Draft_Attachment_A_-_QASP..pdf

QUALITY ASSURANCE SURVEILLANCE PLAN

CREDIT CARD PROGRAM REQUIREMENTS

FOR E-PAYMENTS

Issued: 05/01/2019

TABLE OF CONTENTS

1 INTRODUCTION

1.1 Purpose

1.2 Performance Management Approach

1.3 Performance Management Strategy

2 ROLES AND RESPONSIBILITIES

2.1 The Contracting Officer

2.2 The Contracting Officer’s Representative

2.3 Government's Representative Testers

3 IDENTIFICATION OF REQUIRED PERFORMANCE STANDARDS/QUALITY LEVELS

4 METHODOLOGIES TO MONITOR PERFORMANCE

4.1 Surveillance Techniques

4.2 Validated Customer Feedback (Inspection Process by Customer)

4.3 Acceptable Quality Levels

5 QUALITY ASSURANCE DOCUMENTATION

5.1 The Performance Management Feedback Loop

5.2 Monitoring Forms

6 ANALYSIS OF QUALITY ASSURANCE ASSESSMENT

6.1 Determining Performance

6.2 Reporting

6.3 Reviews and Resolution

6.4 Incentives and Disincentives ……………………………………………………………………………4

6.5 Schedule Development …....…………………………………………………………………………….5

6.6 Tracking of Surveillance ………………………..………………………………………………………5

ATTACHMENT 1: QUALITY ASSURANCE SURVEILLANCE PLAN

ATTACHMENT 2: CONTRACT DISCREPANCY REPORT ………………….……………….……..19

e-Payments (Electronic Payments) 1

1 INTRODUCTION

This Quality Assurance Surveillance Plan (QASP) is pursuant to the requirements listed in the performance work statement (PWS) entitled Electronic Payments (e-Payments). This plan sets forth the procedures and guidelines Internal Revenue Service will use in ensuring the required performance standards or services levels are achieved by the contractor. The Government will inspect for compliance with Contract terms throughout the Contract period using the Quality Assurance Surveillance Plan (see

Attachment 1).

1.1 Purpose

1.1.1 The purpose of the QASP is to describe the systematic methods used to monitor performance and to identify the required documentation and the resources to be employed. The QASP provides a means for evaluating whether the contractor is meeting the performance standards/quality levels identified in the PWS and the contractor’s quality control plan (QCP) in accordance with this zero-dollar contract.

1.1.2 This QASP defines the roles and responsibilities of all members of the Credit Card Program

Team, identifies the performance objectives, defines the methodologies used to monitor and evaluate the contractor’s performance, describes quality assurance documentation requirements, and describes the analysis of quality assurance monitoring results.

1.2 Performance Management Approach

1.2.1 The PWS structures the acquisition around “what” service or quality level is required, as opposed to “how” the contractor should perform the work (i.e., results, not compliance). This QASP will define the performance management approach taken by the W&I e-Payments Section to monitor and manage the contractor’s performance to ensure the expected outcomes or performance objectives communicated in the PWS are achieved. Performance management rests on developing a capability to review and analyze information generated through performance assessment. The ability to make decisions based on the analysis of performance data is the cornerstone of performance management; this analysis yields information that indicates whether expected outcomes for the project are being achieved by the contractor.

1.2.2 Performance management represents a significant shift from the more traditional quality assurance (QA) concepts in several ways. Performance management focuses on assessing whether outcomes are being achieved and to what extent. This approach migrates away from scrutiny of compliance with the processes and practices used to achieve the outcome. A performance-based approach enables the contractor to play a large role in how the work is performed, as long as the proposed processes are within the stated constraints. The only exceptions to process reviews are those required by law (federal, state, and local) and compelling business situations, such as safety and health. A “results” focus provides the contractor flexibility to continuously improve and innovate over the course of the contract as long as the critical outcomes expected are being achieved and/or the desired performance levels are being met.

1.3 Performance Management Strategy

1.3.1 The Contractor is responsible for the quality of all work performed. The Government representative(s) will monitor performance and review performance reports furnished by the

Contractor to determine how the Contractor is performing against communicated performance objectives. The Contractor will be responsible for making required changes in processes and practices to ensure performance is managed effectively.

2 ROLES AND RESPONSIBILITIES

e-Payments (Electronic Payments) 2

2.1 The Contracting Officer

The Contracting Officer (CO) is responsible for monitoring contract compliance, contract administration, and for resolving any differences between the observations documented by the Contracting Officer's

Representative (COR), and the contractor. The CO will designate one full-time COR as the government authority for performance management. The number of additional representatives serving as technical inspectors depends on the complexity of the services measured, as well as the contractor’s performance, and must be identified and designated by the CO.

