                                      March 4, 2020


Why Did We Conduct This Audit?                What Did We Find?
In the Audit of NARA’s Procurement            The National Archives and Records Administration (NARA) has not
Program (Audit Report No. 17-AUD-06,          ensured effective implementation of acquisition management roles
November 15, 2016), the Office of             delegated to the CAO in accordance with Services Acquisition Reform Act
Inspector General (OIG) identified            of 2003 (SARA). This occurred because executive management designed
significant weaknesses in internal controls   controls that weakened key authorities and responsibilities of the Chief
within NARA’s acquisition function,           Acquisition Officer (CAO), including exclusion of the CAO in advising
negatively impacting NARA’s contract          and assisting the agency head and other agency officials to ensure NARA
management. We also found a general           procurements supported the agency in achieving its mission. As a result,
lack of communication existed between         the CAO’s role functioned as a supervisory Contracting Officer, and lacked
the program areas of acquisitions and
                                              the entity-wide governance of acquisition activities as required. Without
information services.
                                              comprehensive management of acquisition activities that ensures agency
                                              executives are making informed strategic decisions, NARA risks
In addition, the OIG’s top ten
                                              experiencing procurement challenges, such as contract costs overruns,
management challenges have long
                                              duplicative projects, and poor contractor performance in a reactive instead
included improving project and contract
management, information technology (IT)
                                              of proactive manner.
security, and enterprise risk management.
                                              In addition, NARA lacks a comprehensive acquisition career management
We performed this audit to determine          (ACM) program that enhanced the acquisition workforce, and provided for
whether NARA provides effective               workforce planning, career paths and education and training. Specifically:
oversight and management of its IT                • CORs assigned to NARA’s most complex and critical IT contracts
contracts.                                            lacked appropriate certifications,
                                                  • training requirements for CORs did not comply with federal
                                                      guidelines, and
What Did We Recommend?
                                                  • NARA’s program/project manager certification program operated
We made seven recommendations                         under outdated guidance.
intended to strengthen the oversight of the
                                              This occurred because the CAO did not establish and maintain
Office of the Chief Acquisition Officer,
                                              acquisition management controls in accordance with federal policies.
improve management of the Contracting
Officer’s Representative (COR)
                                              During FY 2017 and FY 2018, NARA has spent over $90 million in
workforce, and strengthen implementation      contracting for major IT investments. However, CORs assigned to these
of the Federal Acquisition Certification      contracts did not meet the appropriate training and experience levels.
Program for Program and Project               Without an effective ACM program, NARA lacks assurance that its IT
Managers. Management concurred with           contracts are administered to deliver the best value possible to the
the seven recommendations, and in             agency.
response, provided a summary of their
proposed actions.

                                                             3
                                       National Archives and Records Administration
                                                                      OIG Audit Report No. 20-AUD-06


Summary of Recommendations

Finding 1: NARA Needs to Strengthen Oversight of the CAO’s Delegated Responsibilities and
Authorities

 Number Recommendation                                                           Responsible Office
 1         Ensure the CAO's delegated responsibilities and authorities as        Chief of Management
           outlined in NARA Directive 101, NARA Organization and                 and Administration
           Delegation of Authority, are reflected in the CAO's position
           description and performance plan.
 2         Ensure the Chief Acquisition Officer is adequately positioned to      Chief of Management
           regularly engage with NARA’s Management Team and senior               and Administration
           management in order to advise and assist the agency head and
           other agency officials to ensure the mission of the agency is
           achieved through the acquisition management activities.

 3         Establish and document an acquisition workforce strategic plan to     Chief Acquisition
           address achieving the objectives of key acquisition positions.        Officer in consultation
                                                                                 with the Chief of
                                                                                 Management and
                                                                                 Administration

Finding 2: Ineffective Management Controls over NARA’s Acquisition Workforce

 Number Recommendation                                                           Responsible Office
 4         Issue written guidance that requires appointment of Contracting       Chief Acquisition
           Officer’s Representatives with Level III certification for those      Officer
           contracts with major IT investments.
 5         Establish an appointment matrix to ensure consistent                  Chief Acquisition
           identification and assessment of risks for IT contracts.              Officer
 6         Issue written guidance to Contracting Officers that requires use of   Chief Acquisition
           the appointment matrix established in Recommendation 5 when           Officer
           determining the appropriate Contracting Officer’s Representative
           certification level.
 7         Revise Interim Guidance 810-2, NARA’s Implementation of               Chief Acquisition
           Federal Acquisition Certification for Program and Project             Officer
           Managers in accordance with the Office of Federal Procurement
           Policy, Revisions to Federal Acquisition Certification for
           Program and Project Managers, dated, December 16, 2013,
           including NARA’s implementation of reciprocal acquisition
           certifications.




                                                4
                          National Archives and Records Administration
                                                               OIG Audit Report No. 20-AUD-06


Background


The National Archives and Records Administration (NARA) is an independent agency created to
identify, protect, preserve, and make publicly available the historically valuable records of all
three branches of the Federal government.

In October 2016, the Archivist of the United States delegated authority to NARA’s Chief
Acquisition Officer (CAO) to advise and assist in establishing appropriate business strategies to
achieve the agency’s mission and performance objectives, and to ensure acquisition planning and
contract management processes were integrated into agency strategic and operational planning
processes. NARA officially appointed its first CAO in September 2017. The CAO reports to the
Chief of Management and Administration (CMA).

Other CAO duties include leading agency-wide acquisitions policy, planning, and operations.
CAO responsibilities also include the training and professional development of the acquisition
workforce.

