24-021-OITA - IDT Innovation _Quality Assurance Surveillance Plan.docx

PWS Attachment 1

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Identity Theft (IDT) Innovation ii

TABLE OF CONTENTS

7 ATTACHMENTS: A PERFORMANCE REQUIREMENTS SUMMARY

B QUALITY ASSURANCE SURVEILLANCE FORM

QUALITY ASSURANCE SURVEILLANCE PLAN

(QASP)

1. INTRODUCTION

This quality assurance surveillance plan (QASP) is pursuant to the requirements listed in the Performance Work Statement (PWS) entitled Identity Theft (IDT) Innovation. This plan sets forth the procedures and guidelines the Research, Applied Analytics, and Statistics (RAAS) Project Management Office will use in ensuring the required performance standards or services levels are achieved by the contractor.

This Attachment describes the desired outcomes, performance requirements, standards, surveillance methods, and incentives for this award order. The Table below is divided into 9 discrete tasks. It is intended to align Contractor’s goals and objectives with the IRS program goals and objectives as follows:

The Tables below reflects the guidance and methods for determining metrics, Acceptable Quality Levels, and incentives/disincentives for this PWS.

All Deliverables, Documents, and Services shall satisfy program and project requirements, and comply with IRS CMMI standards, existing IRS standards and guidelines, and integrate with IRS, security requirements and Section 508.

1.1 Purpose

The purpose of the QASP is to describe the systematic methods used to monitor performance and to identify the required documentation and the resources to be employed. The QASP provides a means for evaluating whether the contractor is meeting the performance standards/quality levels identified in the PWS and the contractor’s quality control plan (QCP), and to ensure that the government pays only for the level of services received.

This QASP defines the roles and responsibilities of all members of the team, identifies the performance objectives, defines the methodologies used to monitor and evaluate the contractor’s performance, describes quality assurance documentation requirements, and describes the analysis of quality assurance monitoring results.

1.2 Performance Management Approach

The PWS structures the acquisition around “what” service or quality level is required, as opposed to “how” the contractor should perform the work (i.e., results, not compliance). This QASP will define the performance management approach taken by the RAAS Project Management Office to monitor and manage the contractor’s performance to ensure the expected outcomes or performance objectives communicated in the PWS are achieved. Performance management rests on developing a capability to review and analyze information generated through performance assessment. The ability to make decisions based on the analysis of performance data is the cornerstone of performance management; this analysis yields information that indicates whether expected outcomes for the project are being achieved by the contractor.

Performance management represents a significant shift from the more traditional quality assurance (QA) concepts in several ways. Performance management focuses on assessing whether outcomes are being achieved and to what extent. This approach migrates away from scrutiny of compliance with the processes and practices used to achieve the outcome. A performance-based approach enables the contractor to play a large role in how the work is performed, as long as the proposed processes are within the stated constraints. The only exceptions to process reviews are those required by law (federal, state, and local) and compelling business situations, such as safety and health. A “results” focus provides the contractor flexibility to continuously improve and innovate over the course of the contract as long as the critical outcomes expected are being achieved and/or the desired performance levels are being met.

1.3 Performance Management Strategy

The contractor is responsible for the quality of all work performed. The contractor measures that quality through the contractor’s own quality control (QC) program. QC is work output, not workers, and therefore includes all work performed under this contract regardless of whether the work is performed by contractor employees or by subcontractors. The contractor’s QCP will set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS. The contractor will develop and implement a performance management system with processes to assess and report its performance to the designated government representative. The contractor’s QCP will set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS. This QASP enables the government to take advantage of the contractor’s QC program. The QCP shall be submitted 60 days after award order.

1.3.2 The government representative(s) will monitor performance and review performance reports furnished by the contractor to determine how the contractor is performing against communicated performance objectives. The contractor will be responsible for making required changes in processes and practices to ensure performance is managed effectively.

2. ROLES AND RESPONSIBILITIES

2.1 The Contracting Officer

The contracting officer (CO) is responsible for monitoring contract compliance, contract administration, and cost control and for resolving any differences between the observations documented by the Contracting Officer's Representative (COR) and the contractor. The CO will designate one full-time COR as the government authority for performance management. The number of additional representatives serving as technical inspectors depends on the complexity of the services measured.

2.2 The Contracting Officer’s Representative

The COR is designated in writing by the CO to act as his or her authorized representative to assist in administering a contract. COR limitations are contained in the written appointment letter. The COR is responsible for technical administration of the project and ensures proper government surveillance of the contractor’s performance. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the government’s behalf. Any changes that the contractor deems may affect contract price, terms, or conditions shall be referred to the CO for action. The COR will have the responsibility for completing QA monitoring forms used to document the inspection and evaluation of the contractor’s work performance. Government surveillance may occur under the inspection of services clause for any service relating to the contract.

3. IDENTIFICATION OF REQUIRED PERFORMANCE STANDARDS/QUALITY LEVELS

The required performance standards and/or quality levels are included in the PWS and in Attachment A, “Performance Requirements Summary.”

4. METHODOLOGIES TO MONITOR PERFORMANCE

4.1 Surveillance Techniques

In an effort to minimize the performance management burden, simplified surveillance methods shall be used by the government to evaluate contractor performance when appropriate. The primary methods of surveillance are:

· Periodic Reviews – COR typically performs the periodic reviews on a monthly basis.

4.2 Customer Feedback

The contractor is expected to establish and maintain professional communication between its employees and customers. The primary objective of this communication is customer satisfaction. Customer satisfaction is the most significant external indicator of the success and effectiveness of all services provided and can be measured through customer complaints.

Performance management drives the contractor to be customer focused through initially and internally addressing customer complaints and investigating the issues and/or problems, but the customer always has the option to communicate complaints to the COR, as opposed to the contractor.

Customer complaints, to be considered valid, must set forth clearly and in writing the detailed nature of the complaint, must be signed, and must be forwarded to the COR. The COR will accept those customer complaints and investigate.

Customer feedback may also be obtained either from the results of formal customer satisfaction surveys or from random customer complaints.

4.3 Acceptable Quality Levels

The acceptable quality levels (AQLs) included in Attachment A, Performance Requirements Summary Table, for contractor performance are structured to allow the contractor to manage how the work is performed. For certain critical activities such as those involving contractual deliverables, invoice submission, and management reports, the desired performance level is established at 100 percent. Other levels of performance are keyed to the relative importance of the task to the overall mission performance of the RAAS Project Management Office.

5. QUALITY ASSURANCE DOCUMENTATION

5.1 The Performance Management Feedback Loop

The performance management feedback loop begins with the communication of expected outcomes. Performance standards are expressed in the PWS and are assessed using the performance monitoring techniques shown in Attachment A.

Approval of all deliverables will be the responsibility of the contract Program Manager. The COR will provide acceptance of deliverables.

5.2 Monitoring Forms

The government’s QA surveillance, accomplished by the COR, will be reported using the monitoring form in Attachments B. The form, when completed, will document the government’s assessment of the contractor’s performance under the contract to ensure that the required results of contractual deliverables, invoice submission, and management reports are being achieved.

5.2.1 The COR will retain a copy of all completed QA surveillance forms.

6. ANALYSIS OF QUALITY ASSURANCE ASSESSMENT

6.1 Determining Performance

Government shall use the monitoring methods cited to determine whether the performance standards/service levels/AQLs have been met. If the contractor has not met the minimum requirements, it may be asked to develop a corrective action plan to show how and by what date it intends to bring performance up to the required levels. Failure to meet the AQL may result in a negative performance assessment. Likewise, a positive performance assessment is the incentive for the contractor to perform well.

6.2 Reporting

The COR will prepare a written report quarterly summarizing the overall results of the quality assurance surveillance of the contractor’s performance. This written report will become part of the QA documentation. It will enable the government to demonstrate whether the contractor is meeting the stated objectives and/or performance standards, including cost/technical/scheduling objectives.

6.3 Reviews and Resolution

The COR may require the contractor’s project manager, or a designated alternate, to meet with the COR and other government IPT personnel as deemed necessary to discuss performance evaluation. The COR will define a frequency of in-depth reviews with the contractor, including appropriate self-assessments by the contractor; however, if the need arises, the contractor will meet with the COR as often as required or per the contractor’s request. The agenda of the reviews may include:

· Monthly performance assessment data and trend analysis.

· Issues and concerns of both parties.

· Projected outlook for upcoming months and progress against expected trends, including a corrective action plan analysis.

· Recommendations for improved efficiency and/or effectiveness.

· Issues arising from the performance monitoring processes.

The COR must coordinate and communicate with the contractor to resolve issues and concerns regarding marginal or unacceptable performance.

The COR and contractor should jointly formulate tactical and long-term courses of action. Decisions regarding changes to metrics, thresholds, or service levels should be clearly documented. Changes to service levels, procedures, and metrics will be incorporated as a contract modification at the convenience of the CO.

6.4 Acceptance of Deliverables

Due to the complexities of the technical work as identified in the PWS requirement tasks, the government has 20 workdays to review deliverables, Contractor has 10 workdays to perform revisions, government has 10 workdays to approve the final version. Deliverables will be invoiced upon completion once agreed upon by IRS staff. After acknowledgement and acceptance of deliverable(s), the Contractor’s invoice can be submitted for payment. However, this can only be done after an email including the COR and any other key personnel have approved and cleared the invoice to allow for timely payments prior to the invoice submission.

Attachment A: PERFORMANCE REQUIREMENTS SUMMARY Required Services (Tasks) Performance Standards Acceptable Quality Levels Methods of Surveillance Incentive /Disincentive (Positive and/or Negative)

Prepare/Complete Sign-In Sheet for Meeting Participants

Take Meeting Notes.

Provide copy of Briefing Slide/notes presented to include names, telephone numbers and addresses (physical and e-mail) for key task participants as well as roles for both the Contractor and Program Office.

Due 5 days after Orientation Briefing.

This briefing is a one-time only occurrence.

100% review by COR and/or IRS PM.

Positive / Negative Performance Evaluation may result.

Task 2: Ramp-Up Knowledge Transfer / Transition-In (Optional)

Knowledge Transfer Plan

Transition-in Checklist Delivers draft Knowledge Transfer Plan (KTP) at the required time.

Delivers Final KTP at the required time.

Executes knowledge transfer in accordance with the KTP on agreed upon dates.

Delivers documents which meet all of the requirements identified in Section 4.2 in this PWS.

The Contractor shall follow the approved Transition-In Plan submitted as part of their proposal and keep the Government fully informed of status throughout the transition-in period. This will be supported concurrently with Ramp-Up/ Knowledge Transfer, as applicable.

The Government will inspect all intermediate products/ artifacts and/or documentation and instruction as they are presented to minimize the effects of any misunderstandings to determine if the Contractor has provided the necessary information, artifacts and documentation to meet this requirement.

The Government will review and accept or reject deliverables in accordance with all of the elements of Documentation Quality.

Positive / Negative Performance Evaluation may result.

Deliverable 0003.2: Weekly and Ad Hoc Briefings

Deliverable 0003.3: Close-out Meeting and Activities (Final Work Summary Report (to include document inventory and identify any gaps)

The Contractor shall deliver Summary Reports at the required times.

Deliverable 0005.2 - AI Governance Reporting Returns associated with IDT clusters or non-IDT clusters are selected or excluded, as appropriate, and delivered to stakeholders on a weekly basis to IRS stakeholders from late January to November.

A filing season analysis delivered by the end of August that allows IRS stakeholders to determine whether changes need to be implemented for the next year.

Deliverable 0006.2: Anomaly Detection Model

Deliverable 0006.3: Abuse Mitigation, Modeling, and Analysis

Deliverable 0006.4 - AI Governance Reporting Contractor recommended actions must address threats demonstrated in observed data and include supporting rationale and quantify the expected impact of recommended changes to policies, procedures, or protection activities.

Contractor-recommendations for multiple risk factors around the IRS involving data breaches, IDT, or other risk factors must be validated by stakeholders as worthy of response. Recommendations must include clear, understandable, reproducible metrics used to identify data breaches/losses.

Deliverable 0007.2 - AI Governance Reporting Inventory classification will be evaluated on the completeness of the coverage, measured by how the thoroughness of the categorization and materiality for business-side uses. It will also be evaluated by the appropriateness/ usefulness of the classification measures to the business unit.

Recommendations for prioritization may be measured by impact along metrics not limited to but including impact to Service, impact to taxpayer, and quantifying IDT populations impacted.

Deliverable 0008.2 - AI Governance Reporting Document the Planned Scope of the Research Sprint: The Documentation must be clear and adhere to reasonable timelines, e.g., with minimum of errors (fewer than 5) and with revised documents received within 2 days. Suggestions accepted by majority of key executive stakeholders.

Document Methods and Brief Out on Sprint Status: Methods must be agreed upon by stakeholders and the briefing documents should be interpretable by stakeholders. The metrics or indicators should be data-driven and accurate with assumptions and rationale documented.

Summarize Sprint Outcome: Documentation must be interpretable at the executive level with agreed-upon rationale to measure impact.

If deficiencies are found, the Contractor will be notified by the COR in writing of the deficiencies within the 5-day review period and the final product.

marked as “Rejected" and will be returned with appropriate annotations indicating the deficiencies.

The Contractor shall have five (5) working days from the notification of deficiencies to provide final corrected project products.

Acceptable deliverables shall be acknowledged by the COR via email. If the 5-day review period ends without receipt of notification of deficiencies, the Contractor shall inquire about the final acceptance by the Government.

The Government will inspect all intermediate products/artifacts and/or documentation and instruction as they are presented to minimize the effects of any misunderstandings to determine if the Contractor has provided the necessary information, artifacts, and documentation to meet this requirement.

Each work product/artifact and/or documentation, including the Walkthrough, shall be provided to the government project manager and COR.

Upon receipt of the work products/artifacts, the COR will certify that the IRS has taken possession of the work product/artifact, and/or documentation and will review it for deficiencies.

Any work product/artifact and/or documentation will be reviewed by the COR or assigned designee within 5 working days.

Positive / Negative Performance Evaluation may result.

PERFORMANCE REQUIREMENTS

Performance Standard requirements for this PWS are identified as indicated in table above. The Performance Standards are a critical component of the performance objectives that relate directly to the overall objectives of the PWS herein. A Performance Standard is associated with each performance requirement.

Attachment B: Quality Assurance Surveillance Form

QUALITY ASSURANCE SURVEILLANCE FORM

(Additional pages may be added)

SERVICE or STANDARD:

MONITORING PERIOD:

SURVEILLANCE METHOD (Check):

· COR Monitoring Inspection Testing Random Sampling Report

· User/Customer Observations/Complaints

LEVEL OF SURVEILLANCE (Check):

· Weekly Monthly Quarterly As needed

CRITERIA/DOCUMENTATION USED FOR SAMPLE:

ANALYSIS OF RESULTS:

Contractor’s Performance (Check): Meets Standards Does Not Meet Standards

Narrative of Performance During Survey Period:

PREPARED BY: DATE: