oversight

Review of Debt Management Collection System 2 (DMCS2) Implementation

Published by the Department of Education, Office of Inspector General on 2015-08-24.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                  UNITED STATES DEPARTMENT OF EDUCATION
                                                  OFFICE OF INSPECTOR GENERAL

                                                                                                                           AUDIT SERVICES



                                                              August 24, 2015
                                                                                                                   Control Number
                                                                                                                   ED-OIG/A04N0004

James W. Runcie
Chief Operating Officer
U.S. Department of Education
Federal Student Aid
830 First St., N.E.
Washington, DC 20202

Dear Mr. Runcie:

This final audit report, “Review of Debt Management Collection System 2 (DMCS2) Implementation,”
presents the results of our audit. The objective of this audit was to determine whether Federal Student
Aid’s (FSA) plan for correcting DMCS2 1 system deficiencies provided for accountability; specifically,
we assessed whether the plan included (1) milestones to ensure Xerox Education Solutions, LLC,
(Xerox) timely corrected system deficiencies and (2) options to hold Xerox accountable if it did not have
a fully functional system at the end of the initial Xerox contract on December 31, 2013. Our review
covered FSA and Xerox’s management of DMCS2 development activities 2 from June 2010 through
July 2014; FSA and Maximus, Inc. (Maximus) 3 management of DMCS2 development activities; and
BSC Systems, Inc.’s (BSC) 4 Independent Verification and Validation (IV&V) through February 2015.

We found that FSA could not ensure that Xerox delivered a fully functional DMCS2 because FSA did
not develop an adequate plan, ensure Xerox met milestones, or use appropriate systems development
tools. FSA provided a document, referred to as the One-Pager, 5 as part of the May 2013 Status and
Completion document 6 presented as its plan for correcting DMCS2 deficiencies for our review. FSA did
not include the milestones that were in the One-Pager in the Xerox contract. FSA failed to enforce
Xerox’s milestones and ensure that system fixes were independently verified. In addition, FSA routinely

1
  The official name of the system is Debt Management Collection System (DMCS). However, we reviewed the system
upgrades and enhancements corresponding to FSA’s contract with Xerox. As such, for purposes of this report we refer to the
upgraded system as the Debt Management Collection System 2 (DMCS2) to distinguish it from the original system.
2
  Development activities relate to defining, designing, testing, and implementing system requirements identified by FSA or
contractors to upgrade or enhance the system.
3
  Maximus is the new contractor responsible for continuing to develop, maintain, and operate the new DMCS2 system.
4
  BSC is the contractor responsible for the independent verification and validation of Maximus’ development and
enhancement of DMCS2.
5
  FSA’s One-Pager contains a breakdown of DMCS2 subfunctions and subprocesses, with each having an indicator of its
working status (red, yellow, or green), a Xerox target or actual production date, and an FSA anticipated or actual validation
date.
6
  The Status and Completion document is an Excel workbook that contained four spreadsheets, including the One-Pager
(updated as of May 2013), a list of change requests that provided details on DMCS2 problems and whether Xerox or a new
vendor would be responsible for fixing each of the problems, the status of the change requests, and the definitions of the
various statuses and severity levels of the change requests. Xerox provided input on some of the information in the One-
Pager. FSA provided the document to us in May 2013.
     The Department of Education's mission is to promote student achievement and preparation for global competitiveness by fostering educational
                                                       excellence and ensuring equal access.
Final Report
ED-OIG/A04N0004                                                                                 Page 2 of 20

revised Xerox’s milestones when Xerox missed them. However, FSA attempted to hold Xerox
accountable by taking several actions to penalize Xerox for not providing a fully functional DMCS2.
FSA issued a notice of intent to terminate the contract; however, Xerox submitted a corrective action
plan with new milestones, which resulted in FSA allowing Xerox to continue working on DMCS2. In
addition, FSA assessed and received $2.5 million in credits and applied $460,962 in disincentive fees 7
for nondelivery. Despite FSA’s efforts to hold Xerox accountable, Xerox failed to deliver a fully
functional DMCS2.

FSA responded to the deficiencies identified during the course of our audit by incorporating elements of
life-cycle management into both the Maximus and BSC contracts and by including penalties for missed
milestones in the Maximus contract. FSA provided a new plan to address DMCS2 deficiencies in
September 2014. According to its September 2014 plan, FSA awarded a new contract to Maximus to
operate and maintain DMCS2, added the BSC IV&V contract and used its Lifecycle Management
Methodology (LMM). FSA’s contract with Maximus and its other corrective actions provide a
methodology that, if properly implemented, increases the likelihood that Maximus will identify and
timely correct DMCS2 system deficiencies. However, we found that FSA did not update its
presolicitation tailoring plan for correcting the DMCS2 deficiencies until December 23, 2014, more than
9 months after Maximus began working on DMCS2. As such, we are concerned that FSA’s delay in
updating the tailoring plan may be an indication that FSA is not fully implementing its LMM. We
identified additional opportunities for FSA to improve its oversight of the Maximus contract.

In its comments to the draft report, FSA neither explicitly agreed nor disagreed with the finding;
however, it agreed with all four recommendations. FSA’s comments are included as Attachment 2 to the
report.



                                                BACKGROUND


FSA is responsible for managing the student financial assistance programs authorized under Title IV of
the Higher Education Act of 1965, as amended. The U.S. Department of Education (Department)
administers the William D. Ford Federal Direct Loan (Direct Loan) program, the Federal Family
Education Loan (FFEL) program, and the Federal Perkins Loan program to assist students in paying for
their postsecondary education. The Department issues Direct Loans directly to borrowers, but those
loans are serviced by contracted servicers. Private lenders provided FFEL program loans 8 to borrowers,
and postsecondary schools provide Federal Perkins Loan program loans to borrowers. The borrowers are
responsible for repaying their student loans. When the borrowers fail to make a payment on their Direct
Loans for more than 270 days, the loans are deemed to be in default. After 360 days of nonpayment, the
loans are transferred to DMCS2 for collection. However, loans made under the FFEL and Federal
Perkins Loan programs do not always follow the same process since defaulted loans for these programs
are transferred to the Department after meeting certain criteria. The Department can refer the defaulted
debt accounts to one of 22 private collection agencies 9 that it contracts with to collect debts.

