AM0003 Attachment 2 Quality Assurance Surveillance Plan.docx
DOCX document 14 KB Posted
- Solicitation number
- 47QACA26R0274
- Issued by
- Not on record
About this file
This is a Quality Assurance Surveillance Plan (QASP) for a Blanket Purchase Agreement (BPA) issued by the SBA's Office of Capital Access and Office of Credit Risk Management for Loan File Review for Risk Oversight Support Services. The QASP establishes performance standards, acceptable quality levels, and surveillance methods to monitor contractor performance under the BPA, with the Contracting Officer's Representative (COR) designated as the primary monitor, supported by a Quality Assurance team and SBA security personnel as needed.
The QASP specifies surveillance requirements across multiple service dimensions with defined acceptable quality levels and monitoring frequencies. Key performance objectives include: timely draft loan file review reports (95% submitted within 25 business days), timely final reports (95% within 5 business days of COR comments), weekly status reports (≥98% on-time delivery), monthly status reports (100% on-time), work paper completeness and organization (95% acceptable quality rating), system availability for the virtual data warehouse/CRM/DMS (99% uptime with no more than one high-impact outage per quarter), data security with zero confirmed breaches attributable to contractor negligence, and accurate dashboard reporting (98% accuracy). The plan also addresses transition-in requirements (transition plan within 30 days, core environment ready for first task order on schedule), transition-out performance (100% of SBA-owned data and work papers delivered within 60 days), key personnel continuity (no unapproved vacancies, 95% of PM changes within 30 days), and regulatory compliance (≥95% of applicable SBA process and guidance updates implemented within required timeframes). Performance deficiencies are documented and corrected at no additional cost to the Government, with the Contracting Officer authorized to issue cure notices, withhold payment, or pursue termination for default if deficiencies persist or are severe.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Quality Assurance Surveillance Plan (QASP) Blanket Purchase Agreement (BPA: Loan File Review for Risk Oversight Support Services Office: SBA Office of Capital Access (OCA) / Office of Credit Risk Management (OCRM) Prepared: March 23, 2026 Purpose This Quality Assurance Surveillance Plan (QASP) establishes the performance standards, acceptable quality levels, and surveillance methods the Government will use to monitor contractor performance under the Loan File Review for Risk Oversight Support Services Blanket Purchase Agreement (BPA). The QASP is based on the performance objectives identified in the Performance Work Statement (PWS) and ensures that services meet required quality, timeliness, and completeness standards.
Surveillance Approach The Government will employ a risk-based surveillance approach combining periodic desk reviews, sampling of deliverables and work products, system monitoring, and ongoing observation. The Contracting Officer's Representative (COR) is responsible for surveillance activities and may designate quality assurance personnel to assist with reviews.
Performance Standards and Surveillance Methods
| PWS Reference |
| Performance Objective |
| Performance Standard |
| Acceptable Quality Level (AQL) |
| Surveillance Method |
| Frequency / Responsible Party |
| 8.1, 15, Table 1 |
| Timely draft loan file review reports |
| Draft report submitted within 25 business days of receipt of complete loan file |
| 95% of draft reports meet 25-business-day requirement per quarter |
| COR review of submission dates vs. file receipt dates (desk review of dashboard and sample reports) |
| Monthly; COR/designee |
| 8.1, 15, Table 1 |
| Timely final loan file review reports |
| Final report submitted within 5 business days of COR comments |
| 95% of final reports meet 5-business-day requirement per quarter |
| COR comparison of COR comment dates to final report dates (desk review) |
| Monthly; COR/designee |
| 15.1--15.2, Table 1 |
| Timely weekly status reports/ |
dashboard
| Weekly status report delivered by close of business each Monday |
| $\geq$98% of weekly reports delivered on time per quarter |
| COR checklist; verify receipt and completeness of required data elements |
| Weekly; COR/designee |
| 15.1--15.2, Table 1 |
| Timely monthly status reports |
| Monthly status report delivered by 5th business day after month-end |
| $\geq$100% of monthly reports on time |
| COR checklist; verify receipt and completeness |
| Monthly; COR/designee |
| 7.2, 8.1, 9.1--9.2, 12.2 |
| Quality and completeness of loan file reports and Exceptions |
| Reports contain condition, criteria, cause, effect, corrective action; each Exception references specific SBA requirement and is supported in Work Papers |
| 95% of sampled reports rated "Acceptable" or better in QA review (no material omissions or unsupported Exceptions) |
| COR/QA team review of a risk-based sample of completed reviews and associated Work Papers |
