NOTICE TO ALL PROPOSERS

Transcription

1 May 7, 2015 SUBJECT: Enterprise Risk Management Software Solution Inquiry No.Q SR Request For Information Dear Sir or Madam: The New York Power Authority invites you to submit information for Enterprise Risk Management Software Solution. The location of these services will be at the New York Power Authority s Headquarters Office located at 123 Main Street,White Plains, New York NOTICE TO ALL PROPOSERS PROVIDERS ARE HEREBY CAUTIONED TO MAKE USE OF THE NEW YORK POWER AUTHORITY S WEB SITE AT TO OBTAIN CURRENT AND COMPLETE RFI DOCUMENTS, RFI ADDENDA, POST-RFI ADDENDA AND RELATED NOTICES. PROVIDERS OBTAINING RFI DOCUMENTS FROM SOURCES OTHER THAN THE AUTHORITY S WEB SITE AT DO SO AT THEIR OWN RISK. INCOMPLETE PROPOSAL RESPONSES MAY BE REJECTED BY THE AUTHORITY. The Authority is issuing this RFI to: Identify, evaluate and acquire information pertaining to providers ability to provide an Enterprise Risk Management Software Solution. Obtain supplier information with regards to standardizing business processes, making them more closely aligned with industry best practices. Identify suppliers ability to Improve data accessibility and reporting and reduce manual data entry. Review past implementations of each provider to determine if the provider can perform an upgrade of this scope and complexity. Determine suppliers ability to improve data integration between SAP and Primavera. Long Form Invitation Letter 5100 July 2013 Update Inquiry No. Q SR

2 A description of the required Information is provided and detailed in the Information Required attached hereto. Information must be submitted in triplicate (original and two copies) along with a compact disk (CD) for each set to the address listed below. Please mark the original. New York Power Authority 123 Main Street White Plains, New York Attention: Sean Rooney, IT Procurement Specialist III Sean.Rooney@nypa.gov Proposals shall be delivered to the Authority by hand or mail not later than Thursday,May 28 th, Envelopes containing each set should be clearly marked on the outside that a proposal for is enclosed and showing the Proposer s name, address and agreement title. The outside of the submission shall be marked with large letters DO NOT OPEN SEALED PROPOSAL. ed or faxed information will not be accepted. Any proposals received after this date and time will be time stamped and returned unopened to the Provider. If there are any questions regarding this Request For Information (hereinafter RFI ) 139-J and 139-K of the State Finance Law (SFL), require that all questions must be directed in writing to Sean Rooney New York, Power Authority, 123 Main Street, White Plains, New York All expenses incurred by you in preparation of your proposal will be to your account. The Power Authority will not reimburse any such expenses. The Power Authority reserves the right to reject any or all proposals. Please acknowledge receipt of this letter, stating whether or not you intend to submit a proposal by returning the Bid/Inquiry Response Form immediately following this page. Very truly yours, Sean Rooney Sr. Procurement and SAP System Analyst New York Power Authority 123 Main Street White Plains, New York Phone: (914) Fax: (914)

3 BID/INQUIRY RESPONSE FORM PLEASE READ AND RETURN IMMEDIATELY New York Power Authority 123 Main Street Inquiry No: Q SR White Plains, New York Attention: Sean Rooney Information Due Date:Thursday,May28 th, 2015 RESPONSE (CHECK One) Yes, we will submit Information for the above Inquiry. No, we are unable to submit a proposal at this time. REASON(S) FOR NOT PROVIDING INFORMATION (Check all applicable boxes) Not our scope of work. Present work load too heavy at this time. Scope of work too small. Scope of work too large. Not enough time to bid. How much more time needed? Specification requirements too stringent (Please explain on separate paper). Commercial requirements too stringent (Please explain on separate paper). Contract Reporter notification received too late to respond. Date Received. Unable to meet Bond Requirements. Unable to meet Insurance Requirements. Unable to submit a competitive bid at this time. Key personnel unavailable at this time. Cannot meet Delivery or Schedule Requirements. Lack of experience. Other (Please Explain). IF YOU ARE UNABLE TO SUBMIT A BID, DO YOU WISH TO RECEIVE FUTURE SOLICITATIONS FROM THE NEW YORK POWER AUTHORITY? YES NO Name Company (Please Print) Date Telephone No. (Mail or Fax this form to FAX No. (914) )