The Office of the Chief Acquisition Officer (O/CAO) performs all of NARA’s large contracting
functions, including contract management, and manages the NARA purchase card program and
interagency agreements.

NARA Acquisition Workforce Roles and Responsibilities
Acquisition Contract Support
Acquisition contractors provide support to NARA in the areas of acquisition process
management support, acquisition policy development assistance, technical and contracting
support, acquisition training support, technical evaluation assistance, and automated acquisition
system support. NARA has received acquisition support from contractor employees since 2005.

Contracting Officer/Contract Specialist (CO)
A Contracting Officer is responsible for ensuring performance of all necessary actions for
effective contracting, ensuring compliance with the terms of the contract, and safeguarding the
interest of the United States in its contractual relationships.

Contracting Officer’s Representatives (COR)
COR responsibilities include the day-to-day contractor oversight such as providing technical
direction, resolving problems, monitoring contract performance, and verifying invoices for
payment.

                                               5
                         National Archives and Records Administration
                                                                       OIG Audit Report No. 20-AUD-06



Program/Project Manager (P/PM)
P/PMs ensure that performance requirements are appropriately written, standards are established,
and contractors deliver what they promise. P/PMs also lead integrated project teams and oversee
contractual budgeting and governance processes.

Other Acquisition Roles
Individuals who directly manage CORs and P/PMs are also members of the acquisition
workforce. 1

NARA Information Technology (IT) Acquisition Costs
NARA relies extensively on IT systems to accomplish its mission. In fiscal year (FY) 2017 and
FY 2018, NARA obligations for contracted services and supplies totaled $255 million2 and $268
million, respectively. Of these amounts, $115 million (45%) in FY 2017 and $111 million (42%)
in FY 2018 were for NARA IT investments. 3


Prior Audit of NARA Procurement Program
In the Office of Inspector General’s (OIG’s) prior Procurement Audit, 4 we indicated NARA
needed to give critical attention toward strengthening internal controls over its acquisition
functions, providing better oversight and management of its procurement activities and ensuring
effective and efficient processes and procedures adhere to federal and internal acquisition
policies. Our prior audit report included 26 recommendations intended to strengthen the
management, accountability, and oversight of the Procurement Program.

While NARA officials generally agreed with the recommendations, we found during this audit,
acquisition management closed 7 of the 26 audit recommendations (see Appendix B).




1
  Office of Federal Procurement Policy (OFPP) Policy Letter 05-01, Developing and Managing the Acquisition
Workforce, April 15, 2005.
2
  NARA data for obligated amounts obtained from USASpending.gov.
3
  NARA data for IT investments obtained from OMB IT Dashboard.
4
  Audit Report No. 17-AUD-06, Audit of NARA’s Procurement Program, November 15, 2016.
                                                  6
                            National Archives and Records Administration
                                                                           OIG Audit Report No. 20-AUD-06


Objectives, Scope, Methodology

Objectives
The objective of this audit was to determine whether NARA provides effective oversight and
management of its IT contracts. Specifically, determine whether NARA monitored contractor
performance according to federal requirements and guidance, NARA policies and procedures,
and the terms of the contract.

Scope and Methodology
To accomplish our objective, we examined the control environment of acquisition leadership at
NARA and the extent and effectiveness of the internal controls over the acquisition workforce
responsible for monitoring contractor performance. We further sampled certain contracts to
further determine the effectiveness of those controls. We did not assess the use of contractor
performance ratings and past performance information, or NARA’s responsibilities for
performance reporting requirements.

We identified relevant federal statutes and policies; and NARA policies, procedures, and
guidance regarding oversight and management of IT contracts. We judgmentally selected 5 seven
IT contracts active during FY 2017 and FY 2018 to examine contract oversight and management
activities (see Figure 1). In addition to contracts reviewed, we surveyed nine CORs assigned to
oversee the performance of those contracts.

Figure 1: OIG Audit Sample of NARA IT Contracts
                                                                                                        Contract
    Contract Number                                Contract Description
                                                                                                       Award Value
                           NARA Information Technology & Telecommunication Support
    NAMA-14-G-0003                                                                                       $55,949,260
                           /Help Desk
    NAMA-13-F-0141         NARA Integrated Siebel Program Support Services                               $32,425,249
                           Executive Office of the President (EOP) instance of Electronic
    NAMA-15-F-0141                                                                                       $25,781,256
                           Records Archive Data Migration
                           National Archives Catalog and Description and Authority
    NAMA-16-G-0005                                                                                       $17,333,283
                           Systems
    NAMA-15-G-0007         Enterprise Cloud Services                                                     $15,098,999

    NAMA-16-F-0055         Oracle License Support                                                         $8,459,987



5
 This sampling approach is a non-statistical technique of which audit results cannot be projected to the population
of contracts at NARA.
                                                    7
                              National Archives and Records Administration
                                                                             OIG Audit Report No. 20-AUD-06


    NAMA-16-G-0007           History Hub (Pilot Project for External Collaboration Network)                    $540,134
    Total Sample
                                                                                                            $155,588,164
    Amount
Source: NARA CAO


We interviewed NARA officials including the Chief Acquisition Officer, Chief Information
Officer (CIO), Contracting Officers, CORs, Program and Project Managers, and others who have
key roles, such as COR supervisors. To gain an understanding of contract monitoring processes,
procedures, and relevant data, we observed acquisition information systems for project
management, contract writing, and acquisition workforce management, for example, Clarity, the
Procurement Request Information System for Management (PRISM), and the Federal
Acquisition Institute Training Application System (FAITAS). We performed limited verification
of the information generated by these systems, including contract data made available to the
public.

