You must follow your own written procurement procedures, your state and local laws, and the federal rules in 2 CFR 200.318–200.327, using whichever is most restrictive. If you don’t comply, FEMA can deny all contract costs or pay only the portion it finds reasonable.
Your procurement policy, solicitations, bids, selection documentation, cost or price analysis, contracts, change orders and invoices. Source: PAPPG Table 15.
A prequalified contractor list is not a contract. You still have to compete the work, and you can’t exclude firms that weren’t on the list.