VendorRisk_draft_PWS.pdf

SECTION II – PERFORMANCE WORK STATEMENT

1. General The U.S. Department of Housing and Urban Development (HUD) has a requirement to obtain professional business and operational support services for the Government National Mortgage Association (Ginnie Mae) Office of

Enterprise Risk’s Vendor Risk Management Program.

2. Background

Ginnie Mae utilizes the services of third-party entities to provide business and operational support to its program offices/business units and to administer its MBS program. Ginnie Mae recognizes the inherent risks associated with conducting business with third party entities. Ginnie Mae must maintain oversight of its vendors to ensure their activities are conducted in a safe and sound manner and in compliance with applicable laws and regulations. Ginnie

Mae must appropriately manage any strategic, reputational, operational, transaction, credit/financial, and compliance/legal risks associated with such outsourcing. While vendors are responsible for delivering these services in a safe and sound manner, including complying with applicable laws and regulations, Ginnie Mae is ultimately accountable for the risks associated with these outsources services. As a result, the Vendor Risk Management

(VRM) Program has been established to provide a framework to assess, measure, monitor, and manage risks associated with the outsourcing.

3. Objectives

The objectives of this requirement is to obtain support services for the VRM Program which provides oversight of

Ginnie Mae’s vendors to ensure their activities are conducted in a safe and sound manner and in compliance with applicable laws and regulations. The program also assesses the vendor’s ongoing ability to provide the required services and identifies potential risks to Ginnie Mae. The program assists with the identification of strategic, reputational, operational, transaction, credit/financial, and compliance/legal risks affecting Ginnie Mae by third-party entities.

4.Scope

The contractor shall provide services for supporting the Office of Enterprise Risk’s Vendor Risk Management

Program. The contractor shall conduct interviews, identify and gather existing information, perform risk assessments/evaluation, risk identification and gap analysis, and proposal recommendations for remediation of deficiencies and areas of significant risk to the organization.

5. Description of Services The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the Vendor Risk Assessments as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

6. Place of Performance The work to be performed under this contract will be performed at the contractor’s facility, Ginnie Mae office, and/or Ginnie Mae’s vendor facilities.

7. General Information

7.1 The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. It the Contractor feels any action constitutes, or are perceived to constitute personal services, it shall be the Contractor’s responsibility to notify the Contracting Officer immediately. These services shall not be used to perform work of a policy, decision making or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

7.2 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR 42.5. The Government intends to convene a Post Award Conference with the Contractor. The Contracting Officer will notify the Contractor of the specific date, location and agenda within 5 business days after contract award.

7.2.1 Status Meetings

The Contracting Officer, Government Technical Representative (GTR) and other Government personnel, as appropriate may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor’s performance or progress of the requirement. The Contractor will apprise the

Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post award conference and subsequent meetings may be held via teleconference.

7.3. Travel

The Contractor shall be required to perform periodic travel within the Continental United States (CONUS) in the performance of services set forth in this PWS. Travel shall be in accordance with the contract requirements. Prior to travel (each planned trip), the Contractor shall coordinate with and receive Government authorization, in writing, from the CO or GTR for all travel. All travel costs associated with the performance of services in this PWS will be reimbursed in accordance with the Federal Travel Regulation (FTR), if specifically authorized. The Contractor is responsible for obtaining all passenger, transportation, lodging and subsistence. Cost incurred for transportation and per diem (lodging, meals, and incidental expenses) shall be billed in accordance with the regulatory implementation of FAR 31.205-46, Travel Costs. HUD will not reimburse Contractor’s local travel. Local travel is defined as travel within a 50 mile radius of Washington, DC, Maryland and Virginia.

8. Definitions and Acronyms

8.1 Definitions

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government.

The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the

Government.

Defective Service - A service output that does not meet the standard of performance associated with the

Performance Work Statement.

Deliverable - Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports

Federal Acquisition Regulation (FAR) - Federal Government regulation that establishes and directs procurement policies and procedures for all Federal agencies.

Government Furnished Property (GFP) - Government-furnished property” means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract.

Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Government Technical Monitor (GTM) - An individual designated by the Contracting Officer to assist in providing technical direction and monitoring performance under the contract.

Government Technical Representative (GTR) - An employee of the U.S. Government appointed by the

Contracting Officer to perform contract administration activities in regard to technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

HUD Acquisition Regulation (HUDAR) - U.S. Department of Housing and Urban Development’s procurement policies and procedures under the FAR system.

Inherently Governmental Functions - Activities that require either the exercise of discretion in applying

Government authority, or the making of value judgments in making decisions for the Government.

Non-personal Services Contract - A contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met (and optionally, any maximum payment for meeting the acceptable quality level (AQL) and any deduction from payment for not meeting the AQL).

Performance Standard - The Contractor’s performance level required by the Government. This is also known as the acceptable quality level (AQL).

Performance Work Statement (PWS) - A statement of work for performance based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contract’s quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the contractor’s performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Shall Use - To express what is mandatory.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Work Week - Monday through Friday, unless specified otherwise.

8.2 Acronyms

EST Eastern Standard Time (U.S.)

GTM Government Technical Monitor

GTR Government Technical Representative

HUD U.S. Department of Housing and Urban Development

HUDAR HUD Acquisition Regulation

IAW In Accordance With

IG or OIG Inspector General (Office of)

PIV Personal Identity Verification

PM Project Manager

POC Point of Contact

QA Quality Assurance

QASP Quality Assurance Surveillance Plan

QCP Quality Control Plan

GTR Government Technical Representative

TBD To be determined

9. Government Furnished Property (GFP) and Services

The Contractor shall ensure accurate control and accountability of all Government Furnished Property (GFP) in accordance with terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the

GFP shown below.

9.1 Government Services (if applicable)

The Government will provide access to Ginnie Mae applications and infrastructure at all of the Ginnie Mae host sites

9.2 Materials

The Government will provide access to printers, copiers, fax machines etc., when the service contractor is working on-site at Ginnie Mae facilities Copies of required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the GTR upon request or at the end of the contract period of performance

9.3 Quality Assurance (QA)

The Government shall evaluate the Contractor’s performance under this contract in accordance with the Quality

Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the

Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance and the minimum acceptable quality level.

10. Contractor Furnished Items and Services

The Contractor shall furnish all facilities, equipment and supplies required to perform the work under this contract that are not listed under Government Furnished Property and Services that is deemed necessary to complete the deliverables that are identified in this PWS.

11. Contractor Responsibilities U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the GTR.

11.1 Contractor Personnel

The Contractor shall provide a Contract Manager or Project Manager who shall be responsible for the performance of work. An alternate shall also be designated to act in the absence of the Contract/Project Manager. These

Contractor personnel (main point of contact and alternate point of contact) are considered “Key Personnel” by the

Government and shall be listed as such in accordance with HUDAR 2452.237-70, “Key Personnel”. The

Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to actually receive assignment, guidance and direction from the GTR, GTM and CO in accordance with HUDAR 2452.237-73, “Conduct of Work and Technical Guidance” and shall be allocated enough hours to the requirement to ensure successful performance. These points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The

Contract/Project Manager or alternate shall be available during any 8 hour period between the hours of 8:00am to

8:00pm EST, Monday through Friday except Federal Holidays or when the Government facility is closed for administrative reasons.

11.2 Identification of Contractor Employees

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

11.3 Quality Control

The Contractor shall establish and maintain a complete Quality Control Program that shall ensure services are performed in accordance with this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non reoccurrence of defective services. The Contractor’s quality control program is the means by which he assures himself that his work complies with the requirements of the contract. The Contractor shall provide the associated Quality Control Plan.

11.4 Quality Assurance

The government shall evaluate the contractor’s performance under this contract in accordance with the Quality

Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

12. Specific Tasks

The services for supporting the Vendor Risk Management Program shall include the following tasks.