Internal Controls
We reviewed the agency’s internal controls relating to the oversight and management of IT
contracts. Our assessment identified significant deficiencies with both the design,
implementation, and operation of controls over acquisition activities, particularly with the
CAO’s efforts to coordinate, collaborate, and communicate across NARA business areas, and
meet the requirements to provide effective oversight and management of the acquisition
workforce responsible for monitoring contractor performance. The Government Accountability
Office’s (GAO’s) Standards for Internal Controls in the Federal Government provided the basis
for which we identified the weaknesses in NARA's acquisition controls. We assessed compliance
of internal procedures and processes with federal acquisition laws, regulations, and policies;
management of the acquisition workforce, including acquisition training and certification
programs; and data management needed for contract activities, including the documentation of
contractor performance. Our assessment showed that NARA’s controls were not properly
designed, implemented, or operating effectively.

This performance audit was conducted in accordance with generally accepted government
auditing standards between April 2017 and December 2018 6 at Archives II in College Park,
Maryland. The generally accepted government auditing standards require we plan and perform
the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings
and conclusions based on our audit objectives. We believe the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit objectives.




6
    Due to the expansion of the audit scope and other circumstances, the audit was significantly delayed.
                                                      8
                                National Archives and Records Administration
                                                          OIG Audit Report No. 20-AUD-06


The audit was conducted by Sonya Zacker, Senior IT Program Auditor, and Teresa Rogers,
Senior Program Auditor.




                                             9
                       National Archives and Records Administration
                                                                          OIG Audit Report No. 20-AUD-06


Audit Results


Finding 1. NARA Needs to Strengthen Oversight of the CAO’s Delegated
           Responsibilities and Authorities

NARA has not ensured effective implementation of acquisition management roles delegated to
the CAO in accordance with the Services Acquisition Reform Act of 2003 (SARA). 7 This
occurred because executive management 8 designed controls that weakened key authorities and
responsibilities of the CAO, including exclusion of the CAO from advising and assisting the
agency head and other agency officials to ensure NARA procurements support the agency in
achieving its mission. As a result, the CAO’s role functioned as a supervisory Contracting
Officer and lacked the entity-wide governance of acquisition activities as required. Without
comprehensive management of acquisition activities to ensure agency executives are making
informed strategic decisions, NARA risks experiencing procurement challenges, such as contract
costs overruns, duplicative projects, and poor contractor performance in a reactive instead of
proactive manner.

SARA states acquisition management is the primary duty of a CAO and they shall advise and
assist the agency head and other agency officials to ensure the mission of the agency is achieved
through the management of the agency’s acquisition activities.

In addition, the SARA statutory provisions outline seven functions for which CAOs are required
to perform in their capacities. These functions include: (1) monitoring and evaluating
performance of acquisition activities, (2) increasing the use of full and open competition, (3)
increasing performance-based contracting, (4) managing agency acquisition policy, (5) making
acquisition decisions, (6) ensuring acquisition career management, and (7) planning acquisition
resources. SARA also requires the head of each agency to designate a Senior Procurement
Executive (SPE) responsible for management direction of the agency’s procurement system.

In October 2016, NARA adopted into policy the statutory provisions for the CAO and SPE
positions, and appointed the current CAO on September 17, 2017. The CAO has broad authority
through this policy to designate NARA’s SPE. The CAO had retained the SPE role and
responsibilities up until NARA’s recent addition of an SPE. 9

7
  While NARA is not mandated to have a CAO, they have chosen to implement the role. OFPP stated in an October
18, 2012 memo that non-CFO Act agencies should update their policies, as appropriate, to clearly define acquisition
leadership roles and responsibilities at the agency.
8
  Executive management includes senior executives reporting directly to the Archivist and Deputy Archivist.
9
  Subsequent to our fieldwork, on October 15, 2019, NARA appointed a SPE.
                                                   10
                              National Archives and Records Administration
                                                                          OIG Audit Report No. 20-AUD-06



In addition to having managed the role of SPE, the CAO also served as NARA’s Head of
Contracting Activity (HCA), Suspension and Debarment Official (SDO), Director of Small and
Disadvantaged Business Utilization (SADBUS) and Acquisition Career Management (ACM)
Program Officer, and Labor Compliance Advisor. However, executive management’s decision to
design controls that concentrated six additional key acquisition roles with the seven statutory
functions delegated to the CAO further complicated the CAO implementing these roles. This
contributed to challenges with Management enforcing accountability.

Although the CAO delegated some of the aforementioned roles and responsibilities, GAO’s
Standards for Internal Controls in the Federal Government indicates that senior management
retain ownership for fulfilling assigned responsibilities. 10 Rather than rebalance the workload or
increase resource levels, we found that NARA did not fully enforce accountability of the
delegated SARA provisions; and by lessening enforcement, the CAO was unable to demonstrate,
as a primary role, effective acquisition management in accordance with federal requirements.

Until NARA leadership addresses the concentration of acquisition management responsibilities
and establishes clearer lines of authority, the CAO cannot effectively implement acquisition
management roles in accordance with Federal and NARA guidance.

Acquisition Program Coordination and Collaboration
Per NARA Directive 101, NARA Organization and Delegation of Authority, the CAO shall
provide advice and assistance to the Archivist of the United States in establishing appropriate
business strategies to achieve the NARA mission and agency performance objectives, and shall
ensure NARA acquisition planning and contract management processes are integrated into
agency strategic and operational planning processes. We found no instances where the CAO
regularly engages with the Archivist. The CAO did not participate in either the Management
Team (MT) or Executive Leadership Team (ELT) meetings, while other C-level officials such as
the CIO, Chief Financial Officer (CFO) and senior executives such as the CMA were members
of the teams.

The ELT and MT generally meet with the Archivist to discuss the agency’s mission, vision, and
strategic direction. ELT meeting objectives entail working with the Archivist in conducting
activities that include, but are not limited to, defining NARA’s strategic direction and planning
for the achievement of the agency’s vision and strategic goals. Meanwhile, per their objectives
stated in the team’s charter, the MT regularly convenes to define the agency’s priorities, align
resources, and foster meaningful, ongoing communication across the organization. These



10
     GAO Standards for Internal Control in the Federal Government, 3.07
                                                    11
                               National Archives and Records Administration
                                                                           OIG Audit Report No. 20-AUD-06


meetings could have been opportunities in which the CAO could have advised and assisted the
Archivist of the United States.

When we raised concerns about the appropriateness of having acquisitions equally represented in
meetings with NARA leadership, the CAO did not know their reason for the exclusion.
Likewise, the CMA, who oversees the CIO, CFO, and CAO, did not have an explanation nor the
authority to determine which senior managers attend the ELT and MT meetings. Without the
CAO equally represented among senior management, NARA risks creating a ‘tone’ that might
instill unnecessary barriers toward implementing acquisition internal controls. Equally important
Federal standards for internal controls make management responsible for setting the tone at the
top and throughout the organization by their example, which is fundamental to an effective
internal control system. 11

Acquisition Strategic Planning
Per NARA Directive 101, the CAO had been delegated the responsibility to ensure the
appropriate strategic planning and evaluation of NARA acquisition resources, including
assessing the requirements established for agency personnel. However, when the OIG requested
acquisition-related risk assessments and strategic plans, the CAO was unable to provide current
or previous versions.

Recommendations
We recommend the following improvements to the Chief of Management and Administration to
strengthen accountability of acquisition management roles and responsibilities:
         Recommendation 1: Ensure the CAO's delegated responsibilities and authorities as
         outlined in NARA Directive 101, NARA Organization and Delegation of Authority, are
         reflected in the CAO's position description and performance plan.
           Management Response
           The CMA will ensure the CAO's FY 2021 Performance Plan reflects the CAO's delegated
           responsibilities and authorities as outlined in NARA Directive 101, NARA Organization
           and Delegation of Authority.
           Target Completion Date: November 30, 2020
           OIG Analysis
           We consider NARA’s proposed actions responsive to our recommendation. This
           recommendation will remain open and resolved pending completion of the corrective
           actions identified above.


11
     GAO Standards for Internal Controls in the Federal Government 1.03.
                                                    12
                               National Archives and Records Administration
                                                        OIG Audit Report No. 20-AUD-06



Recommendation 2: Ensure the Chief Acquisition Officer is adequately positioned to
regularly engage with NARA’s Management Team and senior management in order to
advise and assist the agency head and other agency officials to ensure the mission of the
agency is achieved through the acquisition management activities.
 Management Response
 The CMA will ensure that the Management Team charter is amended to include the
 CAO. The CAO will begin attending Management Team meetings in June 2020.
 Target Completion Date: June 30, 2020
 OIG Analysis
 We consider NARA’s proposed actions responsive to our recommendation. This
 recommendation will remain open and resolved pending completion of the corrective
 actions identified above.


Recommendation 3: The Chief Acquisition Officer in consultation with the Chief of
Management and Administration establish and document an acquisition workforce
strategic plan to address achieving the objectives of key acquisition positions.
 Management Response
 The CAO, in consultation with the Chief of Management and Administration, will
 establish and document an acquisition workforce strategic plan to address achieving the
 objectives of key acquisition positions
 Target Completion Date: December 31, 2020
 OIG Analysis
 We consider NARA’s proposed actions responsive to our recommendation. This
 recommendation will remain open and resolved pending completion of the corrective
 actions identified above.




                                        13
                   National Archives and Records Administration
                                                                           OIG Audit Report No. 20-AUD-06


Finding 2. Ineffective Management Controls over NARA’s Acquisition
           Workforce

NARA lacks a comprehensive acquisition career management program that enhanced the
acquisition workforce, and provided for workforce planning, career paths and education and
training. Specifically, CORs assigned to NARA’s most complex and critical IT contracts lacked
appropriate certifications, training requirements for CORs did not comply with federal
guidelines, and NARA’s program/project manager certification program operated under outdated
guidance. This occurred because the CAO did not establish and maintain acquisition
management controls in accordance with federal policies. During FY 2017 and FY 2018, NARA
has spent over $90 million in contracting for major IT investments. 12 However, CORs assigned
to these contracts did not meet the appropriate training and experience levels. Without an
effective ACM program, NARA lacks assurance that its IT contracts are administered to deliver
the best value possible to the agency.

According to the Office of Federal Procurement Policy (OFPP) Policy Letter 05-01, Developing
and Managing the Acquisition Workforce, the CAO shall develop and maintain an ACM
program to ensure the development of a competent, professional workforce to support the
accomplishment of agency mission. The Policy Letter also established the ACM role with key
responsibilities in acquisition workforce development and management (including identifying
staffing needs and training requirements), and ensuring agency policies and procedures for
workforce management are consistent with those established by OFPP. Through NARA
Directive 101, the CAO was given the role of ACM program officer.

