OCI is an old friend of ours and all GOVCON.  It is often the sole focus of a protest or one of several aspects of a protest.  Sadly, for many protesters, challenging on the basis of OCI often falls flat.  This case is particularly interesting to explore a risky capture move and how OCI was an integral risk.  This is one of many blogs addressing the tactics of winners and losers in GOVCON bids as a part of our Deadly Sins series! 

U.S. Department of Health and Human Services, Centers for Medicare and Medicaid Services (CMS), Operational analytics (OA) task order for management and oversight for the Federal Facilitated Exchange (FFE)

Protest Decision Date: June 13, 2024

A Square Group (ASG) protested the award decision to Cogent on several bases.  We have the ever-popular challenge of the evaluation itself (technical and management), the best suited vendor determination (CMS uses down select methods to eliminate bidders early and often) and the overall best-value trade-off.  However, the always popular impaired objectivity organizational conflict of interest (OCI) protest reason is front and center here.

The overall evaluation looks straightforward.  Note Table 1 below with the “tale of the tape” between the protester and the winner.

The best value trade-off decision made by CMS was seemingly reasonable considering a 22% difference in price and close non-cost evaluation.  This is important to recognize because we have observed that CMS leans toward being a value buyer, meaning this 22% price premium and small difference in non-cost factors would make it difficult to justify such a greater cost.

ASG was the incumbent on this contract, an advantage that was recognized by CMS as a major benefit of awarding this to them again.  However, CMS did not seem inclined to pay a heavy premium for an incumbent.

Meanwhile, we get on to the main event – the OCI protest vs. CMS and Cogent.

Details matter and firewalling is a risky proposition

We have observed in other blogs and the many, many protest decisions that waging a protest battle using OCI as your ally often ends up with a loss and a less plentiful bank account.  The GAO tends to give the U.S. Government the benefit of the doubt (as our broad observation) when determining if OCI exists and if it has been successfully mitigated.  In this case, both CMS and Cogent contribute to pulling on the threads of the award decision to unravel it. 

What happened? 

Key subcontractor is the target of oversight, but they’re firewalled!

Cogent was the challenger, so what did they do? They brought in “a ringer” to give them a boost on technical expertise and domain knowledge.  This key subcontractor was affiliated with the Federally Facilitated Exchange (FFE) against which this contract examines.  More specifically, and borrowed from the protest decision, we have the below explanation.  Note “REDACTED” is used throughout as the unnamed subcontractor to Cogent. 

…CMS identified a potential OCI because [REDACTED] supports the FFE under a separate contract, and the OA task order’s SOW requires the contractor to reconcile and validate FFE enrollment and payment data.

The agency explains this task as follows:

The OA contractor performs validation of enrollment and payment data using logic developed independently. This independent validation provides CMS confidence that the enrollment data supporting the monthly payment processing are correct. It is imperative that these determinations remain independent so that we prevent as best as possible any flaw in these calculations occurring in both sets of calculations.

As CMS learned about Cogent’s solution, the plot thickened:

When the agency reviewed Cogent’s quotation, the TEP identified a potential OCI because [REDACTED]–the holder of the FFE contract–was proposed as a subcontractor.

While their name is not stated, the implication here is the Cogent subcontractor is none other than Accenture. We cannot confirm that at 100 percent, but the context of the protest decision leaves some well crafted breadcrumbs to consider and very little doubt as to who the proposed subcontractor is. 

If it is indeed Accenture (wink wink, nudge nudge) is the long-time FFE prime and they would certainly have been able to elevate Cogent against an entrenched and capable incumbent in ASG. However, bringing on the contractor for which you are supposed to provide oversight is inherently risky.  As stated in the protest decision:

The concern being that as a subcontractor on the contract, [REDACTED] would be responsible for validating the enrollment and payment data it produced under its FFE contract.

How did Cogent plan to get around this?

Cogent stated it would “firewall [REDACTED] personnel from participation in reviewing and/or validating payments data generated by [REDACTED] personnel on the FFE contract. Only personnel from Cogent People or its other subcontractors will perform validation of [REDACTED]-generated payment data and reports on the OA contract.” Cogent added that it would “provide strict oversight of the payments data validation process” –including “continuous monitoring of all data validation activities” –and it would relocate “resources assigned to payments data validating as necessary and appropriate.”

Ah.  Firewalling.  Here we go.  What is interesting is CMS accepted this solution and moved on.

Understand that this OA contractor is validating enrollment and payment data produced under the FFE contract.   

Did we mention that another key person on Cogent’s team was a business analyst lead that was responsible for validating enrollment data and was an employee for [REDACTED]? 

To recap…we have a key subcontractor that is supposed to be well isolated that has a key person overseeing data that has a material impact on their employer’s flagship contract at CMS. 

What could possibly go wrong?  Might we have impaired objectivity at stake? 

Payment data, enrollment data, what’s the difference?

Remember that CMS accepted this mitigation plan from Cogent.  As the GAO examined the CMS contracting officer’s decision, they found problems.  Note this statement from the GAO:

We find the contracting officer’s position unreasonable and not supported by the record.  As noted above, when Cogent explained its mitigation approach, it specifically stated that [REDACTED] would be firewalled from reviewing or validating payments data. Cogent never stated it would firewall [REDACTED] from validating enrollment data or FFE data generally.

CMS somewhat casually stated that payments and enrollment data were used interchangeably.  However, the SOW itself was very clear to define them as different. 

GAO rejected CMS’s position that firewalling was sufficient when Cogent’s own solution showed that it was using that [REDACTED] subcontractor in a role that created impaired objectivity. 

What is the lesson learned?

Protesting based on an OCI is typically a losing proposition for the protester.  However, when mistakes are made by the awarding agency in terms of how carefully they scrutinize mitigation plans, this can unravel an award decision.  Further, consider a competitor relying heavily on a key subcontractor with true OCI risk and integral to the overall solution.  This dependency can be used to challenge their viability as a prime contractor that is free of OCI.  Firewalling solutions can work, but it’s a risky business worth challenging. 

Does this topic interest you?  Are you interested in finding out more about trends in contract award decisions and even more about what has unraveled award decisions?  Check out our analysis of agency award decisions and trends in our FedAgency Insight reports.  Contact us today! 

© FedSavvy Strategies and FedSavvy Strategies blog, 2012-2024. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to FedSavvy Strategies and FedSavvy Strategies blog with appropriate and specific direction to the original content.

Author: Brian Lindholm