7
  Disincentive fees were assessed as a percentage of Xerox’s monthly invoices for servicing borrowers’ defaulted loans.
8
  The SAFRA Act, part of the Health Care and Education Reconciliation Act of 2010 (Public Law 111-152), mandated that no
new loans be made or insured under the FFEL program after June 30, 2010.
9
  There were 22 as of the date of the audit.
Final Report
ED-OIG/A04N0004                                                                                       Page 3 of 20

On November 20, 2003, FSA entered into the Common Services for Borrowers contract (CSB contract) with
ACS Education Solutions, LLC, (now known as Xerox) 10 to service Direct Loans for FSA. In addition to
servicing Direct Loans, the CSB contract required Xerox to perform default management activities, which
included tracking defaulted student loan balances, borrowers’ payments, repayment agreement information,
and loan servicer information, using the Debt Management Collection System (DMCS).

On June 7, 2010, FSA and Xerox agreed to a contract modification to the CSB contract that required Xerox
to “enhance, upgrade or replace” DMCS by January 1, 2011. On December 21, 2010, FSA and Xerox
agreed to extend the deadline to February 1, 2011. Under the terms of the CSB contract, Xerox agreed to
provide, at a minimum, the DMCS functionality and enhanced functionality FSA identified. The enhanced
functionality included, but was not limited to, applying financial transactions to a debt account, electronically
referring the borrower’s account to a private collection agency, and protecting certain accounts from private
collection agency placement (for example, accounts that were in bankruptcy or assigned to the Department
of Justice). Xerox missed the extended February 1, 2011, deadline and FSA approved the full transition
from DMCS to DMCS2 in October 2011, FSA did not require Xerox to validate system functionality, which
would have included system testing for an entire loan life cycle, including through default and debt
rehabilitation. 11 Many of the deficiencies in the DMCS2 system were directly related to default and debt
rehabilitation functions.

Shortly after the transition from DMCS to DMCS2 in October 2011, FSA became aware of deficiencies and
functionality issues with DMCS2. FSA issued a notice to Xerox in February 2012 to allow Xerox an
opportunity to (1) cure its failure to timely implement the required functionality of DMCS2 and (2) provide a
corrective action plan. 12 On December 14, 2012, FSA and Xerox reached a settlement agreement in which
Xerox agreed to continue implementing the outstanding requirements identified on FSA’s One-Pager and to
complete the DMCS2 enhancements by the end of the CSB contract, which was scheduled for
December 31, 2013. On September 24, 2013, FSA extended the CSB contract with Xerox through
June 30, 2014, to continue all DMCS2 related services. On January 21, 2014, the CSB contract was
modified to clarify the scope of the DMCS2 development work and included an option for Xerox to continue
providing services through December 31, 2014.

FSA’s One-Pager, created in November 2011 and periodically updated, is a high-level representation of
the DMCS2 functionality that FSA used to track the operational statuses of the DMCS2 functions,
processes, and subprocesses. FSA provided an updated One-Pager as part of the Status and Completion
document presented as its plan for correcting DMCS2 deficiencies for our review. FSA also included the
solicitation for a new contractor to correct known and unknown DMCS2 deficiencies as part of its
solution for making DMCS2 fully functional. We conducted this audit in coordination with a separate
Office of Inspector General (OIG) audit, control number A02N0004. The objective of that audit was to
determine whether FSA accurately assessed the operating status of the DMCS2 functions and processes.



10
   Xerox Corporation acquired ACS Education Solutions, LLC, in February 2010 and changed the name to Xerox Education
Solutions, LLC, in April 2012.
11
   Per 34 C.F.R. § 685.211(f), through a process called rehabilitation, borrowers can remove the default status from loans by
making nine voluntary, reasonable, and affordable monthly payments within 20 days of the due date during 10 consecutive
months.
12
   Under 48 C.F.R. § 49.402-3(d), if a contractor fails to perform some of the provisions of the contract or fails to make
progress as to endanger performance of the contract, the Government must notify the contractor and provide at least 10 days
for the contractor to cure the failure.
Final Report
ED-OIG/A04N0004                                                                                       Page 4 of 20

A number of other audits have reported the major deficiencies related to DMCS2 functionality and the
effects on borrowers and FSA’s financial statements. The Independent Auditors’ Report on FSA’s
financial statements for fiscal year 2012 identified material weaknesses in internal controls related to the
functionality of DMCS2. 13 Because of the internal control weaknesses, FSA was unable to process
rehabilitated loans and receive collections through administrative wage garnishments, and DMCS2 was
unable to accept some debt accounts transferred from Title IV Additional Servicers. 14 The independent
auditor recommended that FSA ensure that Xerox resolve and complete the system functionality
requirements to bring DMCS2 to a fully operational status and establish temporary workarounds, as
necessary. In FSA’s audited financial statements for fiscal year 2013, the independent auditor reported
that FSA was in the process of addressing the material weaknesses reported in the fiscal year 2012 annual
audit report. 15 However, the independent auditor identified significant deficiencies related to the
functionality of DMCS2 that continued to occur in fiscal year 2013. The deficiencies affected the
reliability of debt accounts in DMCS2 and the financial statements.

A primary issue identified in the fiscal year 2012 financial statement audit involved certain debt accounts
that were unable to be accepted into DMCS2. On December 13, 2012, OIG issued an alert
memorandum, “Debt Management and Collection System 2,” (ED-OIG/L02M0008) informing FSA of
DMCS2’s inability to accept the transfer of certain debt accounts from FSA loan servicers. OIG found
that since the DMCS2 conversion, more than $1.1 billion in debt accounts should have been transferred
to DMCS2 for management and collection but were not because DMCS2 functionality issues prevented
the transfers. In addition, on May 15, 2013, OIG issued an alert memorandum, “Federal Student Aid
Paid Private Collection Agencies Based on Estimates,” (ED-OIG/L02N0002) reporting that private
collection agencies were paid commissions based on estimated collection activity because DMCS2
functionality issues prevented the system from creating invoices using collection information from
DMCS2. The U.S. Government Accountability Office (GAO) issued a report in March 2014, “Federal
Education Loans: Better Oversight Could Improve Defaulted Loan Rehabilitation,” (GAO-14-256).
GAO reported that FSA performed limited oversight of Xerox and insufficient testing of DMCS2
functionality that adversely affected loan rehabilitations.

On September 30, 2013, FSA signed a contract with a new contractor, Maximus, for more than
$13 million, making Maximus responsible for developing, maintaining, and operating the new DMCS2
system. The performance period for Maximus to develop and upgrade DMCS2 started on
September 30, 2013, while operations and maintenance was scheduled to start on January 1, 2014.
However, a bid protest was filed in November 2013, which resulted in a stop work order for Maximus.
During the bid protest, Xerox provided services and continued to correct system deficiencies under its
September 2013 contract modification. After FSA lifted the stop work order in February 2014, Maximus
resumed work. Xerox continued to correct DMCS2 system deficiencies through July 6, 2014, when FSA
issued a code freeze to preclude Xerox from making further changes within the system. Subsequently,
FSA issued a contract termination for convenience 16 and instructed Xerox to stop all work on

13
   The independent auditor’s report was published with FSA’s “Federal Student Aid Annual Report for Fiscal Year 2012,”
which was issued on November 16, 2012.
14
   FSA has contracted with loan servicing entities to service federal student loans. A loan servicer is a company that handles
the billing of federal student loans and other related services.
15
   The independent auditor’s report was published with FSA’s “Federal Student Aid Annual Report for Fiscal Year 2013,”
which was issued on December 11, 2013.
16
   Under Federal Acquisition Regulation 52.249-2, “Termination for Convenience,” the Government may terminate
performance of work on a contract in whole or in part if the contracting officer determines that a termination is in the
Government’s interest.
Final Report
ED-OIG/A04N0004                                                                                         Page 5 of 20

FSA issued a contract termination for convenience 17 and instructed Xerox to stop all work on
July 31, 2014, except for one service and DMCS2 shutdown activities that were required through
August 31, 2014. On September 26, 2014, FSA submitted a new plan to address DMCS2 deficiencies.
According to its September 2014 plan, FSA awarded a new contract to Maximus to operate and maintain
DMCS2, added an IV&V team, and used its LMM. As of September 30, 2014, FSA had transitioned the
DMCS2 operation and all related functions to Maximus and was in the process of revising the Maximus
contract to reflect work completed by Xerox during the stop work order and subsequent changes to
business needs.



                                                  AUDIT RESULTS


The objective of this audit was to determine whether FSA’s plan for correcting DMCS2 system
deficiencies provided for accountability; specifically, we assessed whether the plan included
(1) milestones to ensure Xerox timely corrected DMCS2 system deficiencies and (2) options to hold
Xerox accountable if it did not have a fully functional system by the end of the initial contract on
December 31, 2013. We found that FSA could not ensure that Xerox delivered a fully functional system
because it did not develop an adequate plan, ensure milestones were met, or use appropriate systems
development tools. Specifically, FSA did not include the milestones that were in the One-Pager
(included in the Status and Completion document) in the Xerox contract and FSA routinely revised
milestones when Xerox missed them. Additionally, FSA did not include its LMM or IV&V in the
development of DMCS2 or in its initial actions to correct DMCS2 system deficiencies. In addition, FSA
failed to enforce Xerox’s milestones and ensure that system fixes were independently verified. At the
end of Xerox’s contract and related extensions, FSA did not have a fully functional DMCS2.

Although FSA did not hold Xerox accountable for missed milestones established in FSA’s One-Pager
(included in the Status and Completion document) for correcting DMCS2 deficiencies, the initial 2003
CSB contract and the subsequent modifications covering the enhancement of DMCS2 included
provisions to hold the contractor accountable for not providing a fully functional system. FSA invoked
the provisions available through the contract to require Xerox to make progress on correcting the
DMCS2 deficiencies. For example, in February 2012, FSA initiated the process of terminating the
contract for default by issuing Xerox a notice, demanding that Xerox take corrective action to meet the
terms and conditions of the contract. However, that process provided limited leverage because FSA
decided not to pursue the default termination after Xerox submitted a corrective action, including
milestones, that FSA concluded addressed its concerns for correcting DMCS2 deficiencies. Xerox
continued to miss milestones even after submitting its corrective action plan. Ultimately, Xerox did not
provide a fully functional DMCS2 as required by the contract modification in which Xerox agreed to
enhance DMCS2.

During the course of our audit, we found that FSA did not use required life-cycle management processes,
lacked the information technology expertise to evaluate Xerox’s work, did not use Independent
Verification and Validation (IV&V), did not employ appropriate means to hold Xerox accountable, and

17
  Under Federal Acquisition Regulation 52.249-2, “Termination for Convenience,” the Government may terminate
performance of work on a contract in whole or in part if the contracting officer determines that a termination is in the
Government’s interest.
Final Report
ED-OIG/A04N0004                                                                              Page 6 of 20

did not provide sufficient contract oversight to ensure that Xerox corrected DMCS2 system deficiencies.
As we communicated deficiencies identified during the audit, FSA implemented corrective action to
address the issues identified. As a result, FSA’s contract with Maximus and its other corrective actions
provide a methodology that, if properly implemented, increases the likelihood that the contractor will
timely identify and correct DMCS2 system deficiencies. However, we could not determine whether FSA
properly implemented this methodology because the contract was in an early stage of implementation
and we identified additional opportunities for improvement.

In its comments to the draft report, FSA neither explicitly agreed nor disagreed with the finding;
however, it agreed with all four recommendations. FSA’s comments are included as Attachment 2 to the
report.

FINDING – FSA Needs to Fully Implement Its Methodology to Correct DMCS2
Deficiencies and Further Improve its Oversight of the Maximus Contract
We found that FSA could not ensure that Xerox delivered a fully functional system because FSA did not
develop an adequate plan, ensure milestones were met, or use appropriate systems development tools.
FSA initiated action to address information technology contracting weaknesses identified during our
audit including life-cycle management, IV&V and technical assistance, contractor accountability, and
contract oversight. However, FSA needs to fully implement these actions to ensure that the new contract
provides a fully functional system. We also identified additional areas for improvement, such as
involving FSA’s Technology Office in the analysis of cost proposals, future negotiations with Maximus,
and evaluation of contractor cost overruns.

Life-Cycle Management

FSA did not apply Departmental life-cycle management (LCM) requirements 18 to its 2010 agreement
with Xerox to develop and implement DMCS2, use its LMM in the December 2012 settlement
agreement, nor use its LMM in its One-Pager for correcting DMCS2 deficiencies. The Department’s
LCM and FSA’s LMM require the use of life-cycle management processes in system development and
enhancement efforts. Both of these requirements provide guidance, processes, and tools to ensure
appropriate and timely technology resource management throughout the project life cycle. 19 Although
the initial DMCS2 implementation and development started in 2010, before FSA’s LMM was established
in July 2011 the Department’s LCM framework was in place and applied to all Department employees
and contractors engaged in the development, acquisition, implementation, maintenance, and disposal of
information technology solutions (including automated information systems, software applications, and
manual processes).

FSA’s LMM is FSA’s project delivery and governance methodology. Project Managers for all
information technology projects at FSA are required to tailor their approach to the LMM according to
their project’s chosen system development life-cycle. Project managers are responsible for developing
and maintaining a tailoring plan unique to the information technology project being developed. A

18
   Department Directive OCIO: 1-106 LCM Framework dated December 2, 2005.
19
   FSA uses the term “life-cycle management methodology” (LMM) and the Department uses the term “life-cycle
management framework” (LCM). The life-cycle management methodology that FSA developed allows it to provide specific
guidance on development projects while also meeting the requirements of the Department’s life-cycle management
framework.
Final Report
ED-OIG/A04N0004                                                                       Page 7 of 20

tailoring plan is an approved baseline of expectations that focus on the documentation an integrated
project team will produce throughout the life of a project. Per FSA’s LMM, the integrated project team
is a “cross-functional team consisting of individuals from the organization who are responsible for
delivering a specific project such as software or a system release, and ensure project life-cycle
management methodology compliance is planned, scheduled and maintained.” The integrated project
team should assist the project manager with the development and maintenance of the project’s LMM
tailoring plan. Each integrated project team should also designate specific team members to be
responsible for ensuring that specific LMM documentation in the tailoring plan is completed.

FSA incorporated elements of its LMM in the Maximus contract through FSA’s requirements that the
contractor submit plans, reports, and other documentation to support the activities required by FSA’s
LMM. However, FSA did not update its June 2013 presolicitation tailoring plan for correcting the
DMCS2 deficiencies for more than a year and a half after FSA created the plan and for more than
9 months after Maximus began working under the contract in February 2014. FSA updated and approved
the tailoring plan on December 23, 2014 and disseminated it in April 2015. Approving and
disseminating the final tailoring plan to appropriate stakeholders is a requirement of the LMM process to
ensure risks are identified and mitigated early in the life cycle of the project. In addition, the final
tailoring plan establishes the LMM expectations for the project, and as such FSA should have approved
and disseminated it earlier in the process, at least before Maximus began work under the contract. It is
imperative that FSA timely update the tailoring plan in accordance with FSA’s LMM as FSA identifies
changes during the different stages of the LMM.

Adherence to FSA’s LMM and related processes should increase the likelihood that the contractor will
timely identify and correct DMCS2 system deficiencies and ultimately provide a fully functional
DMCS2. However, we are concerned that FSA’s delay in updating the tailoring plan may be an
indication that FSA is not fully implementing its LMM.

IV&V Contract and Technical Assistance

FSA did not use IV&V during the initial development of DMCS2 and did not include IV&V as part of its
initial process for correcting DMCS2 deficiencies. In addition, the technical assistance FSA’s
Technology Office provided was limited to information systems security issues and technical review of
one DMCS2 test plan. According to Section 1.5.1 of FSA’s IV&V Handbook, 20 IV&V is a process,
independent of the development organization, used to ensure that the products of a system development
activity meet the requirements of that activity and that the delivered system satisfies the intended use and
user needs as described by the developer. The IV&V process ensures that standard procedures and
practices as defined in FSA’s LMM are followed and that all requirements are adequately tested and that
test results are as expected.

FSA currently has an IV&V contract with BSC associated with the Maximus contract to ensure that
DMCS2 enhancements are developed according to the established requirements in the contract. BSC is
required to make FSA aware of development risks and ensure that DMCS2 development items have been
adequately documented and tested before implementation. In addition, the IV&V contract includes
clauses requiring BSC to develop and maintain an IV&V plan for the DMCS2 development effort and to



20
     Version 4.0 dated September 2008.
Final Report
ED-OIG/A04N0004                                                                                    Page 8 of 20

review Maximus’ system development life-cycle 21 processes for consistency with FSA’s LMM. The
BSC contractor has been reviewing Maximus documentation as it becomes available. For example, BSC
has reviewed, provided comments, and attended meetings relating to monthly releases (software
updates), one quarterly release, test plans, and test results. According to the IV&V plan, the IV&V team
plans to conduct the system development life-cycle review after the second quarterly release, which is
currently scheduled for September 2015.

FSA currently involves its Technology Office in its oversight of the IV&V contractor and in technical
reviews of DMCS2. Specifically, the Technology Office monitors the IV&V contract progress and
ensures that IV&V contract deliverables meet FSA’s standards. The Technology Office reviews the
IV&V status reports, IV&V watch lists, and IV&V risk registers 22 and has weekly meetings with the
contractor to discuss IV&V contract deliverables. The Technology Office also makes recommendations
to the Federal project team in charge of the Maximus contract 23 to address issues presented in the IV&V
contractor reports. In addition, the Technology Office performs technical analyses of DMCS2; for
example, the office has completed an analysis of the IV&V contractor plan for the development of
DMCS2 and Maximus’ transition plan.

FSA’s current contract for IV&V and its process to include the Technology Office should provide
technical insight for DMCS2 development efforts and ensure progress towards obtaining a fully
functional, enhanced DMCS2 system, if FSA (1) uses information from the IV&V contractor, (2) ensures
that Maximus provides all of the information the IV&V contractor needs to perform its tasks, and
(3) adequately monitors the IV&V contractor.

Contractor Accountability

The initial 2003 CSB contract and subsequent modifications covering the enhancement of DMCS2
included provisions to hold the contractor accountable for not providing a fully functional DMCS2. FSA
invoked the provisions available through the contract to require Xerox to make progress on correcting the
DMCS2 deficiencies, but FSA’s efforts were limited and did not result in Xerox delivering a fully
functional DMCS2 by the end of the contract period on December 31, 2013.

The parties initially agreed that Xerox would deliver the enhanced system by January 1, 2011, but that
date was later changed to February 1, 2011. Both parties agreed to transfer all of the borrowers from the
old DMCS to the new DMCS2 no later than 6 months after the successful implementation of DMCS2
(August 1, 2011). FSA included provisions in subsequent modifications to the contract to receive a
$300,000 credit to be applied against Xerox’s monthly invoices should the transfer of all borrowers from
the old DMCS to the new DMCS2 not be completed by October 31, 2011. Those provisions provided
that the credits be applied retroactively to the September 2011 invoice. Under the contract, FSA paid
Xerox $300,000 per month for hosting the Virtual Data Centers. For each month that Xerox did not
deliver DMCS2, Xerox, rather than FSA, would cover all of the Virtual Data Centers hosting costs. In
addition to the $300,000 monthly credits, FSA received an additional 5 percent credit to the January 2012
through April 2012 invoices. FSA received a total of $2.5 million in credits from September 2011

21
   System development life-cycle is a conceptual model used in project management that describes the stages involved in an
information technology development project.
22
   Status reports, watch lists, and risk registers are documents FSA uses during the IV&V process to support the business
process, track IV&V deliverables, and to facilitate project management decisions. Status reports contain a summary of work
performed for the period, while watch lists and risk registers are used to track issues based on the level of risk.
23
   The Federal project team was led by the director of the Default Division and by a senior business advisor.
Final Report
ED-OIG/A04N0004                                                                                       Page 9 of 20

through April 2012. According to the Director of the Mission Procurement Division, the transition from
DMCS to DMCS2 occurred during the August and September 2011 timeframe and FSA continued to
receive credits until April 2012. The credits stopped after April 2012 as part of a negotiation between
FSA and Xerox.
In February 2012, FSA initiated the process of terminating Xerox’s contract for default by issuing a
notice to Xerox, demanding that Xerox correct DMCS2 system deficiencies. FSA subsequently decided
not to terminate the contract because Xerox submitted a corrective action plan, including milestones, that
FSA concluded addressed its concerns. However, Xerox continued to miss milestones. We found that
between May 2012 and May 2013, Xerox met 7 out of 18 production milestone dates (38.9 percent), for
the 17 subfunctions and subprocesses we reviewed. 24

In February 2013, the parties agreed to another contract modification, which stated that if Xerox failed to
fully implement the items on the One-Pager, FSA would apply monthly disincentive fees, assessed as a
percentage of Xerox’s monthly invoices for servicing borrowers’ defaulted loans. The February 2013
modification provided that every 2 months after October 2012, the disincentive rate which started at
2.5 percent, would decrease by 0.5 percent and remained fixed at 1 percent for the April 2013 and
subsequent invoices. As such, the disincentive fees assessed against Xerox decreased rather than
increased for each month that Xerox failed to provide a fully functional DMCS2 system. FSA applied
$460,962 in disincentive fees to Xerox invoices between October 2012 and March 2013 25 because Xerox
failed to implement a fully functional DMCS2 in accordance with the contract modifications.

Unlike the Xerox contract, for which FSA added disincentive fees to hold Xerox accountable for not
providing a fully functional DMCS2 after Xerox demonstrated its inability to deliver, FSA’s contract
with the new DMCS2 contractor, Maximus, proactively provides for contractor accountability.
Specifically, the new DMCS2 contract includes both performance-based payments for development and
disincentive fees for missed milestones and unsatisfactory performance. Per 48 C.F.R. § 32.1002,
performance-based payments are contract financing payments made on the basis of (1) performance
measured by objective, quantifiable methods; (2) accomplishment of defined events; or (3) other
quantifiable measures of results. The Maximus contract contains provisions that allow FSA to withhold
15 percent of Maximus’ payments until successful completion of development milestones. The contract
development items are divided into eight quarterly releases, and the release of the 15 percent
withholdings will occur at designated release intervals if the development items are successfully
completed. In addition, if FSA finds that Maximus is not complying with material requirements of the
contract or is failing to make progress, FSA can reduce or suspend payments to Maximus in accordance
with other contract provisions. For any modification to the Maximus contract, FSA should ensure that it
has provisions to hold the contractor accountable for not meeting any new contract requirements.

Contract Oversight

FSA did not provide sufficient contract oversight to ensure that Xerox corrected the identified DMCS2
system deficiencies. Specifically, FSA’s Technology Office role in overseeing the development of
DMCS2 and negotiating related contract modifications was limited to (1) the participation of the Chief
Information Officer as part of FSA’s Investment Review Board, which would have approved funding
24
   The production milestones do not have a one-to-one relationship to the subfunctions and subprocesses. Some subfunctions
and subprocess may have more than one milestone and some do not have any associated milestone.
25
   Our invoice review for the initial contract and related modifications covered invoices from August 1, 2011 through the start
of the audit in March 2013. However, per additional information obtained late in the audit we found that the disincentive fees
were applied until October 2013.
Final Report
ED-OIG/A04N0004                                                                                     Page 10 of 20

decisions related to information technology investment for DMCS2, and (2) the technical assistance
described in the IV&V Contract and Technical Assistance section of this report. In addition, FSA had
limited involvement in Xerox’s change management process 26 used to handle DMCS2 deficiencies. FSA
management acknowledged the limitations of its approach with Xerox for correcting DMCS2 system
deficiencies and included in the Maximus contract a requirement to follow FSA’s change management
process, which will interface with the contractor’s change configuration management process, to avoid
similar problems in the future. FSA reviewed Maximus’ change management plan and determined that it
aligned with FSA’s process.

In evaluating Maximus’ proposal, a team (consisting of the contracting officer and a contract specialist in
FSA’s Acquisitions Office) reviewed the cost proposal for reasonableness. The contracting officer and
contracting specialist assessed the reasonableness of the proposal by comparing Maximus’ cost proposal
to the cost proposals submitted by each of the other vendors that submitted a proposal. The reviewers
used the information to negotiate the not-to-exceed cost included in the contract. However, the
Technology Office should have been involved in this review because its staff has the technical
knowledge necessary for system development, configuration, and programming in general and could
have provided input in the evaluation of the cost proposal. FSA can improve its oversight of the
Maximus contract by involving its Technology Office in any future negotiations with the contractor.

Although the Maximus contract included a not-to-exceed cost, the contract includes 14 DMCS2
development items without an associated cost for development and implementation. However, according
to the contracting officer for the Maximus contract, the development and implementation cost for the 14
development items are not reflected in the not-to-exceed cost stated in the contract. The contracting
officer also stated that the contractor did not know enough about the requirements for the items and,
therefore, could not provide a cost before the contract was signed. As of February 2015, FSA and
Maximus were still discussing the final pricing and schedule information for the 14 DMCS2
development items. The contracting officer added that the costs for those items will be negotiated once
Maximus provides the level of effort and price proposal for those items. When Maximus provides FSA
with its cost proposal for the 14 items, the contracting officer will conduct an analysis and consult with
the change management group, composed of business analysts and subject matter experts 27 who will help
determine whether the cost proposal is acceptable before FSA authorizes the start of any development
work on those 14 items. FSA’s Technology Office could provide technical expertise in the analysis of
Maximus’ cost proposal for the 14 development items and assist with contract negotiations.

In addition, FSA included in the Maximus contract the use of an Earned Value Management tool to
monitor Maximus’ contract progress and determine whether the contractor is on track with the contract
requirements at a given point in time. Using the tool, FSA will evaluate the contractor’s actual
performance compared to its expected performance and calculate a score every month.

In accordance with the Federal Acquisition Regulation 52.243-3, the contracting officer will make an
equitable adjustment 28 if any changes to the contract cause an increase or decrease in any one or more of

26
   This is a process for managing changes that need to be made to an information technology system.
27
   These subject matter experts assist FSA in determining whether the vendor can accomplish the work with the stated labor
mix, quantity of hours, etc. According to FSA’s LMM, subject matter experts provide guidance to project teams relevant to
their area of expertise. In addition, the contracting officer in charge of the Maximus’ contract described a subject matter
expert as someone who understands the technical aspect of delivering a particular solution.
28
   An equitable adjustment process is a contract adjustment based on changes to the contract that may increase or decrease the
contract price.
Final Report
ED-OIG/A04N0004                                                                    Page 11 of 20

the following and will modify the contract accordingly: (1) ceiling price, (2) hourly rates, (3) delivery
schedule, and (4) other affected terms. Although this process does not currently involve FSA’s
Technology Office, FSA’s Technology Office could provide technical expertise to evaluate the additional
labor hours included in the contractor’s cost overrun justification, in the event one is submitted.
Summary Table

Table 1 summarizes the issues discussed in this report: deficiencies we identified with the initial DMCS2
development efforts and the documentation FSA provided as its Status and Completion document for
correcting DMCS2 system deficiencies, FSA’s actions to address deficiencies in its most recent DMCS2
contract, and additional actions to improve FSA’s DMCS2 contract oversight.

Table 1: Deficiencies Identified with FSA’s Status and Completion Document for Obtaining a Fully
Functional DMCS2 and Initial DMCS2 Development Efforts, FSA’s Actions to Address the
Deficiencies, and Additional Improvements
                                       FSA’s Actions to Address the           Additional Improvements
    Deficiencies Identified          Deficiencies in the New DMCS2           for FSA’s Oversight of the
                                                  Contract                         DMCS2 Contract
Department LCM framework          The Maximus contract requires the         FSA should timely review,
and FSA’s LMM procedures          submission of plans, reports, and other   update, and approve its LMM
were not used in the              documentation to support the key          tailoring plan.
enhancement of DMCS2.             activities required in FSA’s LMM.
IV&V procedures were not          FSA contracted IV&V services for the  FSA should ensure Maximus
used in the enhancement of        Maximus contract.                     provides all of the
DMCS2.                                                                  information the IV&V
                                                                        contractor needs to review
FSA Technology Office             FSA has involved its Technology       Maximus’ system
involvement in the                Office in the oversight of IV&V       development life-cycle
enhancement of DMCS2 was          services and technical reviews of     processes for consistency
limited.                          DMCS2.                                with FSA’s LMM.
FSA initially failed to enforce   The Maximus contract contains         We did not identify any
Xerox’s missed milestones, but    provisions that allow FSA to withhold additional improvements for
later added contract provisions   15 percent of Maximus’ payments until this item.
that included disincentive fees   successful completion of development
to hold Xerox accountable.        milestones.
FSA’s oversight of Xerox’s        The IV&V contractor will oversee and To control costs, FSA should
correction of DMCS2               report on system development          include its Technology Office
deficiencies was inadequate.      activities and make FSA aware of      in evaluating the cost
                                  development risks and issues, and FSA proposal for the
                                  put controls in place to control      14 development items for
                                  development costs.                    which costs have not been
                                                                        negotiated and, where
                                                                        appropriate, in determining
                                                                        the need and the amount for
                                                                        any equitable adjustment.
Final Report
ED-OIG/A04N0004                                                                                Page 12 of 20

Recommendations

We recommend that FSA’s Chief Operating Officer—

     1. Ensure the tailoring plan is timely reviewed, updated, approved, and disseminated as established
        in FSA’s LMM as changes are identified during the different stages of the LMM.

     2. Ensure Maximus provides all of the information the IV&V contractor needs to review Maximus’
        system development life-cycle processes for consistency with FSA’s LMM.

     3. Include FSA’s Technology Office in evaluating the cost proposal for the 14 development items
        for which costs have not been negotiated.

     4. Include FSA’s Technology Office, where appropriate, in determining the need and the amount for
        any equitable adjustment.

FSA Comments

FSA neither explicitly agreed nor disagreed with the finding; however, it agreed with all four
recommendations and detailed its actions to address each recommendation. FSA’s comments are
included as Attachment 2 to the report.



                         OBJECTIVE, SCOPE, AND METHODOLOGY


The objective of our audit was to determine whether FSA’s plan for correcting DMCS2 system
deficiencies provided for accountability; specifically, we assessed whether the plan included milestones
to ensure Xerox timely corrected DMCS2 system deficiencies and options to hold Xerox accountable if it
did not have a fully functional DMCS2 system by the end of the contract, December 31, 2013. Our
review covered FSA and Xerox’s management of DMCS2 development activities from June 2010
through July 2014, Xerox’s invoices and payments from August 2011 through March 2013 29 and
October 2013 through August 2014, 30 other DMCS2 related contracts (and related invoices and
payments) from September 2013 through July 2014; and all updated documents and information
provided through February 2015. 31

We performed our review at the Department’s FSA office in Washington, D.C., from April 2, 2013,
through April 4, 2013; from September 10, 2013, through September 11, 2013; and July 8, 2014. In
addition, we communicated with Xerox from May 16, 2013, through July 13, 2013, to review
information pertaining to Xerox’s development and management of DMCS2. We also reviewed actions

29
   This time period was the original scope of the audit before we concluded that FSA did not have a comprehensive plan to
correct system deficiencies at the start of our audit.
30
   We selected this time period to cover the effective period of Xerox’s extension to the CSB contract.
31
   This includes FSA’s corrective action plan for addressing DMCS2 system deficiencies identified in an OIG alert memo
ED-OIG/L02M0008 and additional information related to the Maximus and IV&V contracts to update the status of DMCS2 as
of February 2015.
Final Report
ED-OIG/A04N0004                                                                    Page 13 of 20

FSA implemented between September 2014 and November 2014, as they pertained to the future
development and oversight of DMCS2. We held our exit conference with the Department’s FSA office
on December 16, 2014.

To gain an understanding of DMCS2, the entities developing and overseeing it, and applicable laws and
guidance, we obtained background, funding, and contractual information pertaining to DMCS2 and its
functions and related contracts. We also obtained information on ACS Education Solutions, LLC, and
Xerox, the contractors responsible for the development of DMCS2; FSA, which has responsibility for the
oversight of DMCS2; Maximus, the new contractor for DMCS2; and the IV&V contractor. In addition,
we obtained Office of Management and Budget Circular 123, Federal Managers Financial Integrity Act
of 1982, GAO Standards for Internal Control, the Federal Acquisition Regulation, FSA issued change
management plans and LMM/IV&V policies and procedures, and other guidance and best practices
pertaining to information technology development. We reviewed prior audits and reviews and related
corrective action plans pertaining to DMCS2 and coordinated with other auditors from the OIG who were
conducting an audit related to DMCS2.

We interviewed key FSA officials and reviewed related documentation to gain an understanding of the
following:

   •   development, implementation, and transition of DMCS2 and related contracts;
   •   controls FSA had in place to oversee the development of DMCS2 and to ensure Xerox would
       timely provide a fully functional DMCS2;
   •   DMCS2 functional deficiencies and the tracking of the deficiencies;
   •   FSA’s May 2013 intended actions for correcting DMCS2 deficiencies;
   •   information pertaining to DMCS2 milestones for development and validation;
   •   actions FSA’s management took to hold Xerox accountable for not providing a fully functional
       DMCS2 as agreed;
   •   the IV&V contract and roles and responsibilities defined in the contract;
   •   roles and responsibilities of FSA’s Technology Office; and
   •   required reports from the new DMCS2 contractor Maximus, and the IV&V contractor.

We interviewed Xerox officials and reviewed related documentation to gain an understanding of the
following:

   •   development, implementation, and transition of DMCS2 and FSA’s involvement;
   •   identification and tracking of DMCS2 functions, defects, and related fixes and validations;
   •   actions FSA took against Xerox to hold it accountable for not providing a fully functional
       DMCS2 as agreed; and
   •   major obstacles impeding Xerox’s progress in developing and upgrading DMCS2.

Analysis of Xerox and FSA’s DMCS2 Related Milestone History

To determine how often Xerox and FSA met milestones for correcting DMCS2 deficiencies, we
evaluated DMCS Requirement Assessment One-Pagers (One-Pager and updates). The One-Pagers
contain a breakdown of DMCS2 subfunctions and subprocesses, with each having an indicator of its
Final Report
ED-OIG/A04N0004                                                                                   Page 14 of 20

working status (red, yellow, or green), 32 a Xerox target or actual production date, and an FSA anticipated
or actual validation date.

At the time of our analysis, FSA provided us a universe of 19 One-Pagers, dated from November 2011
through May 2013. Although the One-Pagers were first created in November 2011, we checked FSA and
Xerox’s track record for meeting milestones within 1 year of FSA creating its requirements for making
DMCS2 fully functional (created in May 2013). From the universe of 19 One-Pagers, we reviewed a
judgmental sample consisting of the 13 One-Pagers related to the months of May 2012 through
May 2013 (one for each month). We tested only the subfunctions and subprocesses that were not fully
functional (red or yellow status) as of the very first One-Pager (dated February 29, 2012) that listed all
105 of the DMCS2 subfunctions and subprocesses, 33 but had turned green as of the May 2013 One-
Pager. From the universe of the 105 subfunctions and subprocesses, we reviewed a judgmental sample
consisting of 17 subfunctions and subprocesses included in our sample months. We compared the
associated Xerox target production date or actual production date in each of the selected One-Pagers to
see how many times Xerox met or did not meet the target production dates. We used the same procedure
to see how many times FSA met or did not meet its anticipated validation dates.

Our review of Xerox’s and FSA’s DMCS2 related milestones was limited to judgmentally selected One-
Pagers and subfunctions and subprocesses. As such, we did not review all One-Pagers provided to us,
nor all of the subfunctions and subprocesses included in the One-Pagers. Therefore, our results from the
milestone analysis are applicable only to the One-Pagers and subfunctions and subprocesses included in
our review.

Analysis of Xerox Invoices and Payments

To determine whether FSA withheld payments from Xerox in response to DMCS2 system deficiencies,
and whether the payments made to Xerox matched Xerox’s invoices, we examined Xerox’s invoices and
the Department of Education’s Central Automated Processing System (EDCAPS) report, Award
Financial History, containing the payments made to Xerox (as it related to the CSB contract). We
obtained Xerox’s CSB contract related invoices for August 1, 2011, through March 30, 2013, and for
October 13, 2013, through August 1, 2014. We obtained the Award Financial History relating to
payments made to Xerox under the CSB contract for the same time periods.

Using the entire universe of 20 Xerox invoices from August 1, 2011, through March 30, 2013, we
verified that FSA withheld payments from Xerox in response to DMCS2 system deficiencies per the
CSB contract. Using the entire universe of 10 invoices from October 13, 2013, through August 1, 2014,
we verified that the proper withholding adjustments were made to the invoices per CSB contract
modification 141. In addition, for both time periods, using the Award Financial History for payments
made to Xerox under the CSB contract, we verified that the invoice totals included in our two universes
of Xerox invoices matched what was recorded in the Award Financial History as payments made to
Xerox.


32
   Red status means in development or test, not yet proven to function at all, or stopped production. Yellow status means in
production with defects that may or may not result in a backlog. Green status means in production and proven to work.
33
   From November 2011 through January 2012, the number of subfunctions and subprocesses in the One-pagers and the
format of the One-pagers varied monthly. Starting with the February 2012 One-Pager through the November 2014 One-pager
(the last one), the number of subfunctions and subprocesses did not vary by much, nor did the format of the One-pagers.
Therefore, we selected the February 2012 One-pager as the baseline for testing purposes.
Final Report
ED-OIG/A04N0004                                                                       Page 15 of 20

We relied on computer-processed data contained in the EDCAPS Award Financial History for purposes
of determining FSA payments made, payments withheld, and credits received. We reconciled Xerox’s
invoices with payments made by FSA and interviewed officials to gain an understanding of the payment
process. Based on our reconciliation, we determined that the computer processed data were sufficiently
reliable for the purposes of this review.

We gained an understanding of the internal controls concerning FSA’s oversight of the DMCS2
implementation. We determined that control activities were significant to our audit objectives. We
reviewed FSA’s control activities for its plans and contracts to make DMCS2 fully functional, FSA’s
oversight of Xerox’s development and enhancement of DMCS2, FSA’s change management control
process and LMM and IV&V policies and procedures, and Xerox invoices and payments. We found
weaknesses in FSA’s internal control for control activities, which are fully reported in the audit results.

We conducted this performance audit in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and conclusions based on our
audit objectives. We believe that the evidence obtained provides a reasonable basis for our
findings and conclusions based on our audit objectives.



