PART 4 - PROCEDURES

(a) At a minimum, HCAs or their SCOs will -

(1) Conduct PMRs on contracting activities, to include subordinate contracting offices, regardless of the level, at least once every three years (36 months)

(2) Provide the schedule of reviews no later than 31 August of the preceding fiscal year to the ODASA(P) Procurement Insight/ Oversight (PI) Directorate.

(b) Waivers.

(1) The DASA(P) may grant, in writing, a 12-month extension, to the 36-month time frame, on a one-time basis, when circumstances are justified.

(2) Waiver requests shall be submitted with the annual PMR schedule of reviews.

(c) The DASA(P) may require, in writing, more frequent reviews of contracting activities as deemed necessary.

(a) The PMR is a tiered program that includes the following types of assessments:

(1) Type 1: Reviews of Internal Controls (other than key internal controls) conducted by the Contracting Activity (CA) Management, as needed, using assessment methods in accordance with Command, CA, local or other applicable guidance.

(2) Type 2: Reviews of Key Internal Controls conducted by the HCAs and SCOs to Offices of the Directors of Contracting and other subordinate contracting offices, at least once every three years (36 months), using the Internal Control Question Set, and any supplemental question sets or toolkits.

(3) Type 3: Reviews of Internal/Key Internal Controls, conducted by the ODASA(P), as needed for special assistance reviews and assessments, on selected CAs and/or ACE-wide, using the applicable question set(s).

(4) Type 4: Reviews of Strategic Controls conducted by the ODASA(P), annually, using the Strategic Control Question Set for CAs across the ACE.

(b) Top-level information on review responsibility, method of assessment, frequency of assessment, and assessment instructions is provided in the table below.

Type	Control Type	Primary Responsibility for Control Assessment	Method of Assessment	Frequency of Control Assessment	Assessment Instructions
1	Internal Controls (Other than Key Controls	Contracting Activity (CA) Management	Business clearance, legal review, local policy and compliance reviews and self- assessments	Action-by-Action IAW CA	CA
2	Key Internal Controls	HCAs, SCOs	Internal Control Question Set *Contingency Contracting Toolkit (as applicable)	At least once every three years (36 months)	AFARS Appendix CC
		HCA	SCO Toolkit	Annually	AFARS Appendix CC
		Per applicable policy	GPC Toolkit	Per applicable policy	AFARS Appendix EE
		Per applicable policy	OSBP Toolkit	Per applicable policy	Per Army OSBP
		Per applicable policy	OT Question Set	Per applicable policy	Per ODASA(P)
		Per applicable policy	Assistance Awards Question Set	Per applicable policy	Per ODASA(P)
3	Key Internal Controls	ODASA(P)	Internal Control Question Set	As required/requested	AFARS Appendix CC
4	Strategic Controls	ODASA(P)	Strategic Controls Toolkit	Annually	AFARS Appendix CC

*Contingency Contracting Toolkit

In conjunction with any PMR performed with continency contracting efforts/missions, the HCA shall utilize the Contingency Contracting Toolkit, located on the PMR SharePoint, to assess the key internal controls of their contingency contracting operations.

(a) For ODASA(P)-led PMRs, the ODASA(P) will notify contracting activity 90 days, or as soon as practicable, before a planned PMR. The contracting activity shall provide the following in advance: metrics, specified statistics, lists of contracts, orientation data (such as vision and mission statements and standard operating procedures), logistical support, and copies of previous review reports and previous corrective action plans. The activity may identify special areas of emphasis and assistance after being notified of a planned PMR.

(b) All other PMRs should comply with the ODASA(P) PMR Standard Operating Procedures (SOP). Commands should establish Command/local procedures to supplement the ODASA(P) PMR SOP.

(a) Reports of PMR results will contain a risk assessment, analysis of issues, commendations, observations, findings, and recommendations as appropriate. PMR report findings must be specific and include sufficient information to enable root cause analysis. PMR recommendations must be based on supported findings and be actionable.

(b) Timely PMR result reports shall be provided. At a minimum -

(1) Reviewers shall submit the initial PMR report to the reviewed activity within 30 business days of the Out-brief.

(2) The responsible official must review and approve the Corrective Action Plans (CAP) and prepare a Final PMR report within 30 business days of CAP receipt.

(c) CAPs shall be created and implemented by the contracting activity. At a minimum -

(1) The contracting activity reviewed shall submit a CAP within 30 business days of report receipt.

(2) The reviewed activity must complete corrective actions – if any – within the agreed timeframe, inform the PMR Team Lead of corrective actions taken, and request closure of the CAP.

(a) The purpose of the CAP is to strengthen internal controls by identifying and resolving organizational weaknesses and deficiencies. The CAP contains data such a s a CAP Summary, CAP with Deficiency Score, Findings, Root Cause, along with the ability to track CAP status updates.

(b) A CAP is required when the contracting activity receives an Overall PMR Risk of Non-Compliance Rating of Medium (Yellow) or High (Red). Depending on the frequency of occurrence, the contracting activity shall take corrective action for findings and deficiencies related to Severity 2 and 3 questions.

CAPs shall be created and implemented by the contracting activity. At a minimum -

The contracting activity reviewed shall submit a CAP within 30 business days of Final PMR Report receipt.

The reviewed activity must complete corrective actions – if any – within the agreed timeframe, inform the PMR Team Lead of corrective actions taken, and request closure of the CAP.

For additional information on the CAP process, please reference the ODASA(P) PMR Guidebook, section 5, and the CAP Informational Guide, located on the PMR SharePoint.