Review of PRISM Automated 

Procurement System Support 

Contracts 

 September 30, 2010 

Report No. 486

Audit Conducted by Regis & Associates, PC 

 
Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

i 

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

OFFICE OF

IIIISPECTOR GEIllERAl

MEMORANDUM

September 30,2010

To; Sharon Sheehan, Associate Executive Director, Office of

Administrative Services (OAS)

Jeffrey Heslop, Chief Operating Officer (COO), and Acting Chief

Information Officer (CIO), Office of Information Technology (OIT) ,VJ

From: H. David Kotz, Inspector General, Office of Inspector Genera~>V~

Subject: Review of PRISM Automated Procurement System Support

Contracts, Report No. 486

This memorandum transmits the U.S. Securities and Exchange Commission

Office of Inspector General's (OIG) final report detailing the results of our review

of the PRISM automated procurement system support contracts. This review

was conducted based on anonymous complaints OIG received regarding

procurements relating to the management and integration of PRISM.

The final report contains five recommendations, which if implemented, should

improve the Commission's programs and operations. OAS concurred with

recommendations 2, 4, and 5 and non-concurred with recommendation 3. The

COO/Acting CIO concurred with recommendation 1which was addressed to OIT.

Your written response to the draft report is included in its entirety in Appendix V

Within the next 45 days, please provide the OIG with a written corrective action

plan that is designed to address the agreed recommendations. The corrective

action plan should include information such as the responsible official/point of

contact, time frames for completing the required actions, milestones identifying

how you will address the recommendations cited in this report.
Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

ii 

Should you have any questions regarding this report, please do not hesitate to 

contact me. We appreciate the courtesy and cooperation that you and your staff 

extended to our staff and contractors. 

Attachment 

cc: Kayla J. Gillan, Deputy Chief of Staff, Office of the Chairman 

Diego Ruiz, Executive Director, Office of the Executive Director 

David Becker, General Counsel, Office of General Counsel 

Jeffrey Risinger, Associate Executive Director, Office of Human 

 Resources 

Kenneth Johnson, Associate Executive Director, Office of 

 Financial Management 

Julie Basile, Assistant Director, Office of Administrative Services, Office of 

 Acquisitions 

George R. Eckard, Assistant Director, Office of Finance and 

 Administration, Office of Information Technology 
Review of PRISM Automated Procurement 

System Support Contracts

Executive Summary 

Background. The Office of Inspector General (OIG) contracted the services of 

Regis & Associates, PC (Regis), Independent Public Accountants, to conduct a 

review of the contract administration activities related to the Office of Acquisitions 

(OA) automated procurement system, PRISM. 

The U.S. Securities and Exchange Commission’s (SEC or Commission) Office of 

Administrative Services (OAS), OA, is responsible for the agency’s contract and 

procurement activities and processes; while the SEC divisions and offices are 

responsible for preparing initial procurement requisitions and statements of work. 

Over the past several years, OA has unsuccessfully attempted to automate its 

procurement function. OA has procured two different automated procurement 

systems (APS) to manage acquisitions, the Procurement Desktop System (PDS), 

and the Strategic Acquisition Manager (SAM). OA discontinued its use of PDS in 

1998, and acquired SAM in 2007. Subsequently, OA discontinued the use of 

SAM in March 2008, due to a variety of system performance issues. In 

September 2008, the SEC acquired an APS named PRISM. PRISM was 

intended to enable OA to accurately track and reconcile SEC’s contracts and 

agreements. PRISM, which was implemented on April 21, 2009, and is 

commonly referred to as OA’s “contract writing tool,” is a web-based, commercial 

off-the-shelf, procurement and contract management system. PRISM provides a 

streamlined, end-to-end procurement cycle that integrates and tracks information 

from the initiation of a requirement, through its solicitation and award. PRISM 

also tracks information on contract administration, contract closeout, and 

document archive. 

Contract No. SECHQ1-08-C-8239 was awarded to Virtus Consulting Group, Inc., 

(Virtus) on August 12, 2008, to provide project support for the implementation of 

PRISM. Task Order No. 0004, under Indefinite Delivery Indefinite Quantity 

(IDIQ) No. SECHQ1-07-D-0320, was awarded to another vendor, Delta 

Technologies and Solutions, Inc., to perform system coding and technical 

services related to the integration of PRISM and Momentum, SEC’s financial 

accounting system. The OIG received anonymous complaints regarding the 

procurements relating to the management and integration of PRISM. This review 

was initiated as a result of those complaints. 

Objectives. The overall objectives were to assess the adequacy of the PRISM 

award and contract administration activities related to the procurement of PRISM, 

and the adequacy of management and implementation of the PRISM project, and 

the integration services. The specific objectives of the audit were as follows: 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

iii 
• Identify and review all procurement documentation related to the project 

management and integration support for PRISM; 

• Determine whether procurements were properly awarded, in accordance 

with Federal Acquisition Regulations and SEC policies and procedures; 

• Determine the validity of complaints received by the OIG, related to the 

award of the procurement for the management and integration of PRISM; 

• Determine whether there was adequate oversight of PRISM; and 

• Review governing Commission policies, guidance, etc., and follow up on 

prior recommendations to ensure they have been closed and corrective 

actions were completed. 

Prior OIG Audit Report. OIG Report No. 471, Audit of the Office of Acquisitions’ 

Procurement and Contract Management Functions, issued September 25, 2009, 

contained 10 recommendations to strengthen management controls over OA’s 

contracting and procurement functions. 

Results. The audit identified several deficiencies related to PRISM contract 

administration activities that raise concerns about the future success of the 

PRISM project. Specifically, we found that there were repeated requests made 

to the Office of Information Technology (OIT) for project management support for 

the project. The Associate Executive Director for the OAS advised OIT that the 

SAM project manager was unable to give the upcoming APS project adequate 

time and attention and that the level of support was insufficient for the project to 

be successful. We found that OIT responded that they simply did not have 

enough resources to provide the needed project management support. 

Further, and notwithstanding the negative experiences in the past and the 

complexity of the project, the PRISM project continued for over a year without an 

active OIT project manager. 

Moreover, we found that competition was improperly restricted by OAS without 

following proper Federal Acquisition Regulation (FAR) requirements when it 

solicited and awarded a contract for PRISM project support through the insertion 

of a condition requiring vendor’s employees have a current (or within the past 30 

days) SEC clearance. We found that this condition effectively precluded outside 

contractors from bidding on the work. Additionally, email correspondence 

between the respective OAS Contracting Officer (CO) and an Office of Financial 

Management (OFM) employee indicated that OAS had already pre-selected a 

contractor approximately a week before the solicitation was publicized. This 

contractor, identified in the CO’s email, was ultimately awarded the contract. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

iv 
In addition, we found that there was inadequate segregation of duties in the 

management of the PRISM support contract. Specifically, neither a project 

manager nor Contracting Officer’s Technical Representative (COTR) was 

appointed for the support contract for at least one year. This resulted in the CO 

assuming these roles and responsibilities during that period. 

Furthermore, we noted that a critical deliverable under the PRISM support 

contract did not meet quality standards. The reconciliation tool developed by the 

vendor did not appear to accurately classify data between PRISM and 

Momentum. This resulted in reconciliation errors which consumed additional 

resources to remedy. 

Lastly, after we conducted follow-up on prior recommendations in OIG Report 

No. 471, Audit of the Office of Acquisitions’ Procurement and Contract 

Management Functions, issued on September 25, 2009, relating to strengthening 

management controls over the contracting and procurement function, we found 

that 8 of the 10 recommendations remain open. 

Summary of Recommendations. Specifically, we recommend that OIT review 

the adequacy of trained project officers that are available to manage all current 

and anticipated projects. If it is determined that sufficient qualified project officers 

are not available to manage all current and anticipated projects, OIT should 

remedy the situation by either providing an adequate number of qualified 

personnel, or implementing an alternative process for ensuring oversight of 

projects. 