Task 1 -Project Work Plan

The Contractor shall develop and provide a draft and final Project Plan in accordance with the deliverables schedule. The Project Work Plan shall identify information such as, but not limited to, background (contract being reviewed), purpose (of the review), scope, methodology, level of effort (resource hours, levels, and dollars), and identify each of the milestones to be accomplished in meet the requirements of the PWS. Each milestone will have a projected completion date, a summary of the activities required and identification of any input from the Government.

Task 2 - Progress Reports

The contractor shall submit a progress report electronically on the last day of each month covering that month’s activities. This report shall benchmark actual progress in comparison to the projected schedule in each assessments major milestone schedule. It shall address potential roadblocks for successful completion of planned work in the upcoming month.

Task 3 - Risk Assessment/Evaluation

The Contractor shall conduct a risk assessment to determine the risks (strategic, reputational, operational, transaction, credit/financial, and compliance/legal risks) that vendors may present to Ginnie Mae. The

Contractor shall evaluate the overall health of the vendor, vendor’s reputation and performance, security and compliance requirements, internal controls structure, operational incidents, performance metrics, etc. At the conclusion of the assessment, the contractor shall submit an Assessment Report summarizing the results of the review. The report shall contain, but not limited to, a summary of the activities performed, the results/conclusion of each activity, identification of risk areas, gaps/deficiencies in controls and processes, recommendations, and impact analysis. A sample assessment schedule is listed in Attachment 2.

Task 4 – Optional Assessments Ginnie Mae may, at its discretion, issue separately priced task orders to the contractor to conduct an additional assessment. The assessment will be conducted in accordance with the objectives of Vendor Risk Management program.

13. Deliverables

The Contractor shall complete all work, deliver all deliverables and adhere to all milestones as specified herein.

Any papers, recommendations, etc. that the Contractor submits are drafts, not final copies. The Government reserves the right to make changes to delivery dates.

13.1 Quality Control Plan

Quality Control Plan: The Contractor shall develop, maintain, enforce, document and provide a Quality Control

Plan (QCP). The QCP shall ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor’s methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor’s methodology for resolving problems identified by the Government during reviews conducted in accordance with its

Quality Assurance Surveillance Plan (QSAP). The QCP shall also provide the Contractor’s methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system. The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the

Government’s QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards.

13.2 Deliverable Schedule. See Attachment 1.

13.3 Acceptance Criteria. Each contract deliverable shall meet the following inspection and acceptance criteria in additional to any “Inspection and Acceptance” contract terms and conditions: Deliverables shall incorporate all

HUD comments.

The Contractor shall perform at the highest levels of professional and technical competence in performing the identified tasks (listed and described above) to achieve HUD’s stated objectives. It is expected that the Contractor work closely with designated HUD staff to ensure all deliverables conform to the task descriptions and work objectives stated herein.

All deliverables shall be provided to the designated GTR first in draft format for review and comment.

Subsequent final reports will incorporate the comments, changes, edits, and concerns expressed to the

Contractor by the GTR. All deliverables will be grammatically correct, reflect comprehensive research, incorporate complete analysis, and address HUD concerns.

To the extent possible, all deliverables and documentation should be provided to HUD in electronic format, readable via Microsoft Office (e.g. Word, Excel, PowerPoint) and other standard software (e.g.

Adobe Reader). In addition to three (3) hard copies, the final reports must be delivered to HUD in

HTML or other applicable electronic format, Section 508 compliant (refer to www.section508.gov), and suitable for posting online to HUD’s internal and external web sites.

Acceptance of all deliverables shall be in writing by the GTR.

14. Performance Requirements Summary

The summary chart below lists the contract’s primary requirements, the associated performance standards, the expected target performance and the methods of surveillance. While several contract requirements are not listed in the chart below, requirements not appearing on the PRS chart do not negate the Contractor’s obligation to perform all requirements as specified in the contract. Additionally, HUD reserves all rights and remedies under the provisions and clauses of the contract when performance of any contract requirement, whether or not listed below, is unacceptable.

The contractor shall develop a Quality Assurance Surveillance Plan to be approved by the Department of Housing and Urban Development and used to provide contract oversight. In conjunction with the Contractor’s Quality

Control Plan and various other methods of assessing performance, the GTR and GTM will perform on-site reviews and/or other types of verification to determine that the specified target performance requirements have been met.

