RFP_-_OCRM_504_Solicitation_06192019_AMENDMENT_00001_071819.pdf

Solicitation 73351019R0002 AMENDMENT 00001

1 | P a g e Solicitation 504 Oversight RFP 2019

Solicitation 73351019R0002

AMENDMENT 00001

SBA 504 Program - CDCs Risk Based Review and Risk Oversight Support Services

Office of Capital Access/Office of Credit Risk Management

PART I – SUPPLIES OR SERVICES AND PRICES/COSTS

SERVICES

SBA’s 504 Loan Program assists small businesses by providing them with needed long-term capital not otherwise available to them to purchase or improve fixed assets or real estate. The 504 Loan Program is delivered through authorized Certified Development Companies (CDCs), which act on the Agency’s behalf to arrange, close, service and (when necessary) liquidate and collect on 504 Loans. CDCs are also referred to as Lenders, SBA Lenders, and Regulated Institutions. SBA is the primary regulator of CDCs.

Currently; there are approximately 217 CDCs and a total of $25 billion in 504 loans outstanding. The Contractor shall provide services necessary to create an evaluation framework for conducting risk-based reviews of CDCs and to monitor the performance of CDCs, provide technical assistance with the administration of CDC reviews, and track and manage data related to CDC reviews. The Contractor shall also provide services to apply the evaluation framework to CDCs selected by SBA’s Office of Capital Access / Office of Credit Risk Management (OCRM), and measure and benchmark the outcomes and impacts of services provided. The Contractor shall also provide support services in connection with supervisory and enforcement actions against CDCs.

1. CONTRACT DEFINITION – INDEFINITE DELIVERY – INDEFINITE QUANTITY

This is an Indefinite Delivery - Indefinite Quantity Contract as defined at Subpart 16.504 of the Federal Acquisition Regulation (FAR), FAR Clause 52.216-22, Indefinite-Quantity. Services provided by the Contractor under this Contract shall be secured by the issuance of Task Orders placed in accordance with the following clauses: FAR 52.216-18, Ordering, and FAR 52.216-19, Ordering Limitations. The North American Industry Classification System (NAICS) code for this acquisition is 541211. NOTE: The successful Offeror shall be registered in Sam.gov under this NAICS prior to award. The small business size standard is $20.5 million.

2. MINIMUM AND MAXIMUM QUANTITIES AND AMOUNTS FOR ORDER

The minimum quantity and/or amount to be ordered under this contract shall not be less than the minimum quantity and/or amount shown in the following table. The maximum quantity and/or amount to be ordered under this contract shall not exceed the maximum quantity and/or amount shown in the table.

THE MINIMUM AND MAXIMUM AMOUNT IS FOR THE LIFE OF THE CONTRACT which includes the base year and all options periods exercised.

MINIMUM

AMOUNT

MAXIMUM

AMOUNT

$250,000.00 $20,000,000.00

2 | P a g e Solicitation 504 Oversight RFP 2019

2.1. TYPE OF CONTRACT - HYBRID CONTRACT TYPE

The contract type is a hybrid. Task orders issued may contain Firm Fixed Price (FFP) or Fixed Unit Price (FUP) Contract Line Items (CLINS), with a cost-reimbursement line item for travel, or a combination of these types.

Task orders will be issued on a fixed price basis or fixed unit price basis. Orders may combine the two types if warranted, e.g. travel costs may be reimbursable under a fixed price order. Upon receipt of a request for a proposal, the Contractor shall provide a proposal of costs to be incurred, including direct labor and other direct costs (ODC). In doing so, the Contractor agrees that, unless otherwise specified in the request for proposal, reimbursable travel will be paid based upon Federal travel regulations in place at the time the travel takes place and will not have any fee added to it.

PRIOR APPROVAL ON ALL TRAVEL or ODCs FROM THE COR. THE

CONTRACTOR IS RESPONSIBLE TO NOTIFY THE CONTRACTING OFFICER AND

THE CONTRACTING OFFICER REPRESENTATIVE ONCE 75% OF THE FUNDS

HAVE BEEN EXPENDED OR THE WILL BE RESPONSIBLE FOR ALL OVERAGES!

3. PERIOD OF PERFORMANCE BASE CONTRACT

The period of performance for this contract is FIVE YEARS with no option periods.

Base period will begin on the date of award and completed sixty months after the date of award.

PART II - IDIQ PRICING SCHEDULE -

4. THE PRICE SCHEDULE IS LOCATED AT ATTACHMENT 1-*NOTES: -FOR PROPOSAL

PURPOSES FILL IN THE UNIT RATE FOR EACH ITEM TO INCLUDE ANNUAL

PRICING INCREASES (IF APPLICABLE).

-. Price Proposal for the Task Order shall be completed on the Task Order Pricing Schedule on Attachment 4, Page and

ALSO LOCATED ON ATTACHMENT 1 TASK PRICING STRUCTURE WITH QUANTITY

ESTIMATES. -

-THE MINIMUMS AND MAXIMUMS LISTED ARE FOR ESTIMATING PURPOSES AND

ARE ONLY ESTIMATES!!! GUARANEES ARE LISTED IN PARAGRAPH 2.0 ABOVE!

5. UTILIZE ATTACHMENT 1 FOR PROVIDING PRICING ON THE BASE/PARENT IDIQ.

As total compensation for all services performed in accordance with the terms, conditions, and specifications stated herein, the Contractor will be paid according to the prices listed above per CLIN Structure or per negotiated level of effort per the Labor Rates listed below under paragraph 6. as negotiated as a fixed price on all Task Orders issued.

