RFP_-_OCRM_504_Solicitation_amended_081414.docx

SBA 504 Program - CDCs Risk Based Review and Risk Oversight Support Services

Office of Capital Access/Office of Credit Risk Management

PART I – SUPPLIES OR SERVICES AND PRICES/COSTS

SERVICES

SBA’s 504 Loan Program assists small businesses by providing them with needed long-term capital not otherwise available to them to purchase or improve fixed assets or real estate. The 504 Loan Program is delivered through authorized Certified Development Companies (CDCs), which act on the Agency’s behalf to arrange, close, service and (when necessary) liquidate and collect on 504 Loans. CDCs are also referred to as Lenders, SBA Lenders, and Regulated Institutions. SBA is the primary regulator of CDCs. Currently; there are approximately 265 CDCs and a total of $27 billion in 504 loans outstanding. The Contractor shall provide services necessary to create an evaluation framework for conducting risk-based reviews of CDCs and to monitor the performance of CDCs, provide technical assistance with the administration of CDC reviews, and track and manage data related to CDC reviews. The Contractor shall also provide services to apply the evaluation framework to CDCs selected by SBA’s Office of Capital Access / Office of Credit Risk Management (OCRM), and measure and benchmark the outcomes and impacts of services provided. The Contractor shall also provide support services in connection with supervisory and enforcement actions against CDCs.

1. CONTRACT DEFINITION – INDEFINITE DELIVERY – INDEFINITE QUANTITY

This is an Indefinite Delivery - Indefinite Quantity Contract as defined at Subpart 16.504 of the Federal Acquisition Regulation (FAR), FAR Clause 52.216-22, Indefinite-Quantity. Services provided by the Contractor under this Contract shall be secured by the issuance of Task Orders placed in accordance with the following clauses: FAR 52.216-18, Ordering, and FAR 52.216-19, Ordering Limitations. The North American Industry Classification System (NAICS) code for this acquisition is 541211. NOTE: The successful Offeror shall be registered in Sam.gov under this NAICS prior to award. The small business size standard is $20.5 million.

2. MINIMUM AND MAXIMUM QUANTITIES AND AMOUNTS FOR ORDER

The minimum quantity and/or amount to be ordered under this contract shall not be less than the minimum quantity and/or amount shown in the following table. The maximum quantity and/or amount to be ordered under this contract shall not exceed the maximum quantity and/or amount shown in the table. THE MINIMUM AND MAXIMUM AMOUNT IS FOR THE LIFE OF THE CONTRACT which includes the base year and all options periods exercised.

2.1. TYPE OF CONTRACT - HYBRID CONTRACT TYPE

The contract type is a hybrid. Task orders issued may contain Firm Fixed Price (FFP) or Fixed Unit Price (FUP) Contract Line Items (CLINS), with a cost-reimbursement line item for travel, or a combination of these types.

Task orders will be issued on a fixed price basis or fixed unit price basis. Orders may combine the two types if warranted, e.g. travel costs may be reimbursable under a fixed price order. Upon receipt of a request for a proposal, the Contractor shall provide a proposal of costs to be incurred, including direct labor and other direct costs. In doing so, the Contractor agrees that, unless otherwise specified in the request for proposal, reimbursable travel will be paid based upon Federal travel regulations in place at the time the travel takes place and will not have any fee added to it.

3. PERIOD OF PERFORMANCE BASE CONTRACT

The period of performance for this contract is one, one-year base period and four, one-year option periods.

Base period will begin on the date of award and completed twelve months after the date of award.

Option period 1 (1 year) NOTE: DATES WILL BE FILLED IN AT TIME OF AWARD Option period 2 (1 year) Option period 3 (1 year) Option period 4 (1 year)

PART II - IDIQ PRICING SCHEDULE -

4. CONTRACT LINE ITEM (CLIN)- PRICE SCHEDULE IS LOCATED AT ATTACHMENT 1-*NOTES: -FOR PROPOSAL PURPOSES FILL IN THE UNIT RATE FOR THE CONTRACT LINE ITEMS (CLINS) ON ATTACHMENT 1, SUBMIT THESE DOCUMENTS.

-. Price Proposal for the Task Order shall be completed on the Task Order Pricing Schedule on Attachment 4, Page and ALSO LOCATED ON ATTACHMENT 1 IS THE CONTRACT LINE ITEM (CLINS) STRUCTURE WITH QUANTITY ESTIMATES. - -THE MINIMUMS AND MAXIMUMS LISTED ARE FOR ESTIMATING PURPOSES AND ARE ONLY ESTIMATES!!! GUARNTEES ARE LISTED IN PARAGRAPH 2.0 ABOVE!

5. UTILIZE ATTACHMENT 1 FOR PROVIDING PRICING ON THE BASE/PARENT IDIQ.

As total compensation for all services performed in accordance with the terms, conditions, and specifications stated herein, the Contractor will be paid according to the prices listed above per CLIN Structure or per negotiated level of effort per the Labor Rates listed below under paragraph 6. as negotiated as a fixed price on all Task Orders issued.