Regular review of Contractor performance is critical to the overall success of the contract. On a monthly basis, the

GTR will evaluate the quality of the product or services. These performance standards will be fully enforceable starting 45 days from date of contract award.

The PRS headings are defined as follows:

Performance Measure – This column lists the service the Contractor must perform as indicated in the PWS.

Performance Objectives (PWS Reference) – This column lists the applicable outcome (service required) as stated in the PWS.

Performance Standard for Excellence – All tasks must be completed within 72 hours of assignment with any errors or re-work.

Minimum Acceptable Quality Level (AQL) – Percentage or minimum required acceptable level of service, [i.e., no more than one customer complaint per report]

Surveillance Method – Lists the assessment/monitoring method the Government will use to evaluate the

Contractor’s performance in meeting the contract requirements and indicates who performs the surveillance.

Definitions of methods of surveillance are below.

100% Inspection. One hundred percent inspection shall be used for those products and services, which are considered critical tasks. All tasks that utilize this method of surveillance shall be reviewed by HUD and certified for its completeness, accuracy, and conformance to HUD’s standard.

Validated User Complaints. User complaints will be received through various means of communications, telephone calls, email, forum entries, etc. User complaints will be recorded and maintained by HUD.

Periodic Inspection. Predetermined plans for inspecting part of the work are established using the scope of work.

Random Sampling. Services/products are sampled to determine if the level of performance is acceptable.

Incentive/Disincentive – States the outcome for performance above or below the AQL of service.

Performance

Measure

Performance

Objective

Surveillance

Method

Performance

Standard Minimum

Acceptable

Quality Level

Incentive/

Disincentive

Project Work

Plan IAW

PWS Section

12, Task 1

The Contractor shall provide timely schedule update IAW

HUD PPM guidelines

100% Inspection by GTR

All projects shall be completed upon the mutually agreed on project completion date.

Zero Deviation None

Progress

Reports IAW

PWS Section

12, Task 2

All deliverables shall conform to the requirements set forth in the Work Order, must contain accurate information, presented in a professional manner and with substantive technical information.

100% inspection by GTR

Projects shall be completed within the designated timeframes

100% of the time, unless revised by the

GTR as a result of constraints or other priorities.

Extensions will be approved in advance of the due date by the

GTR.

Projects shall be completed within the designated timeframes 100% of the time, unless revised by the GTR as a result of constraints or other priorities.

Extensions will be approved in advance of the due date by the GTR.

End products shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

None

Risk

Assessment/E valuation

IAW PWS

Section 12, Task 3

Contractor shall provide reports as defined in the PWS.

At a minimum all deliverables shall include Executive

Summary, detail narrative, (explaining the purpose/scope of the engagement and the results of the work performed), an explanation of the work performed and recommendations/ conclusions (where appropriate).

Feedback received from participants must be incorporated in the deliverables.

100% inspection

(to confirm adherence to established standards and delivery dates).

All reports are accurate, free of grammatical errors, and contain all required information.

Executive

Summary provided.

Training participant feedback is provided. Report presentation is professional.

Delivery dates are met, or exceeded.

All reports are accurate, free of most grammatical errors, and contain all required information.

Executive Summary provided.

Training participant feedback is provided.

Delivery dates are met.

None

Optional

Assessment

IAW PWS

Section 12, Task 4

Contractor shall provide reports as defined in the PWS.

At a minimum all deliverables shall

100% inspection

(to confirm adherence to established standards and

All reports are accurate, free of grammatical errors, and contain all

All reports are accurate, free of most grammatical errors, and contain all required

None include Executive

Summary, detail narrative, (explaining the purpose/scope of the engagement and the results of the work performed), an explanation of the work performed and recommendations/ conclusions (where appropriate).

Feedback received from participants must be incorporated in the deliverables.

delivery dates). required information.

Executive

Summary provided.

Training participant feedback is provided. Report presentation is professional.

Delivery dates are met, or exceeded.

information.

Executive Summary provided.

Training participant feedback is provided.

Delivery dates are met.

ATTACHMENT 1

DELIVERABLES SCHEDULE

All deliverable due dates shall be met in accordance with the contract schedule. Schedule delays that are not beyond the Contractor’s reasonable control will result in withholding of regular contract payments until the Contractor’s satisfactory completion of the task. If a deliverable due date falls on a weekend or federally recognized holiday, the due date shall be the next business day.

Deliverable Frequency

# of

Copies Medium/Format Submit To Due Date

Project Work

Plan

Draft – Once

Final - Once

1 original Electronic copy GTR Draft – 5 business days after Kick-Off meeting- TBD;

Final -10 business days after Kick-Off

Meeting- TBD

Status/Progress

Report

Monthly 1

Original

Electronic copy GTR Last day of each month

Assessment

Report and work papers

As requested by the GTR

1 original Electronic (CD in

MS Word) and hard copies

GTR TBD

ATTACHMENT 2

ESTIMATED WORKLOAD DATA

A. Annual assessments:

Description of Service

Pool Processing, Pool Certification, Central Paying and Transfer

Agent, Platinum Trustee, and Multiclass Information Agency Services

Functions as Issuing Agent, Authenticating Agent, Paying Agent, Collection Agent, Transfer Agent, Central Registry Agent, Platinum

Trustee, and Multiclass Information Agent. Provides information technology (IT) services. The work performed under this contract is integral to Ginnie Mae’s ability to administer its existing MBS and

Multiclass programs.

MBS Administration

Provides data collection, analysis and risk management services related to

Ginnie Mae’s MBS program. Performs portfolio risk analyses based on monthly accounting reports and quarterly loan level information submitted by Ginnie Mae Issuers. Performs custodial bank rating analyses and certification analyses, system maintenance and enhancements.

Managed Data Center

Provides an end-to- end managed data center with information technology service provision for certain Ginnie Mae enterprise architect. Responsible for the procurement and/or lease for certain Ginnie Mae, hardware, software, licensing and, system upgrades to include hardware, databases, Operating Systems and core network infrastructure.

B. Bi-annual assessments:

Securitized Transaction – Financial Advisor

Provides Investment Banking guidance and expertise on executing and operating Ginnie Mae’s Multiclass Securities Program. Provides highly complex securitized mortgage, mortgage derivative, and mortgage related product expertise.

Multiclass Legal Services

Provides advice, assistance counsel, and legal opinions as required by the

Office of General Counsel and Ginnie Mae. Assists in the development, implementation and operation of Ginnie Mae’s Multi-class Securities program; including litigation support and/or representation to Ginnie

Mae as necessary in all phases of both affirmative and defensive litigation matters.

Valuations Modeling and Policy Guidance

Provides support to enhance Ginnie Mae’s Valuations Models— including valuations of Mortgage Servicing Rights (MSR), guarantee-fee income, and cash-flow generation and scenario analyses of various types, all using industry standard methodologies.

Single Family Master Subservicer

Services current, delinquent and defaulted loans, including enforcement and foreclosure services, management and disposition of acquired properties, and preparation and submission of insurance claims to FHA, RSA and VA, and reports to Ginnie Mae.

Issuer Compliance Reviews

Performs reviews of issuers and document custodians to ensure compliance with Ginnie Mae’s MBS Guide.

General Ledger Financial Services

Provides system support services for Ginnie Mae Financial Accounting

System (GFAS).

C. Assessments conducted as needed.

Information Technology Services

Assists with the implementation and maintenance of Ginnie Mae’s

Enterprise Information Systems Security Program. Conducts Cost

Benefit Analysis; achieving initial information system security certification and accreditation; performing a Privacy Impact Assessment;

producing a risk mitigation plan; recording, updating and inputting data into the Department of Homeland Security Federal Information

Security Management Act and Trusted Agent Tool for the generation of

NIST required documentation.

Financial Statement Review Reviews audited financial statements and supplemental reports received annually from issuers/lenders, as well as applicants applying for issuer status.