Quality Assurance Surveillance Plan

What the plan does in a contract governance context

A Quality Assurance Surveillance Plan, or QASP, turns a contract’s performance promise into something a government buyer can actually observe, measure, and accept. It defines the surveillance methods, acceptance criteria, and review cadence that show whether the supplier is meeting contractual expectations, rather than relying on informal judgement or ad hoc oversight.

That matters because service delivery in regulated environments is often judged against evidence, not intent. A well-formed QASP gives the customer a repeatable way to test whether support, operations, response times, documentation, or other service obligations are being met consistently enough to justify acceptance and continued performance.

How a QASP differs from the contract itself

The contract states what is owed, while the QASP explains how the buyer will check that it is being delivered. In practice, it translates broad obligations into surveillance points that can be reviewed by a contracting officer, programme manager, or quality reviewer without changing the underlying legal terms.

This distinction is important in identity and security programmes, where service quality can be easy to claim and hard to prove. A vendor may say it can support audits, access reviews, or evidence collection, but the QASP is where those claims become measurable through artefacts, timelines, and pass-fail conditions.

Because the plan is operational, it also helps prevent scope drift. If the supplier’s responsibilities change, the surveillance criteria should change with them; otherwise the customer may keep measuring the wrong things or miss failures that matter to governance.

Why observable criteria matter for assurance

A QASP is only useful when its criteria are specific enough to be observed consistently. Vague language such as “good support” or “timely action” creates ambiguity, while observable measures such as review completion, response windows, evidence quality, or issue closure standards let the customer assess performance in a defensible way.

That structure is especially valuable when multiple stakeholders rely on the same service. Procurement, programme leadership, security, and operational teams may all care about different aspects of performance, but the QASP gives them a shared reference point for what is being watched and how exceptions are handled.

In governance-heavy environments, the plan also acts as a boundary document. It clarifies what the customer will verify directly, what the supplier must evidence, and where acceptance depends on documented proof rather than verbal assurance.

Where QASPs fit in regulated and identity-sensitive programmes

QASPs are common where service quality has compliance consequences, such as managed services, control testing, audit support, or any outsourced function that feeds formal assurance processes. When the service touches identity governance, access administration, or evidence production, the plan helps turn policy expectations into testable obligations.

For identity programmes in particular, the QASP can expose whether the vendor understands the customer’s control environment, reporting expectations, and approval process. If the support team cannot interpret the surveillance requirements, it will struggle to operate inside the customer’s governance model, even if the underlying service is technically adequate.

Used well, the QASP becomes part of accountability, not just administration. It gives the buyer a basis for service review, escalation, and acceptance decisions when performance is uneven or when the supplier’s outputs must support formal assurance.

Risk and Threat Considerations

A weak QASP creates a governance blind spot: the organisation may believe performance is being controlled when it is only being assumed. That risk is highest where service quality supports security, compliance, or audit evidence, because poor surveillance can let failures persist until they affect reporting, acceptance, or downstream control effectiveness.

Failure mechanism: Undefined or poorly tailored surveillance criteria let the supplier optimize for the contract language while missing the behaviours the customer actually depends on, such as evidence quality, timeliness, or exception handling.

Impact: The customer can accept incomplete or unreliable performance, miss recurring service failures, and lose confidence in the operational evidence that supports governance, assurance, or regulated control outcomes.

Practitioner Guidance

Governance implication: Treat the QASP as an operational control document, not a filing exercise. The people who rely on the service should be able to point to specific surveillance points, acceptance triggers, and escalation conditions that reflect real business risk.

What to watch for: The plan is too weak if it describes oversight in general terms but does not tell reviewers what to inspect, what counts as acceptable, or how to handle repeated misses. In that case, the contract may be live, but the assurance model is not.

Practitioner takeaway: A good QASP makes service quality measurable enough that both sides can see the same reality, which is what keeps outsourced performance governable.

Related resources from NHI Mgmt Group

• Guide: Audit, Assurance and Compliance Guide
• What should security leaders look for in an AI SOC quality assurance process?
• Why do code rewrite tools need performance testing as part of quality assurance?
• What is the difference between a rapid start rollout and a full implementation plan for data quality observability?
• What is the difference between a quality gate and a quality profile in AI code assurance?