6. LABOR RATES

All task orders issued against this contract will be firm-fixed price. Tasks will be either based on a per unit price agreed upon with the award of the IDIQ contract or will be based on proposed labor categories and hourly rates agreed upon with the award of the IDIQ contract. Please see section 6 of this solicitation for further information on how to propose pricing for tasks based on labor categories and rates.

Tasks 1, 2, 3, 4, 6, 7, 8, and 10 are based on per unit pricing. For task 1, Offerors should propose a monthly price for technical assistance. The costs associated with tasks 18, 19, and 21 should be included in the proposed monthly price for task 1.

For tasks 2, 3, 4, 6, 7, and 8 , Offerors must propose a per review price. Costs associated with tasks 13 and 14 should be included in the proposed per review price for tasks 2, 3, 4, 6, 7 and 8, as tasks 13 and 14 must be completed as part of each review.

The proposed price for task 10 should be per order and is estimated to be ordered once per year of contract performance. The proposed price for task 11 is per order for CDC process analysis and it is estimated that this task may be ordered once or twice a year, or more a year of contract performance. The proposed price for task 12 is per biannual analysis of oversight program and process, which is estimated to be ordered once per year of contract performance for two a year.

The per unit pricing all for tasks shall be provided on Attachment 1. Additionally, if the task order at Attachment 3 orders any of the tasks listed here, then the pricing for those tasks should be listed in the Offeror’s pricing proposal for the task order award (Attachment 3). As total compensation for all services performed in accordance with the terms, conditions, and specifications stated herein, the Contractor will be paid according to the prices listed above per CLIN Structure or per negotiated level of effort per the Labor Rates listed below under paragraph 5.16. as negotiated as a fixed price on all Task Orders issued.

TASKS BASED ON LABOR CATEGORIES AND LABOR RATES

Some of the tasks described in this solicitation are priced based on a fixed price, which will be agreed upon with the award of task orders placed against the IDIQ contract. For certain tasks associated with the contract, Offeror’s must provide their proposed labor categories and hourly pricing in response to the IDIQ RFP by completed the SF 1449 and Attachment 1. If a task order RFP is issued for one of those tasks, the Offeror must propose the number of hours and individuals necessary to complete the tasks, based on the agreed upon labor categories and hourly pricing. The resulting task order award is a firm-fixed price award.

The following tasks are priced based on labor categories and hourly rates agreed upon in the IDIQ contract: task 5, task 8, task 9, task 16, task 17, 20, and task 22. If any of these tasks (5, 8, 9, 16, 17, 20, or 22) are included in the Task Order 1 RFP (Attachment 2), the Offeror must provide its proposed number of hours and individuals to complete those tasks and include that information in its proposal for the task order award. The proposed labor categories, hourly rates, and any increase in price for option year performance of such tasks will be incorporated into the award of the IDIQ contract and the number of hours and individuals will be negotiated and agreed upon prior to the award of any task order for these tasks.

PART III – PERFORMANCE WORK STATEMENT

1.0 Purpose

The Contractor shall provide services necessary to create an evaluation framework for conducting risk-based reviews of CDCs that close, service, and in some cases, liquidate U.S. Small Business Administration (SBA) loans through the 504 loan program. The Contractor will assist with the performance of CDC reviews, provide technical assistance with the administration of CDC reviews, track and manage data related to CDC reviews and provide support services for supervisory and enforcement actions against CDC.

2.0 Background

The SBA is an independent agency of the United States, established in 1953, pursuant to the Small Business Act. The SBA derives its authority principally from the Small Business Act and the Small Business Investment Act. The 504 loan program is authorized by the Small Business Investment Act.

The U.S. Small Business Administration (“SBA”) Office of Credit Risk Management (“OCRM”) is charged with credit risk management of the SBA’s lending programs. OCRM’s objective for CDC oversight is to identify and analyze the risk profile of SBA’s lending partners and assign a specific level of concern to each CDC. OCRM is part of the Office of Capital Access (“OCA”). The Office of Financial Assistance (“OFA”), also a unit of OCA, oversees SBA’s 504 loan processing and servicing liquidation centers. SBA’s District Offices also have responsibilities involving interaction with CDCs and loan litigation responsibilities.

The 504 Loan Program is a key component supporting the SBA’s mission to assist small businesses by providing them with needed long-term capital not otherwise available to them to purchase or improve fixed assets or real estate. The purpose of the 504 Loan Program is to encourage economic development within a community. The 504 Loan Program is delivered through authorized CDCs, which act on the Agency’s behalf to arrange, close, service and (when authorized) liquidate and collect on 504 Loans. CDCs do not use their own funds to make any 504 loans. CDCs arrange 504 Loans with pooled funds obtained through SBA from the sale of Debentures in the capital markets. Currently, there are approximately 265 CDCs authorized to participate in SBA’s 504 Loan Program with over $27 billion in total SBA 504 Loans under management.

3.0 Overview

OCRM’s strategy is to select CDCs for Risk-Based Reviews (“RBRs”) based upon a broad set of risk attributes, so as to meet its mission of identifying, assessing and managing credit program risks related to eligibility, credit underwriting, servicing, liquidation and suspicious activity. To accomplish this, OCRM conducts extensive analysis combined with strategic on-site and off-site (virtual) review activities.