2.2 The Contracting Officer’s Representative

The (COR is designated in writing by the CO to act as his or her authorized representative to assist in administering a contract. COR limitations are contained in the written appointment letter. The COR is responsible for technical administration of the project and ensures proper government surveillance of the contractor’s performance. The COR is responsible for documenting the Contractor’s performance through

Contractor Performance Assessment Report System (CPARS) prior to forwarding to the CO. The CO will review the document and forward to Contractor. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the government’s behalf. Any changes that the contractor deems necessary that may affect the terms or conditions of the contract shall be referred to the CO for action. The COR will have the responsibility for completing QA monitoring forms used to document the inspection and evaluation of the Contractor’s work performance.

2.3 Government’s Representative Testers

The Government Representative Tester (GRT) will test and or review the Contractor’s electronic tax payment processing service system for functional requirements/user interface, information technology, physical security, and personnel security (background investigation check). All testing will be conducted in accordance with the contract’s C.2 Mandatory Business Requirements. The GRT will forward all testing results to the COR, and in turn, the COR will review and share the results with the Contractor.

3 IDENTIFICATION OF REQUIRED PERFORMANCE STANDARDS/QUALITY

LEVELS

The required performance standards and quality levels are included in C. 2 Mandatory Business

Requirements in the PWS and in Attachment 1. If the Contractor meets the required service, they will be eligible to exercise the next contract Option year. If the Contractor fails to meet the required service, this will result in the COR documenting the CPARS accordingly. The Government will evaluate the

Contractor’s services. The Contracting Officer, government project office, and the COR will consider other contractual methods to help the Contractor achieve satisfactory contract performance. The government may, or may not, exercise the next Option year.

4 METHODOLOGIES TO MONITOR PERFORMANCE

4.1 Surveillance Techniques

In an effort to minimize the performance management burden, the QASP will be used by the

Government to evaluate Contractor performance. The primary method of the QASP is:

• 100% Inspection Reviews - Weekly, monthly, semi-annual and annual (as applicable), the COR will review the contract requirements and enter any failed items into the QASP

• Quarterly Inspection Status Reports - From the Credit Card Project Office/COR to the CO

• Contract Discrepancy Report (CDR) – The COR will complete and sign the CDR, and the

Contractor shall sign it as well.

4.2 Validated Customer Feedback (Inspection Process by Customer) e-Payments (Electronic Payments) 3

The Contractor is expected to establish and maintain tax payment processing services which allow taxpayers successfully make a debit or credit card payment transaction. The primary objective is to make the contract system is secure, safe, convenience and user friendly for the taxpayers.

Taxpayers’ issues or concerns about the payment system are address by the Contractor’s customer services representatives. In addition, complaints received by the IRS are handled accordingly.

4.3 Acceptable Quality Levels

The acceptable quality levels (AQLs) included in Attachment 1, for contractor performance is structured to allow the contractor to manage how the work is performed while providing positive or negative incentives.

5 QUALITY ASSURANCE DOCUMENTATION

5.1 The Performance Management Feedback Loop

The performance management feedback loop begins with the communication of expected outcomes.

Performance standards are expressed in the PWS and assessed using the performance monitoring techniques shown in Attachment 1.

5.2 Monitoring Forms

The Government’s QA surveillance, accomplished by the COR, will be reported using the monitoring forms in Attachments 2 and 3. The forms, when completed, will document the government’s assessment of the contractor’s performance under the contract to ensure that the required results enable the Contractor to implement electronic payment services for the Government. The COR will retain a copy of all completed QA surveillance forms.

6 ANALYSIS OF QUALITY ASSURANCE ASSESSMENT

6.1 Determining Performance

6.1.1 The Government shall use the monitoring methods cited to determine whether the performance standards/service levels/AQLs have been met. If the contractor has not met the minimum requirements, it may be asked to develop a corrective action plan to show how and by what date it intends to bring performance up to the required levels.

6.2 Reporting

6.2.1 At the end of each quarter, the COR will prepare a Quarterly Status Report for the CO summarizing the overall results of the quality assurance surveillance of the Contractor’s performance. This written report, which includes the Contractor’s submitted monthly report and the completed quality assurance monitoring forms (Attachment 2 and 3), will become part of the

QA documentation. It will enable the Government to demonstrate whether the Contractor is meeting the stated objectives and/or performance standards, including technical and scheduling objectives. For any requirements not met, the COR will prepare and sign a CDR (Attachment 3) and it will be signed by the Contractor (this is to sign as receiving a copy of the CDR – not signed in agreement of the CDR). The COR will forward the completed CDR to the CO for action with the Contractor.

