17-R-00001_QA's.pdf

1 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

CONSUMER FINANCIAL PROTECTION BUREAU

WASHINGTON, D.C. 20552

Questions and Answers in Response to Request for Proposals # CFP-17-R-00001 – Fund and Redress Administration

1. Activities 4 and 7 on the Pricing Sheet require, in part, Check Fraud Prevention measures as described in Section 3.2Ae and 3.2Be of the Solicitation. The measures include Positive Pay features, the costs of which accrue on a per-payment basis. Other costs associated with

Account Maintenance may also be affected by the volume of payments drawn on the account.

The Pricing Sheet identifies the unit for the Account Maintenance as “P/Year.” We have the following questions about this requirement:

(a) What volume of payments drawn on the accounts should the offeror assume when completing the Pricing Sheet?

Pricing for activity 4 (Bureau Administered Redress account maintenance) and activity 7 (Civil

Penalty Fund account maintenance) shall be priced based on the account maintenance of a single year, which includes as per Attachment 4- “all expenses associated with Sections 3.2Ac (Fund

Transfer), 3.2Ad (Interest Earned), 3.2Ae (Check Fraud Prevention), 3.2Ag (Online Account

Access) through 3.2Ah (Bank Statement Corrections), and 3.2Aj (Required Documents) in the

PWS and any preparation or maintenance costs required for fulfillment of the check activity reporting as specified in Section 3.7A (Check activity reporting) and Section 3.7B (Check

Registry Reporting) in the PWS. Any order in place more than 12-months will be adjusted based on a monthly pro-rated charge (Listed Fee / 12 = Monthly $))”.

In pricing for account maintenance, vendors must price according to the unit provided in column

E. Vendors must incorporate costs which could accrue on a per-payment basis into a single fixed price. With respect to your request as to the volume of payments to be drawn on a particular account, that information is unknown. However, vendors can review Attachment 5- Price

Model, which includes sample annual volume estimates. Estimates provided in Attachment 5 are based upon limited prior experience and unknown future conditions; and may not match actual annual volume totals.

(b) How will the CFPB address this issue when establishing Task Order budgets?

Task Order budgets will be based on the final quoted price of the winning vendor of the Task.

2. Activities 45 through 49 contemplate distribution of claim forms through the website.

The Pricing Sheet describes Activity 76 as: “This website is assumed to be enabled to intake consumer data for the purposes of claims processing.” Can you provide clarification on the distinction between Activities 45 through 49 and Activity 76?

2 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

Vendors should describe the process associated with distribution of a claim form or defect letter using an online website distribution methodology in their proposals and price accordingly per unit in rows 45-49. Vendor’s proposals and accompanying pricing should include, per the solicitation, a way for consumers to “to access, complete, submit, and correct claim forms” (See

Section 3.4D-Distribution of a claim form and defect letter”). This includes the ability for consumers to receive and access personalized claim forms and/or defect letters which are fillable online. The opportunity to price for the verification and receipt of claims data within an online website is available in rows 56-60 and is described in Section 3.5E- Verification and receipt of claims data

Activity 76 is to be used to price specifically for the development and maintenance of the website as described in Section 3.5F which is assumed to be enabled to intake consumer data for the purposes of claims processing. It is expected that this same website would be used to enable the distribution of claims form or defect letter as priced in rows 45-49.

3. The Pricing Sheet identifies the Unit for Activity 71 and Activity 74 as Monthly. We have the following questions about these requirements:

(a) Should IVR costs be priced at the same per-minute unit as Live Agents when included in Activity 71?

No, IVR costs associated with Activity 71 should be included within the monthly fixed unit price under Activity 71.

(b) If so, how many IVR minutes should the offeror assume per month?

Not applicable. See (a), above.

The Pricing Guidance documents note that “Standard print pricing should include two double-sided sheets,” while the units for Activities 78 through 82 are Sheets, which are defined as one page, double sided. Both documents note that the pricing should include postage costs. We have the following questions about these requirements:

(a) Should the total printing and postage costs for mailing “two double-sided sheets” at each volume level be divided by 2 to provide a per-sheet price?