6. LABOR RATES

All task orders issued against this contract will be firm-fixed price. Tasks will be either based on a per unit price agreed upon with the award of the IDIQ contract or will be based on proposed

3 | P a g e Solicitation 504 Oversight RFP 2019 labor categories and hourly rates agreed upon with the award of the IDIQ contract. Please see section 6 of this solicitation for further information on how to propose pricing for tasks based on labor categories and rates.

Tasks 1, 2, 3, 4, 6, 7, 8, and 10 are based on per unit pricing. For task 1, Offerors should propose a monthly price for technical assistance. The costs associated with tasks 18, 19, and 21 should be included in the proposed monthly price for task 1.

For tasks 2, 3, 4, 6, 7, and 8, Offerors must propose a per review price. Costs associated with tasks 13 and 14 should be included in the proposed per review price for tasks 2, 3, 4, 6, 7 and 8, as tasks 13 and 14 must be completed as part of each review.

The proposed price for task 10 should be per order and is estimated to be ordered once per year of contract performance. The proposed price for task 11 is per order for CDC process analysis and it is estimated that this task may be ordered once or twice a year, or more a year of contract performance. The proposed price for task 12 is per biannual analysis of oversight program and process, which is estimated to be ordered once per year of contract performance for two a year.

The per unit pricing all for tasks shall be provided on Attachment 1. Additionally, if the task order at Attachment 4 orders any of the tasks listed here, then the pricing for those tasks should be listed in the Offeror’s pricing proposal for the task order award (Attachment 4). As total compensation for all services performed in accordance with the terms, conditions, and specifications stated herein, the Contractor will be paid according to the prices listed above per CLIN Structure or per negotiated level of effort per the Labor Rates listed below under paragraph

5.16. as negotiated as a fixed price on all Task Orders issued.

TASKS BASED ON LABOR CATEGORIES AND LABOR RATES

Some of the tasks described in this solicitation are priced based on a fixed price, which will be agreed upon with the award of task orders placed against the IDIQ contract. The task rates and labor rates will be incorporated as part of the award but will not be added to the SF 1449. The rates for the or certain tasks associated with the contract, Offeror’s must provide their proposed labor categories and hourly pricing in response to the IDIQ RFP by completed Attachment 1. If a task order RFP is issued for one of those tasks, the Offeror must propose the number of hours and individuals necessary to complete the tasks, based on the agreed upon labor categories and hourly pricing. The resulting task order award is a firm-fixed price award.

The following tasks are priced based on labor categories and hourly rates agreed upon in the IDIQ contract: task 5, task 8, task 9, task 16, task 17, 20, and task 22. If any of these tasks (5, 8, 9, 16, 17, 20, or 22) are included in the Task Order 1 RFP (Attachment 3), the Offeror must provide its proposed number of hours and individuals to complete those tasks and include that information in its proposal for the task order award. The proposed labor categories, hourly rates, and any increase in price for option year performance of such tasks will be incorporated into the award of the IDIQ contract and the number of hours and individuals will be negotiated and agreed upon prior to the award of any task order for these tasks.

4 | P a g e

PART III – PERFORMANCE WORK STATEMENT

1.0 Purpose

The Contractor shall provide services necessary to create an evaluation framework for conducting risk-based reviews of CDCs that close, service, and in some cases, liquidate U.S. Small Business Administration (SBA) loans through the 504 loan program. The Contractor will assist with the performance of CDC reviews, provide technical assistance with the administration of CDC reviews, track and manage data related to CDC reviews and provide support services for supervisory and enforcement actions against CDCs.

2.0 Background

The SBA is an independent agency of the United States, established in 1953, pursuant to the Small Business Act. The SBA derives its authority principally from the Small Business Act and the Small Business Investment Act. The 504 loan program is authorized by the Small Business Investment Act.

The U.S. Small Business Administration (“SBA”) Office of Credit Risk Management (“OCRM”) is charged with credit risk management of the SBA’s lending programs. OCRM’s objective for CDC oversight is to identify and analyze the risk profile of SBA’s lending partners and assign a specific level of concern to each CDC. OCRM is part of the Office of Capital Access (“OCA”). The Office of Financial Performance Operations (“OFPO”), also a unit of OCA, oversees SBA’s 504 loan processing and servicing liquidation centers. The Office of Financial Assistance (“OFA”), also a unit of OCA, sets policy for the 504 loan program and carries out other program responsibilities jointly with OCRM.

SBA’s District Offices also have responsibilities involving interaction with CDCs and loan litigation responsibilities.

The 504 Loan Program is a key component supporting the SBA’s mission to assist small businesses by providing them with needed long-term capital not otherwise available to them to purchase or improve fixed assets or real estate. The purpose of the 504 Loan Program is to encourage economic development within a community. The 504 Loan Program is delivered through authorized CDCs, which act on the Agency’s behalf to arrange, close, service and (when authorized) liquidate and collect on 504 Loans.

CDCs do not use their own funds to make any 504 loans. CDCs arrange 504 Loans with pooled funds obtained through SBA from the sale of Debentures in the capital markets. Debenture terms are 10, 20 and 25 years. Currently, there are approximately 217 CDCs authorized to participate in SBA’s 504 Loan Program with over $25 billion in total SBA 504 Loans under management.