6.2.2 For WCAG 2.0 reporting, the Contractor shall submit Section 508 and WCAG 2.0 test plans once all technical requirements identified in PWS are met. Additionally, the Contractor shall provide updated reports within 5 business days after any updates to the interface are made. Both test plans are located in Appendix D in Attachment 1.

6.3 Reviews and Resolution

e-Payments (Electronic Payments) 4

6.3.1 The COR may require the Contractor’s project manager, or a designated alternate, to meet with the CO and other Government representatives as deemed necessary to discuss the Contractor’s performance evaluation. The agenda of the reviews may include:

• COR’s Quarterly Status Report and or CDR reports;

• Issues and concerns of both parties;

• Project Plan Work Breakdown Schedule (WBS); and

• Recommendations for improved efficiency and or effectiveness in the QCP.

6.3.2 The COR will coordinate and communicate with the Contractor to resolve issues and concerns regarding marginal or unacceptable performance.

6.4 Incentives and Disincentives

6.4.1 The FAR requires all performance-based contracting to provide Incentives and Disincentives for contract performance. The government COR will evaluate the contractor’s performance for each inspection period. Depending on the performance requirement, the contractor may be given the opportunity to re-perform the requirement at no cost to the government. However, non-performance of contract requirements and the AER will be evaluated, and the following Disincentive will become a part of the contactor’s past performance rating. When the contractor complies with the contract requirements and AER for each performance standard, the Government may apply the following Incentives:

6.4.2 Incentive

• Provide an Excellent Performance Rating in CPARS;

• Spotlight the Contractor in the IRS Solution Center publication (if applicable);

• Spotlight the Contractor in the Treasury Procurement News Publication (if applicable);

• Provide a Letter of Recommendation for the IRS Small Business or Large Business of the Year

Award (as applicable) or a Letter of Commendation from the IRS Procurement Director (if applicable) and

• Recommend the Contracting officer to exercise the next contract option year.

6.4.3 Disincentive

• The government will utilize CPARS to evaluate and document the Contractor’s non-performance and reflect the reduced value of the services performed;

• The government may, or may not, exercise the next Option year; and

• In accordance with the FAR, the governments Contracting Officer may issue further contract actions such as Cure Notice, Show Cause, etc

6.5 Schedule Development

The government program office will develop a schedule of surveillance activities based on the requirements. The schedule will show which activities the government will monitor each day, week, month, quarter, or annual inspection times. Surveillance should ideally cover all required hours of the

Contractor’s operation. The schedule will be updated as required and submitted to the COR for review.

Any changes to the schedule should be sent to the COR with written justification for the change. The schedule doesn’t have to be shown to the Contractor.

e-Payments (Electronic Payments) 5

6.6 Tracking of Surveillance

The actual surveillance activity must be comparable to the schedule. There should be a complete audit trail from the schedule, to the performance of surveillance inspections; the completion of the surveillance observation records; and or the CDRs, when applicable. An auditor, or Inspector General, must be able to track the above items to the CO's final disposition. The government will maintain a copy of all surveillance schedules, surveillance records, customer complaints, and other supporting data and forward the documents to the CO's contract file at the close of the contract.

e-Payments (Electronic Payments) 6

Quality Assurance Surveillance Plan Contract Number:

Inspection Check Sheet – e-Payments Credit Card Program Requirements March 7, 2019

Frequency of Inspection (FOI) keynotes:

W – Weekly M – Monthly Q - Quarterly SA – Semi-Annual A – Annual

ATTACHMENT 1

PERFORMANCE REQUIREMENTS SUMMARY

E-Payment (Electronic Payment)

TASK FOI AQL Performance Criteria Pass/ Fail/

NA

Rating Comments

C.2.1 A The AQL is achieved once the Contractor’s system continuously accepts payments successfully.

The tested system is Section 508/WCAG 2.0 compliant (AA criterion at the minimum) The criteria are met if the independent test confirms compliancy.

C.2.1.1. A The AQL is achieved once the testing is completed successfully.

C.2.1.2 A The AQL is achieved if the Contractor passes on-site security reviews for both IRS Physical Security and Information Technology. All documents should adhere to Section 508 and WCAG 2.0 standards.

The criteria are met if the independent test confirms compliancy. NOTE: Follow-up reviews, if needed.

