Loan File Review for Risk Oversight Support Services

Quality Assurance Surveillance Plan (QASP) Blanket Purchase Agreement (BPA): Loan File Review for Risk Oversight Support ServicesOffice: SBA Office of Capital Access (OCA) / Office of Credit Risk Management (OCRM)Prepared: March 23, 2026 Purpose This Quality Assurance Surveillance Plan (QASP) establishes the performance standards, acceptable quality levels, and surveillance methods the Government will use to monitor contractor performance under the Loan File Review for Risk Oversight Support Services Blanket Purchase Agreement (BPA). The QASP is based on the performance objectives identified in the Performance Work Statement (PWS) and ensures that services meet required quality, timeliness, and completeness standards. Surveillance Approach The Government will employ a risk-based surveillance approach combining periodic desk reviews, sampling of deliverables and work products, system monitoring, and ongoing observation. The Contracting Officer's Representative (COR) is responsible for surveillance activities and may designate quality assurance personnel to assist with reviews. Performance Standards and Surveillance Methods PWS Reference Performance Objective Performance Standard Acceptable Quality Level (AQL) Surveillance Method Frequency / Responsible Party 8.1, 15, Table 1 Timely draft loan file review reports Draft report submitted within 25 business days of receipt of complete loan file 95% of draft reports meet 25-business-day requirement per quarter COR review of submission dates vs. file receipt dates (desk review of dashboard and sample reports) Monthly; COR/designee 8.1, 15, Table 1 Timely final loan file review reports Final report submitted within 5 business days of COR comments 5% of final reports meet 5-business-day requirement per quarter COR comparison of COR comment dates to final report dates (desk review) Monthly; COR/designee 15.1--15.2, Table 1 Timely weekly status reports/ dashboard Weekly status report delivered by close of business each Monday $\geq$98% of weekly reports delivered on time per quarter COR checklist; verify receipt and completeness of required data elements Weekly; COR/designee 15.1--15.2, Table 1 Timely monthly status reports Monthly status report delivered by 5th business day after month-end $\geq$100% of monthly reports on time COR checklist; verify receipt and completeness Monthly; COR/designee 7.2, 8.1, 9.1--9.2, 12.2 Quality and completeness of loan file reports and Exceptions Reports contain condition, criteria, cause, effect, corrective action; each Exception references specific SBA requirement and is supported in Work Papers 95% of sampled reports rated "Acceptable" or better in QA review (no material omissions or unsupported Exceptions) COR/QA team review of a risk-based sample of completed reviews and associated Work Papers Quarterly; COR with QA support 12.1--12.3 Work Papers and monitoring files completeness Work Papers are complete, organized, and sufficient to allow third-party replication of conclusions 95% of sampled lender reviews have Work Papers meeting sufficiency criteria On-site or remote inspection of Work Papers/ monitoring files; checklist-based QA Semi-annual; COR/QA 10.1--10.4, 11, 10.6 Virtual data warehouse/CRM/MWS and DMS availability System accessible to authorized SBA users during normal business hours; supports upload, storage, search, and tracking as described 99% availability during SBA business hours; no more than 1 high-impact outage per quarter Monitoring of contractor uptime reports; COR tracking of incident logs and user complaints Quarterly; COR with IT/security 10.2, 11, 24 Security and protection of PII/confidential data No unauthorized disclosures; incidents handled per SBA/contract procedures Zero confirmed data breaches attributable to contractor negligence; 100% of incidents reported within required timeframes Review of incident reports; SBA CISO/security input; corrective action tracking Ongoing; as incidents occur; COR/CISO 5.3, 15.1--15.2 Accuracy of dashboards/ status reporting Status reports accurately reflect file counts, stages, due dates, and submission dates 98% accuracy of key fields in sampled reports COR reconciliation of sample status report entries against underlying loan review records Quarterly; COR/designee 8.1, 21.1 Transition-In performance Transition plan submitted within 30 days; core environment and processes ready to accept first Task Order by agreed date 100% on-time transition plan; no delay to first TO start attributable to contractor COR review of transition plan and milestone completion; readiness meeting(s) Once during transition-in; COR 21.2, 10.3, 12.3 Transition-Out performance and data hand-off Complete SBA-owned data and Work Papers delivered in usable format within 60 days of expiration/ termination 100% of required data/work papers delivered, verified, and readable by SBA COR verification of data transfer; spot-checking for completeness/ readability Once during transition-out; COR 4.2--4.3, 23 Key Personnel performance and continuity Project Manager in place meeting qualifications; changes approved by CO and transitioned within 30 days if required No unapproved vacancies; 95% of PM changes (if any) completed within 30 days with no material service disruption COR observation of performance; review of key personnel change notices and approvals Ongoing; as needed; COR 6.1--6.4, 13, 25 Keeping current with SBA regulations/SOPs Processes, tools, and templates updated within 30 days of general SBA program changes and within quarterly cycle for OCRM-specific changes $\geq$95% of applicable changes implemented within required timeframes COR review of contractor update logs; sample checks of tools/templates against current SBA guidance Quarterly; COR Performance Deficiencies and Corrective Action Performance deficiencies identified through surveillance activities shall be documen…