Attachment 2 Quality Assurance Surveillance Plan (QASP) .docx
DOCX document 14 KB Posted
- Solicitation number
- 47QACA26R0274
- Issued by
- Not on record
About this file
This is a Quality Assurance Surveillance Plan (QASP) for a Blanket Purchase Agreement (BPA) focused on Loan File Review for Risk Oversight Support Services managed by the SBA Office of Capital Access (OCA) and Office of Credit Risk Management (OCRM), effective March 23, 2026. The QASP establishes performance standards, acceptable quality levels, and surveillance methods that the Government will employ to monitor contractor performance under the BPA using a risk-based approach combining periodic desk reviews, sampling of deliverables, system monitoring, and ongoing observation.
The plan specifies fourteen key performance objectives with defined metrics and surveillance frequencies. Critical performance requirements include: timely submission of draft loan file review reports within 25 business days (95% AQL), final reports within 5 business days of COR comments (5% AQL), weekly status reports by close of business Monday (98% AQL), and monthly status reports by the 5th business day after month-end (100% AQL). Additional performance standards address quality and completeness of loan file reports and exception documentation (95% acceptable ratings), work paper sufficiency (95% compliance), system availability and data warehouse functionality (99% uptime), zero confirmed data breaches with 100% incident reporting compliance, dashboard accuracy (98%), and key personnel continuity with no unapproved vacancies. The Contracting Officer's Representative (COR) bears primary responsibility for surveillance activities, supported by Quality Assurance team members and the SBA Chief Information Security Officer (CISO) for security monitoring. Performance deficiencies are documented and communicated in writing, with corrective actions required at no additional Government cost. The COR maintains comprehensive documentation of all surveillance activities, sampling results, performance deficiency notices, and corrective action tracking in the contract file.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Quality Assurance Surveillance Plan (QASP) Blanket Purchase Agreement (BPA: Loan File Review for Risk Oversight Support Services Office: SBA Office of Capital Access (OCA) / Office of Credit Risk Management (OCRM) Prepared: March 23, 2026 Purpose This Quality Assurance Surveillance Plan (QASP) establishes the performance standards, acceptable quality levels, and surveillance methods the Government will use to monitor contractor performance under the Loan File Review for Risk Oversight Support Services Blanket Purchase Agreement (BPA). The QASP is based on the performance objectives identified in the Performance Work Statement (PWS) and ensures that services meet required quality, timeliness, and completeness standards.
Surveillance Approach The Government will employ a risk-based surveillance approach combining periodic desk reviews, sampling of deliverables and work products, system monitoring, and ongoing observation. The Contracting Officer's Representative (COR) is responsible for surveillance activities and may designate quality assurance personnel to assist with reviews.
Performance Standards and Surveillance Methods
| PWS Reference |
| Performance Objective |
| Performance Standard |
| Acceptable Quality Level (AQL) |
| Surveillance Method |
| Frequency / Responsible Party |
| 8.1, 15, Table 1 |
| Timely draft loan file review reports |
| Draft report submitted within 25 business days of receipt of complete loan file |
| 95% of draft reports meet 25-business-day requirement per quarter |
| COR review of submission dates vs. file receipt dates (desk review of dashboard and sample reports) |
| Monthly; COR/designee |
| 8.1, 15, Table 1 |
| Timely final loan file review reports |
| Final report submitted within 5 business days of COR comments |
| 5% of final reports meet 5-business-day requirement per quarter |
| COR comparison of COR comment dates to final report dates (desk review) |
| Monthly; COR/designee |
| 15.1--15.2, Table 1 |
| Timely weekly status reports/ |
dashboard
| Weekly status report delivered by close of business each Monday |
| $\geq$98% of weekly reports delivered on time per quarter |
| COR checklist; verify receipt and completeness of required data elements |
| Weekly; COR/designee |
| 15.1--15.2, Table 1 |
| Timely monthly status reports |
| Monthly status report delivered by 5th business day after month-end |
| $\geq$100% of monthly reports on time |
| COR checklist; verify receipt and completeness |
| Monthly; COR/designee |
| 7.2, 8.1, 9.1--9.2, 12.2 |
| Quality and completeness of loan file reports and Exceptions |
| Reports contain condition, criteria, cause, effect, corrective action; each Exception references specific SBA requirement and is supported in Work Papers |
| 95% of sampled reports rated "Acceptable" or better in QA review (no material omissions or unsupported Exceptions) |
| COR/QA team review of a risk-based sample of completed reviews and associated Work Papers |
| Quarterly; COR with QA support |
| 12.1--12.3 |
| Work Papers and monitoring files completeness |
| Work Papers are complete, organized, and sufficient to allow third-party replication of conclusions |
| 95% of sampled lender reviews have Work Papers meeting sufficiency criteria |
| On-site or remote inspection of Work Papers/ |
monitoring files; checklist-based QA Semi-annual; COR/QA
| 10.1--10.4, 11, 10.6 |
| Virtual data warehouse/CRM/MWS and DMS availability |
| System accessible to authorized SBA users during normal business hours; supports upload, storage, search, and tracking as described |
| 99% availability during SBA business hours; no more than 1 high-impact outage per quarter |
| Monitoring of contractor uptime reports; COR tracking of incident logs and user complaints |
| Quarterly; COR with IT/security |
| 10.2, 11, 24 |
| Security and protection of PII/confidential data |
| No unauthorized disclosures; incidents handled per SBA/contract procedures |
| Zero confirmed data breaches attributable to contractor negligence; 100% of incidents reported within required timeframes |
| Review of incident reports; SBA CISO/security input; corrective action tracking |
| Ongoing; as incidents occur; COR/CISO |
| 5.3, 15.1--15.2 |
| Accuracy of dashboards/ |
status reporting
| Status reports accurately reflect file counts, stages, due dates, and submission dates |
| 98% accuracy of key fields in sampled reports |
| COR reconciliation of sample status report entries against underlying loan review records |
| Quarterly; COR/designee |
| 8.1, 21.1 |
| Transition-In performance |
| Transition plan submitted within 30 days; core environment and processes ready to accept first Task Order by agreed date |
| 100% on-time transition plan; no delay to first TO start attributable to contractor |
| COR review of transition plan and milestone completion; readiness meeting(s) |
| Once during transition-in; COR |
| 21.2, 10.3, 12.3 |
| Transition-Out performance and data hand-off |
| Complete SBA-owned data and Work Papers delivered in usable format within 60 days of expiration/ |
termination
| 100% of required data/work papers delivered, verified, and readable by SBA |
| COR verification of data transfer; spot-checking for completeness/ |
readability Once during transition-out; COR
| 4.2--4.3, 23 |
| Key Personnel performance and continuity |
| Project Manager in place meeting qualifications; changes approved by CO and transitioned within 30 days if required |
| No unapproved vacancies; 95% of PM changes (if any) completed within 30 days with no material service disruption |
| COR observation of performance; review of key personnel change notices and approvals |
| Ongoing; as needed; COR |
| 6.1--6.4, 13, 25 |
| Keeping current with SBA regulations/SOPs |
| Processes, tools, and templates updated within 30 days of general SBA program changes and within quarterly cycle for OCRM-specific changes |
| $\geq$95% of applicable changes implemented within required timeframes |
| COR review of contractor update logs; sample checks of tools/templates against current SBA guidance |
| Quarterly; COR |
Performance Deficiencies and Corrective Action Performance deficiencies identified through surveillance activities shall be documented by the COR and communicated to the contractor in writing. The contractor shall correct deficiencies at no additional cost to the Government and within timeframes specified by the COR, consistent with Section 16 of the PWS.
If performance deficiencies persist or are severe, the COR will notify the Contracting Officer, who may take appropriate action including:
• Issuance of a Cure Notice
• Withholding of payment
• Termination for default or convenience
• Contractor responsibility determination for future awards Roles and Responsibilities Contracting Officer (CO): Final authority for contract and BPA administration, modifications, and enforcement actions.
Contracting Officer's Representative (COR): Monitors contractor performance, conducts surveillance activities, accepts or rejects deliverables, documents performance issues, and coordinates with quality assurance and security personnel.
Quality Assurance (QA) Team: Assists COR with sampling and detailed review of loan file reports, Work Papers, and monitoring files.
SBA Chief Information Security Officer (CISO) / IT Security: Monitors security incidents, data protection compliance, and system security posture.
Documentation and Records The COR shall maintain documentation of all surveillance activities, including:
• Checklists and review forms
• Sampling plans and results
• Performance deficiency notices and corrective action tracking
• Acceptance or rejection of deliverables
• Contractor correspondence related to performance All surveillance documentation shall be retained in the contract file in accordance with agency record retention policies.
Revision History
| Version |
| Date |
| Description |
| Prepared By |
| 1.0 |
| March 23, 2026 |
| Initial QASP |
| OCRM |
File details come from the government source that posted it. Updated .