OCRM conducts risk based analyses of CDC’s through strategic reviews of CDC’s activities including the performance of their operations and their compliance with SBA Loan Program Requirements. OCRM also assesses the quality of the overall SBA loan portfolio. Through this analysis, trends are identified and analyzed. As a result of this trend analysis and assessment, as well as other analytical risk indicators identified, OCRM is able to better understand CDC and portfolio performance. All of the tasks outlined in the Performance Work Statement are critical to the effective oversight of SBA’s lending partners and analysis of SBA's loan programs.

4.0 Objectives

• SBA is seeking a Contractor who will provide innovative approaches to SBA’s oversight and monitoring processes, and Risk-Based Reviews of CDCs in accordance with SBA Loan Program Requirements, including, but not limited to, 13 C.F.R. Part 120 and SBA SOPs 51 00 “On-Site Lender Reviews/Examinations” and 50 53 “Lender Supervision & Enforcement”, as amended from time to time. The Contractor will ensure that (1) SBA Loan Program Requirements as defined in 13 C.F.R. 120.10 are being followed by CDCs, and (2) the assessments of individual CDCs are provided at the best value possible to the SBA as well as to the CDCs.

• SBA is seeking a Contractor who has an understanding of the existing process of SBA’s risk-based reviews in accordance with 13 C.F.R. Part 120 and SBA’s SOPs 51 00 and 50 53, as amended from time to time.

• SBA is seeking a Contractor who has an understanding of SBA’s Loan Program Requirements, including, but not limited to, SBA regulations in 13 CFR Part 120 and SOPs applicable to loan processing, servicing and liquidating (i.e., SOPs 50 10 (5) “Lender Development Company Loan Programs” and 50 55 “504 Loan Servicing and Liquidation”, as amended from time to time.)

• SBA is seeking a Contractor who can provide services consistent with the practices utilized by the various federal banking regulators and servicer rating agencies as part of its overall CDC oversight and monitoring efforts. SBA prefers a Contractor who has experience conducting large scale risk management, risk based reviews, and internal control systems capabilities.

• SBA is seeking a Contractor who shall ensure that the SBA is provided with services and models that are current, relevant, and reflective of federal government, regulatory and industry best practices, given the constant evolution of generally accepted accounting principles and federal banking regulations.

• SBA prefers the Offeror to have experience performing reviews under AICPA standards and consulting services. SBA also prefers that Offerors be able to demonstrate experience performing: (i) reviews or audits involving financial standards; (ii) forensic reviews; (iii) Agreed Upon procedure reviews; and (4) reviews for fraud, waste and abuse when there was a degree of attestation required within the past 3 years.

• SBA is seeking a Contractor who will be capable of providing and utilizing a Virtual Data Room solution. The SBA is not currently using a virtual data room solution. SBA seeks access to an existing commercial off-the-shelf solution (COTS) that will integrate the current tools and implement the Contractors proposed COTS solution.

• SBA seeks COTS tools in response to the requirements associated with Task 1 and Task 10. Some solutions may require some customizing and configuration for implementation specifically for SBA. The customizing and configuration specifically for SBA is anticipated for in the Contractor’s response/pricing referenced as CLIN 0010 - Task 10 of the Task Order 0001- Attachment 3. SBA does not seek the design and development of a system for SBA. SBA does not anticipate owning a system at the conclusion of the contract. However, SBA will own all data housed in the virtual data room and tracking system.

The Contractor shall provide support consistent with these objectives.

5.0 Abbreviations and Definitions

5.1.3 CAM - Certified Auditing Manager

5.1.28 SDR - SMART CDC Review

5.1.34 SAS - Statistical Analytical Software

5.1.35 TM – Technical Monitor

5.2 Definitions

5.2.1 Business Day: Any day other than a Saturday, Sunday, a Federal holiday or other day on which the Federal Government, by law, or executive order is closed.

5.2.2 Community Advantage: is a new pilot loan program introduced by SBA to meet the credit, management, and technical assistance needs of small businesses in underserved markets. CA is designed to provide mission-oriented lenders, primarily nonprofit financial intermediaries focused on economic development, access to 7(a) loan guaranties for loans of $250,000 or less. Some CDCs have been approved as lender participants in the Community Advantage Program.

5.2.3 Contracting Officer: The SBA Official authorized to execute and administer the contract on behalf of SBA and includes any duly appointed successor or authorized representative.

5.2.4 Contractor: The individual, partnership, corporation, or other entity, which is the party subject to the terms and condition of this contract.

5.2.5 Day: Calendar day unless otherwise stated.

5.2.6 Deliverables: If a deliverable date falls on a weekend or federally recognized holiday, the due date shall be the next business day. Unless otherwise specified SBA will review all deliverables and provide comment’s generally within 30 days after receipt of either a draft or a final deliverable.

5.2.7 Delegated CDC: A CDC that has been designated by SBA and given increased authority to process, close and service SBA loans. There are two types of delegated authority available to CDCs: Accredited Lenders Program (ALP) and Premier Certified Lenders Program (PCLP). All such designations must comply with SBA Loan Program Requirements and are subject to subsequent review by SBA.

5.2.8 Findings: Significant issues identified during Risk Based Reviews (e.g. violations of SBA Loan Program Requirements of the governing agreement or applicable regulation). Findings must be specific and supported by documentation.

5.2.9 Industry Accounting Designation: The designation can be found at American Institute of Certified Public Accountants

5.2.10 Key Personnel: Personnel specifically considered to be essential to the work being performed under this contract are defined at Paragraph 11.

5.2.11 CDC Profile Assessment (LPA): An assessment that is compiled from internal SBA data sources and public federal regulatory information. Data is provided by SBA. A full list of data sources will be provided post award.

5.2.12 Loan Program Requirements: As defined in 13 CFR 120.10, these are requirements imposed upon CDCs by statute, SBA regulations, any agreement the CDC has executed with SBA, SBA SOPs, official SBA notices and forms applicable to the 504 loan program, and loan authorizations, as such requirements are issued and revised by SBA from time to time. For CDCs, this term also includes requirements imposed by Debentures, as that term is defined in 13 CFR 120.802.

5.2.13 SMART: Solvency and Financial Condition, Management and Board Governance, Asset Quality and Servicing, Regulatory Compliance, Technical Issues and Mission Risk Assessment Framework.

5.2.14 Performance Work Statement: Describes the requirement in terms of measurable outcomes rather than by means of prescriptive methods.

5.2.15 Portfolio Stratification Analysis: an analysis of SBA 504 loan portfolio to determine risk.

5.2.16 Potential Damages: 13 CFR 120.938(b) authorizes SBA to look to the CDC for the entire amount of a 504 loan debenture in the case of fraud, negligence, or misrepresentation. In such cases, the amount that may be due to SBA is referred to as “potential damages”.

5.2.16 Pre-Plan: A Microsoft Word document that documents the procedures to be performed to meet the review objectives and review methodology. The objective of the pre-plan is to ensure that each party is well prepared for an efficient and productive review.

5.2.17 Quality Assurance: A program for the systemic monitoring and evaluation of the various aspects of a project, service, or facility to ensure that standards of quality are being met.

5.2.18 Quality Control: Those actions taken by a Contractor to control the production of outputs to ensure that they conform to the contract.

5.2.19 Quarter – A quarter will be defined as the first of January through the end of March, first of April through the end of June, first of July through the end of September, and first of October through the end of December.

5.2.20 Regulated Institution – A CDC that provides loans under the SBA 504 loan program.

5.2.21 Risk Assessment Framework: The OCRM SMART risk framework that includes various components of risk assessment for each CDC.

a) Solvency and Financial Condition: The “S” in the SMART Risk Assessment Framework involves, but may not be limited to, a review of a CDC’s Capital, Earning, Liquidity, cash flow impact to SBA (5 year cumulative net cash flow yield), and its financial condition (net asset position, change in net asset position, working capital), and reserves for losses (for PCLP loans) and for future operations.

b) Management and Board Governance: The “M” in the SMART Risk Assessment Framework involves, but may not be limited to, an assessment of each CDC’s organizational structure, policies and internal controls, including projected purchase rate, high-risk originations in the previous 36 months, loans in liquidation for more than 3 years and board-approved internal controls.

c) Asset Quality and Servicing: The “A” in the SMART Risk Assessment Framework involves, but may not be limited to, a review of the CDC’s ability to originate, underwrite, close, service, and wrap up 504 loans. In particular, SBA will review past due loans, delinquent loans, loans in liquidation, 12-month purchase rate, early problem loan rate, active purchase rate and recovery rate. SBA will also review adverse change determinations on ALP loans. d) Regulatory Compliance The “R” in the SMART Risk Assessment Framework involves but may not be limited to, ensuring that the CDC is in compliance with SBA’s Loan Program Requirements including Annual Report submission, liquidation updates to SBA loan servicing center, loan classification, internal control policy and staffing. SBA will determine the adequacy of risk management systems, capability of management, the soundness of policies and procedures, and the effectiveness of internal controls. SBA will also review the CDC’s overall capital and non-performing asset ratios, as well as its SBA Lender Risk Rating(s) and SBPS score(s). SBA may also review each CDC’s corporate governance structure, SBA operating plan, quality control processes (including fraud deterrence and detection practices), risk classification system, and internal oversight strategy over the SBA loan portfolio.

e) Technical Issues and Mission: The “T” in the SMART Risk Assessment Framework involves, but may not be limited to, a review of risk areas that do not fall into any of the above categories, but may pose risk to SBA, such as CDCs’ use of professional service contractors, concentrations (e.g. industry), growth over 24 months, loans over $2 million, other economic development, compliance with retained earnings requirements, job creation requirements, franchise lending, and fraud, waste, and abuse issues.

5.2.22 Risk Assessment Memorandum: Integral to Contractor's planning stage for any specific CDC review (regardless of whether the review is a SFR or a STR). This document serves as the work order on what is to be done and is specific to each CDC to be reviewed. It establishes specific objectives for the review.

5.2.23 Risk Based Reviews: An in-depth analytical assessment of a CDC’s administration of the SBA 504 loan program (i.e. – SAR, STR, SFR,)

5.2.24 Risk Data Warehouse - The risk data warehouse is already established. Data mining is facilitated by use of SAS programming and report writing. SBA also refers to our Business Intelligence Tool (“BI Tool”) in the delegated authority work flow. The BI Tool is programmed in SAS and is a capability that the Offeror will find beneficial to accessing our Risk Data Warehouse

5.2.25 SBA: The U.S. Small Business Administration. The terms “Small Business Administration,” “SBA” and the “Government” shall be synonymous and may be used interchangeably in this contract.

5.2.26 SAS (Statistical Analysis System), is a software suite developed by the SAS institute for advanced analytics, business intelligence data management and predictive analytics

5.2.27 Technical Monitor: The Technical Monitor (TM) is subordinate to the COR and assigns work associated with regions, reviews, etc. and assists the COR in monitoring the Contractor’s performance. The TM may provide project-specific technical clarification, assistance and direction to the Contractor in the performance of duties of this contract. The TM provides technical advice and assistance to the COR.

5.2.28 Technical Security Plan: A formal plan that identifies the plan of action to implement and secure the various systems outlined in the Performance Work Statement.

5.2.29 Virtual Data Room: An online repository of information created by or provided by the Contractor that is used for the storing and distribution of documents. The current platform for PDMS is Dropbox. The current platform for DLAMS is FoxPro, Excel, SAS-BI Tool and the SBA’s Partner Information Management System (PIMs). SBA is currently maintaining the data.

6.0 Contractor Furnished Items

The Contractor shall furnish the necessary personnel, materials, travel, facilities that fully functional offices and meeting space, teleconference capacities, share space abilities to allow interface between contractor key personnel and SBA staff, and services and shall otherwise do all things necessary for, or incidental to, the performance of the tasks set forth in this contract. Any additional specific requirements and any government furnished items or services will be identified in each task order.

The Contractor shall appoint a Project Manager and an Alternate Project Manager. The Alternate Project Manager shall be capable of assuming the role of the Project Manager without delays due to any lack of knowledge/information, which could reduce the level of efficiency necessary to ensure task order performance. NOTE: The Project Manager and the Alternate Project Manager of Contact SHALL be employees of the Contractor and cannot be employees of a subcontractor or consultant. The Project Manager and an Alternate Project Manager are considered part of the KEY PERSONNEL and shall have the same qualifications as listed in paragraph 11.

7.0 Government Furnished Property and Services

SBA may provide the Contractor with seating in its office facilities in Washington D.C., including office space, furniture, office equipment and Agency-approved software and hardware for up to 3 individuals in order to perform some of the services detailed in this Performance-Based Statement of Work. Only Contractor employees who have completed all security clearance requirements and have been cleared through SBA OIG and who work at SBA facilities will have access to SBA systems. The Government will conduct a post-award conference approximately 10 days after award. The Contracting Officer will notify all parties of the time, date, and location of the post-award conference (note: SBA anticipates that post-award conference will take place in SBA Headquarters Location in Washington, DC).

8.0 Performance Work Statement

The Contractor will provide SBA with assistance in conducting Risk Based Reviews and Risk Oversight services for CDCs; access to either a (developed or provided) Management Workflow and Tracking System/Virtual Data Room and maintain a Management Workflow and Tracking System/Virtual Data Room; and technical assistance in accordance with the general scope outlined herein. The Contractor will be required to provide SBA with a detailed description of its proposed methodology for review, coordination, tracking, and follow-up and its plan for implementing its methodology for all tasks identified. The Contractor is expected to work collaboratively with SBA employees, including OCRM and the Office of Capital Access (“OCA”), and other SBA offices as necessary.

Below in sections 8.1, 8.2 and 8.3, are general descriptions of the major services associated with this contract. Section 9 contains a more detailed description of all tasks and deliverables associated with the contract.

8.1 CDC Risk Based Review and Oversight

• The Contractor will assist SBA in conducting Risk Based Reviews (RBRs) that will assess the CDC’s practices against both internal policies and procedures accepted industry practices, and SBA Loan Program Requirements. At a minimum, Risk Based Reviews will include the extraction and analysis of data from various SBA sources, data warehouses and CDC files, plus file reviews, operating reviews, Annual Report analysis, and possible site visits. Access to these data warehouses will be provided at post award. The Contractor shall prepare a report addressing each risk assessment framework area for SMART (Solvency and Financial Condition, Management and Board Governance, Asset Quality and Servicing, and Technical Issues and Mission and also including factors related to capital, Earnings and liquidity ) Protocol. (See Attachment 5 Exhibits 1, 2, 4, 6, 7, and 8)

• The Contractor will provide risk oversight services through CDC monitoring activities, as defined by SBA, for approximately 265 CDCs annually. These monitoring activities include making recommendations of CDCs for SAR reviews for a defined population of at least 25 CDCs annually based on risk characteristics. The defined population is updated annually and the SAR reviews will be based upon risk characteristics as determined by SBA. These monitoring activities also include conducting CDC Review Assessments of at least 80 delegated lenders CDCs on a biennial schedule. These numbers will vary each fiscal year and will be further defined at the task order level. The numbers in this paragraph are estimates and are not guaranteed.

• The Contractor shall prepare a report that outlines any weaknesses or deficiencies identified during the RBR and make recommendations for improvement as applicable. The report shall discuss the methodology used for determining the Contractor’s findings. The Contractor shall produce and prepare other ancillary reports as requested by SBA.

• Included in these tasks are conducting RBRs both on-site at CDC location, through electronic means, and other possible locations that are distant from CDC location, which shall include established SBA office locations.

• The Contractor will also provide reviews and support services for supervisory and enforcement actions against CDCs.

8.2 Management Workflow and Tracking System and Virtual Data Room

• The Contractor will be responsible for providing access to a Management Workflow and Tracking System and Virtual Data Room that are IT web-based, to support the coordination of the CDC review/monitoring and corrective action process. The Management Workflow and Tracking System and Virtual Data Room will include and incorporate information obtained through the performance of related contract functions. The Management Workflow and Tracking System/Virtual Data Room will include, at a minimum, CDC (client) contact information and a record of communications with the CDC client as well as tracking of the risk-based review process and corrective action review follow-up.

• The Contractor will be responsible for ensuring that the Management Workflow and Tracking System and Virtual Data Room is secure and internet accessible. The Contractor must demonstrate through the Contractor’s Technical Security Plan its adherence to SBA’s security requirements.

• The Contractor will be responsible for ensuring the Virtual Data Room is accessible to SBA employees, its authorized representatives, and to individual CDCs within their respective storage locations. It must provide for upload of information by all users, and accessibility on-line, as well as allowance for download permissions and other possible communications as defined in the Security Section of this document. Through the use of digital media, the Contractor must ensure that SBA has access to the data contained in the Management Workflow and Tracking System and Virtual Data Room even when this contract has ended. SBA owns the data that will be entered into the Virtual Data Room and expects delivery of that data as detailed below in the deliverables chart.

• The Contractor will also be required to develop or provide and maintain the Virtual Data Room so that it an integrated data room warehouse that is accessible to SBA-users 24 hours a day through a secure Internet website. The Virtual Data Room/data room warehouse will be used to file and catalogue data, images, and information developed.

• The Contractor shall implement a work paper retention client management service. The Contractor must ensure that has SBA has access to all work papers even when this contract has ended.

• The Contractor shall ensure that SBA has access for up to 50 users for the Management Workflow and Tracking System and Virtual Data Room.

8.3 Quality Control Plan / Quality Assurance Plan

The contractor shall develop, implement, and execute a detailed QCP / QAP that provides for inspections of all services and deliverables to verify conformance to acceptability standards specified in the task order. The contractor shall provide a Draft of its QCP/QAP at post award meeting or 10 days after award and then after award deliver a Final copy to the COR via email not later than 30 days after the post award conference. The QCP/QAP is considered a “living document” and as such, shall be revised by the contractor as its conditions change. The QCP/QAP shall include provisions for responding to and incorporating technical direction and comments from the COR and TMs; descriptions of the techniques to be employed for producing and validating services and deliverables conforming to the acceptable quality standards in the contract, and a description of “checks and balances” that shall be used to ensure the government receives quality services.

Within 30 days of the post award conference, the Contractor shall provide a Final QCP/QAP that will provide for complete quality control for all Reports, Letters, and Agreements to be issued. The QCP/QAP shall include a defined process and personnel identification by title. The QCP/QAP shall also include Communication Plan to ensure effective communication between SBA Personnel and Contract Analyst/Reviewers/Writers and to ensure the objectives of the contract are being met. The QCP/QAP should also address the concerns listed below:

• The development and implementation of

- A system of internal controls for managing the Management Workflow and Tracking System and Virtual Data Room as well as assuring timely delivery of all tasks.

· Procedures to identify and bring to the attention of SBA any potential conflicts of interest that exist as a result of providing risk oversight services, and an information control policy that includes confidentiality requirements.

• The Contractor is obligated by the terms of its contract (including any corresponding confidentiality agreement) to (i) safeguard the Confidential Information as set forth in this Agreement; (ii) return, or certify to the SBA the destruction of, all copies of the Confidential Information at the conclusion of its engagement with the SBA; (iii) not use the Confidential Information for any purpose other than in connection with its engagement with the SBA; and (iv) not disclose the Confidential Information to anyone outside of SBA or the Contractor without the prior written approval of the SBA.

Deliverable: Provide a Draft QCP / QAP with the proposal and within 30 days after Award provide the Final QCP/QAP. The contractor shall develop, implement, and execute a detailed QCP / QAP that provides for inspections of all services and deliverables to verify conformance to acceptability standards specified in the task order. The contractor shall provide a Draft of its QCP/QAP as part of their proposal and then after award deliver a Final copy to the COR via email not later than 7 days after the post award conference. The QCP/QAP is considered a “living document” and as such, shall be revised by the contractor as its conditions changes. The QCP/QAP shall include provisions for responding to and incorporating technical direction and comments from the COR and TMs; descriptions of the techniques to be employed for producing and validating services and deliverables conforming to the acceptable quality standards in the contract, and a description of “checks and balances” that shall be used to ensure the government receives quality services.

9.0 Performance Work Statement Tasks

CDC Risk Based Reviews and Technical Assistance Oversight Activity

The Contractor will be required to provide:

• SBA with technical assistance in the assessment of CDCs overall management of their SBA loan programs from file review information collected, as well as from the annual financial reports and other data available to the SBA and maintained in the data room warehouse. SBA anticipates that all Technical Assistance shall be either onsite at the SBA’s Headquarters Office in Washington, DC or at Contractor’s office located in the DC Metro Area (as defined) fulltime and management staff continuously coordinating with the SBA Staff.

• Technical assistance for the ALP and PCLP Delegated Authority Review and Assessment to include, at a minimum, administrative processing of records and documents.

• OCRM technical assistance in effectively and efficiently monitoring the performance of the 504 program through SBA loan and CDC portfolio stratification for strategic planning of risk mitigation activities, annual audit plan development, selection of CDCs for enhanced assessment activities, and planning and conducting risk-based reviews (“RBRs”) using SBA’s risk assessment framework.

Technical assistance should reflect discussion and coordination with the key personnel and project management team. Cost for advisory and technical assistance may be allocated in the CLIN monthly cost and/or imputed across the fixed cost items. SBA wishes to be able to consult, meet with and converse on aspects of performance, improvement of, efficiencies and conduct of the engagement with the Contractor to assure best practice execution and value to the SBA.

9.1. Task 1: SMART ALP and PCLP Delegated Authority CDC Reviews and Technical Assistance Oversight Activity for delegated and non-delegated CDCs - CLINS 0001, 1001, 2001, 3001 and 4001

The Contractor will be required to provide SBA with technical assistance in the assessment of the SBA 504 loan program. The CDC Profile Assessment (LPA) has been developed using SAS and report writing has been automated. The LPA is a tool and should be utilized whenever assessing a CDC. SBA anticipates working with the Contractor to consider improvements to the LPA. The LPA will be prepared for each delegated authority review. Note: Pricing for Task 1 includes Tasks 1A and 1B.

The tasks shall include at a minimum:

Task 1A: SMART ALP & PCLP Delegated-Lender CDC Reviews Technical Assistance – There is an estimated minimum of 30 reviews and a maximum of 80 reviews annually as part of the pricing under Task 1.

SMART ALP & PCLP Delegated-Lender CDC Reviews

The Contractor shall provide technical assistance in the review, assessment, and processing of all SMART ALP & PCLP Delegated-Lender CDC Authority Nominations and Renewals processing. The Contractor shall perform the administrative research necessary, to include but not be limited to, collecting all required information and certification from the CDC and District Office to assist the SBA in determining eligibility and qualification for the specific status being sought. This will include preparing an LPA.

The SMART ALP & PCLP Delegated CDC Authority Review Assessment and eligibility process is as follows:

Overview of process:

The Delegated CDC team which includes “CT/FA” process includes four types of actions, renewals, reconsiderations, extensions and nominations. The team assesses two types of delegated authorities:

The data analysis components for each CDC currently include:

All loans are pulled from the BI SAS Tool and SBA Risk CDC to determine Performance Scope for a CDC that includes the following:

Data Analysis for Compliance includes:

Data Analysis- Regulatory:

Deliverable: “The Contractor shall prepare and distribute the SMART Delegated Renewal CDC Reviews (SDR), Letters and Agreements (if applicable). The SBA will provide the Contractor with a list of CDCs with Delegated Authorities requiring review on a monthly basis. The Contractor’s analysis should be completed and provided to SBA three months in advance of the CDC’s Delegated Lender Authority expiration date. SBA will make the final decision regarding renewal of delegated authority. SBA will provide Contractor with any comments/questions regarding Contractor’s CDC Delegated Authority Renewal Analysis and Contractor will provide SBA with an updated analysis addressing those SBA comments/questions within 7 business days.

SMART Delegated-Lender CDC Authority Renewal CDC Portfolio Analysis

The Contractor shall perform a SMART Delegated-CDC Authority portfolio review and analysis of all CDCs with delegated authority. This will be completed by tracking of the expiration dates for Delegated CDC Authority statuses for all CDCs. Each month the Contractor will provide to SBA a list of all CDCs with authorities that will expire in three months (e.g., - in January of each year, provide a list of all CDCs with authorities expiring in April of that same year and in February of each year, provide a list of all CDCs with authorities expiring during May of that same year).

Delegated Authority Renewals for each CDC may be granted for up to 2 years. Renewal Terms may also be limited to less than 2 years (e.g. one year, six months, and/or extensions for period under the 2 year term) based on the analysis of the elements and components. Delegated Authority can also be non-renewed or revoked from a CDC.

Much of the Data components are provided and/or accessible through SBA data and systems. An LPA will be prepared for each delegated authority review. SBA has access to CDC regulatory and financial information.