(b) Alternatively, should the unit price be for two double-sided sheets?

Both a single sheet and two sheet mailing will require the same postage amount. On the one hand, if we include the full cost of postage in single sheet pricing, the CFPB would end up double-charged for postage on a two-sheet mailing. On the other hand, if we calculate the per-sheet price by dividing the cost of postage by two, the offeror risks 50% losses on postage costs for any single-sheet mailing.

3 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

CFPB has re-reviewed the pricing schedule of the print and mailing section and have edited in response to the questions. The following updates have been made:

1. The pricing worksheet (attachment 4) and pricing model (attachment 5) have updated the unit for rows 78-82 from “Sheet” to “Standard Mailing Package”.

2. The definition of a Standard Mailing Package has been clarified in the pricing guidance (attachment 8). The pricing guidance has been updated to clarify that a standard mailing package includes printing and mailing a double-sided cover letter and accompanying check for each eligible victim. Letter and check language will include a combination of dynamic (consumer name, address, and check amount) and static text. CFPB anticipates the contractor will use a CFPB approved window or other type envelope. The pricing guidance has also clarified that the entire printing and mailing of a package should be priced as a single unit.

3. Activity “Additional sheets included within the standard mailing package” has been added and is reflected in new rows 82a1-82a5 in the pricing worksheet

(attachment 4). Pricing in this row will be used to price the printing and mailing costs for any additional sheet which is mailed within the standard mailing package.

The contractor should price any expense associated with printing (stuffing, folding, etc.) and mailing of additional sheets of paper (beyond that included in the standard mailing package in the pricing schedule) on a per sheet basis on row 82a1-82a5.

“Sheet” is defined as one page, double sided. Additional ‘sheets’ may include inserts or notices, defect letters or claims forms (as defined in section 3.4 c (Distribution and receipt of claim form and defect letter, US Postal Mail). The pricing guidance has also been updated to include this information.

4. Activity “Additional sheets NOT included within the standard mailing package, IE standalone print and mailing” has been added and is reflected in new rows

82b1-82b5 in the pricing worksheet (attachment 4). Pricing in this row will be used to price the printing and mailing of any additional sheet that would not be included as part of the standard mailing package, but would be mailed as a stand-alone print and mailing package. A “sheet” may be in the form of an insert or notice, defect letter or claims form (as defined in section 3.4 c- Distribution and receipt of claim form and defect letter, US Postal Mail), or reminder letter (as defined in section

3.4Bb-Reminder Letters). "Sheet" is defined as one page, double sided. The pricing guidance has also been updated to include this information.

5. It has been clarified that checks will only be printed as part of a standard mailing package in the pricing worksheet (attachment 4) and pricing guidance

(attachment 9). If a Task requires a check without a standard mailing package, this requirement will be priced on a Task-order basis.

4. Will the Task Order always specify which deficiencies are curable and non-curable, or must the contractor develop these criteria?

4 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

This question and response pertains, only, to Section III, 3.4.E, Verification and Receipt of

Claims Data, with respect to claimants who submit deficient claims and curable and non-curable defects in those claims. CFPB anticipates working together with the vendor on the criteria for claims process. It will be expected that the vendor will propose which criteria will be curable or non-curable. Specific information within task orders will vary depending on the case.

5. Sample Task Order 1 states, “The funds allocated to any victims whose total harm falls below the de minimis threshold should be redistributed among the remaining victims up to 100% of each victim’s harm.” Is there a specific de minimis threshold we should apply? Sample Task Order 2 specifies a $10 de minimis threshold, but Sample Task

Order 1 does not appear to set a specific threshold.

The de minimis threshold for Sample Task Order 1 is $10.00.

6. Section 6.0.G of the Solicitation provides as follows:

The Contractor shall provide a current SSAE 16, SOC1, Type II report audit of its internal controls and other financial and performance audits with their proposal.

Awarded contractor will be required to provide an SSAE 16, SOC 1, Type II report annually during the term of this contract. The SSAE 16 (SOC 1) should render an independent opinion on the operating effectiveness of the controls and procedures as a result of their assessments/tests. The Contractor is required to review this report with CFPB and/or its auditors. The CFPB reserves the right to terminate or suspend services of the Contractor based on the results noted in these reports.

We have the following questions about this requirement:

(a) Is this a “go/no-go” requirement such that a contractor’s inability to produce a

SOC 1, Type II audit report alongside its substantive proposal disqualifies that contractor from consideration for this solicitation?

Yes. Per the solicitation in Section 6.0- Quality Control, “The Contractor shall develop and maintain an effective quality control program (QCP) to ensure services are performed in accordance with this Performance Work Statement… G. The Contractor shall provide a current SSAE 16, SOC1, Type II report audit of its internal controls and other financial and performance audits with their proposal. Note that the solicitation is additionally being amended to add clarifying language in the PWS at Section 6.0, the submission instructions and the stated evaluation criteria.

(b) Instead of a SOC 1, Type II audit report, will the CFPB permit a contractor to provide an alternative third-party audit report that demonstrates, as compared to established industry standards, the competence of the contractor’s “controls and procedures” relevant to administration programs of the type contemplated by this solicitation?

5 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

No, the requirements of the solicitation specify under Section 6.0- Quality Control G. that “ [t]he

Contractor shall provide a current SSAE 16, SOC1, Type II report audit of its internal controls and other financial and performance audits with their proposal.”

(c) If the answer to Question 7(a) is “yes,” and the answer to Question 7(b) is “no,” will the CFPB permit a contractor to obtain a SOC 1, Type II audit report over the course of this contract in lieu of producing it at the time of the proposal submission? For example, will the CFPB permit a contractor to be selected for the

IDIQ but not become eligible to win a task order until the contractor produces a

SOC 1, Type II audit report?

We recall from the April 18, 2016 Pre-Solicitation Conference that one of the

CFPB’s primary goals with respect to this solicitation is to qualify as many expert administration firms as possible to compete for each task order contemplated by this solicitation. We fear that this singular restriction would eliminate many of the firms you hoped to include in those task order competitions. Additionally, it appears that the solicitation does not require any specific result in an SSAE 16, SOC 1, Type II audit report, but rather just the existence of such a report, which could include failing results.

No, the solicitation requirements have been drafted based upon CFPB’s minimum needs. The selection process is to obtain vendors that meet the requirements for performance of the work and are eligible to compete for task orders.

7. If a contractor has a professional liability insurance policy for sufficient coverage that is not client or matter specific, would the highlighted language below from Section 3.9(A), Liability Insurance and Employee Dishonesty Bonding, require the contractor to separately purchase a $10M professional liability policy specific to work performed under the CFPB Contract?

A. Liability Insurance and Employee Dishonesty Bonding. The Contractor shall obtain and maintain professional liability insurance and employee dishonesty bonding.

a. At a minimum, the Contractor must carry liability insurance of ten million dollars

($10,000,000) and employee dishonesty bonding of five million dollars

($5,000,000). The blanket policies shall apply to all TO’s issued under this contract. The policies shall be executed in favor of both:

i. the CFPB for the benefit of the potential funds recipients pursuant to judgment(s) administered under the Contract, and

ii. the potential funds recipients pursuant to such judgment(s).

It appears you are asking a question regarding interpretation of the terms of a particular liability insurance policy that you or another Contractor may have, and we are unable to offer an opinion on that. Pursuant to the terms of the solicitation, the Contractor must ensure that all requirements

6 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552 of Section 3.9A- Liability Insurance and Employee Dishonesty Bonding, are met with respect to its insurance and bonding. Please note: The go/no go criteria requires proof of the necessary insurance & bonding at the time of submission of the proposal or proof of the ability to obtain the necessary insurance & bonding by time of contract award (i.e. letter of pre-approval from a surety that holds a Federal Certificate of Authority as Acceptable Surety On Federal Bond and

Reinsuring.)

8. Does the Combined Synopsis/Solicitation under solicitation number CFP17R00001 contain requirements similar to a current contract? If possible, please provide the current contract number. Or, is this a new requirement for the government?

CFPB awarded a similar contract in 2013 which can be reviewed here:

https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=75baf2a76c512c1362586

6d55f6a074b&_cview=0

CFP-17-R-00001 is a new contract and has new requirements.

9. An assembling our proposal, should Key Personnel resumes be placed in the Non-Price

Volume? If yes, do they count against the page limit (42 pages)? If yes, under which section identified on Page 68 so we can make the appropriate adjustment?

The Non-Price Volume instructions have been clarified to identify placement of resumes; and to update the page limit to 46 pages, which includes the two resumes related to “Key Personnel” with 2 page max. per resume.

10. This question relates to a requirement for a SSAE 16, SOC1, Type II Report.

Page 40 (Section 6.0 Quality Control) identifies seven components of a Quality Control

Plan that must be included or “have incorporated into during performance of contract…” (emphasis added). One of components is:

G. The Contractor shall provide a current SSAE 16, SOC1, Type II report audit of its internal controls and other financial and performance audits with their proposal. Awarded contractor will be required to provide an SSAE 16, SOC 1, Type II report annually during the term of this contract. The SSAE 16 (SOC 1) should render an independent opinion on the operating effectiveness of the controls and procedures as a result of their assessments/tests. The Contractor is required to review this report with CFPB and/or its auditors. The CFPB reserves the right to terminate or suspend services of the Contractor based on the results noted in these reports.

On Page 69 (Section 5.C), we are instructed that “Offerors shall submit a QCP, which correlates to the requirements of the PWS – 6.0 Quality Control Plan.”

Page 74 (Section 5.D) identifies Go/No Go Factor 1 – Package Completion, which states that:

https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=75baf2a76c512c13625866d55f6a074b&_cview=0 https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=75baf2a76c512c13625866d55f6a074b&_cview=0

7 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

Evaluation Criteria Offeror’s proposal will be evaluated for its completeness under this factor. To be considered complete (“Go” rating), the respondent must include the following:

a. Proof of insurance & bonding at levels described in PWS, or proof of ability to receive of eligibility of insurance & bonding (i.e. letter of pre-approval from a surety that holds a Federal Certificate of Authority as Acceptable Surety On

Federal Bond and Reinsuring) by time of contract award;

b. Responses to Sample Task Orders (3 sample task order responses total);

c. Resumes related to “Key Personnel” (2 resumes (2 page max. per resume));

d. Redress Experience and Past Performance Worksheets completion (4);

e. Quality Control Plan;

f. Small Business Subcontracting Plan (applicable to large businesses);

g. Completed provisions FAR 52.209-5, 52.209-7, and 52.212-3 (see below); and

h. Completed CFPB 3rd Party Service Provider Self-Assessment (Attachment 6).

Offerors who receive a rating of “No Go” under this evaluation factor (Step 1, Factor 1 –

Package Completion) shall not be evaluated further and shall not be eligible for consideration for award.

I don’t see where items e, f, g, and h are qualitatively reviewed and scored (in Section D

– Evaluation of Proposals).

Is a Quality Control Plan (item e) that includes a commitment to obtain a SSAE 16 SOC

1 report sufficient to satisfy the “have incorporated into during performance of contract…” clause, or will this result in a “No Go” score under Step 1, Factor 1?

Please see the answer to question 6(a), above.

11. Is a Contractor Information Security Program that meets the requirements of CFPB 3rd

Party Service Provider Self-Assessment required? Or will a failure to meet these requirements result in a “No Go” score under Step 1, Factor 1?

A completed CFPB 3rd Party Service Provider Self-Assessment (Attachment 6) is required as part of the go/no go criteria. The completion of the Self-Assessment, only, is what is being evaluated under this part of Step 1, Factor 1. However, to be eligible to compete for task orders, awarded Contractors will be required to meet certain cybersecurity requirements, including criteria referenced in the CFPB 3rd Party Service Provider Self-Assessment.

12. Will there be a requirement to meet NIST Special Publication (SP) 800-53, Revision IV rather than Revision III? If so, what?

800-53, Revision IV is in effect and may be applicable depending upon factors relevant to the particular vendor system. Please also the solicitation at Section II, Para. 20.0, Cybersecurity/IT

Security.

8 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552