Improper COR Certification Levels
OFPP Memo, Revisions to the Federal Acquisition Certification for Contracting Officer’s
Representatives (FAC-COR), established three levels of certifications, with Level III CORs
being the most experienced in an agency. Level III CORs should be assigned to the most
complex and mission critical contracts within the agency. CORs for major investments, as
defined by Office of Management and Budget (OMB) Circular A-11, Preparation, Submission,
and Execution of the Budget, shall generally be designated as Level III CORs.

Of the seven IT contracts 13 sampled, we found five involved major IT investments, which totaled
approximately $147 million. The CORs assigned to oversee the performance of these contracts
had Level II certifications instead of Level III as generally required. We surveyed the CORs
assigned to determine their responsibilities related to the major IT contracts. Four of the nine
CORs reported they did not receive adequate guidance in order to perform their responsibilities.

12
     NARA data for IT investments obtained from OMB IT Dashboard.
13
     Contracts sampled were judgmentally selected and active during FY 2017 and 2018.
                                                     14
                                National Archives and Records Administration
                                                              OIG Audit Report No. 20-AUD-06


Also, six of the nine CORs indicated concerns regarding the instructions they received on how to
document contractors’ performance.

According to the CAO, Information Services, not the Office of the Chief Acquisition Officer, is
responsible for direct supervision of CORs that oversee IT contracts. The CAO further indicated
IT contracts do not require Level III CORs and the competencies identified in the OFPP Memo,
FAC-COR, were only for IT contracts in development, of which the CAO indicated NARA had
none. However, NARA has spent over $90 million in contracting for major IT investments in FY
2017 and FY 2018. Failure to assign CORs with proper certification levels and required
experience, increases NARA’s risk of approving payments for inferior goods and services,
preventing ballooning contract costs, and failing to meet mission-critical contract objectives.

Inadequate COR training
OFPP Memo, FAC-COR, established the minimum training, experience, and continuous learning
points (CLPs) needed for CORs to perform their required duties. (See Figure 2).

Figure 2: FAC-COR Certification Requirements
 Level I        ● 8 hours of training
                ● no experience
                ● Continuous learning: 8 CLPs, every two years
 Level II       ● 40 hours of training
                ● one year of previous COR experience
                ● Continuous learning: 40 CLPs, every two years
 Level III      ● 60 hours of training
                ● two years of previous COR experience required on contracts of moderate to
                   high complexity that require significant acquisition investment
                ● Continuous learning: 40 CLPs, every two years
Source: OFPP FAC-COR


Level III CORs are also often called upon to perform significant program management activities
and should be trained accordingly.

NARA assigned CORs to major IT investments that did not meet the minimum training and
experience levels. For example, a COR assigned to oversee an IT contract valued at over $55
million had less than four months of experience at Level II. According to the COR, their training
and previous experience did not prepare them to handle a contract of this magnitude, nor were
adequate resources provided to oversee the contract. In situations where CORs were not
adequately trained, NARA lacks assurance contracts have the appropriate oversight and
management to achieve optimal performance.



                                               15
                          National Archives and Records Administration
                                                                      OIG Audit Report No. 20-AUD-06


As reported in the prior Procurement Audit 14 NARA’s Procurement Guide required CORs to
complete “a mandatory refresher course every three years,” to maintain each certification level.
However, this policy was not in accordance with federal guidance, which required training every
two years. According to the CAO, NARA was provided a waiver to allow recertification every
three years instead of the mandatory two years. However, the CAO did not provide
documentation supporting the waiver. Without a comprehensive ACM program maintained in
accordance with federal policies, NARA CORs responsible for overseeing contractors’
performance may continue to lack training requirements necessary to meet the demands of their
role and responsibilities.

Outdated Policies for Program and Project Managers
OFPP Memo, Revisions to the Federal Acquisition Certification for Program and Project
Managers (FAC-P/PM), established reciprocity for individuals certified as P/PMs. Mid-level
P/PMs are considered to have met FAC-COR Level II requirements and senior-level P/PMs are
considered to have met FAC-COR Level III requirements. However, NARA guidance 15 is
outdated and does not reflect the revised FAC-P/PM policy. Additionally, thirteen of
approximately 17 P/PMs have senior-level certifications (i.e., Level III COR equivalent) and
could have been assigned as CORs instead of the Level II CORs appointed to oversee the major
IT contracts. Without controls to ensure P/PMs are properly assigned, NARA has limited
assurance that a capable and competent workforce will oversee critical agency contracts.

Recommendations
We recommend the following improvements to the Chief Acquisition Officer to strengthen
management of acquisition workforce responsible for overseeing IT contracts:
     Recommendation 4:        Issue written guidance that requires appointment of Contracting
        Officer’s Representatives with Level III certification for those contracts with major IT
        investments.
        Management Response
        The Chief Acquisition Officer will issue written guidance that requires appointment of
        Contracting Officer's Representatives with Level III certification for those contracts with
        major IT investments.
        Target Completion Date: November 30, 2020
        OIG Analysis



14
 Audit Report No. 17-AUD-06, Audit of NARA’s Procurement Program, November 15, 2016.
15
  Interim Guidance 810-2, NARA's Implementation of Federal Acquisition Certification for Program and Project
Managers, dated September 18, 2009.
                                                 16
                            National Archives and Records Administration
                                                          OIG Audit Report No. 20-AUD-06


   We consider NARA’s proposed actions responsive to our recommendation. This
   recommendation will remain open and resolved pending completion of the corrective
   actions identified above.


Recommendation 5:        Establish an appointment matrix to ensure consistent identification
   and assessment of risks for IT contracts.
   Management Response
   The Chief Acquisition Officer will establish an appointment matrix to ensure consistent
   identification and assessment of risks for IT contracts.
   Target Completion Date: November 30, 2020
   OIG Analysis
   We consider NARA’s proposed actions responsive to our recommendation. This
   recommendation will remain open and resolved pending completion of the corrective
   actions identified above.


Recommendation 6:        Issue written guidance to Contracting Officers that requires use of
   the appointment matrix established in Recommendation 5 when determining the
   appropriate Contracting Officer’s Representative certification level.
   Management Response
   The Chief Acquisition Officer will issue written guidance to Contracting Officers that
   requires use of the appointment matrix established in Recommendation 5 when
   determining the appropriate Contracting Officer's Representative certification level.
   Target Completion Date: November 30, 2020
   OIG Analysis
   We consider NARA’s proposed actions responsive to our recommendation. This
   recommendation will remain open and resolved pending completion of the corrective
   actions identified above.


Recommendation 7:         Revise Interim Guidance 810-2, NARA’s Implementation of
   Federal Acquisition Certification for Program and Project Managers in accordance with
   the Office of Federal Procurement Policy, Revisions to Federal Acquisition Certification
   for Program and Project Managers, dated, December 16, 2013, including NARA’s
   implementation of reciprocal acquisition certifications.
   Management Response

                                          17
                     National Archives and Records Administration
                                                      OIG Audit Report No. 20-AUD-06


The Chief Acquisition Officer will revise Interim Guidance 810-2 to include reciprocal
acquisition certifications.
Target Completion Date: November 30, 2020
OIG Analysis
We consider NARA’s proposed actions responsive to our recommendation. This
recommendation will remain open and resolved pending completion of the corrective
actions identified above.




                                      18
                 National Archives and Records Administration
                                                                                                OIG Audit Report No. 20-AUD-06


Appendix A – Summary of Monetary Results

Finding
          Recommendation       Description         Amount      Category        Agency Response                 OIG Response
  No.
                                                                           Management does not            The OIG’s position of
                                                                           agree with the questioned      these questioned costs did
                                                                           costs included in this         not change. In addition to
                                                                           report. This report            the sampled contracts for
                                                                           identifies as "questioned      major IT projects not
                                                                           costs" NARA's entire           having a level III COR,
                                                                           portfolio of "major" IT
                                                                                                          the OIG also observed the
                                                                           projects for FY 2017and
                                                                                                          following:
                                                                           FY 2018. Management
                                                                           acknowledges the               1. A cure notice was
                           NARA assigned                                   weaknesses identified in       issued for one contract.
                           CORs to major IT                                this report, but does not
                           investments that did               Questioned   agree that the risk and        2. The COR was unable to
                                                                           consequences of those          meet review requirements
  2            N/A         not meet the           $90,000,000 Costs, No
                                                                           weaknesses are so severe       for deliverables for one
                           minimum training                   Recovery
                                                                           that the entire value of the   contract.
                           and experience                                  subject contracts should
                           levels.                                         be considered a                3. CORs indicating they
                                                                           questioned cost.               were not adequately
                                                                           Management also believes       trained or prepared for the
                                                                           that the sampled contracts     contracts they were
                                                                           do not represent the entire    assigned.
                                                                           portfolio of major IT
                                                                           projects to a degree or        4. The CAO was unable to
                                                                           extent sufficient to           produce adequate spend
                                                                           characterize the entire        analysis for the contracts.
                                                                           portfolio as questioned
                                                                           costs.



                                                             19
                                        National Archives and Records Administration
                                                 OIG Audit Report No. 20-AUD-06


Appendix B – Acronyms

ACM          Acquisition Career Management
CAO          Chief Acquisition Officer
CFO          Chief Financial Officer
CIO          Chief Information Officer
CLP          Continuous Learning Points
CMA          Chief of Management and Administration
CO           Contracting Officer
COR          Contracting Officer’s Representative
ELT          Executive Leadership Team
EOP          Executive Office of the President
FAC          Federal Acquisition Certification
FAITAS       Federal Acquisition Institute Training Application System
FAR          Federal Acquisition Regulation
FY           Fiscal Year
GAO          General Accountability Office
HCA          Head of Contracting Activity
IT           Information Technology
MT           Management Team
NARA         National Archives and Records Administration
O/CAO        Office of the Chief Acquisition Officer
OFPP         Office of Federal Procurement Policy
OIG          Office of Inspector General
OMB          Office of Management and Budget
P/PM         Program and Project Manager
PRISM        Procurement Information System for Management
SADBUS       Director of Small and Disadvantaged Business Utilization
SARA         Services Acquisition Reform Act of 2003
SDO          Suspension and Debarment Official
SPE          Senior Procurement Executive




                                  20
             National Archives and Records Administration
                                                                  OIG Audit Report No. 20-AUD-06


Appendix C – Prior Audit Recommendations

The status of the recommendations from the Audit of NARA’s Procurement Program (OIG
Report No. 17-AUD-06, November 16, 2016).

 Rec. No.                               Recommendation Text                                      Status
     1      CAO and Senior Procurement Executive (SPE) are structured to ensure                  Closed
            alignment with NARA leadership and used by leadership as a business partner in
            supporting mission needs.
     2      Archivist ensures the CAO responsibilities and title are assigned or delegated to    Closed
            an official who performs the duties of a CAO, including establishing an effective
            control environment, identifying acquisition objectives, and assessing the risks
            facing NARA as it seeks to achieve acquisition objectives.
     3      CAO formally appoint a SPE and procurement officials who are authorized to           Open
            approve warrants over $100,000,000 and approve warrant for construction and
            architectural-engineering services contracting officers.
     4      Competition Advocate, in collaboration with the CAO, completes an evaluation         Closed
            and report on the overall strength of NARA's competition practice in accordance
            with the (Federal Acquisition Regulation (FAR) and OMB guidance.
     5      Competition Advocate, in collaboration with the CAO, develop and implement           Open
            procedures to promote the acquisition of commercial items and report annually
            new initiatives to the CAO and SPE.
     6      CAO develop and implement procedures to ensure contracting offices in BCN            Open
            and BFS report all contract related activity to the SPE.
     7      CAO ensure NARA 501 NARA Procurement policy and NARA's General                       Open
            Acquisition Policy addresses procurements related to Architecture/Engineering
            and Construction.
     8      CAO, in collaboration with CFO, Director of Acquisitions, and program                Open
            managers, develop and implement procedures for proper planning of new
            contracts with NARA funds.
     9      CAO develop and implement procedures to ensure contracts are evaluated to            Open
            identify contracts that are wasteful, inefficient, or unlikely to meet NARA needs.
    10      CAO and SPE develop and implement test plans and procedures to assess                Open
            internal control over acquisition activities and programs using OMB
            Memorandum, Conducting Acquisition Assessments.
    11      CAO modify procedures to ensure all contracting activity, including                  Open
            Architecture/Engineering, construction services are included in random
            selections for internal control reviews.
    12      CAO establish standards for retaining documentation supporting the evaluation        Closed
            of internal controls.


                                              21
                         National Archives and Records Administration
                                                            OIG Audit Report No. 20-AUD-06


13    CAO include CO's who are not GS1102's, COR's and P/PM's in the internal             Open
      control program test plan.
14    CAO establish various performance metrics to be tracked and analyzed on how         Open
      long the acquisition takes, where delays occur and why delays occur.
15    CAO develop and implement meaningful and measurable performance metrics             Open
      to continually assess the performance of the acquisition function in supporting
      NARA's mission and achieving acquisition goals.
16    CAO ensure NARA 501 NARA Procurement policy includes guidance to                    Open
      program offices on their responsibilities in the procurement process.
17    CAO ensure program offices are routinely trained in NARA procurement policy         Closed
      and procedures, specifically procurements requisition packages and procurement
      lead times.
18    CAO assess staffing needs for NARA's Procurement Program to ensure the              Open
      procurement program has sufficient staff to maintain effective, efficient
      operations and adhere to federal and internal guidance.
19    CAO develop a process to monitor the close-out of contracts process to ensure       Open
      contracts are closed in a timely manner and identify reasons contracts are not
      closed out in a timely manner.
20    Acquisition Career Manager (ACM) verify all contracting officers, contracting       Open
      officer representatives, program and project managers, and other contracting
      professionals set up an account in FAITAS for tracking certifications and
      continuous training.
21    ACM continue to work with the Federal Acquisition Institute to get access to all    Closed
      NARA staff accounts in FAITAS. If the ACM is unable to obtain direct access
      to NARA staff accounts, the ACM should develop and implement a tracking
      system to document and monitor training for all contracting officers, contracting
      officer representatives, program and project managers, and other contracting
      professionals ensuring compliance with the Federal Acquisition Certification.
22    CAO work with the CIO to determine and document how best to support IT              Closed
      acquisition, such as through the development of specialized IT acquisition
      cadres, specifically contracting officers, and staff.
23    ACM ensure NARA Certification for Program and Project managers                      Open
      Applications are signed by the Deputy Archivist in accordance with NARA
      policy and maintained.
24    CAO ensure all contracting officers, regardless of their government series, be      Open
      certified at an appropriate level; and any contracting professional issued an
      unlimited warrant be level III certified.
25.   CAO establish and implement procedures for potential administrative or              Open
      disciplinary actions for contracting officers, and contracting officer
      representatives, and other contracting professionals that do not have their FAC
      certifications or continuous training required by OMB guidance. For example, if
      after one year from notice the contracting professional still does not have

                                        22
                   National Archives and Records Administration
                                                            OIG Audit Report No. 20-AUD-06


     appropriate certificates and/or training, disciplinary action, removal of warrant
     or removal from the position may occur.
26   CAO ensure there is more IT training for CO's that do a significant amount of       Open
     work in IT in accordance with OMB technology acquisition cadre guidance.




                                       23
                  National Archives and Records Administration
                                                              OIG Audit Report No. 20-AUD-06


Appendix D – Future Acquisition Audits


Based on the findings identified in this report and the OIG’s assessment of risk of NARA’s
acquisition activities, we plan to include in the following audits in our future Work Plans:
   • Use of Independent Contractors
   • Use of Technical Direction Letters
   • Acquisition Information System, PRISM




                                              24
                         National Archives and Records Administration
                                                                          OIG Audit Report No. 20-AUD-06


Appendix E – Management Response




      ~ NATIONAL
       ARCHIVES

        Date:         25 February 2020

        To:          James Springs, Inspector General

        From:         David S. Ferriero, Archivist of the United States

        Subject: Action Plan to OIG Report 20-AUD-06, Audit of NARA~ Oversight and
        Management ofInformation Technology Contracts


        Thank you for the opportunity to provide comments on this final report. We appreciate
        your willingness to meet and clarify language in the report.

        Management does not agree with the questioned costs included in this report. This report
        identifies as "questioned costs" NARA's entire portfolio of "major" IT projects for FY 2017
        and FY 2018. Management acknowledges the weaknesses identified in this report, but does
        not agree that the risk and consequences of those weaknesses are so severe that the
        entire value of the subject contracts should be considered a questioned cost. Management
        also believes that the sampled contracts do not represent the entire portfolio of major IT
        projects to a degree or extent sufficient to characterize the entire portfolio as questioned
        costs.

        We concur with the seven recommendations in this audit, and in response, the attachment
        provides a summary of our proposed actions. As each recommendation is satisfied, we will




   NATIONAL ARCHIVES          and
   RECORDS ADMINISTRATION

      8601 ADELrHI ROAD
   COLLEGE PARK. MD 20740-6001
        www . archivts .gov




                                                   25
                              National Archives and Records Administration
                                                            OIG Audit Report No. 20-AUD-06




provide documentation to your office. If you have questions about this action plan, please
contact Kimm Richards at kimm.richards@nara.gov or by phone at 301-837-1668.




DAVIDS. FERRIERO
Archivist of the United States

Attachment




                                      26
                 National Archives and Records Administration
                                                         OIG Audit Report No. 20-AUD-06




             Action Plan Response to OIG Report 20-AUD-06
   Audit ofNARA~ Oversight and Management ofInformation Technology
                               Contracts


Recommendation 1: We recommend the Chief of Management and Administration
ensure the CAO's delegated responsibilities and authorities as outlined in NARA
Directive 101, NARA Organization and Delegation of Authority, are reflected in the
CAO's position description and performance plan.

Planned Action: The CMA will ensure the CAO's FY 2021 Performance Plan reflects
the CAO's delegated responsibilities and authorities as outlined in NARA Directive 101,
NARA Organization and Delegation of Authority.

Target Completion Date: November 30, 2020

Recommendation 2: We recommend the Chief of Management and Administration
ensure the Chief Acquisition Officer is adequately positioned to regularly engage with
NARA's Management Team and senior management in order to advise and assist the
agency head and other agency officials to ensure the mission of the agency is achieved
through the acquisition management activities.

Planned Action: The CMA will ensure that the Management Team charter is amended
to include the CAO. The CAO will begin attending Management Team meetings in June
2020.

Target Completion Date: June 30, 2020

Recommendatjon 3: We recommend the Chief Acquisition Officer, in consultation
with the Chief of Management and Administration, establish and document an
acquisition workforce strategic plan to address achieving the objectives of key
acquisition positions.

Planned Action: The CAO, in consultation with the Chief of Management and
Administration, will establish and document an acquisition workforce strategic plan to
address achieving the objectives of key acquisition positions.

Target Completion Date: December 31, 2020

Recommendation 4: We recommend the Chief Acquisition Officer issue written
guidance that requires appointment of Contracting Officer's Representatives with Level
III certification for those contracts with major IT investments.




                                  27
             National Archives and Records Administration
                                                         OIG Audit Report No. 20-AUD-06




Planned Action: The Chief Acquisition Officer will issue written guidance that requires
appointment of Contracting Officer's Representatives with Level III certification for
those contracts with major IT investments.

Target Completion Date: November 30, 2020


Recommendation 5: We recommend the Chief Acquisition Officer establish an
appointment matrix to ensure consistent identification and assessment of risks for IT
contracts.

Planned Action: The Chief Acquisition Officer will establish an appointment matrix to
ensure consistent identification and assessment of risks for IT contracts.

Target Completion Date: November 30, 2020


Recommendation 6: We recommend the Chief Acquisition Officer issue written
guidance to Contracting Officers that requires use of the appointment matrix
established in Recommendation 5 when determining the appropriate Contracting
Officer's Representative certification level.

Planned Action: The Chief Acquisition Officer will issue written guidance to
Contracting Officers that requires use of the appointment matrix established in
Recommendation 5 when determining the appropriate Contracting Officer's
Representative certification level.

Target Completion Date: November 30, 2020


Recommendation 7: We recommend the Chief Acquisition Officer revise Interim
Guidance 810-2, NARA's Implementation ofFederal Acquisition Certification for Program
and Project Managers in accordance with the Office of Federal Procurement Policy,
Revisions to Federal Acquisition Certification for Program and Project Managers, dated,
December 16, 2013, including NARA's implementation of reciprocal acquisition
certifications.

Planned Action: The Chief Acquisition Officer will revise Interim Guidance 810-&o
include reciprocal acquisition certifications.

Target Completion Date: November 30, 2020




                                  28
             National Archives and Records Administration
                                                        OIG Audit Report No. 20-AUD-06


Appendix E – Report Distribution List


Archivist of the United States
Deputy Archivist of the United States
Chief Operating Officer
Deputy Chief Operating Officer
Chief of Management and Administration
Chief Acquisition Officer
Accountability
United States House Committee on Oversight and Government Reform
Senate Homeland Security and Governmental Affairs Committee




                                           29
                      National Archives and Records Administration
                                                            OIG Audit Report No. 20-AUD-06


                                       OIG Hotline

To report fraud, waste, or abuse, please contact us:

Electronically: https://www.archives.gov/oig/referral-form/index.html

Telephone: 301-837-3500 (Washington, D.C. Metro Area)
           1-800-786-2551 (toll-free and outside the Washington, D.C. metro area)

Mail: IG Hotline
      NARA
      P.O. Box 1821
      Hyattsville, MD 20788-0821




                                              30
                         National Archives and Records Administration