DRAFT Vendor Risk Management _VRM_ Program_QASP_Updated Final.pdf

Quality Assurance Surveillance Plan (QASP) Third Party / Vendor Risk Management

(VRM) Program 2/9/2021

Version 1.0

1 Vision

1 INTRODUCTION

1.1 Purpose

1.2 Performance Management Approach

1.3 Performance Management Strategy

2 ROLES AND RESPONSIBILITIES

2.1 The Contracting Officer’s

2.2 The Contracting Officer’s's Representative

3 IDENTIFICATION OF REQUIRED PERFORMANCE STANDARDS/QUALITY

LEVELS

4 METHODOLOGIES TO MONITOR PERFORMANCE

4.1 Surveillance Techniques

4.2 Customer Feedback

4.3 Acceptable Quality Levels

5 QUALITY ASSURANCE DOCUMENTATION

5.1 The Performance Management Feedback Loop

5.2 Monitoring Forms

6 ANALYSIS OF QUALITY ASSURANCE ASSESSEMENT

6.1 Determining Performance

6.2 Reporting

6.3 Reviews and Resolution

6.4 Surveillance Matrix

Appendix 1 - Surveillance Matrix

Appendix 2 - Corrective Action Report (CAR)

Appendix 3 - Customer Complaint Record

Appendix 4 - Performance Assessment Report (PAR)

Quality Assurance Surveillance Plan (QASP)

Third Party / Vendor Risk Management (VRM) Program

1 Vision

To strengthen the Vendor Risk Management Program (VRM) to enable an optimized approach to the identification and remediation of third party / vendor compliance issues as well as implementation of effective risk mitigation strategies through consistent reporting and monitoring of Ginnie Mae's vendors.

1 INTRODUCTION

This Quality Assurance Surveillance Plan (QASP) is pursuant to the requirements listed in the Performance Work Statement (PWS) entitled Third Party / Vendor Risk Management (VRM) Program. This plan sets forth the procedures and guidelines that Ginnie Mae's Office of Enterprise Risk (OER) will use in ensuring the required performance standards or service levels are achieved by the Contractor.

1.1 Purpose

1.1.1 The purpose of the QASP is to describe the systematic methods used to monitor performance and to identify the required documentation and the resources to be employed. The QASP provides a means for evaluating whether the Contractor is meeting the performance standards/quality levels identified in the PWS and the Contractor's Quality Control Plan (QCP), and to ensure that the Government pays only for the level of services received.

1.1.2 This QASP defines the roles and responsibilities of all members of the Integrated Project Team (IPT), identifies the performance objectives, defines the methodologies used to monitor and evaluate the Contractor's performance, describes quality assurance documentation requirements, and describes the analysis of quality assurance monitoring results.

1.2 Performance Management Approach

1.2.1 The PWS structures the acquisition around "what service or quality level is required", as opposed to "how the Contractor should perform the work" (i.e., results, not compliance). This QASP will define the performance management approach taken by Ginnie Mae's OER to monitor and manage the Contractor's performance to ensure the expected outcomes or performance objectives communicated in the PWS are achieved.

Performance management rests on developing a capability to review and analyze information generated through performance assessment. The ability to make decisions based on the analysis of performance data is the cornerstone of performance management; this analysis yields information that indicates whether expected outcomes for the project are being achieved by the Contractor.

1.2.2 Performance management represents a significant shift from the more traditional Quality Assurance (QA) concepts in several ways. Performance management focuses on assessing whether outcomes are being achieved and to what extent. This approach migrates away from scrutiny of compliance with the processes and practices used to achieve the outcome. A performance-based approach enables the Contractor to play a large role in how the work is performed, as long as the proposed processes are within the stated constraints. The only exceptions to process reviews are those required by law (federal, state, and local) and compelling business situations, such as safety and health. A "results focus" provides the Contractor flexibility to continuously improve and innovate over the course of the contract as long as the critical outcomes expected are being achieved and/or the desired performance levels are being met.

1.3 Performance Management Strategy

1.3.1 The Contractor is responsible for the quality of all work performed. The Contractor measures that quality through the Contractor's own Quality Control (QC) program. QC is work output, not workers, and therefore includes all work performed under this contract regardless of whether the work is performed by Contractor employees or by subcontractors. The Contractor's QCP will set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS. The Contractor will develop and implement a performance management system with processes to assess and report its performance to the designated government representative. This QASP enables the Government to take advantage of the Contractor's QC program.

1.3.2 The Government representative(s) will monitor performance and review performance reports furnished by the Contractor to determine how the Contractor is performing against communicated performance objectives. The Contractor will be responsible for making required changes in processes and practices to ensure performance is managed effectively.

2 ROLES AND RESPONSIBILITIES

The following personnel shall oversee and coordinate surveillance activities.

2.1 The Contracting Officer’s

The Contracting Officer’s (CO) is responsible for monitoring contract compliance, contract administration, and cost control and for resolving any differences between the observations documented by the Contracting Officer’s Representative (COR) and the Contractor. The CO will designate one full-time COR as the government authority for performance management. The number of additional representatives serving as technical inspectors depends on the complexity of the services measured, as well as the Contractor's performance, and must be identified and designated by the CO.

2.2 The Contracting Officer’s Representative

The COR is designated in writing by the CO to act as his or her authorized representative to assist in administering a contract. COR limitations are contained in the written appointment letter. The COR is responsible for technical administration of the project and ensures proper government surveillance of the Contractor's performance.

The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government's behalf. Any changes that the Contractor deems may affect contract price, terms, or conditions, shall be referred to the CO for action. The COR will have the responsibility for completing QA monitoring forms used to document the inspection and evaluation of the Contractor's work performance.

Government surveillance may occur under the inspection of services clause for any service relating to the contract.

3 IDENTIFICATION OF REQUIRED PERFORMANCE STANDARDS/QUALITY

LEVELS

The required performance standards and/or quality levels are included in the PWS and in Appendix 1, "Surveillance Matrix". If the Contractor meets the required service or performance level, it will be paid the monthly amount agreed on in the contract.

4 METHODOLOGIES TO MONITOR PERFORMANCE

4.1 Surveillance Techniques

In an effort to minimize the performance management burden, simplified surveillance methods shall be used by the Government to evaluate Contractor performance when appropriate. The primary methods of surveillance are:

• Random Sampling - (insert the process which will be used to conduct the random sampling)

• 100% Inspection - Each month, the COR/PM, shall review the generated documentation and enter summary results into the Surveillance Activity Checklist.

• Periodic Inspection - The COR/PM typically performs the periodic inspection on a monthly basis.

• Customer Feedback

4.2 Customer Feedback

The Contractor is expected to establish and maintain professional communication between its employees and customers. The primary objective of this communication is customer satisfaction. Customer satisfaction is the most significant external indicator of the success and effectiveness of all services provided and can be measured through customer complaints.

Performance management drives the Contractor to be customer focused through initially and internally addressing customer complaints and investigating the issues and/or problems. The customer always has the option to communicate complaints to the CO and/or COR/PM as opposed to the Contractor.

Customer complaints, to be considered valid, must set forth clearly and in writing the detailed nature of the complaint, must be signed, and must be forwarded to the

COR/PM.

Customer feedback may also be obtained either from the results of formal customer satisfaction surveys or from random customer complaints.

4.3 Acceptable Quality Levels

The Acceptable Quality Levels (AQLs) included in Appendix 1, "Surveillance Matrix", for Contractor performance are structured to allow the Contractor to manage how the work is performed. For certain critical activities such as those involving Assessments, Enterprise Level Assessments, and Conclusion and Recommended Assurance Statement, the desired performance level is established at 100 percent. Other levels of performance are keyed to the relative importance of the task to the overall mission performance.

5 QUALITY ASSURANCE DOCUMENTATION

5.1 The Performance Management Feedback Loop

The performance management feedback loop begins with the communication of expected outcomes. Performance standards are expressed in the PWS and are assessed using the performance monitoring techniques shown in Appendix 1.

5.2 Monitoring Forms

The Government's QA surveillance, accomplished by the COR/PM, may be reported using the following monitoring forms: Appendix 2 - "Corrective Action Report (CAR)", Appendix 3 - "Customer Complaint Record", and Appendix 4 "Performance Assessment Report" (PAR). The forms, when completed, will document the Government's assessment of the Contractor's performance under the contract to ensure that the required results are being achieved. The COR/PM will retain a copy of all completed QA surveillance forms.

6 ANALYSIS OF QUALITY ASSURANCE ASSESSEMENT

6.1 Determining Performance

The Government will use the monitoring methods cited to determine whether the performance standards/service levels/AQLs have been met. If the Contractor has not met the minimum requirements, it may be asked to develop a corrective action plan to show how and by what date it intends to bring performance up to the required levels.

6.2 Reporting

At the end of each month, the Contracting Manager will prepare a written report for the COR/PM summarizing the overall results of the quality assurance surveillance of the Contractor's performance. This written report, which includes the Contractor's submitted monthly report and the completed quality assurance monitoring forms, will become part of the QA documentation. It will enable the Government to demonstrate whether the Contractor is meeting the stated objectives and/or performance standards, including cost/technical/scheduling objectives.

6.3 Reviews and Resolution

6.3.1 The COR/PM may require the Contractor's contract/project manager, or a designated alternate, to meet with the CO, PM, and/or other Government IPT personnel as deemed necessary to discuss performance evaluation. The COR/PM will define a frequency of in-depth reviews with the Contractor, including appropriate self-assessments by the Contractor; however, if the need arises, the Contractor will meet with the COR/PM as often as required or per the Contractor's request.

The agenda of the reviews may include:

• Monthly performance assessment data and trend analysis,

• Issues, concerns, and risks of both parties,

• Projected outlook for upcoming months and progress against expected trends, including a corrective action plan analysis,

• Recommendations for improved efficiency and/or effectiveness.

6.3.2 The CO and COR/PM must coordinate and communicate with the Contractor to resolve issues and concerns regarding marginal or unacceptable performance.

6.3.3 The COR/PM and Contractor should jointly formulate tactical and long-term courses of action. Decisions regarding changes to metrics, thresholds, or service levels should be clearly documented. Changes to service levels, procedures, and metrics will be incorporated as a contract modification at the discretion of the CO.

6.4 Surveillance Matrix

The Surveillance Matrix (Appendix 1) is the list of performance objectives and standards that must be performed by the Contractor. This matrix details the method of surveillance the COR/PM will use to validate and inspect these performance elements. Inspection of each element will be documented in the COR/PM file.

Performance objectives define the desired outcomes. Performance standards define the level of service required under the contract to successfully meet the performance objective. The inspection methodology defines how, when, and what will be assessed in measuring performance. The Government performs surveillance, using this QASP, to determine the quality of the Contractor's performance as it relates to the performance element standards. The PRS should be used to form the foundation of the COR's/PM's inspection checklist.

In evaluating the quality of contractor’s performance, the following performance ratings may be used.

Performance Rating

Criteria

Excellent / Outstanding

Performance meets contractual requirements and exceeds many to the Government’s benefit. The contractual performance of the element or sub-element being assessed was accomplished with few minor problems for which corrective actions taken by the contractor was highly effective.

Very Good Performance meets contractual requirements and exceeds some to the Government’s benefit. The contractual performance of the element or sub-element being assessed was accomplished with some minor problems for which corrective actions taken by the contractor was effective.

Satisfactory Performance meets contractual requirements. The contractual performance of the element or sub-element contains some minor problems for which corrective actions taken by the contractor appear or were satisfactory.

Marginal Performance does not meet some contractual requirements.

The contractual performance of the element or sub-element being assessed reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear only marginally effective or were not fully implemented.

Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance of the element or sub-element contains a serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

Appendix 1 - Surveillance Matrix

Statements Standards/AQLs Inspections Ratings

5.1 Task One - Program Management (Scope Area 2)

5.1.1 Weekly Status Meetings & Reports

5.2 Task Two - Update of VRM Framework (Scope Area 10)

Deliverables:

A004 Draft and Final VRM Framework, Assessment Plan, and Supporting Tools and Templates

5.3 Task Three - Vendor Assessments (Scope Area 10)

Deliverables:

A005 Draft and Final Vendor Risks Segmentation by Tier A006 Draft and Final Scope Assessment A007 Draft and Final Initial Risk

a) Completes Vendor Risk Segmentation by Tier, Scope Assessment, Draft and Final VRM Assessment Plans tailored for each Tier 1 vendor, and Initial Risk Register per timelines agreed to in the PWP.

AQL: Zero deviation

b) Completes Interview Questions, Questionnaire Forms and

What: Deliverables How: Review of deliverables Frequency: Continuous Who: COR/PM Incentive: 10% deduction in TO amount for every week the task is not complete within specified deadline Standard(s): all standards

Register A008 Draft and Final VRM Program Assessment Plans tailored for each Tier 1 vendor A009 Draft and Final Interview Questions, Questionnaire Forms, and Templates A010 Draft and Final Information Gathering, Meeting Minutes, and Documentation Acceptance Forms A011 Draft and Final Business Process Handoff Documentation A012 Draft and Final Risk Identification and Gap Analysis Assessment Report A013 Draft and Final Risk Register A014 Draft and Final Vendor Assessment Reports A015 Draft and Final VRM Dashboard and Executive Report

Templates, as well as Information Gathering, meeting minutes, Documentation Acceptance Form, and Business Process Handoff documentation per timeliness agreed to in the PWP.

AQL: Zero deviation

c) Completes Risk Identification and Gap Analysis Assessment Report and Risk Register per timelines agreed to in the PWP.

AQL: Zero deviation

d) Completes Vendor Assessment Reports, VRM Dashboards, and Executive Reports per timelines agreed to in the PWP.

AQL: Zero deviation

5.3.1 Plan, Define Risks, and Scope Assessment

5.3.2 Information Gathering

5.3.3 Assess Documentation and Management of Vendors

5.3.4 Identify Gaps, Analyze Risks, and Rate Vendors

5.3.5 Vendor Assessment Reporting

5.4 Task Four: Service Organization Monitoring and Risk Mitigation (Scope Area 10)

Deliverables:

A016 Draft and Final Standardized SOC 1 and SOC 2 Report Review SOP(s) A017 Draft and Final Vendor Specific SOC Report Assessment Reports A018 Draft and Final Vendor CUECs Control Mapping A019 Draft and Final Enterprise Level Common Controls Catalog A020 Draft and Final Attestation to Ginnie Mae's Implementation of Relevant CUEC Controls A021 Draft and Final Test Plans and Testing Results per CUEC A022 Draft and Final Documentation of CUEC Deficiencies A023 Draft and Final Corrective Action Plans/Plans of Actions and Milestones for CUECs A024 Draft and Final GAP Assessment Finding Reporting for Ginnie Mae controlled CUECs A025 Draft and Final Universal Trends and Weaknesses SOC CUECs Report Findings

a) Completes Standardized SOC Report Review SOP and Vendor Specific SOC report Assessment Reports within specified timelines agreed to in the PWP.

AQL: Zero deviation

b) Completes Vendor CUECs Control Mapping and Enterprise Level Common Controls Catalog within specified timelines agreed to in the PWP.

AQL: Zero deviation

c) Completes Test Plans and Testing Results per CUEC, Documentation of Vendor CUEC Deficiencies as well as Corrective Action Plans/Plans of Actions and Milestones for CUECs within specified timelines agreed to in the

PWP.

AQL: Zero deviation

d) Completes GAP Assessment Findings Reporting, Universal Trends and Weaknesses SOC CUECs report Findings, Mitigation Strategies and Corrective Action Plans and Reporting, and Mitigation KPIs and Performance Dashboards within specified timelines agreed to in the PWP.

AQL: Zero deviation

What: Deliverables How: Review of deliverables Frequency: Continuous Who: COR/PM

A026 Draft and Final Mitigation Strategies and CAPs and Reporting for Ginnie Mae Controlled CUECs A027 Draft and Final Mitigation KPIs and Performance Dashboards

5.4.1 SOC Report Evaluation

5.4.2 Complementary User Entity Controls (CUECs) Analysis and Support

5.4.3 CUEC Testing

5.4.4 Risk Mitigation for CUECs in Ginnie Mae's Control

5.5 Task Five: Information Technology (IT) Governance (Scope Area 10)

Deliverables:

A028 Draft and Final Recommended Standardized FISCAM Security Controls A029 Draft and Final FISMA Pre-audit Validations (system inventory, system controls, and security processes) A030 Draft and Final OIG FISMA Audit Response and Reporting A031 Draft and Final IT Security Governance Documents (policies,

a) Completes Recommended Standardized FISCAM Security Controls, FISMA Pre-audit Validation, OIG FISMA Audit Response and Reporting, and IT Security Governance policies, SOPs, and roadmaps within specified timelines agreed to in the

PWP.

AQL: Zero deviation

What: Deliverables How: Review of deliverables Frequency: Continuous Who: COR/PM

SOPs, and roadmaps including cybersecurity)

5.6 Task Six - VRM Governance Documents Updates (Scope Area 7)

Deliverables A032 Draft and Final Charter A033 Draft and Final Policy A034 Draft and Final Procedure, Flowcharts, RACI, and other VRM Governance Documents A035 Draft and Final VRM Program Tri-fold

5.7 Task Seven - VRM Training (Scope Area 5)

Deliverables:

A036 Draft and Final Training Materials A037 Draft and Final Training

5.8 Task Eight - Special Projects (Scope Area 10)

Deliverables A038 Draft and Final Special Projects

Appendix 2 - Corrective Action Report (CAR)

CORRECTIVE ACTION REPORT (CAR)

(If more space is needed, use reverse and identify by number)

1. CONTRACTOR

2. CONTRACT NUMBER

3. TYPE OF SERVICES

4. FUNCTIONAL AREA

5. SUSPENSE DATE

6. CONTROL NUMBER

7. DEFICIENCY MAJOR MINOR

FINDING:

FINDING IMPACT:

Please respond with a written corrective action plan that details the corrective action of the cited deficiency, the cause of the deficiency, and actions taken to prevent recurrence by Suspense Date in Block 5. If date was not entered in Block 5, the contractor is not required to provide a response.

8. QUALITY ASSURANCE PERSONNEL (COR)

TYPED NAME AND GRADE

SIGNATURE AND DATE

9. ISSUING AUTHORITY

TYPED NAME AND GRADE

SIGNATURE AND DATE

10. COR RESPONSE TO CONTRACTOR CORRECTIVE ACTION AND ACTION TAKEN TO PREVENT RECURRENCE

11. COR DETERMINATION

ACCEPTED REJECTED

12. CLOSE DATE

Appendix 3 - Customer Complaint Record

CUSTOMER COMPLAINT RECORD

DATE/TIME OF COMPLAINT

SOURCE OF COMPLAINT

ORGANIZATION

BUILDING NUMBER

INDIVIDUAL

PHONE NUMBER

NATURE OF COMPLAINT

CONTRACT REFERENCE

VALIDATION

DATE/TIME CONTRACTOR INFORMED OF COMPLAINT

ACTION TAKEN BY CONTRACTOR

RECEIVED/VALIDATED BY

Appendix 4 - Performance Assessment Report (PAR)

PERFORMANCE ASSESSMENT REPORT (PAR)

(If more space is needed, use reverse and identify by number)

1. CONTRACT/TASK ORDER NUMBER 2. CONTRACTOR 3. TYPE OF SERVICES

4. QUALITY ASSURANCE PERSONNEL (COR) SIGNATURE AND DATE

5. COR PHONE 6. SUSPENSE DATE

I. PERFORMANCE

7. DEFICIENCY (CHECK ALL BOXES THAT APPLY)

NEW

REPEAT

NO DEFICIENCY NOTED

8. SERVICES SUMMARY or PWS PARAGRAPH ITEM REVIEWED

9. BRIEF DESCRIPTION OF DEFICIENCY (IF DEFICIENCY BOX WAS

CHECKED)

10. DETAILED PERFORMANCE ASSESSMENT

II. CONTRACTOR VALIDATION

11. CONTRACTOR REPRESENTATIVE CONCUR NON-

CONCUR

12. CORRECTIVE ACTION ESTIMATED COMPLETION DATE

13. CONTRACTOR REPRESENTATIVE CORRECTIVE ACTION AND PREVENTION OF RECURRENCE OR REASON FOR NON-

CONCURRENCE OF COR CITED DEFICIENCY

III. ACTION CORRECTED

14. CONCUR NON-CONCUR COR SIGNATURE AND DATE

15. COR REMARKS (REQUIRED)

6. CONTRACTOR REPRESENTATIVE REMARKS