Deliverable: The analysis will be conducted and provided to SBA on the first of the month. This must be done three months in advance of the CDC Delegated Lender Authority expiration date. The Contractor shall provide a formal written analysis.

Task 1B: Delegated and non-delegated CDC Oversight Technical Assistance

CDC Oversight Technical Assistance includes the following work at a minimum;

-Entering select financial and operational information from each CDC’s Annual Report into a database to allow for a comprehensive understanding of the financial structure and performance of the CDCs and the organizational and operational traits that may be related to higher level risk to SBA;

- Identifying CDC Portfolio risks, for the SBA 504 Loan Portfolio through analysis of SBA data (data will be provided at post award);

-Assisting in the analysis and evaluation of CDC financial statements and annual reports;

-Assist in providing an annual analysis of CDC financial statements and annual reports;

-Assisting in the review and tracking of PCLP LLRF compliance;

-Assisting in the development of a Portfolio Stratification Analysis;

-Assisting in the development of selection criteria for an Annual Risk Management Oversight Plan- current plan that will be provided at or about post award;

-Preparation of individual CDC Profile Assessments;

-Technical assistance in developing the content of individual CDC SMART Analytical Review plans;

-Assisting in the development and maintenance of the corrective action plan process;

-Tracking of SBA portfolio trends and performance via a dashboard. The dashboard already exists and the Contractor will analyze and track the information presented through the dashboard.

-The development of a solution that provides data and business analytics that will be used to support the organizational strategic goals. This is intended for the Offeror to provide SME input and is up to Offeror to work with SBA in the normal course of supporting the OCRM Review program; and

-Documenting and assessing the process for delegated CDCs renewal of authorities.

The contractor will assist in the annual risk plan and developing the annual review/audit plan.

The LPA has been developed using SAS and report writing has been automated. The LPA is a tool and should be utilized whenever assessing a CDC. SBA anticipates working with Contractor and other existing SBA contractors to consider improvements to the LPA. The LPA will be prepared for each delegated authority review.

SBA is working on some reporting dashboards with the L/LMS contractor. SBA anticipates this contractor supplementing the dashboard for Review activity (Project Coordinator Status Reporting), providing expertise on appropriate dashboard items and general SME input.

Deliverable: “The Contractor shall provide a monthly report on the technical assistance provided. A report is due 5 days after the end of the month unless further defined at the Task Order level. For the CDC annual financial statement and annual report, the majority of CDCs have a fiscal year end of September 30, which means that their annual reports and financial statements are due to SBA by the following March 31. Those reports are submitted by the CDCs to SBA’s local district offices who then forward them to SBA Headquarters. The September 30 annual reports and financial statements should be available for review and analysis no later than June 30. The next most common fiscal year end for CDCs is December 31, which means that those CDC annual financial statements and annual reports will be made available to SBA Headquarters by September 30. A small number of CDCs have fiscal years ending in either March or June, which will result in SBA Headquarters staff having access to these financial statements and reports by December 31 or March 31, respectively. The Contractor shall enter select financial and operational information from each CDC’s annual report and financial statements no later than one year after each CDC’s annual report date.

9.2 Task 2: SMART Analytical Review (SAR) - CLINS 0002, 1002, 2002, 3002 and 4002

SMART Analytical Reviews are performed using a standard CDC Profile Assessment (LPA) (See Exhibit 1), and are designed to 1) measure the level of risk the CDC poses to SBA, and 2) determine the scope of any additional assessment necessary (e.g., through a STR or SFR). The purpose of the SAR is to identify whether additional assessment is necessary and to inform decisions regarding delegated CDC authorities.

a) Populate CDC Profile Assessment (LPA) – Contractor shall populate the LPA with information pulled electronically from internal SBA data sources and external data sources (if available) public federal regulatory information and review this information for accuracy, consistency, and completeness. (See Exhibit 1)

b) Contractor will obtain review information from CDC files, CDC loan data information and other CDC information, from SBA, and outside sources (e.g., previous RBR findings and corrective actions, SBA processing and liquidation center input, CDC’s latest strategic plan and organizational chart, CDC’s policies and procedures, and copies of audits and independent loan reviews).

c) Contractor will perform initial analysis (using for example the LPA and information obtained).

d) Contractor will include at a minimum, full narrative and analysis based on the SMART protocols ready for delivery to SBA team analyst. The narrative should include relevant observations, findings, weaknesses and corrective actions as applicable, and recommendations. The Contractor must include review of previous RBR findings and corrective actions, SBA processing and liquidation center input, CDC's latest strategic plan and organizational chart, CDC’s policies and procedures, and copies of audits and independent loan reviews. Report should also include Contractor's recommendation for an additional SMART Targeted Review (STR) or SMART Full Review (SFR), as applicable. If STR or SFR is recommended, this recommendation should include an assessment of CDC's ability to submit loan information electronically to allow for a "virtual" review.

e) Supplemental SAR Reports per CDC – the Contractor shall provide any supplemental reports, if the SBA deems that supplemental review work is necessary.

Deliverable:

The Contractor must populate and provide an LPA for each SMART Analytical Review (SAR) conducted. The Contractor will have two days from the work (order) assignment from the Technical Monitor to…