C.2.1.3 A The AQL is achieved once the testing is completed

C.2.1.4. A The AQL is achieved once the testing is completed

C.2.1.5 A The AQL is achieved once the testing is completed

C.2.1.6 A The AQL is achieved once the testing is completed

C.2.1.7 W & M & A A. The AQL is achieved once the required Marketing Plan and weekly and monthly reports are received by the COR.

C.2.1.8 W & M & A A. The AQL is achieved once the required Marketing Plan and weekly and monthly reports are

C.2.2 A The AQL is achieved once the Contractor’s system continuously accepts payments successfully and provides the contact information.

C.2.2.1 A The AQL is achieved once the Contractor’s system

C.2.2.2 A The AQL is achieved once the Contractor’s system e-Payments (Electronic Payments) 7

NA

Rating Comments

C.2.3 A The AQL is achieved if funds are settled in accordance with the Credit Card Bulk Provider (CCBP) Requirements approved by the Bureau of the Fiscal Service.

C.2.4 A The AQL is achieved if funds are settled in accordance with the CCBP Requirements approved by the Bureau of the Fiscal Service.

C.2.5 A The AQL is achieved upon the CORs approval of the Contractor’s system implementation.

C.2.6 A The AQL is achieved upon the CORs approval of

C.2.6.1 A The AQL is achieved upon the CORs approval of

C.2.6.2 A The AQL is achieved upon the CORs approval of

C.2.7 A The AQL is achieved upon the CORs approval of

C.2.8 W & M The AQL is achieved when the determined once the Weekly and Monthly Transaction Reports are submitted by the Contractor and received/reviewed by the COR.

C.2.9 A The AQL is achieved once the testing is completed

C.2.10

A The AQL is achieved after the Annual Requirements Review Kickoff Meeting is adjoined and the Contractor participated.

C.2.11 M The AQL is achieved when the determined once the monthly development status report is submitted by the Contractor and received/reviewed by the COR.

C.2.12

A The AQL is achieved upon the CORs approval of

C.2.13 A The AQL is achieved upon the CORs approval of

C.2.14 A The AQL is achieved upon the CORs approval of

C.2.15

A The AQL is achieved upon the CORs approval of

C.2.16 A The AQL is achieved if funds are settled in

C.2.17 A The AQL is achieved if funds are settled in

C.2.17.1 A The AQL is achieved if funds are settled in

C.2.17.2 A The AQL is achieved if funds are settled in

C.2.18 A The AQL is achieved if funds are settled in

C.2.19 A The AQL is achieved if funds are settled in e-Payments (Electronic Payments) 8

NA

Rating Comments accordance with the CCBP Requirements approved by the Bureau of the Fiscal Service.

C.2.20 A A. The AQL is achieved if funds are settled in accordance with the CCBP Requirements approved by the Bureau of the Fiscal Service.

B. The AQL is achieved when the Contractor submit an Incident Report for any delay settlement funds.

C.2.21 A The AQL is achieved during on-site security reviews. NOTE: Follow-up reviews, if needed.

C.2.22 A The AQL is achieved during on-site security

Any modifications to software shall not fall below the current Section 508 compliance level of the software and will be validated by independent test. The system shall be Section 508/WCAG 2.0 compliant (AA criterion to the minimum).

C.2.23 A The AQL is achieved upon the CORs approval of

C.2.24 A The AQL is achieved upon the CORs approval of

C.2.25 A The AQL is determined by the Contractor’s Findings and Marketing Reports.

All surveys shall confirm to Section 508 and WCAG

2.0 standards (AA criterion to the minimum).

C.2.26 W & M The AQL is determined once the Weekly and Monthly Transaction Reports are submitted by the Contractor and received/reviewed by the COR.

C.2.27 A The AQL is achieved once the testing is completed

C.2.28 A The AQL is achieved once the COR received a completed CCBP Requirements Agreement and Registration Form.

C.2.29 A The AQL is achieved upon the CORs approval of

C.2.30 A The AQL is achieved upon the CORs approval of

C.2.31 A The AQL is achieved upon the CORs approval of

C.2.32 A The AQL is achieved upon the CORs approval of

C.2.33

A The AQL is achieved once all required documents are received by the COR. The criteria is met if the independent test confirms compliancy. All documents should adhere to Section 508 and WCAG 2.0 standards. The criteria are met if the independent test confirms compliancy.

C.2.34 A The AQL is achieved during on-site security

C.2.34.1

A The AQL is achieved during on-site security

C.2.34.2 A The AQL is achieved during on-site security

C.2.34.3 A The AQL is achieved during on-site security e-Payments (Electronic Payments) 9

NA

Rating Comments reviews. NOTE: Follow-up reviews, if needed.