Further, we recommend that OAS: 

(1) Issue guidance to staff on the proper use of restrictive clauses in 

solicitations and the prohibition on pre-selection, and require that 

applicable requirements in the Federal Acquisition Regulations are 

followed. 

(2) Implement internal procedures to limit Contracting Officers from also 

assuming project management and COTR responsibilities on the same 

project. 

(3) Review existing contracts to ensure that COTRs are assigned for each 

contract as appropriate. 

(4) Work in conjunction with OFM to evaluate the reconciliation tool discussed 

in Finding 4 in order to determine, on a cost to benefit basis, whether it 

would be feasible to correct the deficiencies noted. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

v 
Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

vi 

TABLE OF CONTENTS 

Executive Summary .............................................................................................

Table of Contents ................................................................................................

Background and Objectives

Background ..............................................................................................

Objectives .................................................................................................

Findings and Recommendations

Finding 1: OIT Was Not Actively Involved in Project Management for the

Implementation of the PRISM Project .......................................................

Recommendation 1 ..............................................................

Finding 2: Full and Open Competition was Restricted in the Solicitation 

Process .....................................................................................................

Recommendation 2 ..............................................................

Finding 3: Contracting Officer Performed Project Management and 

Contracting Officer Technical Representative Duties on the Project 

Support Contract .......................................................................................

Recommendation 3 ..............................................................

Recommendation 4 ..............................................................

Finding 4: Tool to Reconcile PRISM and Momentum Contract Informatio

Did Not Meet Quality Standards ................................................................

Recommendation 5 ..............................................................

Appendices 

Appendix I: Acronyms. ...........................................................................

Appendix II: Scope and Methodology ......................................................

Appendix III: Criteria .................................................................................

Appendix IV: List of Recommendations ...................................................

Appendix V: Management Comments .....................................................

Appendix VI: OIG Response to Management’s Comments......................

......... iii 

...

...

...

...

...

...

...

...

...

...

n

...

...

...

...

...

...

...

..... vi 

...... 1 

...... 2 

...... 4 

...... 6 

...... 6 

...... 9 

.... 10 

.... 12 

.... 12 

.... 13 

.... 14 

.... 15 

.... 16 

.... 18 

.... 19 

.... 20 

....... 29 
Background and Objectives

Background 

The Office of Administrative Services (OAS), Office of Acquisitions (OA) is 

responsible for the U.S. Securities and Exchange Commission (SEC or 

Commission) procurement and contract activities and processes, which are 

governed by the Federal Acquisition Regulation (FAR). While OA oversees the 

procurement responsibilities, the SEC divisions and offices are responsible for 

preparing initial procurement requisitions and statements of work. OA consists of 

four primary contracting branches, each of which is headed by a Branch Chief. 

Each branch is staffed with Contracting Officers, Contract Specialists, and 

support personnel. 

Over the past several years, OA has unsuccessfully attempted to automate its 

procurement function. Initially, OA utilized the Procurement Desktop System 

(PDS), but discontinued its use in 1998 after finding that the system was 

inadequate to perform necessary procurement functions. OA then acquired the 

Strategic Acquisition Manager (SAM) tool1

 to automate the SEC’s acquisition and 

procurement process. OA used SAM as its pilot automated procurement system 

(APS) from May 2007 to March 2008. OA discontinued using SAM as a result of 

the system’s failure to meet its needs and the vendor’s failure to provide trained 

system administrators who could fix the system’s problems. OA also 

encountered problems with the interfacing between SAM and Momentum2 when 

Momentum would occasionally experience problems and shut down. OAS also 

experienced problems with server equipment not being able to handle the 

volume of data being sent from Momentum and SAM. 

In September 2008, the SEC acquired PRISM, another APS. OA hopes that 

PRISM will enable it to more accurately track and reconcile SEC’s contracts and 

agreements. PRISM, commonly referred to as OA’s “contract writing tool,” is a 

web-based, commercial off-the-shelf, procurement and contract management 

system. It provides a streamlined end-to-end procurement cycle that integrates 

and tracks information from the initiation of the requirement through solicitation 

and award. It also tracks information on contract administration, contract 

closeout, and document archive. 

The following procurements were issued relative to the acquisition and 

integration of PRISM and Momentum: 

 

1

SAM was a multi-year project that was approved in April 2005 for a total cost of $2,492,371. 2

Momentum is the SEC’s financial accounting system. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

1 
• PRISM Phase 1, Software and Support Contract (OA Contract Writing 

Tool): Compusearch Software Systems, Inc., SECHQ1-08-F-8240, 

$3,744,582.08, period of performance - September 23, 2008 to present. 

• PRISM Phase 1, Project Management Contract (Project Support): Virtus 

Consulting Group, Inc. (Virtus), SECHQ1-08-C-8239, $1,239,119.20, 

period of performance - August 12, 2008 to December 10, 2010. 

• PRISM Phase 2, (Interface) Integration Support Task Order: Delta 

Solutions and Technologies, Inc. (Delta), SECHQ1-07-D-0320 Task Order 

0004, $1,240,061.27, period of performance - February 4, 2009 to July 15, 

2010. 

On July 21, 2008, SEC posted a solicitation notice to vendors on 

FedBizOpps.gov, to procure project support services for the implementation of an 

APS. The solicitation required key contractor employees proposed to work on 

the implementation, to have been cleared to work at the SEC within the past 30 

days. Although 33 vendors requested the SEC’s Request for Proposal, only one 

vendor, Virtus Consulting Group, Inc. (Virtus) submitted a bid. After a review by 

a technical evaluation panel, this one offer was accepted, and a contract was 

awarded to Virtus, on August 12, 2008, for project support related to the PRISM 

implementation in the amount of $600,000. 

On January 7, 2009, the SEC’s Project Review Board approved a project related 

to the integration of PRISM and Momentum. Subsequently, on February 20, 

2009, OAS awarded Task Order 0004 to Delta Solutions and Technologies, Inc. 

under Indefinite Delivery Indefinite Quantity (IDIQ) SECHQ1-07-D-0320, in the 

initial amount of $586,386 to perform coding and technical services related to the 

integration. 

The Office of Inspector General (OIG) received anonymous complaints regarding 

the procurements relating to the management and integration of the PRISM. 

This audit was initiated as a result of those complaints.

Objectives 

The overall objectives were to assess the adequacy of the PRISM award and 

related contract administration activities and assess the management and 

implementation of the PRISM project and the integration services. The specific 

objectives were as follows: 

1) Identify and review all procurement documentation related to project 

management and integration support for PRISM; 

2) Determine whether procurements were properly awarded, in accordance 

with Federal Acquisition Regulations and SEC policies and procedures; 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

2 
3) Determine the validity of complaints received by the OIG, related to the 

award of the procurements for the management and integration of PRISM; 

4) Determine whether there was adequate oversight of PRISM; and 

5) Review governing Commission policies, guidance, etc., and follow up on 

prior recommendations to ensure that they have been closed, and that 

corrective actions were completed. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

3 
Findings and Recommendations

Finding 1: OIT Was Not Actively Involved in 

Project Management for the Implementation 

of the PRISM Project 

The Office of Information Technology (OIT) was not actively 

engaged in project management of the PRISM 

implementation and integration project for over a year, 

despite OAS’ request for full-time OIT project management 

support prior to the start of the project.3

 

OIT Did Not Adequately Provide Project Management 

The Office of Management and Budget (OMB) A-109, Major System Acquisitions, 

Section 8- Management Structure, states, in part: 

b. Each agency that acquires -- or is responsible for activities 

leading to the acquisition of -- major systems will establish 

clear lines of authority, responsibility, and accountability for 

management of its major system acquisition programs. 

Over the past several years, OA unsuccessfully tried to automate its procurement 

function. OAS procured two different APS’s to track acquisitions, PDS and SAM. 

After OAS discontinued the use of SAM in March 2008, OAS acquired PRISM in 

September 2008. PRISM is a web-based, commercial off-the-shelf procurement 

and contract management system that provides a streamlined end-to-end 

procurement cycle that integrates and tracks information from the initiation of the 

requirement through the solicitation and award process. PRISM also tracks 

information on contract administration, contract closeout and document archive. 