| Quarterly; COR with QA support |
| 12.1--12.3 |
| Work Papers and monitoring files completeness |
| Work Papers are complete, organized, and sufficient to allow third-party replication of conclusions |
| 95% of sampled lender reviews have Work Papers meeting sufficiency criteria |
| On-site or remote inspection of Work Papers/ |
monitoring files; checklist-based QA Semi-annual; COR/QA
| 10.1--10.4, 11, 10.6 |
| Virtual data warehouse/CRM/MWS and DMS availability |
| System accessible to authorized SBA users during normal business hours; supports upload, storage, search, and tracking as described |
| 99% availability during SBA business hours; no more than 1 high-impact outage per quarter |
| Monitoring of contractor uptime reports; COR tracking of incident logs and user complaints |
| Quarterly; COR with IT/security |
| 10.2, 11, 24 |
| Security and protection of PII/confidential data |
| No unauthorized disclosures; incidents handled per SBA/contract procedures |
| Zero confirmed data breaches attributable to contractor negligence; 100% of incidents reported within required timeframes |
| Review of incident reports; SBA CISO/security input; corrective action tracking |
| Ongoing; as incidents occur; COR/CISO |
| 5.3, 15.1--15.2 |
| Accuracy of dashboards/ |
status reporting
| Status reports accurately reflect file counts, stages, due dates, and submission dates |
| 98% accuracy of key fields in sampled reports |
| COR reconciliation of sample status report entries against underlying loan review records |
| Quarterly; COR/designee |
| 8.1, 21.1 |
| Transition-In performance |
| Transition plan submitted within 30 days; core environment and processes ready to accept first Task Order by agreed date |
| 100% on-time transition plan; no delay to first TO start attributable to contractor |
| COR review of transition plan and milestone completion; readiness meeting(s) |
| Once during transition-in; COR |
| 21.2, 10.3, 12.3 |
| Transition-Out performance and data hand-off |
| Complete SBA-owned data and Work Papers delivered in usable format within 60 days of expiration/ |
termination
| 100% of required data/work papers delivered, verified, and readable by SBA |
| COR verification of data transfer; spot-checking for completeness/ |
readability Once during transition-out; COR
| 4.2--4.3, 23 |
| Key Personnel performance and continuity |
| Project Manager in place meeting qualifications; changes approved by CO and transitioned within 30 days if required |
| No unapproved vacancies; 95% of PM changes (if any) completed within 30 days with no material service disruption |
| COR observation of performance; review of key personnel change notices and approvals |
| Ongoing; as needed; COR |
| 6.1--6.4, 13, 25 |
| Keeping current with SBA regulations/SOPs |
| Processes, tools, and templates updated within 30 days of general SBA program changes and within quarterly cycle for OCRM-specific changes |
| $\geq$95% of applicable changes implemented within required timeframes |
| COR review of contractor update logs; sample checks of tools/templates against current SBA guidance |
| Quarterly; COR |
Performance Deficiencies and Corrective Action Performance deficiencies identified through surveillance activities shall be documented by the COR and communicated to the contractor in writing. The contractor shall correct deficiencies at no additional cost to the Government and within timeframes specified by the COR, consistent with Section 16 of the PWS.
If performance deficiencies persist or are severe, the COR will notify the Contracting Officer, who may take appropriate action including:
• Issuance of a Cure Notice
• Withholding of payment
• Termination for default or convenience
• Contractor responsibility determination for future awards Roles and Responsibilities Contracting Officer (CO): Final authority for contract and BPA administration, modifications, and enforcement actions.
Contracting Officer's Representative (COR): Monitors contractor performance, conducts surveillance activities, accepts or rejects deliverables, documents performance issues, and coordinates with quality assurance and security personnel.
Quality Assurance (QA) Team: Assists COR with sampling and detailed review of loan file reports, Work Papers, and monitoring files.
SBA Chief Information Security Officer (CISO) / IT Security: Monitors security incidents, data protection compliance, and system security posture.
Documentation and Records The COR shall maintain documentation of all surveillance activities, including:
• Checklists and review forms
• Sampling plans and results
• Performance deficiency notices and corrective action tracking
• Acceptance or rejection of deliverables
• Contractor correspondence related to performance All surveillance documentation shall be retained in the contract file in accordance with agency record retention policies.
Revision History
| Version |
| Date |
| Description |
| Prepared By |
| 1.0 |
| March 23, 2026 |
| Initial QASP |
| OCRM |
File details come from the government source that posted it. Updated .