                                 ADMINISTRATIVE MATTERS


Corrective actions proposed (resolution phase) and implemented (closure phase) by your office will be
monitored and tracked through the Department’s Audit Accountability and Resolution Tracking System.
The Department’s policy requires that you develop a final corrective action plan (CAP) for our review in
the automated system within 30 calendar days of the issuance of this report. The CAP should set forth
the specific action items, and targeted completion dates, necessary to implement final corrective actions
on the findings and recommendations contained in this final audit report. An electronic copy of this
report has been provided to your Audit Liaison Officer.

In accordance with the Inspector General Act of 1978, as amended, the Office of Inspector General is
required to report to Congress twice a year on the audits that remain unresolved after 6 months from the
date of issuance.

Statements that managerial practices need improvements, as well as other conclusions and
recommendations in this report, represent the opinions of the Office of Inspector General.
Determinations of corrective action to be taken will be made by the appropriate Department of Education
officials.

In accordance with the Freedom of Information Act (5 U.S.C. §552), reports issued by the Office of
Inspector General are available to members of the press and general public to the extent information
contained therein is not subject to exemptions in the Act.
Final Report
ED-OIG/A04N0004                                                                     Page 16 of 20

We appreciate the cooperation given us during this review. If you have any questions, please call
Denise M. Wempe, Regional Inspector General for Audit, at 404-974-9416.



                                            Sincerely,

                                            /s/

                                            Patrick J. Howard
                                            Assistant Inspector General for Audit


Attachments
Final Report
ED-OIG/A04N0004                                                              Page 17 of 20

                                                                                     Attachment 1

              Acronyms, Abbreviations, and Short Forms Used in This Report


CAP                  Corrective Action Plan

CSB                  Common Services for Borrowers

BSC                  BSC Systems, Inc.

Department           U.S. Department of Education

Direct Loan          William D. Ford Federal Direct Loan

DMCS                 Debt Management and Collections System

DMCS2                Debt Management and Collections System 2

EDCAPS               Department of Education’s Central Automated Processing System

FFEL                 Federal Family Education Loan

FSA                  Federal Student Aid

GAO                  Government Accountability Office

IV&V                 Independent Verification & Validation

LCM                  Department’s Lifecycle Management Framework

LMM                  FSA’s Lifecycle Management Methodology

Maximus              Maximus, Inc.

OIG                  Office of Inspector General

One-Pager            FSA’s Requirements Assessment One-Pager Completion Tracker

Xerox                Xerox Education Solutions, LLC
                                                                                                             Attachment 2
Fed era I Student
A   Qrft"[   • "•   ~    OEPA~· 1:£1'•    f   EOL.CATION
                                                              PROUD SPONSOR of
                                                              the AMERICAN M INO •




                MEMORANDUM

                DATE;           JUL l \\ 1(\\5
                TO:                      De ni se M. We mpe
                                         Regional Inspector General for Audit
                                         Office of Ins pector Gene~

               FROM:                 James W. Runc ie                                ~
                                     Chief Operating Officer

               SUBJECT:              Respo nse to Draft Audit Report:
                                     Debt M anagement and Co llecti ons Syste m 2 (DMCS2) Im plementation
                                     Control No. ED-OIG/A04N0004

               Thank you for the o pportunity to comment on the Office o f Inspector General 's (OIG)
               draft aud it repo rc, Review of Debt Management and Collections System 2 (DMCS2 )
               l111pleme11tatio11 , dated May 29, 201 5. Federal S tudent Aid (FS A) is committed to
               addressin g the remaining DMCS2 system deficiencies. As you note in your draft report,
               we have already taken a num ber of steps to support thi s effo rt, such as:

                        I. Incl usion of explic it Lifecyc le Management Methodology (LMM) requirements
                           in the new DMCS contract with Maximus Federal Services.
                        2. Inclusion of finan cial incenti ves in the contract to encourage the successful
                           completio n of development milestones.
                        3. Awarding of an independent validation and verification (IV & V) contract to
                           advise o n the software development process.

               We agree with the recommendatio ns incl uded in your draft report that build on and
               co mple ment these initial steps.

               FSA 's response to each recommendatio n in your report is as fo ll ows:

               R ecommendation 1: E nsure the tailoring plan is timely reviewed , upda ted ,
               approved, and disseminated as established in FSA's LMM as changes are identified
               during the differ ent stages of the LMM.

               Response: FSA agrees with the recommendation. Staff fro m FSA 's Technology Office
               are in the process o f workin g with Business Operations and Acquisitions to revi ew the
               tailoring plan in light o f the development acti vit y to date. Recommendations and any
               necessary changes will be incorporated into the contract thro ugh a modification and
               dissemin ated as established in FSA's LMM.



                                         ~H                s ret:.t NE V\ a~
                                                                ~·     e IA
                                                                                        Attachment 2



Page 2.

Recommendation 2: Ensure Maxim us provides all of the information the IV& V
contractor needs to review Maximus' system development life-cycle processes for
consistency with FSA's LMM.

Response: FSA agrees with the recommendation. FSA is conducting bi-weekly
coordination meetings with the DMCS Federal Project Management and IV& V teams
where information needs are discussed and escalated, if necessary. A standing agenda
item will be added regarding data needs or gaps in preparation for the system
development life-cycle (SDLC) review planned after Release 2. Additionally, the IV& V
team can escalate information impediments through the Technology Office - Quality
Assurance (QA) Program to the FSA Chief Information Officer for resolution.

Recommendation 3: Include FSA's Technology Office in evaluating the cost
proposal for the 14 development items for which costs have not been negotia ted.

Response: FSA agrees with the recommendation. The Technology Office - Engineering
Review Board (ERB) will provide review and evaluation support to appropriate cost
proposals of the 14 development items for which costs have not been negotiated.

Recommendation 4: Include FSA's Technology Office, where appropriate, in
determining the n eed and the amount for any equitable adjustment.

Response: FSA agrees with the recommendation. The Technology Office - ERB and
QA Program team members will provide review and evaluation support to appropriate
requests for equitable adjustments.

Thank you for the opportunity to review and comment on this draft report.

cc: Chris Vierling
                                                                                                  Attachment 2



Page 3--Technical Comments

Page I 0 states that Business Operations subject-maner experts reviewed cost proposals
for reasonability. This is not the case; these reviews are performed by Acq uisitions staff.

To clari fy the timing of the LMM documentation, the first LMM tailoring plan primarily
foc used on the transi tion, wh ich fed the initial deliverables table included in the contract
al the time of award. After the stop work order was lifted, this deliverables table was
updated in the contract via Modification 0005 on March 28 , 20 14 to update the due
dates. Thereafter, based on our experience and the Release I development results, FSA
reviewed. updated, approved and disseminated the plan for future development
work. The resu lting updated deliverables schedule is to be included in another contract
modification.