3.0 Overview

OCRM’s strategy is to select CDCs for Risk-Based Reviews (“RBRs”) based upon a broad set of risk attributes, using a Risk-Based Review protocol as described below, so as to meet its mission of identifying, assessing and managing credit program risks related to, among other things, eligibility, credit underwriting, servicing, liquidation and suspicious activity. To accomplish this, OCRM conducts extensive analysis combined with strategic on-site and off-site (virtual) review activities.

OCRM conducts risk based analyses of CDC’s through strategic reviews of CDC’s activities including the performance of their operations and their compliance with SBA Loan Program Requirements. OCRM also assesses the quality of the overall SBA loan portfolio. Through this analysis, trends are identified and analyzed. As a result of this trend analysis and assessment, as well as other analytical risk indicators identified, OCRM is able to better understand CDC and portfolio performance. All of the tasks outlined in

5 | P a g e Solicitation 504 Oversight RFP 2019 the Performance Work Statement are critical to the effective oversight of SBA’s lending partners and analysis of SBA's loan programs.

OCRM oversees CDCs using a Risk-Based Review protocol that features a composite risk measurement methodology and scoring guide, “SMART.” SMART is an acronym for the specific risk areas or components that SBA reviews for CDCs. SBA’s Risk-Based Review protocol for CDCs features the following levels/types of reviews: 1. Lender Portal Report; 2. Analytical Review; 3. Targeted Review; 4.

Full Review; 5. Annual Report Review; 6. Delegated Authority Review; and 7. Other Reviews. The Risk-Based Review protocol, like the SMART methodology, may be revised and is subject to periodic adjustment. Risk-Based Reviews, particularly Analytical Reviews, Targeted Reviews, and Full Reviews, culminate in a Review Report. The Report includes a summary assessment of the CDC and include an individual assessment for each SMART component reviewed. The Risk-Based Assessment categories are “Acceptable,” “Acceptable with Corrective Actions,” “Marginally Acceptable with Corrective Action Required,” and “Less Than Acceptable with Corrective Action Required.”

4.0 Objectives

• SBA is seeking a Contractor who will provide innovative approaches to SBA’s oversight and monitoring processes, and Risk-Based Reviews of CDCs in accordance with SBA Loan Program Requirements, including, but not limited to, 13 C.F.R. Part 120, SBA SOPs 51 00 “On-Site Lender Reviews/Examinations” and 50 53 “Lender Supervision & Enforcement”, as amended from time to time, and SBA Policy Notice 5000-1348, Revised Risk-Based Review Protocol for Certified Development Companies, issued August 5, 2015, and SBA Information Notice 5000-1398, Updated SMART Methodology for Oversight of CDCs, issued November 9, 2016. The Contractor will ensure that (1) SBA Loan Program Requirements as defined in 13 C.F.R. 120.10 are being followed by CDCs, and (2) the assessments of individual CDCs are provided at the best value possible to the SBA as well as to the CDCs.

• SBA is seeking a Contractor who has an understanding of the existing process of SBA’s risk-based reviews of CDCs in accordance with 13 C.F.R. Part 120, SBA’s SOPs 51 00 and 50 53, as amended from time to time, and the SMART Policy and Information Notices described above.

• SBA is seeking a Contractor who has an understanding of SBA’s Loan Program Requirements, including, but not limited to, SBA regulations in 13 CFR Part 120 and SOPs applicable to loan processing, servicing and liquidating (i.e., SOPs 50 10 (5) “Lender Development Company Loan Programs” and 50 55 “504 Loan Servicing and Liquidation”, as amended from time to time.)

• SBA is seeking a Contractor who can provide services consistent with the practices utilized by the various federal banking regulators and servicer rating agencies as part of its overall CDC oversight and monitoring efforts. SBA prefers a Contractor who has experience conducting large scale risk management, risk based reviews, and internal control systems capabilities.

• SBA is seeking a Contractor who shall ensure that the SBA is provided with services and models that are current, relevant, and reflective of federal government, regulatory and industry best practices, given the constant evolution of generally accepted accounting principles and federal banking regulations.

• SBA prefers the Offeror to have experience performing reviews under AICPA standards and consulting services. SBA also prefers that Offerors be able to demonstrate experience performing: (i) reviews or audits involving financial standards; (ii) forensic reviews; (iii) Agreed Upon procedure reviews; and (4) reviews for fraud, waste and abuse when there was a degree of attestation required within the past 3 years.

6 | P a g e

• SBA is seeking a Contractor who will be capable of providing and utilizing a Virtual Data Room solution. SBA seeks access to an existing commercial off-the-shelf solution (COTS) that will integrate the current tools and implement the Contractors proposed COTS solution.

• SBA seeks COTS tools in response to the requirements associated with Task 1 and Task 10.

Some solutions may require some customizing and configuration for implementation specifically for SBA. The customizing and configuration specifically for SBA is anticipated for in the Contractor’s response/pricing referenced as CLIN 0010 - Task 10 of the Task Order 0001- Attachment 3. SBA does not seek the design and development of a system for SBA. SBA does not anticipate owning a system at the conclusion of the contract. However, SBA will own all data housed in the virtual data room and tracking system.

The Contractor shall provide support consistent with these objectives.

5.0 Abbreviations and Definitions

5.1 Abbreviations

5.1.1 ALP – Accredited Lender Program

5.1.2 AUP – Agreed Upon Procedures

5.1.3 CAM - Certified Auditing Manager

5.1.4 CATS – Corrective Action Tracking System

5.1.5 CDC – Certified Development Company

5.1.6 CO – Contracting Officer

5.1.7 CLIN – Contract Line Item Number

5.1.8 CPARS – Contractor Performance Review System

5.1.9 COR – Contract Technical Monitor

5.1.10 CSA – Central Servicing Agent

5.1.11 DLAMS – Delegated Lender Authority Management System

5.1.12 FFP – Firm Fixed Price

5.1.13 FTR - Federal Travel Regulations

5.1.14 IPP - Invoice Processing Platform

5.1.15 LAMP - – Lender Analysis & Management Program

5.1.16 LLRF – Loan Loss Reserve Fund

5.1.17 LPR – Lender Portal Report

5.1.18 MWP – Management Work Plan

5.1.19 OCA – Office of Capital Access

5.1.20 OCRM – Office of Credit Risk Management

5.1.21 OFA – Office of Financial Assistance

5.1.22 OFPO – Office of Financial Performance Operations

5.1.23 OGC – Office of General Counsel

5.1.24 PCLP – Premier Certified Lender Program

5.1.25 RBR – Risk Based Review

5.1.26 SAR- SMART Analytical Review

5.1.27 SFR – SMART Full Review

5.1.28 SDMS – SMART Document Management System

5.1.29 SDR - SMART Delegated Authority Renewal CDC Review

5.1.30 STR – SMART Targeted Review

5.1.31 QAP – Quality Assurance Plan

5.1.32 PWS - Performance Work Statement

5.1.33 RAM – Risk Assessment Memorandum

7 | P a g e Solicitation 504 Oversight RFP 2019

5.1.34 SBA – U.S. Small Business Administration

5.1.35 SAS - Statistical Analytical Software

5.1.36 TM – Technical Monitor

5.2 Definitions

5.2.1 Business Day: Any day other than a Saturday, Sunday, a Federal holiday or other day on which the Federal Government, by law, or executive order is closed.

5.2.2 Community Advantage: is a pilot loan program introduced by SBA to meet the credit, management, and technical assistance needs of small businesses in underserved markets. CA is designed to provide mission-oriented lenders, primarily nonprofit financial intermediaries focused on economic development, access to 7(a) loan guaranties for loans of $250,000 or less. Approximately 30 CDCs have been approved as lender participants in the Community Advantage Program. CA is scheduled to operate through September 30, 2022 unless extended or made a permanent part of SBA’s financial assistance programs.

5.2.3 Contracting Officer: The SBA Official authorized to execute and administer the contract on behalf of SBA and includes any duly appointed successor or authorized representative.

5.2.4 Contractor: The individual, partnership, corporation, or other entity, which is the party subject to the terms and condition of this contract.

5.2.5 Day: Calendar day unless otherwise stated.

5.2.6 Deliverables: If a deliverable date falls on a weekend or federally recognized holiday, the due date shall be the next business day. Unless otherwise specified SBA will review all deliverables and provide comment’s generally within 30 days after receipt of either a draft or a final deliverable.

5.2.7 Delegated CDC: A CDC that has been designated by SBA and given increased authority to process, close and service SBA loans. There are two types of delegated authority available to CDCs:

Accredited Lenders Program (ALP) and Premier Certified Lenders Program (PCLP). All such designations must comply with SBA Loan Program Requirements and are subject to subsequent review by SBA.

5.2.8 Findings: Significant issues identified during Risk Based Reviews (e.g. violations of SBA Loan Program Requirements). Findings must be specific and supported by documentation.

5.2.9 Industry Accounting Designation: The designation can be found at American Institute of Certified Public Accountants

5.2.10 Key Personnel: Personnel specifically considered to be essential to the work being performed under this contract are defined at Paragraph 11.

5.2.11 Lender Portal Report (LPR): A report that is compiled from internal SBA data sources and public federal regulatory information. Data is provided by SBA. The Contractor will be provided with access to the SBA website to pull LPRs on individual CDCs post award.

5.2.12 Loan Program Requirements: As defined in 13 CFR 120.10, these are requirements imposed upon CDCs by statute, SBA regulations, any agreement the CDC has executed with SBA, SBA SOPs, official SBA notices and forms applicable to the 504 loan program, and loan authorizations, as such requirements

8 | P a g e Solicitation 504 Oversight RFP 2019 are issued and revised by SBA from time to time. For CDCs, this term also includes requirements imposed by Debentures, as that term is defined in 13 CFR 120.802.

5.2.13 SMART: “S”-Solvency and Financial Condition, “M”-Management and Board Governance, “A”-Asset Quality and Servicing, “R”-Regulatory Compliance, “T”-Technical Issues and Mission Risk Measurement Methodology and Scoring Guide.

5.2.14 Performance Work Statement: Describes the requirement in terms of measurable outcomes rather than by means of prescriptive methods.

5.2.15 Portfolio Stratification Analysis: an analysis of SBA 504 loan portfolio to determine risk.

5.2.16 Potential Recovery Claim: 13 CFR 120.938(b) authorizes SBA to look to the CDC for the entire amount of a defaulted 504 debenture in the case of fraud, negligence, or misrepresentation by the CDC.

In such cases, the amount that may be due to SBA is referred to as a “potential recovery claim”.

5.2.16 Pre-Plan: A Microsoft Word document that documents the procedures to be performed to meet the review objectives and review methodology. The objective of the pre-plan is to ensure that each party is well prepared for an efficient and productive review.

5.2.17 Quality Assurance: A program for the systemic monitoring and evaluation of the various aspects of a project, service, or facility to ensure that standards of quality are being met.

5.2.18 Quality Control: Those actions taken by a Contractor to control the production of outputs to ensure that they conform to the contract.

5.2.19 Quarter – A quarter will be defined as the first of January through the end of March, first of April through the end of June, first of July through the end of September, and first of October through the end of December.

5.2.20 Regulated Institution – A CDC that provides loans and issues Debentures under the SBA 504 loan program.

5.2.21 Risk Measurement Methodology: The OCRM SMART risk measurement methodology that includes various components of risk assessment for each CDC.

a) Solvency and Financial Condition: The “S” component in the SMART Risk Measurement Methodology measures a CDC’s financial ability to operate and portfolio performance. Quantitative factors include, but may not be limited to, 5 year cumulative net cash flow yield, 12 month default rate, and 5 year default rate. Qualitative factors include, but may not be limited to, reserves for future operations, liquidity risk management and balance sheet leverage..

b) Management and Board Governance: The “M” in the SMART Risk Measurement Methodology measures a CDC’s organizational structure, policies and internal controls Quantitative factors include, but may not be limited to, forecasted purchase rate, high risk origination rate (high-risk originations in the previous 36 months), and loans in purchase status over 3 years rate. Qualitative factors include, but may not be limited to, board-approved internal control policies, including independent loan review and loan classification system, business strategy and planning, audit and review programs, IT operations, and management of risk concentrations.

9 | P a g e Solicitation 504 Oversight RFP 2019

c) Asset Quality and Servicing: The “A” component in the SMART Risk Measurement Methodology measures the quality of the CDC’s 504 loan origination, closing, servicing and liquidation practices. Quantitative factors include, but may not be limited to, stressed loan rate (Past Due + Delinquent + Deferred Loans), 5 year charge off rate, and early problem loan rate. Qualitative factors include, but may not be limited to, credit administration, servicing and liquidation management, and potential fraud, negligence or misrepresentation on individual 504 loans. SBA will also review adverse change determinations on ALP loans.

d) Regulatory Compliance: The “R” component in the SMART Risk Measurement Methodology measures a CDC’s compliance with SBA’s Loan Program Requirements. Quantitative factors include, but may not be limited to, minimum level of 504 loan activity. Qualitative factors include, but may not be limited to,timely and complete submission of Annual Report and PCLP loan loss reserve report (if applicable) , liability insurance minimums, liquidation updates to SBA loan servicing center, loan classification, internal control policy and staffing. SBA will determine the adequacy of risk management systems, capability of management, the soundness of policies and procedures, and the effectiveness of internal controls. SBA may also review each CDC’s corporate governance structure, SBA operating plan, quality control processes (including fraud deterrence and detection practices), risk classification system, and internal oversight strategy over the SBA loan portfolio.

e) Technical Issues and Mission: The “T” component in the SMART Risk Measurement Methodology measures additional key metrics or items that are not included in the other components but may pose risk to SBA or present program integrity concerns. Quantitative factors include, but are not limited to, average SBPS score (weighted) and top industry concentration rate. Qualitative factors include, but are not limited to, CDC support of “other economic development initiatives,” a CDC’s use of professional service contractors, compliance with retained earnings requirements, job creation and retention documentation, franchise concentration rate, and fraud, waste, and abuse issues.

5.2.22 Risk Assessment Memorandum: Integral to Contractor's planning stage for any specific CDC review (regardless of whether the review is an SFR or a STR). This document serves as the work order on what is to be done and is specific to each CDC to be reviewed. It establishes specific objectives for the review.

5.2.23 Risk Based Reviews: An in-depth analytical assessment of a CDC’s administration of the SBA 504 loan program (i.e. – SAR, STR, SFR,)

5.2.24 Risk Data Warehouse - The risk data warehouse is already established. Data mining is facilitated by use of SAS programming and report writing. SBA also refers to our Business Intelligence Tool (“BI Tool”) in the delegated authority work flow. The BI Tool is programmed in SAS and is a capability that the Offeror will find beneficial to accessing our Risk Data Warehouse

5.2.25 SBA: The U.S. Small Business Administration. The terms “Small Business Administration,” “SBA” and the “Government” shall be synonymous and may be used interchangeably in this contract.

5.2.26 SAS (Statistical Analysis System), is a software suite developed by the SAS institute for advanced analytics, business intelligence data management and predictive analytics

5.2.27 Technical Monitor: The Technical Monitor (TM) is subordinate to the COR and assigns work associated with regions, reviews, etc. and assists the COR in monitoring the Contractor’s performance.

The TM may provide project-specific technical clarification, assistance and direction to the Contractor in the performance of duties of this contract. The TM provides technical advice and assistance to the COR.

10 | P a g e Solicitation 504 Oversight RFP 2019

5.2.28 Technical Security Plan: A formal plan that identifies the plan of action to implement and secure the various systems outlined in the Performance Work Statement.

5.2.29 Virtual Data Room: An online repository of information created by or provided by the Contractor that is used for the storing and distribution of documents.

5.5.30 Microloan Intermediary: An entity participating in the SBA Microloan Program that makes and services Microloans to eligible small businesses and that provides marketing, management, and technical assistance to its Microborrowers and potential Microborrowers. Some CDCs are Microloan Intermediaries.

5.5.31 504 Corporate Governance Repository: An electronic repository operated by SBA where CDCs can upload copies of documents for review by SBA.

6.0 Contractor Furnished Items

The Contractor shall furnish the necessary personnel, materials, travel, facilities that fully functional offices and meeting space, teleconference capacities, share space abilities to allow interface between contractor key personnel and SBA staff, and services and shall otherwise do all things necessary for, or incidental to, the performance of the tasks set forth in this contract. Any additional specific requirements and any government furnished items or services will be identified in each task order.

The Contractor shall appoint a IDIQ Project Manager and an Alternate IDIQ Project Manager. The Alternate IDIQ Project Manager shall be capable of assuming the role of the IDIQ Project Manager without delays due to any lack of knowledge/information, which could reduce the level of efficiency necessary to ensure task order performance. NOTE: The IDIQ Project Manager and the Alternate IDIQ Project Manager of Contact SHALL be employees of the Contractor and cannot be employees of a subcontractor or consultant. The IDIQ Project Manager and an Alternate IDIQ Project Manager are considered part of the KEY PERSONNEL and shall have the same qualifications as listed in paragraph 11.

7.0 Government Furnished Property and Services

SBA may provide the Contractor with seating in its office facilities in Washington D.C., including office space, furniture, office equipment and Agency-approved software and hardware for up to four (4) individuals in order to perform some of the services detailed in this Performance-Based Statement of Work. Only Contractor employees who have completed all security clearance requirements and have been cleared through SBA Office of Personnel Security and who work at SBA facilities will have access to SBA systems. The Government will conduct a post-award conference approximately 10 days after award. The Contracting Officer will notify all parties of the time, date, and location of the post-award conference (note: SBA anticipates that post-award conference will take place in SBA Headquarters Location in Washington, DC).

8.0 Performance Work Statement

The Contractor will provide SBA with assistance in conducting Risk Based Reviews and Risk Oversight services for CDCs; access to either a (developed or provided) Management Workflow and Tracking System/Virtual Data Room and maintain a Management Workflow and Tracking System/Virtual Data Room; and technical assistance in accordance with the general scope outlined herein. The Contractor will be required to provide SBA with a detailed description of its proposed methodology for review, coordination, tracking, and follow-up and its plan for implementing its methodology for all tasks

11 | P a g e Solicitation 504 Oversight RFP 2019 identified. The Contractor is expected to work collaboratively with SBA employees, including OCRM and the Office of Capital Access (“OCA”), and other SBA offices, including the Office of General Counsel, as necessary.

Below in sections 8.1, 8.2 and 8.3, are general descriptions of the major services associated with this contract. Section 9 contains a more detailed description of all tasks and deliverables associated with the contract.

8.1 CDC Risk Based Review and Oversight

• The Contractor will assist SBA in conducting Risk Based Reviews (RBRs) that will assess the CDC’s practices against both internal policies and procedures accepted industry practices, and SBA Loan Program Requirements. At a minimum, Risk Based Reviews will include the extraction and analysis of data from various SBA sources, data warehouses and CDC files, plus file reviews, operating reviews, Annual Report analysis, and possible site visits. Access to these data warehouses will be provided at post award. The Contractor shall prepare a report addressing each risk assessment component for the SMART (Solvency and Financial Condition, Management and Board Governance, Asset Quality and Servicing, and Technical Issues and Mission) Risk Measurement Methodology. (See Attachment 6 Exhibits 1, 2, 4, 6, 7, and 8)

• The Contractor will provide risk oversight services through CDC monitoring activities, as defined by SBA, for approximately 217 CDCs annually. These monitoring activities include making recommendations of CDCs for SAR reviews for a defined population of approximately 25 CDCs annually based on risk characteristics. The defined population is updated annually and the SAR reviews will be based upon risk characteristics as determined by SBA. These monitoring activities also include conducting CDC Delegated Authority Review Assessments of at least 75 delegated lenders CDCs on a biennial schedule. These numbers will vary each fiscal year and will be further defined at the task order level. The numbers in this paragraph are estimates and are not guaranteed.

• The Contractor shall prepare a report that outlines any weaknesses or deficiencies identified during the RBR and make recommendations for improvement as applicable. The report shall discuss the methodology used for determining the Contractor’s findings. The Contractor shall produce and prepare other ancillary reports as requested by SBA.

• Included in these tasks are conducting RBRs both on-site at CDC location, through electronic means, and other possible locations that are distant from CDC location, which shall include established SBA office locations.

• The Contractor will also provide reviews and support services for supervisory and enforcement actions against CDCs.

8.2 Management Workflow and Tracking System and Virtual Data Room

• The Contractor will be responsible for providing access to a Management Workflow and Tracking System and Virtual Data Room that are IT web-based, to support the coordination of the CDC review/monitoring and corrective action process. The Management Workflow and Tracking System and Virtual Data Room will include and incorporate information obtained through the performance of related contract functions. The Management Workflow and Tracking System/Virtual Data Room will include, at a minimum, CDC (client) contact information and a record of communications with the CDC client as well as tracking of the risk-based review process and corrective action review follow-up.

12 | P a g e Solicitation 504 Oversight RFP 2019

• The Contractor will be responsible for ensuring that the Management Workflow and Tracking System and Virtual Data Room is secure and internet accessible. The Contractor must demonstrate through the Contractor’s Technical Security Plan its adherence to SBA’s security requirements.

• The Contractor will be responsible for ensuring the Virtual Data Room is accessible to SBA employees, its authorized representatives, and to individual CDCs within their respective storage locations. It must provide for upload of information by all users, and accessibility on-line, as well as allowance for download permissions and other possible communications as defined in the Security Section of this document. Through the use of digital media, the Contractor must ensure that SBA has access to the data contained in the Management Workflow and Tracking System and Virtual Data Room even when this contract has ended. SBA owns the data that will be entered into the Virtual Data Room and expects delivery of that data as detailed below in the deliverables chart.

• The Contractor will also be required to develop or provide and maintain the Virtual Data Room so that it an integrated data room warehouse that is accessible to SBA-users 24 hours a day through a secure Internet website. The Virtual Data Room/data room warehouse will be used to file and catalogue data, images, and information developed.

• The Contractor shall implement a work paper retention client management service. The Contractor must ensure that has SBA has access to all work papers even when this contract has ended.

• The Contractor shall ensure that SBA has access for up to 50 users for the Management Workflow and Tracking System and Virtual Data Room.

8.3 Quality Control Plan / Quality Assurance Plan

The contractor shall develop, implement, and execute a detailed QCP / QAP that provides for inspections of all services and deliverables to verify conformance to acceptability standards specified in the task order. The contractor shall provide a Draft of its QCP/QAP at post award meeting or 10 days after award and then after award deliver a Final copy to the COR via email not later than 30 days after the post award conference. The QCP/QAP is considered a “living document” and as such, shall be revised by the contractor as its conditions change. The QCP/QAP shall include provisions for responding to and incorporating technical direction and comments from the COR and TMs; descriptions of the techniques to be employed for producing and validating services and deliverables conforming to the acceptable quality standards in the contract, and a description of “checks and balances” that shall be used to ensure the government receives quality services.

Within 30 days of the post award conference, the Contractor shall provide a Final QCP/QAP that will provide for complete quality control for all Reports, Letters, and Agreements to be issued. The QCP/QAP shall include a defined process and personnel identification by title. The QCP/QAP shall also include Communication Plan to ensure effective communication between SBA Personnel and Contract Analyst/Reviewers/Writers and to ensure the objectives of the contract are being met. The QCP/QAP should also address the concerns listed below:

• The development and implementation of

- A system of internal controls for managing the Management Workflow and Tracking System and Virtual Data Room as well as assuring timely delivery of all tasks.

- Procedures to identify and bring to the attention of SBA any potential conflicts of interest that exist as a result of providing risk oversight services, and an information control policy that includes confidentiality requirements.

13 | P a g e

• The Contractor is obligated by the terms of its contract (including any corresponding confidentiality agreement) to (i) safeguard the Confidential Information as set forth in this Agreement; (ii) return, or certify to the SBA the destruction of, all copies of the Confidential Information at the conclusion of its engagement with the SBA; (iii) not use the Confidential Information for any purpose other than in connection with its engagement with the SBA; and (iv) not disclose the Confidential Information to anyone outside of SBA or the Contractor without the prior written approval of the SBA.

Deliverable: Provide a Draft QCP / QAP with the proposal and within 30 days after Award provide the Final QCP/QAP. The contractor shall develop, implement, and execute a detailed QCP / QAP that provides for inspections of all services and deliverables to verify conformance to acceptability standards specified in the task order. The contractor shall provide a Draft of its QCP/QAP as part of their proposal and then after award deliver a Final copy to the COR via email not later than 7 days after the post award conference. The QCP/QAP is considered a “living document” and as such, shall be revised by the contractor as its condition changes. The QCP/QAP shall include provisions for responding to and incorporating technical direction and comments from the COR and TMs; descriptions of the techniques to be employed for producing and validating services and deliverables conforming to the acceptable quality standards in the contract, and a description of “checks and balances” that shall be used to ensure the government receives quality services.

9.0 Performance Work Statement Tasks

CDC Risk Based Reviews and Technical Assistance Oversight Activity

The Contractor will be required to provide:

• SBA with technical assistance in the assessment of CDCs’ overall management of their SBA loan programs from file review information collected, as well as from the annual financial reports and other data available to the SBA and maintained in the data room warehouse. SBA anticipates that all Technical Assistance shall be either onsite at the SBA’s Headquarters Office in Washington, DC or at Contractor’s office located in the DC Metro Area (as defined) fulltime and management staff continuously coordinating with the SBA Staff.

• Technical assistance for the ALP and PCLP Delegated Authority Review and Assessment to include, at a minimum, administrative processing of records and documents.

• OCRM technical assistance in effectively and efficiently monitoring the performance of the 504 program through SBA loan and CDC portfolio stratification for strategic planning of risk mitigation activities, annual audit plan development, selection of CDCs for enhanced assessment activities, and planning and conducting risk-based reviews (“RBRs”) using SBA’s risk assessment framework.

Technical assistance should reflect discussion and coordination with the key personnel and project management team. Cost for advisory and technical assistance may be allocated in the CLIN monthly cost and/or imputed across the fixed cost items. SBA wishes to be able to consult, meet with and converse on aspects of performance, improvement of, efficiencies and conduct of the engagement with the Contractor to assure best practice execution and value to the SBA.

9.1. Task 1: SMART ALP and PCLP Delegated Authority CDC Reviews and Technical

Assistance Oversight Activity for delegated and non-delegated CDCs –

14 | P a g e Solicitation 504 Oversight RFP 2019

The Contractor will be required to review the CDC’s most current Lender Portal Report (LPR);

reviewing open corrective actions; coordinate with OFA on professional services contracts and recommending renewals; and provide SBA with technical assistance in the assessment of the SBA 504 loan program. The CDC Lender Portal Report (LPR) has been developed using SAS and report writing has been automated. The LPR is a tool and should be utilized whenever assessing a CDC. The LPR is updated quarterly by SBA. The LPR will be prepared for each delegated authority review.

Note: Pricing for Task 1 includes Tasks 1A and 1B.

The tasks shall include at a minimum:

Task 1A: SMART ALP & PCLP Delegated-Lender CDC Reviews Technical Assistance – There is an estimated minimum of 30 reviews and a maximum of 80 reviews annually as part of the pricing under Task 1.