The scope of the PRISM project not only included implementation of the actual 

system, but also included the award of two related contracts for project support 

and integration work.4

 

Based on lessons learned from the failure of SAM, OAS recognized the necessity 

of having a full-time project manager with a strong information technology (IT) 

background during the acquisition and implementation of a procurement system. 

 

3

 While OIT did not have resources to assign a full-time project manager, OIT maintains that two 

knowledgeable project managers were assigned to assist OA with the IT-related aspects of the initial PRISM 

implementation and subsequent initiative to integrate PRISM with Momentum prior to OIT assuming the role 

of overall project manager in December 2009. 

4

 The PRISM project consists of two distinct phases. Phase 1 was to field the PRISM system in OA as a 

contract writing tool. Phase 2, which is still ongoing, is meant to interface PRISM with the Commission’s 

financial management system. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

4 
Therefore, in May 2008, approximately four months prior to acquiring its third 

procurement system, the Associate Executive Director (AED) for OAS requested 

OIT provide more project management resources for the upcoming PRISM 

project. 

More specifically, on May 21, 2008 the AED OAS sent an email to the Assistant 

Director of Finance and Administration for OIT, indicating that she had made 

repeated requests to OIT for project management support for the past two years. 

The AED OAS further stated that the SAM project manager was unable to give 

the project adequate time and attention and was “spread across too many 

projects.” In addition, the AED OAS stated that the current level of support for 

the upcoming APS project “simply isn’t enough for a project of this complexity to 

be successful.” Moreover, the AED OAS noted that the amount of effort was 

considered inadequate when benchmarked against a U.S. Army project that she 

procured which was similar in nature and complexity. A similar system 

implementation at the U.S. Army involved the full-time efforts of a GS-14 IT 

project officer, and two GS-13 IT junior project officers, and did not involve 

integration with the U.S. Army’s financial system. The AED OAS stated that OIT 

representatives explained on a number of occasions that they simply didn’t have 

enough resources to provide the needed project management support. OIT, 

however, never formally responded to OAS’ request for more project 

management resources for PRISM. 

Report No. 486 

5 

 

 

Notwithstanding the negative experiences in the past and the complexity of the 

project, the implementation of PRISM (Phase 1) and its integration with 

Momentum (Phase 2) commenced and continued for over a year without an 

active OIT project manager. In December 2009, OIT senior management 

became concerned with the direction of the integration project and as a result, an 

individual designated by OIT as the project manager5 became actively involved 

in the project. 

Additionally, while OIT maintains that Virtus, a contractor hired by OAS to 

perform project support (see Finding 2), was considered to be and functioned as 

the project manager for the APS project, the contractor’s contract with the SEC 

specifically precluded the contractor from performing program management or 

technical implementation.6

 Further, there is no documentation to support the 

assertion that OIT complied with the provisions of its own Operating Directive, 

OD 24-02.04, IT Project Manager Qualification Standards, dated May 30, 2006, 

which requires OIT to demonstrate that vendor project managers performing 

project management duties possess appropriate qualifications in accordance with 

SEC and OMB guidance. Accordingly, there was a lack of clearly defined lines of 

5

 In August 2008, OIT sent an email to OAS stating that an OIT employee would be “listed” as the APS 

program manager; however, this individual was not actively involved in the project due to competing 

priorities. 

6

 Contract No. SECHQ1-08-C-8239, Section C: Description/Specifications/Statement of Work, C.1.0 Scope, 

states that “This support does not include program management or technical implementation.” 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 
authority, responsibility, and accountability related to project management of 

PRISM. 

The value of the two PRISM support contracts we reviewed as part of this audit, 

doubled since the inception of the contracts. Specifically, SECHQ1-08-C-8239, 

Virtus increased from $600,000 to $1,239,119 and SECHQ1-07-D-0320, Task 

Order 0004, increased from $586,386 to $1,041,061. Had an OIT project 

manager been actively involved in Phases 1 and 2, issues resulting in contract 

increases may have been avoided. 

The Commission’s apparent lack of sufficient resources to adequately manage 

the PRISM project, in our opinion, raises serious concerns about the viability of 

the project going forward. The SEC also may have received services that were 

not adequate for the purposes for which they were ordered. Moreover, we are 

concerned that the problem with lack of project management support with PRISM 

may be indicative of a systemic problem with other major IT investments. 

Recommendation 1: 

The Office of Information Technology (OIT) should review the adequacy of 

trained project officers that are available to manage all current and 

anticipated projects. If it is determined that sufficient qualified project 

officers are not available to manage all current and anticipated projects, 

OIT should remedy the situation by either providing an adequate number 

of qualified personnel, or implementing an alternative process for ensuring 

oversight of the projects. 

Management Comments. The COO/Acting CIO concurred with this 

recommendation. See Appendix V for management’s full comments. 

OIG Analysis. We are pleased that the COO/Acting CIO concurred with 

this recommendation. 

Finding 2: Full and Open Competition was 

Restricted in the Solicitation Process 

OAS issued a solicitation to obtain contractor project support 

for PRISM that included an unusually restrictive condition 

requiring contractor key personnel to have current security 

clearances with the SEC, or be cleared by the SEC within 

the past 30 days. Additionally, email correspondence 

between the respective OAS Contracting Officer (CO) and 

an Office of Financial Management (OFM) employee 

indicated that OAS had already pre-selected a contractor 

approximately one week before the solicitation was 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

6 
publicized. As a result, outside contractor sources were 

effectively precluded from bidding on the contract and full 

and open competition was restricted. 

Full and Open Competition was Restricted By a Condition 

Added to the Solicitation 

Because OIT was unable to provide the project management support OAS 

requested in May 2008, OAS decided to obtain contractor project support. 

However, in doing so, they issued a solicitation that was unnecessarily restrictive 

and effectively precluded competition from outside contractor sources. 

The FAR Part 6.101, Full and Open Competition—Policy, states that with 

certain limited exceptions, contracting officers shall promote and provide 

for full and open competition in soliciting offers (emphasis added) and 

awarding Government contracts, and contracting officers shall provide for 

full and open competition through use of the competitive procedures that 

are best suited to the circumstances of the contract action and consistent 

with the need to fulfill the Government’s requirements efficiently. 

Additionally, the FAR, Subpart 5.2, Synopses of Proposed Contract 

Actions, § 5.207, Preparation and transmittal of synopses, Paragraph c, 

requires that notices of proposed contract actions contain a clear and 

concise description of the supplies or services that is not unnecessarily 

restrictive of competition and will allow a prospective offeror to make an 

informed business judgment as to whether a copy of the solicitation should 

be requested. 

On July 21, 2008, a solicitation for PRISM project support services was 

publicized in FedBizOpps.gov, with an August 5, 2008 due date for technical and 

price proposals. OAS sought to obtain a contractor to provide project support 

with the functional aspects of pre-deployment planning, deployment, and post 

deployment for PRISM.7 

Part C.1.1 of the solicitation, Background, stated that “to take advantage of 

lessons learned, and to increase our chance of success, the SEC seeks an 

experienced and knowledgeable project support contractor to assist with 

establishing the procurement requirements and implementing an APS that has 

been proven in the Federal Sector. The Contractor shall also be knowledgeable 

in SEC systems, especially Momentum Financials and with SEC processes and 

workflows, in order to be effective immediately upon award of a contract.” 

Report No. 486 

7 

 

In addition, Part C.3.0 of the solicitation, Requirements, contained conditions that 

vendors were required to meet in order to receive consideration. Specifically, the 

solicitation stated that “The Contractor’s employees shall have a current (or 

7

 Project support was intended for Phase 1 of PRISM only (fielding the system as a contract writing tool in 

OA). 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 
within the past 30 days) SEC clearance to minimize the amount of time to be on 

site and begin work.” Further, a letter addressed to potential offerors, which was 

attached to the solicitation, stated “The SEC invites all offerors who meet the 

requirements and constraints of this solicitation to propose, but please seriously 

consider not proposing if you have no one who qualifies.” 

The solicitation limited competition by excluding vendors who were not currently 

cleared to work at the SEC and were not knowledgeable about its systems and 

processes. We found that there was substantial interest in the project as 33 

vendors contacted OAS to obtain a copy of the combined synopsis and 

solicitation publicized on FedBizOpps.gov. However, upon close of the 

solicitation on August 5, 2008, only one vendor responded with a proposal likely 

because of the conditions in the solicitation, including the requirement that the 

contractor’s employees have a current SEC clearance. 

Further, we found email correspondence in the contract file, dated July 14, 2008 

(seven days before the release of the aforementioned solicitation), containing 

improper communications between an OAS CO and a representative from OFM 

regarding the potential selection of a then-current SEC contractor to serve as a 

project manager for APS. In this July 14, 2008 email, sent by the CO to the OFM 

representative, containing the subject line “Procurement system status,” the CO 

stated that it may be best to delay a meeting because “we are hiring a project 

manager (i.e., ) to assist with the acquisition and implementation. 

When the PM is hired . . . .” The email further stated, “Right now nothing is 

happening on the APS acquisition; I’m trying to prepare the solicitation for the PM 

support.” Incredibly, the email identified the name of the contractor that OAS 

intended to hire a week before the solicitation was released to the public. This 

email, coupled with the extremely restrictive solicitation provision demonstrates 

potential evidence of the improper pre-selection of the project manager. In 

August 2008, OAS awarded the contract to the contractor specified in the CO’s 

July 14, 2008 email. 

During an interview Regis held with the AED OAS on July 29, 2010, she 

explained the reasoning behind the decision to include the restrictive clause in 

the solicitation regarding the security clearance by stating that during the period 

the contract was awarded, it took one year, at a minimum, for contractors to 

obtain the necessary security clearances at the SEC. The AED OAS also stated 

that due to these time requirements, as well as the fact that no in-house project 

officers were provided by OIT, the provision requiring current clearances had to 

be inserted into the solicitation. In addition, the AED OAS acknowledged that 

she reviewed the solicitation and authorized the clause requiring that only 

vendors with currently cleared personnel should respond to the solicitation. 

However, it should be noted that the contract file did not contain any justifications 

for OAS’ decisions. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

8 
Subsequently, in August 2010, a personnel security specialist in the SEC’s 

Personnel Security Branch informed OIG that although there was a back log of 

clearances that needed to be adjudicated in 2008, interim clearances were 

granted to individuals coming to work at the SEC who had no criminal record in 

seven to ten business days. If a person had a criminal record, it could take an 

additional two to three weeks longer to adjudicate the clearance. The personnel 

security specialist informed OIG that full clearances were typically granted within 

90-days of the initial submission. 

We determined that the inclusion of restrictive clauses in the solicitation and the 

CO’s July 14, 2008 email correspondence have the appearance that the results 

of the bid was predetermined and it was not awarded fairly as was alleged in a 

complaint the OIG received. Consequently, these findings raise concerns about 

management controls within OAS to ensure adherence to applicable FAR 

requirements regarding promoting full and open competition. Additionally, the 

Commission may not have received the best value for the services procured. 

Further, we found that the original contract was awarded to Virtus on August 12, 

2008 in the amount of $600,000, but as a result of six modifications, the contract 

amount has more than doubled and is currently valued at $1,239,119.8

 

Additionally, we found that the period of performance under the contract was also 

extended. 

Recommendation 29

: 

The Office of Administrative Services should issue guidance to staff 

on the proper use of restrictive clauses in solicitations and the 

prohibition on pre-selection, and require that applicable 

requirements in the Federal Acquisition Regulations are followed. 

Management Comments. OAS concurred with this 

recommendation. See Appendix V for management’s full 

comments. 

OIG Analysis. We are pleased that OAS concurred with this 

recommendation. We do note that OAS in its response stated that 

they strongly disagreed with the finding that competition was 

restricted inappropriately. The facts of this solicitation are not in 

dispute. A restrictive condition was added to the solicitation for a 

project manager requiring a current SEC clearance that resulted in 

only one vendor submitting a proposal after 33 vendors had 

Report No. 486 

9 

 

8

 The modifications included additional funding related to internal control support, technical writing and 

documentation services, additional project support due to reclassification of PRISM as a mixed financial 

system, and data migration services. 

9

 The Office of Inspector General is simultaneously issuing a Memorandum Report, referring the evidence 

contained in this finding to the Executive Director, Associate Executive Director for Human Resources and 

the General Counsel for appropriate disciplinary action for the senior level personnel who were responsible 

for the improper pre-selection. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 
expressed interest in the proposal. This one vendor was identified 

by name in an e-mail as the project manager being hired a week 

before the solicitation was released to the public. 

Finding 3: Contracting Officer Performed 

Project Management and Contracting Officer 

Technical Representative Duties on the 

Project Support Contract 

The OAS CO for the project support contract discussed in Finding 2 

also assumed the roles and responsibilities of a project manager 

and Contracting Officer’s Technical Representative (COTR) for 

about one year from the inception of the contract. Additionally, the 

CO approved the first 10 vendor invoices under this contract and 

reviewed and accepted contract deliverables, though it appears this 

individual lacked the technical competence needed to ensure the 

deliverables met the contract requirements. 

No COTR or Project Manager Was Initially Appointed to 

Manage the Contract 

We found that the CO for one of the PRISM support contracts also served 

as the COTR and this individual did not appear to have the technical 

qualifications or time to fulfill this role. Contract Number SECHQ1-08-C8239, was awarded to Virtus to provide project support for the 

implementation of PRISM. The respective OAS CO did not appoint a 

COTR for this contract from its August 12, 2008 inception to August 17, 

2009. The contract, Section G - Contract Administration Data, Subsection 

G.1, Appointment of Contracting Officer’s Technical Representative, 

stated that a COTR would not be appointed for the award and that the CO 

would perform the duties of a COTR such as inspecting, reviewing, and 

accepting deliverables and services. However, the deliverables for this 

type of contract are of an inherently technical nature and require approval 

by an individual with appropriate technical competencies. The 

deliverables included an internal controls reconciliation report, disaster 

recovery plan, system security plan, privacy analysis worksheet, business 

impact analysis, and communication plan. 

Based on information gathered in interviews with the CO, we do not 

believe this individual possessed the necessary technical competencies or 

adequate time to monitor a contract of this complexity and size. The CO’s 

knowledge and experience was primarily in procurement administration 

and management, while the subject contract required IT requirement 

development and project management experience. Additionally, as 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

10 
discussed in Finding 1, there was a lack of OIT project management for 

the overall PRISM project, including at the inception of this contract for 

project support. 

SEC Regulation 10-15 (November 4, 2004 revision) requires that in order to be 

appointed as a COTR, an individual must “possess at the time of the nomination 

the technical background, experience necessary, and Federal Acquisition 

Certification COTR certification specified in this Directive, and shall be 

knowledgeable about the services for which the COTR responsibilities are 

assigned.” Furthermore, SEC Regulation 10-15 requires the CO to carefully 

consider the complexity and dollar value of the contract and appoint a COTR 

based on the results. Contract Number SECHQ1-08-C-8239 was a complex 

contract, with a final dollar value in excess of $1.2 million. In addition, a 

widespread and standard practice in the implementation of software related 

projects is the designation of a project manager, who typically has information 

technology experience, as well as project management experience. 

Consequently, we believe that OAS’ decision to appoint the CO as the COTR 

was contrary to the intent of SEC’s internal policies and procedures, as well as 

standard industry practice. Additionally, this put the SEC at risk of accepting 

deliverables that may not have been in accordance with the contract or in the 

best interest of the project.

10 

We also found that the CO approved the first 10 invoices for the subject 

contract, though the contract terms and conditions specifically prohibited 

the CO from approving invoices. During the period covered by our scope, 

20 invoices were received and payments were made to Virtus. These 

invoices totaled approximately $1 million, and covered the period October 

8, 2008 to May 12, 2010. Of this amount, $578,013 represented 

payments on the first 10 invoices that were approved by the CO. Section 

G - Contract Administration Data, Subsection G.2, Submission of Invoices, 

states that “the CO will not approve invoices.” This contract clause 

provides for segregation of duties between the CO and an individual 

designated to review invoices, such as the COTR. 

 

Based on discussions with the AED OAS, we were informed that the CO 

assumed the roles and responsibilities of a project manager and COTR for 

the first year of the contract because of a lack of adequate project 

management support from OIT. Finally, in December, 2009, the situation 

was remedied when OIT became more actively involved in Phase 2 of the 

PRISM project. 

 

As a result of the condition noted above, there is a risk that SEC may have 

received services or deliverables that were not adequate for the purposes 

for which they were ordered. For example, in Finding 4, we found that a 

Report No. 486 

11 

 

10 While OAS maintains that the CO coordinated with subject matter experts in OFM and OIT prior to 

accepting deliverables, we found that these efforts were not appropriately documented. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 
reconciliation tool developed by Virtus to reconcile contract information 

entered into PRISM and Momentum did not meet contract requirements. 

Recommendation 3: 

To ensure duties are segregated, the Office of Administrative Services 

should implement internal procedures to limit Contracting Officers from 

also assuming project management and Contracting Officer’s Technical 

Representative’s responsibilities on the same project. 

Management Comments. OAS did not concur with this recommendation. 

See Appendix V for management’s full comments. 

OIG Analysis. We are disappointed that OAS did not concur with 

this recommendation and encourage them to reconsider. We do 

not believe it is disputable that the contracting officer did not posses 

the necessary technical competencies or experience to monitor this 

project and that there was a lack of project management support for 

the project as well. Lack of resources is not an appropriate 

justification for failing to properly manage a multi-million dollar 

project. Segregation of duties is a critical method of ensuring that 

there is accountability and proper management in a project. The 

recommendation that OAS implement procedures to “limit” 

contracting officers (not “restrict” as claimed in the Management 

response) from assuming certain project management duties is a 

prudent and appropriate step to take to ensure that SEC projects 

are managed more efficiently in the future. 

Recommendation 4: 

The Office of Acquisitions should review existing contracts to ensure that 

Contracting Officer’s Technical Representatives are assigned for each 

contract, as appropriate. 

Management Comments. OAS concurred with this recommendation. 

See Appendix V for management’s full comments. 

OIG Analysis. We are pleased that OAS concurred with this 

recommendation. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

12 
Finding 4: Tool to Reconcile PRISM and 

Momentum Contract Information Did Not Meet 

Quality Standards 

The reconciliation tool developed by Virtus to reconcile contract 

information entered into PRISM and Momentum did not meet 

contract requirements. This reconciliation tool does not accurately 

classify data between PRISM and Momentum, thus resulting in 

reconciliation errors. Also, the reconciliation errors generated 

require the use of in-house resources to investigate them.

A Critical Deliverable Under the Contract Did Not Meet 

Quality Standards 

One of the critical deliverables, under Contract Number SECHQ1-08-C8239, was a tool to reconcile PRISM and Momentum. This reconciliation 

was necessary because PRISM and Momentum have not yet been 

integrated, and contract data is being entered into both systems manually. 

However, the reconciliation tool does not appear to accurately classify 

data between the systems, thus resulting in reconciliation errors. 

Specifically, there are differences between the data fields used for 

entering information into PRISM and Momentum. These differences are 

incorrectly classified as errors on the reconciliation reports, i.e., false 

positives. 

The Statement of Work for Modification P00001 to Contract Number 

SECHQ1-08-C-8239 states, “The Contractor shall provide an accurate, 

operational, and reliable reconciliation report that can be run nightly to 

reconcile that day’s entries in Momentum Financials and in PRISM. The 

report must generate and maintain an error log of discrepancies between 

the two extracts.” 

We found that the internal logic used in the reconciliation tool was not fully 

developed to account for the inherent differences between the data fields 

for contract information entered into PRISM and Momentum. As a result, 

items, incorrectly classified as errors, have accumulated on the 

reconciliation error log, and an inordinate amount of time has been spent 

by SEC staff in determining that these items were not actual errors. In 

addition, because the reports generated by this reconciliation tool cannot 

be completely relied upon, there is currently no assurance that the entries 

in Momentum accurately reflect the contracts that were written through 

PRISM. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

13 
Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

14 

Recommendation 5: 

The Office of Administrative Services (OAS), in conjunction with the Office 

of Financial Management, should evaluate the reconciliation tool in order 

to determine, on a cost to benefit basis, whether it would be feasible to 

correct the deficiencies noted. OAS should then decide whether the 

corrections should be performed by Commission personnel, or by 

technically competent contractor personnel. 

Managements Comments. OAS concurred with this recommendation. 

See Appendix V for management’s full comments. 

OIG Analysis. We are pleased that OAS concurred with this 

recommendation. 

 
Appendix I

Acronyms

AED Associate Executive Director 

APS Automated Procurement System 

CO Contracting Officer 

COTR Contracting Officer’s Technical Representative 

FAR Federal Acquisition Regulations 

IDIQ Indefinite Delivery Indefinite Quantity 

IT Information Technology 

OA Office of Acquisitions 

OAS Office of Administrative Services 

OFM Office of Financial Management 

OIG Office of Inspector General 

OIT Office of Information Technology 

PDS Procurement Desktop System 

SAM Strategic Acquisition Manager 

SEC or Commission U.S. Securities and Exchange Commission 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

15 
Appendix II 

Scope and Methodology 

Scope. We obtained the contract files for Contract Number SECHQ1-08-C-8239 

awarded to Virtus, and Task Order 0004 for IDIQ SECHQ1-07-D-0320 awarded 

to Delta Solutions and Technologies, Inc. We obtained documentation detailing 

the history of the implementation of PRISM; and the progress to date, of the 

integration of PRISM and Momentum, such as meeting minutes from the Project 

Review Board and the Information Officers’ Council. This information provided 

us with an understanding of the implementation process for PRISM and its 

integration with Momentum, and identified individuals who were instrumental in 

the process. We obtained Obligation History Reports, listing the invoices 

received from both Virtus and Delta Solutions and Technologies, Inc., and the 

supporting invoices. 

We conducted our fieldwork from June 2010 to August 2010. We reviewed 

documentation related to the implementation of PRISM, which began in August, 

2008, and was completed in April, 2009, and the integration of PRISM and 

Momentum, which began in February, 2009 and is still ongoing. 

Methodology. To meet the objectives to assess the adequacy of the PRISM 

award and contract administration activities related to the procurement of PRISM 

and the management and implementation of the PRISM project and integration 

services, as well as our other specific objectives Regis: 

• Identified all of the procurement documentation related to project 

management and integration support for PRISM. We obtained and 

reviewed the contract files for Contract Number SECHQ1-08-C-8239 

awarded to Virtus, and Task Order Number 0004 for IDIQ SECHQ1-

07-D-0320 awarded to Delta Solutions and Technologies, Inc. 

• Gained access to documentation detailing the history of the 

implementation of PRISM; and the progress, to date, of the integration 

of PRISM and Momentum. 

• Reviewed this documentation to gain an understanding of how the 

contracts were awarded, and whether there were any FAR violations.

• Obtained a listing of all contractor invoices received from and paid to 

Virtus and Delta Solutions and Technologies, Inc. 

• Conducted interviews with personnel from OA, OFM, and OIT, who 

were associated with the acquisition or implementation of PRISM, or 

the integration of PRISM and Momentum.

• Obtained and reviewed relevant SEC regulations and policies, and 

determined whether there was compliance with these policies.

Internal or Management Controls. Our review of the contract files for the 

PRISM and Delta awards included gaining an understanding of internal controls 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

16 
Appendix II 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

17 

over the contracting process, as required by FAR and by SEC regulations. We 

noted whether there was adherence to these controls. 

Prior Audit Coverage. Our fieldwork included determining whether 

recommendations set forth in OIG Report No. 471, Audit of the Office of 

Acquisitions Procurement and Contract Management Functions, September 25, 

2009, were implemented. 
Appendix III 

Criteria 

Federal Acquisition Regulation. Establishes uniform policies and procedures 

for acquisition by all executive agencies. The latest revision became effective on 

July 23, 2010. 

SEC Regulation 10-15. (Revised November 4, 2004) Discusses roles and 

responsibilities of Contracting Officers’ Technical Representatives and Inspection 

and Acceptance Officials. 

Contract SECHQ1-08-C-8239. Issued August 12, 2008, contains provisions 

governing contractor performance, and specifying roles of the SEC Contracting 

Officer. 

Modification P00001 of Contract SECHQ1-08-C-8239. Issued June 4, 2009, 

contains provisions governing contractor performance, and specifying roles of the 

SEC Contracting Officer. 

OMB Circular A-109, Major System Acquisitions. Establishes policies to be 

followed by executive branch agencies in the acquisition of major systems. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

18 
Appendix IV 

List of Recommendations 

Recommendation 1: 

The Office of Information Technology (OIT) should review the adequacy of 

trained project officers that are available to manage all current and anticipated 

projects. If it is determined that sufficient qualified project officers are not 

available to manage all current and anticipated projects, OIT should remedy the 

situation by either providing an adequate number of qualified personnel, or 

implementing an alternative process for ensuring oversight of the projects. 

Recommendation 2: 

The Office of Administrative Services should issue guidance to staff on the 

proper use of restrictive clauses in solicitations and the prohibition on preselection, and require that applicable requirements in the Federal 

Acquisition Regulations are followed. 

Recommendation 3: 

To ensure duties are segregated, the Office of Administrative Services should 

implement internal procedures to limit Contracting Officers from also assuming 

project management and Contracting Officer’s Technical Representative’s 

responsibilities on the same project. 

Recommendation 4: 

The Office of Acquisitions should review existing contracts to ensure that 

Contracting Officer’s Technical Representatives are assigned for each contract, 

as appropriate. 

Recommendation 5: 

The Office of Administrative Services (OAS), in conjunction with the Office of 

Financial Management, should evaluate the reconciliation tool in order to 

determine, on a cost to benefit basis, whether it would be feasible to correct the 

deficiencies noted. OAS should then decide whether the corrections should be 

performed by Commission personnel, or by technically competent contractor 

personnel. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

19 
Appendix V 

Management Comments 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

20 

MEMORANDUM

September 24, 2010

TO: H. David Kotz

Inspector General

FROM: Sharon Sheehan ft,J..

Associate Executive Director

Office ofAd7lE:' 's tiveS . es

Jeffery Heslop

ChiefOperating cer and

Acting ChiefInfOrmation Officer

SUBJECf: OAS Management Response to Draft Report No. 486~ Review ofPRISM

Automated Procurement System Support Contracts

This memorandum is in response to the Office ofInspector General's Draft Report No. 486,

Review ofPRISMAutomatedProcurement System Support Contracts. Thank you for the

opportunity to review and respond to this report. OIT concurs with recommendation I, and OAS

concurs with recommendations 1,2,4 and 5. OAS does not concur with recommendation 3. We

have coordinated our response with the Office ofGeneral Counsel and have provided detailed

response information for the findings and reco11UDendations presented in the report.

Cc: David Becker, OOC

Diego Ruiz, ED

Ken Johnson, CFO

Kayla Gillan. OOC

Julie Basile, OA

Zayra Okrak, OFM

George Eckard, OIT

George Brown, OOC

1
Appendix V 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

21 

Introduction

Draft Audit Report 486 (Report) addresses the Office ofAcquisition's (OA) automation ofits

procurement function, and states that the findings identified in the Report "raise concerns about

the future success ofthe PRISM project." Management firmly believes that the PRISM project as

a whole has been successful and will continue to succeed. The PRISM project will evolve and

provide business process improvements as we fully implement the capabilities ofthe system

PRISM is proving to be a successful tool for OA. This fiscal year 886 total contract actions were

processed in PRISM representing $110.3 million.

While the Report offers some helpful suggestions, we are concerned that the Report overall is

inaccurate or reaches unsupported conclusions in a number ofrespects. Some ofthe findings in

the Report are based on improper interpretation ofcomplex issues ofcontract practice govemed

by the Federal Acquisition Regulation (FAR). We will provide references from the FAR and

from a Government Accountability Office (GAO) decision regarding similar matters that

demonstrate the SEC did not act improperly.

The Report's assertion that the Office ofAdministrative Services (OAS) restricted competition is

based on a misinterpretation ofacquisition regulations, since including requirements the

government deemed necessary fur perfonnance ofwork does not improperly restrict competition.

The language ofthe solicitation was "the Contractor's employees shall have current (or within

the past 30 days) SEC clearance to minimize the amount oftime to be on site and begin work."

This permitted potential contractors to provide both employees who had active badges and

employees who had a recently expired SEC clearance, to be proposed.

The Report asserts that "OAS had already pre-selected a contractor approximately a week befure

the solicitation W811 publicized." During market research on projects, agencies frequently identity

potential offerors who should be able to perform the work. The filct that one ofthe six companies

identified during the market research was ultimately the only offeror on the project was not a

result ofpre-selection. Multiple companies often propose the same qualified individuals for

government projects. Further, none ofthe 33 potential vendors who received a copy ofthe RFP

complained that the security provision was improper.

Recommendation 1:

The Office of Information Technology (Om should review the adequacy oftrained project

officers that are available to manage all current and anticipated projects. Ifit is

determined that sufficient qualified project officers are not available to manage all current

and anticipated projects, orr should remedy the situation by either providing an adequate

2
Appendix V 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

22 

number of qualified personnel, or implementing an alternative proeess for eosuring

oversight of the projects.

The Office ofInfonnation Technology (OIT) concurs with this finding and recommendation. An

independent consultant is assessing the OIT organization structure and staffing levels to ensure

we are positioned to meet the technology needs ofthe SEC. The assessment will include the

qualifications and assignment ofour project management staff. We will rely upon results ofthe

assessment to staffour project management capability to the appropriate level and skill set. A

significant portion ofnew positions allocated to OIT in FY 11 will be assigned as project

managers.

Recommendation 2:

The Office ofAdministrative Services should issue guidance to staff on the proper use of

restrictive clauses in solidtations and the prohibition on pre-selection, and require that

appUcBble requirements in the Federal Acquisition Regulations are foUowed.

OAS concurs with the recommendation to issue such guidance to staff. Management takes very

seriously the obligation ofall contracting staffto adhere to the requiremerits ofthe FAR and

conduct every procurement action with the utmost professionalism and integrity. This

recommendation restates existing regulatory requirements, since such guidance is already present

in the FAR, which contracting staffalready are required to follow as part oftheir duties.

We strongly disagree with the finding that competition was restricted inappropriately. The

Report's statements in this finding do not align with the actual implementation ofthe

Competition in Contracting Act (CICA) of 1984. As implemented in FAR part 6, which sets a

standard ofcompetition for federal contracts, competition standards do not require that the needs

ofthe agency be abandoned in order to expand competition. The statement in this Report that

OAS restricted competition is a misinterpretation ofacquisition regulations since including

requirements the government deems necessary for performance ofthe work is appropriate.

The GAO has found that the determination ofa contracting agency's needs and the best method

for accommodating them is a matter primarily within the agency's discretion. Generally, the mct

that a requirement may be burdensome or even impossible for particular firms to meet does not

make it objectionable ifthe requirement properly reflects the agency's needs.

FederaI policy at FAR 11.002(a)(1)(ii) states that "agencies shall- (I) specify needs· • .... The

determination ofagency needs is within the reasonable discretion ofthe acquiring agency. Here

the SEC had a reasonable basis to contract with vendors who could start work immediately. The

Momentum Upgrade was scheduled to go live in August 2008. Because ofthe time line, it was

3
Appendix V 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

23 

important that we obtain onsite project support fur PRISM quickly. During the numerous

planning meetings, OIT, OFM and OAS collectively understood that the Momentum Upgrade

support contractors' stay onsite was limited. A delay in project start was a significant risk since

the overlap with OFM contractors was key to a successful interface ofthe two sYstems, PRISM

and Momentum.

The work required access to sensitive SEC data and a security requirement was necessary fur

such access. A reasonable method for meeting this requirement, given the time delays in

obtaining security clearances,.was to require the presence ofa current or recent SEC security

clearance.

FAR 11.002 goes on to state that in specifying needs, agencies should be "using market

research." Here, market research indicated that six contractors with the expertise and security

clearances were avail.able to seek the w:ork set forth in the RFP. Given the availability ofmore

than one source to satisfy the stated requirement, it is incorrect to state that the security clearance

was restrictive. Even ifit were considered in some fashion restrictive (it did not appear so at the

time based on market research), the FAR goes on to state in (a)(l)(ii) that such restrictions are

permissible ''to the extent necessary to satisfy the needs of the agency" [emphasis added]. In

this case, the SEC'srequirement for a security clearance relates directly to potential offerors'

ability or capacity to perform the contract and to have personnel enter the SEC work site and

gain access to SEC computer systems, allowing them to begin work immediately upon award.

The awardee was required to immediately attend meetings, interview and interact with

government personnel as well as contractors supporting the upgrade to SEC's financial

management system, Momentum. The contract generally supported all aspects ofimplementing

the contract writing system and preparing to interface the two.

The requirement for a security clearance in this solicitation falls within the category ofa

responsibility determination. One ofthe most fundamental principles ofgovernment contracting

is that the government may contract only with "responsible sources." Determination of

contractor responsibility is a businessjudgment made by the agency as to whether the contractor

can or will perform the specific requirements the government has specified. As a result, the

agency enjoys considerable discretion in making this decision. The requirement to assure that

personnel held or could quickly obtain SEC clearance is appropriate in light ofrelevant FAR

provisions that describe the elements bearing on determining that potential contractors are

responsible sources. The term "responsible source" is defined by statute and implemented into

regulation at FAR 9.104-1. FAR 9.104-1 (b), states the firm must "be able to comply with the

required or proposed delivery or performance schedule" and 9.104-3(a), states the contracting

officer "shall require aceeptable evidenee ofthe prospective contractor's ability to obtain

required resources," and that evidence ''normally consists ofa commitment or explicit

arrangement, that will be in existence at the time of contract award, to rent, purchase, or

4
Appendix V 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

24 

otherwise acquire the needed filcilities, equipment, other resources, or personnel [emphasis

added]."

The Report also quoted FAR 6.101, but improperly focused only on the first portion ofthe

subpart, and failed to consider FAR 6.1 01 (b) oftbat same section which clearly shows agencies

should use competitive procedures that "are best suited to the circumstances ofthe contract

action and consistent with the need to fulfill the Government requirements efficiently."

The Report states that in 2008 SEC was granting interim clearances to individuals within 7-10

business days but no longer than 2-3 weeks, with final clearance in 90 days. Although these

objectives were at times met during 2008, the office's perfonnance to this standard was very

inconsistent Instead, these timeframes more accurately reflect the office's current standard of

performance. The challenges fiIced by the SEC in processing background investigation at that

time were cited in an inspection conducted by OIG itselfin March of2008 (Background

Investigations, Report No. 434). At that time, DIG showed that although the workload ofthe

branch had significantly increased, the staffresources had not, resulting in a backlog of

investigations amounting to hundreds ofcases. The Report stated, "Delays in processing

background investigations and the lack ofadherence to relevant Federal requirements negatively

impact the recruitment ofstaffand other temporary personnel, efficient use of contractors, and

securit}' offederally controlled filcilities and Commission information systems." In addition,

Report No. '434 referenced complaints by Commission officials ofsignificant delays with

clearances. The office was also faced with a requirement to review existing employees and

contractors with a deadline ofOctober 27, 2008. Contrary to the Report, delays were still

occurring at the time the contracts in question were formulated and awarded. Further, the process

ofonboarding a contract employee involves additional time for employees to complete the

background forms, obtain fingerprints, and process those forms through their company. Once

approval is granted, the company must then negotiate a start date with the employees,and the

government.

In an effort to assure broadest possible competition within the constraints ofthe needs ofthe

SEC, the contracting officer properly submitted a combined solicitation/synopsis to Federal

Business Opportunities web site in accordance with FAR 5.2. FAR5.201 (c) establishes the

purpose ofthe notice as ''to enhance competition by identifYing contracting and subcontracting

opportunities." When a solicitation is issued, ifany potential offeror wishes to complain about

the tenns ofthe solicitation as too restrictive, there are provisions in the FARto do so. FAR

33.l03(e) states that protests based on alleged improprieties in a solicitation must be filed before

the closing date for receipt ofproposals. The SEC received no such protest Ifcompeting offerors

had believed that the restriction was unnecessary to meet the schedule and requirements ofthe

5
Appendix V 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

25 

solicitation, each had a right to protest the SEC's inclusion ofthe requirement. However, none

did so.

The detennination ofa contracting agency's needs and the best method for accommodating them

is a matter primarily within the agency's discretion. The GAO decided a similar case, in which

prospective vendor protested a requirement that bidders have a security clearance at the.time of

award, and suggested instead that bidders should be permitted 90 days to obtain the clearance. In

that case, GAO upheld the government's position. The case decision is Computer Maintenance

Operations Services, B-255530, Feb. 23,1994.

The Report asserts that "OAS had already pre-selected a contractor approximately a week before .

the solicitation was publicized." This statement is incorrect and a highly speculative inference

from an email referenced in the Report by the auditors. The correspondence in question occurred

during the market research phase ofthe procurement The auditors never discussed this email

with its author concerning her intent.! During market research on projects, agencies :frequently

identify potential offerors who are expected to be able to perform the work. In fact, the winning

offeror was one ofsix firms identified as being capable ofmeeting requirements. The fact that

one ofthe contractors identified by OFM during the initial market research was ultimately the

only offeror on the project is not an indicator ofpre-selection. Anyone could propose who met

the requirements, and it was the vendor(s) who decided whether to propose or not. A named

individual need not be associated with a single contractor. It is common practice for competing

firms to hire staffmembers who have experience with agency needs. In fact, often the same

individual will appear as a key person on multiple contract proposals from different firms. Any

firm wishing to submit a proposal could, in fact, have proposed and hired any SEC employee or

SEC contractor who was qualified and cleared by SEC, or whose clearance had not been e:xpired

more than 30 days. These proposals would have been considered.

For the many reasons referenced above, OAS does not agree that this action is evidence that

OAS management controls are inadequate to ensure adherence to competition requirements of

the FAR or that there is evidence of~selection.On the contrary, the fact that OAS attempted

1 The Report makes much ofthe contracting officer's use ofthe common abbreviation" ie.", the Latin abbreviation

for id est (that is) instead of"e.g.", the Latin abbreviation for exempli gratkl (for example) in an email. In the email,

she·identifiesthe name ofa cleared individual who might be proposed for program work, who later came to work

with the eventual successful ofBor. The Report, in our opinion, is highly speculative in concluding that the use of

"i.e." indicated pn>selection, for all the reuons set forth above. Use of"ie." rather than "e.g." is a common

gnunmatic:al error and in filct, is coDSidered one ofthe top ten errors seen in college level writing or tecbnical

documents. Reference, e.g., http://www.mbatutes.comltop-5-most-common-english-grammar-errors. Further, the

Contracting Officer was not in a position to unilaterally select the successful vendor. Evaluators would be involved

in analyzing proposals and generally making li recommendation as to the most highly qualified technical offer, and

be in a position to comment before any final aWllI'd decision was made. A contracting officermakes her own

ultimate aWllI'd decision, but in doing so, she relies on the input from the evaluation staff'and, ifshe reaches a

different decision, documents her views and why they difler from that ofher evaluation panel.