C.2.35 A The AQL is achieved once all required documents are received by the COR.

All documents should adhere to Section 508 and WCAG 2.0 standards. The criteria are met if the independent test confirms compliancy.

C.2.36 SA The AQL is determined once an incident report is received and reviewed by the COR within 24 hours from the incident.

Note: This requirement will only be applicable if an incident occurs.

C.2.37 SA The AQL is determined once an incident report is received and reviewed by the COR within 24 hours from the incident

Note: This requirement will only be applicable if an incident occurs.

C.2.38 A The AQL is achieved once all required forms are

C.2.39 A The AQL is achieved once the required document is

C.2.40 A The AQL is achieved once the testing is completed

C.2.41 A The AQL is achieved once the testing is completed

C.2.42 A The AQL is achieved upon the CORs approval of

C.2.43 A The AQL is achieved once the testing is completed

C.2.43.1 A The AQL is achieved once the testing is completed

C.2.44 SA The AQL is achieved once the Contractor inform the COR of all incidents within 24 hours of occurrence or awareness and provide an incident report within 5 business days.

Note: This requirement will only be applicable if an incident occurs.

C.2.45 A The AQL is achieved once the testing is completed

C.2.46 A The AQL is achieved once the testing is completed

C.2.47 A The AQL is achieved during on-site security

C.2.48 A The AQL is achieved during on-site security

C.2.49 A The AQL is achieved during on-site security

C.2.50 W The AQL is achieved once the COR verifies the IRS PIV Background Investigation Process (PBIP) Report.

C.2.51 SA The AQL is achieved once the required reports are e-Payments (Electronic Payments) 10

NA

Rating Comments

C.2.52 A The AQL is achieved once the COR performs live testing of the Contractor’s user interface.

C.2.53 W & M The AQL is achieved once the required reports are

C.2.54 A The AQL is achieved once the Quality Control Plan is received with their proposal.

C.2.55

W The AQL is achieved when the COR receive the Weekly Chargeback report from the Contractor.

C.2.56 A & W The AQL is achieved tracking /monitor weekly progress during on-going weekly meetings with IRS Cybersecurity Team and the Contractor. NOTE:

Follow-up reviews, if needed.

C.2.57 A The AQL is achieved once the testing is completed

C.2.58. Q The AQL is achieved once the COR receives the Quarterly Report.

C.2.59 W & M The AQL is determined once the Weekly and Monthly Transaction Reports are submitted by the Contractor and received/reviewed by the COR.

OVERALL

RATING

Summary Documentation/Rating Comments:

IRS COR Signature: _______________________________________________________ Date:

Project Manager Receipt/Signature: _________________________________________ Date:

e-Payments (Electronic Payments) 11

ATTACHMENT 2

QUALITY ASSURANCE

MONITORING FORM

SERVICE or STANDARD:

SURVEY PERIOD:

SURVEILLANCE METHOD (Check):

Random Sampling 100% Inspection Periodic Inspection Customer Complaint

LEVEL OF SURVEILLANCE (Check):

Monthly Quarterly As needed

PERCENTAGE OF ITEMS SAMPLED DURING SURVEY PERIOD: ______ %

ANALYSIS OF RESULTS:

Observed Service Provider Performance Measurement Rate: ______%

Service Provider’s Performance (Check): Meets Standards

Does Not Meet Standards

Narrative of Performance During Survey Period:

PREPARED BY: ___________________________________ DATE: _________________

e-Payments (Electronic Payments) 12

ATTACHMENT 3

CONTRACT DISCREPANCY REPORT

GOVERNMENT ACTION

1. To Contractor Manager Name):

2. From (Name of Government Representative):

3. Description of Problem (Describe in detail, reference PWS Section #. Attach continuation sheet if necessary):

4. Contractor Notified (Contact Point):

5. Date & Time:

6. Signature of Contracting Officer or Authorized Government Reprehensive

7. Date:

CONTRACTOR ACTION

8. To (Contracting Officer):

9. From (Contractor):

10. Contractor Actions (Response to cause, corrective actions, and preventive measures):

11. Signature of Contractor Representative:

12. Date:

GOVERNMENT CLOSE OUT

13. Government Evaluation (Acceptance, Partial Acceptance, or Reaction):

14. Government Action (Cure Notice, Show Cause, Other):

15. Signature of Contracting Officer:

16. Date:

17. Signature of Reviewing Official (As applicable):

18. Date: