Field Compliance Review PWS 05282024.doc

Performance Work Statement (PWS)

Field Compliance Review

05/28/2024 Version 1.0 4Vision Statement

1 General Information

1.1 Introduction

1.2 Background

1.3 Constraints

1.4 Description of Services

1.5 Non-Personal Services

1.6 Period of Performance

1.7 Place of Performance

1.8 Hours of Operation

1.9 Special Qualifications

1.10 Post Award/Kickoff Conference

1.11 Status Meetings

1.12 Contractor Travel

1.13 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Material

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

4.7 Quality Control

4.7.1 Quality Control Plan

5 Specific Tasks

5.1 Issuer/Document Custodian Reviews

5.2 Other Reviews and Audit Support

5.3 Issuer, Document Custodian and Stakeholder Training

5.4 Information, Technology, Systems, Applications, and System Security

5.5 Transition Out

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Related Documents 8 Performance Requirements Summary

Performance Work Statement (PWS) Field Compliance Review Vision Statement Ginnie Mae's commitment to the integrity of its Mortgage-Backed Securities (MBS) program is paramount. With the full-faith-and-credit guaranty of the federal government, Ginnie Mae ensures the minimization of financial risk and maintain investor confidence through rigorous monitoring of issuer performance and steadfast compliance with the MBS program guidelines. Ginnie Mae upholds its vision of a stable and reliable marketplace for all participants.

1 General Information

1.1 Scope of Work

The purpose of conducting the Compliance Reviews is to determine if Issuers/Documents Custodians are following Ginnie Maes program requirements. The integrity of Ginnie Maes MBS programs is dependent upon the quality of loan servicing, accuracy of the reporting to Ginnie Mae and proper management of Ginnie Mae custodial accounts. The Contractor shall conduct Compliance Reviews to determine whether the Ginnie Mae pools, and underlying mortgages are being administered in accordance with Ginnie Mae requirements. Prevailing guidance for conducting Compliance Reviews is captured in the Compliance and Monitoring (C&M) module located within Ginnie Mae Central. The Contractor shall be required to travel from time-to-time to support Compliance Reviews and Default Activities. These activities may occur concurrently.

The Contractor shall perform Specialized Reviews, including Ad Hoc Analysis and Forensic Analysis to address matters that present a unique compliance risk to Ginnie Mae, but are not within the scope of the Compliance Reviews outlined in the C&M Module.

Specialized Reviews, including Ad Hoc Analysis and Forensic Analysis, may require the Contractor to performed in accordance with appropriate American Institute of Certified Public Accountants (AICPA) or attestation standards (or other appropriate standards), if requested by Ginnie Mae.

1.2 Background

The Government National Mortgage Association (Ginnie Mae) is a wholly owned corporate instrumentality of the United States within the U.S. Department of Housing and Urban Development (HUD) which provides a secondary market for government insured/guaranteed loans through its Mortgage-Backed Securities (MBS) programs.

Performance of Compliance Reviews and Specialized Reviews, which includes Ad Hoc Analysis and Forensic Analysis of Issuers participating in the Ginnie Mae MBS Program is vital to Ginnie Mae’s oversight of Issuers and Document Custodians from a compliance perspective. Compliance Reviews are designed to provide stakeholders with reasonable assurance that the collateral underlying Ginnie Mae mortgage-backed security pools exists and conforms to Ginnie Mae’s requirements. They also provide vital knowledge of whether the mortgages and securities are being administered in accordance with requirements stated in the Ginnie Mae Guaranty Agreements, Ginnie Mae MBS Guide, and other relevant MBS authoritative guidance.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

· Compliance Review Guide

· Document Custodian Compliance Review Manual

The functions required under this contract currently require the use of Government Furnished Information Technology Systems (MyGinnieMae) and Applications (GFITSA), i.e., uploading Compliance Reviews into Ginnie Mae’s platform. The Contractor must have its own system(s) infrastructure and interfaces in place and fully functional. When access to data maintained by other Ginnie Mae Contractors is required, the Contractor, through the COR, shall request the necessary access or interfaces. In addition, the contractor must maintain IT security and comply with all terms and conditions of the contract with respect to all data and information technology requirements. Specifically, the Contractor shall:

Use, maintain, enhance, develop, and upgrade all information technology software and system documentation under this Contract in accordance with Federal Laws, best practices, and regulations which includes:

1. Federal Information Security Management Act (FISMA) - https://www.dhs.gov/fisma

2. The Clinger-Cohen Act - https://www.fismacenter.com/Clinger%20Cohen.pdf

3. Government Paper Reduction Act - http://www.hhs.gov/ocio/policy/collection/

4. Office of Management, and Budget Circulars A-130, A-I27, and A-I23 - https://www.whitehouse.gov/omb/circulars_default

5. Department of Housing and Urban Development regulations, Handbooks and Policies - www.HUD.gov.

6. Applicable Ginnie Mae Handbooks and Policies in effect during the performance period- www.ginniemae.gov

7. HUD Acquisition Regulation (HUDAR)

8. NIST Special Publications

9. Federal Information Systems Controls Audit Manual (FISCAM)

10. Federal Financial Management Improvement Act (FFMIA)

Maintain Security Assessment & Authorization (SA&A) standards in accordance with guidance published by NIST. Any updates to the SA&A shall be submitted for COR approval no less than 30 days prior to SA&A expiration.

Follow the Department of Housing and Urban Development's (HUD's) Project Planning and Management (PPM) Life Cycle and industry best practices in the analysis, design, development, testing and implementation of proposed new systems and/or the enhancement to existing systems.

Review and update system documentation to ensure accuracy, compliance, and completeness. Reviews and revisions to be completed and delivered to the Ginnie Mae COR quarterly.

The Contractor will update its Security Plan per the applicable requirements from HUD, OMB, NIST, FISMA, FISCAM, and FFMIA, which will require the preparation of several related documents:

1. FIPS 199/200 Security Categorization Analysis.

2. SP-800 Security Controls Self-Assessment.

3. Application and network venerability scan

4. Business Impact Assessment.

5. Privacy Impact Assessment.

6. Create System Security Plan, Risk Assessment, Technical Architecture, COOP and Contingency Plans, Quality Control Plan, ST&E Plan, and other relevant SA&A supporting documentation for each new application.

7. (Security Assessment Reports) (formerly ST&E Testing).

8. (Security Assessment Reports) (formerly ST&E Report).

9. POA&M.

10. Accreditation Documentation.

11. Penetration Testing & Threat Matrix Report.

12. IT Contingency Plan.

13. Incident Response Plan.

The Contractor shall perform assessments for each mixed or financial system and FISMA system that the Contractor operates, modifies, enhances, releases and/or upgrades under the Federal Information System Controls Audit Manual (FISCAM) methodology that include control families for both General Computer and Business Process Application controls:

1. Security Management

2. Access Controls

3. Configuration Management

4. Segregation of Duties

5. Contingency Planning

6. Business Process Application Controls:

7. Application Security

8. Business Process Controls

9. Interfaces

10. Data Management

The Contractor must comply with identified OMB A-123 Appendix A. "Managements Responsibility for Internal Control, and Appendix D (Compliance with the Federal Financial Management Improvement Act of l996) key controls and the Federal Information Security Management Act of 2002 (FISMA) to include the following for each mixed or financial system and FISMA system that the Contractor operates modifies, enhances, releases and/or upgrades:

1. National Institute of Standards and Technology Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 4 (NIST SP 800-53, Rev. 4).

2. NIST SP 800-18 Rev. 1 Guide for Developing Security Plans for Federal Information Systems.

3. NIST SP 800-23 Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products.

4. NIST SP 800-30 Rev. 1 Guide for Conducting Risk Assessments.

5. NIST SP 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems.

6. NIST SP 800-37 Rev. 1 Guide for Applying the Risk Management Framework to Federal Information Systems.

7. NIST SP 800-47 Security Guide for Interconnecting Information Technology Systems

8. NIST SP 800-53A Rev. 1 Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans.

9. NIST SP 800-59 Guideline for Identifying an Information System as a National Security System.

10. NIST SP 800-60 Rev. 1 Guide for Mapping Types of Information and Information Systems to Security Categories.

(11) NIST SP 800-84 Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities.

(12) Federal Information Processing Standards (FIPS) 199/200 Security Categorization Analysis.

(13) FIPS 191 Guideline for the Analysis of Local Area Network Security.

Ginnie Mae Office of Enterprise Data and Technology Solutions (OEDTS) will have responsibility for maintaining the FISCAM-based mapping of security controls that will be required to maintain compliance with FISMA, OMB A-123, HUD, and Ginnie Mae security requirements.

1. The Contractor shall support and provide system security to ensure availability, confidentiality, and integrity of the Ginnie Mae data applications (e.g., maintaining access control, user identification, password protection and authentication, confidentiality of customer profiles and traffic, physical and personnel security required under this PWS).

2. The Contractor shall provide SA&A support on a quarterly basis, including potential off cycle SA&A support, over the life of the contract.

The Ginnie Mae System Security Plans (Risk Assessment, Incidence Response Plan, and IT Contingency Plan) shall be reviewed and presented to Ginnie Mae’s Chief Information Security Officer for approval.

The Contractor shall provide and present to the Ginnie Mae’s Chief Information Security Office on an annual basis a Security Self-Assessment Report.

1.4 Description of Services

The purpose of conducting the Compliance Reviews is to determine if Issuers are following Ginnie Mae’s program requirements. The integrity of Ginnie Mae’s MBS programs is dependent upon the quality of loan servicing, accuracy of the reporting to Ginnie Mae and proper management of Ginnie Mae custodial accounts. Issuer Compliance Reviews will be conducted to determine whether the Ginnie Mae pools, and underlying mortgages are being administered in accordance with Ginnie Mae requirements. Prevailing guidance for conducting Compliance Reviews is captured in two Compliance Review Guides: one for Issuer Reviews (CRG) and one for Document Custodians Document Custodian Compliance Review Manual (DCCRM). Staffing levels must support the capability to travel, if required, and to perform simultaneous Compliance Reviews at multiple Issuers remotely.

Specialized Reviews, including Ad Hoc Analysis and Forensic Analysis, will be performed to address matters that present a unique compliance risk to Ginnie Mae, but are not within the scope of the Compliance Reviews described in the CRG.

Specialized Reviews, including Ad Hoc Analysis and Forensic Analysis, may be performed in accordance with appropriate American Institute of Certified Public Accountants (AICPA) or attestation standards (or other appropriate standards), if requested by Ginnie Mae.

1.5 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making, or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.6 Period of Performance

The period of performance shall be for 6 months.

1.7 Place of Performance

The place of performance for this Contract will generally be the Contractors work site and occasionally remotely at issuers, sub-servicers, or Document Custodians. However, performance may require travel and work performed at HUD facilities (i.e., periodic meetings with Ginnie Mae or follow-up activities performed at the Contractors site, or Issuer or Document Custodian training) or other work sites.

1.8 Hours of Operation

The Contractor is responsible for providing services between the hours of [insert the appropriate hours for your organization] Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. Weekly hours shall not exceed a forty (40) hour work week and a typical workday will be 8 hours each day Monday through Friday. The Government reserves the right to change hours of operation or restrict contractor access. Work outside of these daily hours is prohibited without Contracting Officer approval. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.9 Special Qualifications

The Contractor shall be required to perform HUDs Personal Identity Verification (PIV) which is the security prescreening process in which HUD performs preliminary checks and initiates a background investigation on all contractors in accordance with Homeland Security Presidential Directive-12 (HSPD-12) and Executive Orders, 13764, 10577, 13467, and 13488; sections 3301, 3302, 7301, and 9101 of title 5, United States Code (U.S.C.); parts 2, 5, 731, and 736 of title 5, Code of Federal Regulations (CFR), and Federal information processing standards. Ginnie Mae COR will initiate the PIV process. Each Contractor must have the Security Approval Notice (SAN) which enables the Contractors personnel clearance and access into HUD and its systems.

1.10 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award.

1.11 Status Meetings

The Contracting Officer, Government Technical Representative (GTR) and other Government personnel, as appropriate may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.12 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46. The Contractor shall travel using the lower cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the Contractor shall use the tourist class, economy class or similar lodging accommodations to the extent they are available and commensurate with the mission requirements. HUD will not reimburse Contractor's local travel. Local travel is defined as travel within fifty (50) miles of Washington, DC. All other travel will be reimbursed on a cost-reimbursable basis; no profit or fee will be paid.

1.13 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel during the 90 Transition-Out period. The Contractor shall ensure a smooth transition with any successor Contractor during the Transition-Out period, prior to completion of contractual performance. The Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period.

2 Definitions and Acronyms

2.1 Definitions

Business/Workdays - Every official workday of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) – Government furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Government Technical Monitor (GTM) - An individual designated by the Contracting Officer to assist in providing technical direction and monitoring performance under the contract.

Government Technical Representative (GTR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level

ARAMS - Automated Renewal and Amendment System

BAA - Business Area Analysis Study

CBT - Computer-Based Training

CCB - Change Control Board

CCMB - Configuration Change Management Board

CMMI - Capability Maturity Model Integration

CFO or OCFO - Office of the Chief Financial Officer of HUD

CFR - Code of Federal Regulations

CIO or OCIO - Office of the Chief Information Officer of HUD

CO - Contracting Officer

COR - Contracting Officer Representative

COTS - Commercial Off-the-Shelf

CPO - Office of the Chief Procurement Officer of HUD

EST - Eastern Standard Time (U.S.)

ETC - Estimate to Completion

GAO - U.S. General Accounting Office

GTM - Government Technical Monitor

GTR - Government Technical Representative

HUD - U.S. Department of Housing and Urban Development

HUDAR - HUD Acquisition Regulation

HUD/ISG - Internet Services Group within the Telecom Processing Division

HUD Web - HUDs Intranet Web Site and related WEB pages.

IG or OIG - Inspector General (Office of)

IT - Information Technology

IV&V - Independent Validation and Verification

LOOCS - Line of Credit Control System

OCPO - Office of the Chief Procurement Officer

OIG - Office of Inspector General

OMB - Office of Management and Budget

PL Public Law

PM - Project Manager

POC - Point of Contact

PPM - Project Planning and Management

QA - Quality Assurance

QASP - Quality Assurance Surveillance Plan

QCP - Quality Control Plan

SF - Standard Form

TBD - To be determined

U.S.C - United States Code

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

No Government services will be provided.

3.2 Facilities

No facilities will be provided by the Government.

3.3 Equipment/System (Information, Technology, Systems, Applications, and System Security) The functions required under this contract currently require the use of Government Furnished Information Technology Systems (MyGinnieMae) and Applications (GFITSA), i.e., uploading Compliance Reviews onto Ginnie Maes platform. The Contractor must have its own system(s), infrastructure, and interfaces in place and fully functional. The Contractor shall utilize Ginnie Mae Central (GMC), Compliance and Monitoring (C&M) module to access, perform all compliance Issuer and Document Custodian reviews. When access to data maintained by other Ginnie Mae Contractors is required, the Contractor, through the COR, shall request the necessary data in the format to perform tasks related to the data.

The Contractor shall create and maintain records and archives related to the services performed under this Contract. All Contractor work-papers, data and information housed in its system(s) from Compliance Reviews are the property of Ginnie Mae and shall be turned over to Ginnie Mae or its agent upon request.

The Contractor will be required to utilize Ginnie Mae's work-papers and proprietary system(s) to prepare, transmit, and store work products, data and supporting documents associated with this Contract.

3.4 Materials

The Government will provide Training materials related to the C&M module.

Copies of required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The contractor shall furnish the facilities to meet the requirements under the PWS.

4.2 Equipment

The contractor shall furnish the equipment to meet the requirements under the PWS.

4.3 Material

The contractor shall furnish the materials to meet the requirements under the PWS.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

The Contractor shall provide a Contract/Project Manager who shall be responsible for the performance of work. An alternate shall also be designated to act in the absence of the Contract/Project Manager. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel. The Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to receive assignment, guidance, and direction from the COR and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to the requirement to ensure successful performance. These points of points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 8:00am to 4:30pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

4.5.1. Key Personnel

The following are designated key personnel for this Task Order. The Contractor shall propose comparable labor categories for these positions:

· Partner/Director An individual with a minimum of ten (10) years of experience in planning, coordinating, and directing work similar to that required to be completed in the Performance Work Statement (PWS). Must have strong mortgage banking, audit and/or compliance experience, including a demonstrated knowledge of Ginnie Mae, FHA, VA and RD mortgages and securities programs.

· Forensic Partner/Director An individual with a minimum of ten (10) years of experience in planning, coordinating, and directing work similar to that required to be completed in the PWS. Must have strong mortgage banking, forensic audit and/or compliance experience, including a demonstrated knowledge of Ginnie Mae, FHA, VA and RD mortgages and securities programs.

This individual must also possess direct experience in forensic accounting. Specifically, the ability to conduct thorough forensic financial analysis of business and personal records and developing financial profiles of participants suspected of involvement in activities deemed suspicious or illegal. Expertise in effectively gathering evidence associated with financial analysis, interviewing subjects and key witnesses associated with financial transactions, identifying and tracing funding sources and interrelated transactions, compiling findings and conclusions into financial investigative reports; and be able to provide expert testimony relating to the Ginnie Mae program for litigated issues or other Government Sponsored Enterprise (GSE) related issues.

· Certified Fraud Examiner/Expert Witness An individual with a minimum of three (3) years of experience in fraud examination and management in a mortgage banking environment who possesses a thorough understanding and demonstrated knowledge of fraud prevention, detection, and deterrence methodologies. The CFE must possess the capability to identify fraud triggers and trends, interview suspects, write investigative reports and provide expert testimony relating to the Ginnie Mae program for litigated issues or other Government Sponsored Enterprise (GSE) related issues.

· Project Manager An individual with a minimum of eight (8) years of experience performing or supervising work in the areas of audit and/or compliance as it relates to the mortgage and securities industries. The individual must also have a demonstrated knowledge of Ginnie Mae, FHA, VA, and RD mortgages and securities programs.

This individual must have experience in project management, including the supervision of subcontractors to ensure that deliverables are of consistently high quality and that project timelines and budgets are being adhered to and met. This includes experience in managing numerous tasks simultaneously, often with short turnaround times.

· Senior Manager An individual with a minimum of eight (8) years of experience performing or supervising work in the areas of audit and/or compliance as it relates to the mortgage and securities industries. The individual must also have a demonstrated knowledge of Ginnie Mae, FHA, VA, and RD mortgages and securities programs.

· Senior Consultant/Field Review Team Leader An individual with a minimum of eight (8) years of experience completing tasks associated with a compliance review or audit and acting in a lead or supervisory role in directing a compliance review or audit team. The individual must have a demonstrated knowledge of Ginnie Mae, FHA, VA, and RD mortgages and securities programs, and have performed work in the areas of audit and/or compliance as it relates to the mortgage industry and securities programs.

The Contractor shall be required to perform HUD’s Personal Identity Verification (PIV) which is the security prescreening process in which HUD performs preliminary checks and initiates a background investigation on all contractors in accordance with Homeland Security Presidential Directive-12 (HSPD-12) and Executive Orders, 13764, 10577, 13467, and 13488; sections 3301, 3302, 7301, and 9101 of title 5, United States Code (U.S.C.); parts 2, 5, 731, and 736 of title 5, Code of Federal Regulations (CFR), and Federal information processing standards. Ginnie Mae COR will initiate the PIV process. Each Contractor must have the Security Approval Notice (SAN) which enables the Contractor’s personnel clearance and access into HUD and its systems.

4.5.2. Non-Key Personnel Requirements

Personnel other than key personnel are considered support personnel (including both mainstream and miscellaneous support categories). Personnel, both key and support, assigned to work on the GSA Ginnie Mae Task Order must be acceptable to the Government in terms of capabilities and professional qualifications. Should the continued assignment to this Task Order of any person in the Contractor's organization be deemed by the Government to conflict with the interests of the Government; the Contractor shall be required to remove that person from the assignment and replace him/her with an acceptable person.

The Contractor shall provide the staffing to complete the work and period of performance specified in the Task Order.

Contractor personnel will abide by the normal rules and regulations applicable to the Government premises on which they work, including any applicable safety and security regulations. The Contractor will schedule work hours of all on-site personnel in a manner that will provide maximum responsiveness to the Government's requirements.

The Contractor shall adhere to the same professional and ethical standards of conduct required of Government personnel. The Contractor shall not:

· Discuss with unauthorized persons any information obtained in the performance of work under this Task Order.

· Conduct business, other than that which is covered by this Task Order, during periods paid by the Government.

· Conduct business not directly related to this task order on Government premises.

· Use computer systems and/or other Government facilities for company or personal business; or

· Recruit on Government premises or otherwise act to disrupt official Government business.

4.5.3. Key Personnel Substitution

All key personnel are those personnel considered essential to successful Contractor performance. They include the Project Manager and other personnel providing supervision or critical technical oversight. The Contractor shall not replace any personnel designated as key personnel without the written concurrence of the CO. This notification shall be no later than ten (10) calendar days in advance of any proposed substitution and shall include justification (including resume(s) and labor category of proposed substitution(s)) in sufficient detail to permit evaluation of the impact on TO performance. The Government will approve initial Contactor key personnel at time of extension award. Replacement key personnel will be approved via modification to the Task Order.

Prior to utilizing other than personnel specified in quotes in response to an RFQ, the Contractor shall notify the Government CO and the COR. Substitute personnel qualifications shall be equal to, or greater than, those of the person(s) is being substituted for. If the Government CO and the COR determine that the proposed substitute personnel are unacceptable, or that the reduction of effort would be so substantial as to impair the successful performance of the work under the TO, the Contractor may be subject to default.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

4.7 Quality Control

The Contractor shall establish and maintain a complete quality control program that shall ensure services are performed in accordance with this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non reoccurrence of defective services. The Contractor's quality control program is the means by which he assures himself that his work complies with the requirements of the contract. The Contractor shall provide the associated Quality Control Plan to the Government as directed.

4.7.1 Quality Control Plan

The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP). The QCP shall ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor's methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor's methodology for resolving problems identified by the Government during reviews conducted in accordance with its Quality Assurance Surveillance Plan (QASP). The QCP shall also provide the Contractor's methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system. The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the Government's QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards.

5 Specific Tasks

5.1 Issuer/Document Custodian Reviews

5.1.1 Quarterly Itinerary

The Contractor shall participate in selecting the Issuer/Document Custodian for the Quarterly Compliance Review Itinerary 45 calendar days from the start of each ensuing quarter.

The Contractor shall utilize the approved Quarterly Compliance Review Itinerary to begin the planning, scheduling, and staffing of reviews and to reserve the required travel, if applicable.

The Contractor shall submit changes to the Quarterly Itinerary to Ginnie Mae via the C&M module for approval and specify the time period for the requested change.

Performance Standards

a) Standard: Deliver the Quarterly Itinerary on quarterly basis and at least 45 days prior to the compliance review period.

AQL: Zero Deviation

b) Standard: Submit the Quarterly Itinerary changes in accordance with the C&M module

5.1.2 Standard Reviews

The Contractor shall test Issuers via the C&M module with a lower perceived risk profile to Ginnie Mae. The scope of this Compliance Review is generally the same as the Expanded Review, however the sample sizes are smaller than the Expanded Review and certain testing performed in Expanded Reviews may not be applicable.

· Testing of Issuer Custodial Account Structure

· Testing of Issuer Clearing and Escrow Disbursement Account structure

· Testing of Issuer Timely Movement of Ginnie Mae Funds

· Testing of Issuer Internal Control Reporting

· Testing of Issuer Collections and Foreclosure Processes

· Submission of Issuer Profile Data via an Advance Questionnaire

· Testing of Agency Endorsements

· Testing of Agency Endorsement Matching

5.1.3 Expanded Reviews

The Contractor shall test Issuers via the C&M module representing a higher level of perceived risk profile to Ginnie Mae.

Note that the foregoing is accomplished via. Ginnie Maes risk-based scheduling criteria for Issuers. These Issuers receive the most in-depth level of review to ascertain whether information from source documents (i.e., loan files, custodial bank accounts and other appropriate documentation) is reflective of assertions made to Ginnie Mae. In addition, the Compliance Reviews are designed to ascertain that Issuers send information to Ginnie Mae that is accurate and are administering their Ginnie Mae portfolio in accordance with MBS program requirements.

All Standard Testing Areas AND

· Testing of Refinanced/Net-Funded Loans

· Testing of GFee Calculations

· Testing for verification of clear title at time of pooling

· Testing of re-certification deadlines

5.1.4 Advance Contact and Schedule Issuer/Document Custodian Review

The Contractor shall initiate contact with the Participant of the Review no later than three weeks prior to the intended date of review. The Contractor shall indicate the intended Review date within the quarterly itinerary via the C&M module.

The Contractor may accommodate scheduling of the Participant Review within the approved quarterly itinerary. If a Participant wishes to be reviewed in a time frame not within the quarterly itinerary, the Contractor shall submit the request to Ginnie Mae via the C&M module with any recommendation by the Contractor, if applicable. Ginnie Mae will have the discretion to reschedule a Participant Review to a different quarterly itinerary.

Performance Standards

a) Standard: No later than three weeks prior to the intended date of Review.

AQL: Unless otherwise approved by Ginnie Mae.

5.1.5 Select Pools, Loans, Accounts, and Transactions for Review

The Contractor shall select the required number of pools, loans, accounts, and transactions by using Ginnie Maes approved sampling methodology using testing procedures in the C&M module. Selection of pools and loans will be compiled directly from standard reports from Ginnie Maes Risk Analysis Contractor and various reports furnished by Ginnie Mae, i.e., Government-Furnished Information (GFI).

5.1.6 Conduct Participants Compliance Review

The Contractor shall follow Ginnie Maes prescribed test steps by completing test areas and logging results in C&M modules workpapers. The Contractor shall log non-compliance as Findings and identify supporting documentation. The Contractor shall communicate with Participants throughout the review, including the Entrance and Exit Conferences.

The Contractor shall notify/debrief with Ginnie Mae COR and Subject Matter Experts (SMEs)

Upon executing a Compliance Review, the Contractor shall notify the COR and Subject Matter Experts (SMEs) within one business day of any events that warrant immediate Issuer default as stipulated in Article X of the Ginnie Mae Guaranty Agreement. Bi-monthly meetings with the COR and SMEs are also required. On a quarterly basis, the Contractor shall prepare a summary report and attend a briefing with the COR and SMEs, and if applicable, other stakeholders in Ginnie Mae to discuss issues encountered in Compliance Reviews and Specialized Reviews. This quarterly report shall include all relevant data concerning recent Compliance Reviews, findings issued to include itemization of repeat high or medium risk findings issued in successive Compliance Reviews, trend analysis, finding disagreements or referrals to Ginnie Mae and Ginnie Mae Policy issues needing clarification, etc., to optimize the process.

Performance Standards

a) Standard: The Contractor shall notify the COR and Program Manager within one business day of any events that warrant immediate Issuer default as stipulated in Article X of the Ginnie Mae Guaranty Agreement.

AQL: Zero Deliverables A004 Notice of Article X violations

5.1.7 Prepare Letters and Reports

Using the C&M module the Contractor shall send draft and final letters to Participants on the Compliance Reviews within time frames prescribed by the C&M module. If available, references to the Ginnie Mae MBS Guide, Guaranty Agreements, or other authoritative Ginnie Mae guidance shall be noted in the comment section. All data and information associated with Compliance Reviews shall be maintained in Ginnie Maes work-papers and the C&M system used to conduct Compliance Reviews.

Performance Standards

a) Standard: The Draft Report will be presented to the Issuer before the FRC on-site Review team leaves the Issuers site and the FRC team will also transmit, in soft copy, the draft report to the COR/Monitoring within 24 hours of the review.

AQL: Zero Deviation

b) Standard: The Final Report shall be due 90 days from the review end date.

AQL: Zero Deviation

5.1.8 Conduct Remediation Activities

The Contractor shall conduct remediation on each Compliance Review with findings issued. For each finding, the Contractor shall request a Findings Resolution Plan - FRP (Corrective Action

Plan), for which the Contractor must evaluate for completeness. To the extent that any high or medium risk findings are repeat findings from the prior Compliance Review, the Contractor shall report this to the COR and SMEs.

A remediation group comprised of staff not part of the Compliance Review testing shall perform remediation activities with Issuers in accordance with procedures out lined in the C&M module to include:

· Monitoring remediation of findings to establish that Ginnie Mae MBS program requirements are being met. The remediation process is designed to mitigate any findings identified in the Compliance Reviews.

· Remediation activity shall begin upon issuance of the draft letter to the Issuer and will continue for a period of up to three (3) months from issuance of the draft letter. Any unresolved findings shall be referred to Ginnie Mae upon conclusion of the remediation period, or, in extraordinary circumstances, at the request of Ginnie Mae.

· Remediation shall require the Contractor to coordinate the activities of those performing Compliance Reviews with those responsible for remediation. Findings are prioritized to stress items requiring most immediate action. Remediation shall require the Contractor to:

· control document collection and flow,

· evaluate the adequacy of issuer responses,

· communicate with the issuer by letter, telephone, or e-mail,

· document remediation activities,

· upload files of remediation activities into the C&M module, and

· update status of findings accordingly.

Issuers shall correct all findings cited in accordance with the testing. The findings are "mitigated” when it is determined the root cause issue identified has been corrected. In cases where an Issuer may need to make a systematic or other procedural update that spans past the 90-day remediation period, the finding shall be referred to Ginnie Mae for disposition. The Contractor is responsible for monitoring the progress of the remediation from the point the draft and final letters are issued until all findings have been mitigated or the uncleared findings have been referred to Ginnie Mae.

5.1.9 Suggest Updates to C&M Repository

Given that Compliance Reviews are driven by requirements in the MBS Guide and other governing program guides, and changes or updates in Ginnie Maes policy to remain current with industry best practices, it is essential to submit any enhancements to the procedures and testing governed by the C&M module to Ginnie Mae for review.

Therefore, the Contractor shall, within three months of the award date and on a quarterly basis, provide recommendations and updates to the C&M Repository via the C&M module. The Contractor shall include details of impacted areas (e.g., Test Area ID#), reason for change, and material impact to review level of effort. Ginnie Mae reviews the suggested updates and determines how to proceed with each suggestion. Suggestions may be approved, denied, or postponed for reconsideration in a future quarter. Decisions rendered no later than 10 days before the next quarterly itinerary is published.

For changes approved by Ginnie Mae, the Contractor shall draft the changes to the relevant Repository Items via the C&M module, as assigned by Ginnie Mae Program Managers. The Contractor shall submit drafted changes for quality assurance review by Ginnie Mae in the C&M module before it is fully implemented. Changes drafted are submitted no later than 10 days before next quarterly itinerary is published.

Performance Standards

a) Standard: Review and update of the CRG shall be due three (3) months from contract award date and quarterly thereafter.

AQL: Zero Deviation

5.2. Other Reviews and Audit Support

5.2.1 Review of Document Custodian Facility

The Contractor shall inspect the Document Custodians physical premises when requested by the Monitoring Division DC SME. The Contractor shall ascertain whether the layout of the Custodian facility and safekeeping standards are adequate to ensure necessary security over loan collateral files. The Contractor shall verify and submit its findings via the C&M module.

5.2.2 Specialized Reviews

The Contractor shall perform Specialized Reviews, including Ad Hoc Analysis and Forensic Analysis, the Contractor shall address matters that present a unique compliance risk to Ginnie Mae.

Specialized Reviews may not be within the scope of Compliance Reviews and the C&M module.