6
Appendix V 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

26 

to find additional sources that could perfonn the work instead ofsimply entering into a sole

source contract (which would have been far easier) is evidence that maximizing competition was

a prime consideration for the OA contracting officer. In preparing thisresponse, we discussed the

issue and the email with the contracting officer and she stated she had no intent ofpre-selection

but in fuet used competitive procedures.

Recommendation 3:

To ensure duties are segregated, the Office of Administrative Services should implement

. internal procedures to limit Contracting Officers from also assuming project management

and CoJitracting Officer's Technical Representative's responsibilities on the same project.

OAS does not concur with this recommendation. OMB Circular A-I 23 discusses the

management control environment and proper segregation ofduties (sepanite personnel with

authority to authorize a transaction, processthe transaction, and review the transaction).

Segregation ofduties does not restrict a contracting officer from performing contracting officer's

technical representative (COTR) responsibilities. The contracting officer, who has those duties as

an intrinsic part ofher contracting officer's responsibilities, delegates COTRs responsibilities.

The contracting officer cannot delegate a responsibility she does not have. COTRs act for the

contracting officer in certain situations and perform delegated duties as necessary to administer

an assigned contract and support the contracting officer.

A contracting officer has express authority to enter into, administer, and terminate contracts.

According to SECR 10-15, the contracting officer has authority to determine what type of

contract administration pOsition is needed for a contract and works with program officials (in this

case OAS) to identifY appropriate employees for those contract administration positions; further,

the contracting officer appoints/designates employeesto contract administration positions in

writing. The Report assumes that an individual other than the contracting officer would have

been better qualified to perform the duties often delegated to a COTR. We do not agree. There is

a dynamic balance between IT expertise and business process expertise when implementing IT

projects that support business owners. The business process requirements were critically

important when the system involved directly supported the acquisition business process. The

SEC must manage risk, since it is impossible to eliminate it, and often an agency assigns the best

available resource combining knowledge ofbusiness needs and IT requirements.

As the business sponsor ofthe APS project, OA recognizes that assistance with project planning

and coordination would have been highly desirable, and as OIT strengthens its staffing resources,

we agree that we will use those resources more fully as they become available. However, both

OA and OIT had insufficient personnel to support all projects as robustly as we might desire.

Management agrees that the contracting officer did not have as much time to manage this project

7
Appendix V 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

27 

optimally, and OIT had insufficient personnel resources to fully support the effort. However, the

businesssponsor and acquisition subject matter experts needed to be substantially involved in the

project to ensure ONs business needs were met. The Assistant Director for OA at the time had a

significant role in the APS project. ht addition to his oversight and knowledge, he chaired the

Executive Steering Committee, briefed the htfonnation Officer's Council (lOC) on a quarterly

basis, met regularly with OIT, Office ofFinancial Management (OFM) and the contractors

involved in the project, and spent roughly eight to twelve hours per week working on the APS

project Management made the decision to optimize constrained resources by not delegating

COTR duties whm inadequate staffing structures existed in both offices.

The contracting officer oversaw performance and retained contract administration. This approach

was appropriate because OIT had limited program management resources available. PRISM is a

COTS product that is compliant with federal FSIO requirements, and is a tool that has been

successfully implemmted in many federal agencies. Given resource constraints, management

believes these were appropriate decisions given the conditions existing in 2008 when those

decisions were made; Tom King and John Pezzullo, both OIT program/project managers,

supported the APS project extensively by providing technical, CPIC, CMQA, and other IT

expertise and support. Their input and guidance were critical in terms ofmanaging the technical

requirements ofthe APS project. Some oftheir responsibilities in support ofthe April 2009

Phase Irollout included system development life cycle (SDLe) processing CCBs,'labs,

documents, certification and accreditation, vulnerability testing, mitigating Plans ofAction and

Milestones (pOAM», technical advice, buying servers and equipment, setting up OIT required

environments, completing data installations, processing CCBs through SDLC and "Authoritiesto

Operate" issued after the certification and accreditation process.

During implementation, there has been significantstatutory and regulatory change, internal

improvements within the SEC in both OA and OFM, and increasing focus on OMB A-123 and

A-127. Staffoffices successfullyworked together as a cross-functional team consisting of

Federal subject matter experts and contractors in completing Phase Iimplementation ofPRISM

in April 2009. Because ofthe team's efforts, OA for the first time has a contract writing tool, a

tool that is improving the office's ability to more accurately manage contract activities and track

contract actions. Although the integration project has been delayed, Management intends to seek

an integrated solution as financial system solutions are implemented.

Despite non-concurrence with this finding, OIT and OAS together will continue to work to

strengthm the project management and COTR function at the SEC.

Recommendation 4:

The Office of Acquisitions should review existing contracts to ensure

8
Appendix V 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No. 486 

28 

that Contracting Officer's Technical Representatives are assigned for each

contract as appropriate.

OAS concurs with this recommendation. While it is neither appropriate nor necessary to appoint

a COTR. for all existing contracts- for instance, aged contracts pending closeout. closed out

contracts that are being retained in accordance with records management policies, or certain

contracts that are not technical in nature - OA has already begun an effort to review active

contracts. The contracting officer will determine whether it is appropriate to appoint an

Inspection and Acceptance Official or a COTR. to those active contracts.

Recommendation 5:

The Office of Administrative Services (OAS), in conjunction with the Office of Financial

Managemen~should evaluate the reconciliation tool in order to determine, on a cost to

benefit basis, whether it would be feasible to correct the deficiencies noted. OAS should

then .decide whether the corrections should be performed by Commission personnel, or by

technically competent contractor personnel.

OAS concurs with this recommendation. OA and OFM have made a decision that it is not

feasible to correct the deficiencies in the validation report. Subsequent to the IG's audit, the

FMOC made a decision to go to a shared service provider for its financial management system.

That and upgrades to PRISM required to accommodate new reporting requirements warrant

deterring corrections to this report. This qualitative decision supersedes the need to conduct a

cost benefit analysis since it is inappropriate to revise a reconciliation report for the two existing

systems until the financial system is determined. We request this recommendation be closed.
Appendix VI 

OIG Response to Management’s Comments 

The Office of Inspector General is pleased that the Office of Administrative 

Services (OAS) has concurred with recommendations no. 2, 4, and 5, but are 

disappointed in OAS’s non-concurrence with recommendation no. 3. The 

recommendation that OAS implement procedures to “limit” contracting officers 

from assuming certain project management duties is a prudent and appropriate 

step to take to ensure that Commission projects are managed more efficiently in 

the future. 

We are pleased that the Chief Operating Officer/Acting Chief Information Officer 

concurred with recommendation no. 1, the only recommendation directed to the 

Office of Information Technology. We believe that the independent consultant‘s 

assessment will be useful to improve the vulnerabilities and areas of concern that 

we identified in the audit. 

We believe that if all of the recommendations in this report are fully implemented, 

the Commission’s contract and procurement oversight will be significantly 

improved. 

Review of PRISM Automated Procurement System Support Contracts September 30, 2010 

Report No.486 

29 
Appendix VI 

Audit Requests and Ideas

The Office of Inspector General welcomes your input. If you would like to 

request an audit in the future or have an audit idea, please contact us at: 

U.S. Securities and Exchange Commission 

Office of Inspector General 

Attn: Assistant Inspector General, Audits (Audit Request/Idea) 

100 F Street, N.E. 

Washington D.C. 20549-2736 

Tel. #: 202-551-6061 

Fax #: 202-772-9265 

Email: oig@sec.gov 

Hotline 

To report fraud, waste, abuse, and mismanagement at SEC, 

contact the Office of Inspector General at: 

Phone: 877.442.0854 

Web-Based Hotline Complaint Form: 

www.reportlineweb.com/sec_oig