SMART ALP & PCLP Delegated-Lender CDC Reviews

The Contractor shall provide technical assistance in the review, assessment, and processing of all SMART ALP & PCLP Delegated-Lender CDC Authority Nominations and Renewals processing.

The Contractor shall perform the administrative research necessary, to include but not be limited to, collecting all required information and certification from the CDC, District Office and Corporate Governance Repository to assist the SBA in determining eligibility and qualification for the specific status being sought. This will include reviewing the most current Lender Portal Report; reviewing open corrective actions; coordinating with OFA on professional services contracts and recommending renewals.

The SMART ALP & PCLP Delegated CDC Authority Review Assessment and eligibility process is as follows:

Overview of process:

The Delegated CDC team which includes “CT/FA” process includes four types of actions, renewals, reconsiderations, extensions and nominations. The team assesses two types of delegated authorities:

1. Accredited Lenders Program (ALP)

2. Premier Certified Lenders Program (PCLP) The data analysis components for each CDC currently include:

• Performance

• Compliance

• Regulatory Activities

All loans are pulled from the BI SAS Tool and SBA Risk CDC to determine Performance Scope for a CDC that includes the following:

Age of Portfolio Disbursal activity Size of most loans Length of time in liquidation Early defaults Delivery Method

Data Analysis for Compliance includes:

SBA Training Responsiveness to SBA Program Offices (District and OFPO Centers, Denver Financial Center) RBR Reviews: Review Results and IG or GAO issues

15 | P a g e Solicitation 504 Oversight RFP 2019

Data Analysis- Regulatory:

Financial Ability to Operate Supervisory Actions (SBA Corrective Actions) Certification of Good Standing IRS Compliance Check

Financial Indicators Loan Loss Reserve Fund Adequacy (PCLP lenders only)

Deliverable: The Contractor shall prepare and distribute the SMART Delegated Authority Renewal CDC Reviews (SDR) Letters and Agreements (if applicable). The SBA will provide the Contractor with a list of CDCs with Delegated Authorities requiring review on a monthly basis. The Contractor’s analysis should be completed and provided to SBA three months in advance of the CDC’s Delegated Lender Authority expiration date. SBA will make the final decision regarding renewal of delegated authority. SBA will provide Contractor with any comments/questions regarding Contractor’s CDC Delegated Authority Renewal Analysis and Contractor will provide SBA with an updated analysis addressing those SBA comments/questions within 7 business days.

SMART Delegated-Lender CDC Authority Renewal CDC Portfolio Analysis

The Contractor shall perform a SMART Delegated-CDC Authority portfolio review and analysis of all CDCs with delegated authority. This will be completed by tracking of the expiration dates for Delegated CDC Authority statuses for all CDCs. Each month the Contractor will provide to SBA a list of all CDCs with authorities that will expire in three months (e.g., - in January of each year, provide a list of all CDCs with authorities expiring in April of that same year and in February of each year, provide a list of all CDCs with authorities expiring during May of that same year).

Delegated Authority Renewals for each CDC may be granted for up to 2 years. Renewal Terms may also be limited to less than 2 years (e.g. one year, six months, and/or extensions for period under the 2 year term) based on the analysis of the elements and components. Delegated Authority can also be non-renewed or revoked from a CDC.

Much of the Data components are provided and/or accessible through SBA data and systems. An LPR should be pulled for each delegated authority review. SBA has access to CDC regulatory and financial information.

Deliverable: The analysis will be conducted and provided to SBA on the first of the month. This must be done three months in advance of the CDC Delegated Lender Authority expiration date. The Contractor shall provide a formal written analysis.

PCLP Lender Oversight

The Contractor shall perform a quarterly review of individual CDC PCLP loan loss reserves to ensure each CDC’s compliance with SBA reserve requirements. There are approximately 30 CDCs with at least one outstanding PCLP loan. Such CDCs are required to maintain a restricted reserve amount for these PCLP loans and they are required to report to SBA within 45 days of each quarter-end to evidence such reserves. The Contractor must obtain these quarterly Loan Loss Reserve Reports, review the reports, and then determine whether each CDC with PCLP loans outstanding is in compliance with SBA’s reserve requirements. This will normally require the Contractor to reach out to the local SBA office to request their quarterly Loan Loss Reserve Report.

16 | P a g e Solicitation 504 Oversight RFP 2019

Deliverable: The analysis of PCLP loan loss reserves will be conducted by the Contractor 60 days after each quarter end and the Contractor shall provide SBA with a report no later than 90 days after each quarter end. For example, CDCs must report their December 31 year-end PCLP loan loss reserve reports to SBA by February 15, which is within 45 days of the quarter end. The Contractor will be required to finalize their review of these reports within the next 45 days – so that they can provide a report no later than 90 days after each quarter end.

Task 1B: Delegated and non-delegated CDC Oversight Technical Assistance

CDC Oversight Technical Assistance includes the following work at a minimum;

-Reviewing all CDC Annual Reports to assess completeness of the report, overall condition of the CDC, and any non-compliance issues. After reviewing each individual Annual Report, the Contractor must assess whether the report is complete and whether the items in the report demonstrate CDC compliance with SBA Loan Program Requirements. Some required items may have been uploaded by the CDC into the 504 Corporate Governance Repository, so the CDC must check the repository. The contactor must contact the CDC to request any missing items from the Annual Report and must notify the CDC to provide updated documents if any documents demonstrate non-compliance.