4 NEW YORK POWER AUTHORITY REQUEST FOR INFORMATION FOR ENTERPRISE RISK MANAGEMENT SOFTWARE SOLUTION INQUIRY NO. Q SR Long Form Information for Providers 5100 July2013UpdateUpdate

5 TABLE OF CONTENTS A) Information Inquiry Response Form B) Information For Providers (Instruction for Preparation of Information Pages IP-1 through IP-2.) C) P.O. Address of the Provider (Page B-1). D) Information Required (Pages IR-1 through IR-7) Long Form Table of Contents 5100 July2013Update

6 INFORMATION FOR PROVIDERS I. EXAMINATION OF REQUEST FOR INFORATION A. Provider shall examine the RFI carefully. Any questions with respect to the RFI, including an interpretation of the RFI or clarification of any ambiguity, inconsistency or error therein, shall be addressed to the Authority in writing, ( inquiries acceptable) to the Authority for response. Such inquiries may be answered in writing by the Authority, as it deems necessary, as an addendum to the RFI, and will be posted on the website. Any addendum issued becomes part of the RFI, binding on all Providers whether or not the Provider receives or acknowledges actual notice of any such addendum. B. Only written interpretation(s) or correction(s) provided in any addendum shall be binding. Providers are cautioned that no officer, agent or employee of the Authority is authorized otherwise to explain or interpret the RFI, and the Provider must not rely upon any such explanation or interpretation, if given. The contract as defined in Article 15 of the AGREEMENT shall constitute the entire AGREEMENT between the Provider and the Authority. I. WITHDRAWAL OF INFORMATION Permission will not be given to modify or explain any information after it has been deposited with the Authority. No information shall be withdrawn or cancelled before the time designated in this RFI for opening such information except upon such conditions as the Authority may deem to be necessary. III. PRIVACY LAW NOTIFICATION SECTION 941(1)(d) OF THE NEW YORK PUBLIC OFFICERS LAW REQUIRES THIS NOTICE TO BE PROVIDED WHEN COLLECTING PERSONAL INFORMATION FROM ENTITIES DOING BUSINESS WITH THE NEW YORK POWER AUTHORITY. This information is requested pursuant to Article 5, Title I of the Public Authorities Law and Section 6041 of the Federal Internal Revenue Code. The principal purpose for which the information is collected is to comply with requirements of the Federal Internal Revenue Code in accordance with Section 96(1) of the Personal Privacy Protection Law, particularly subdivisions (b), (e) and (f). Because services providers doing business as 1099 status Consultants typically submit their personal social security numbers and residential addresses to the Authority for business use and tax requirements, such Long Form Information For Providers 5100 July2013Update Inquiry No. Q SR IP-1

7 personal information must be maintained by the Authority in accordance with New York s Personal Privacy Protection Law. Failure to provide the requested information may result in fines by the Federal Government for failure to properly report income. This information will be maintained by the Office of Procurement at the Power Authority of the State of New York located at 123 Main Street, 5 th Floor, White Plains, New York, 10601, or when appropriate, at one of the various Authority facilities. July2013Update Information For Providers 5100 IP-2

8 NON-COLLUSIVE INFORMATION CERTIFICATION Provider shall submit one signed non-collusive information certificate with each copy of its information submitted. A. By submission of this information, each Provider and each person signing on behalf of any Provider certifies as to its own organization, under penalty of perjury, that to the best of his /her knowledge and belief: 1. The prices in this information have been arrived at independently without collusion, consultation, communication, or agreement, for the purpose of restricting competition, as to any matter relating to such prices with any other Provider or with any competitor; 2. Unless otherwise required by law, the prices which have been quoted in this information have not been knowingly disclosed by the Provider and will not knowingly be disclosed by the Provider prior to opening, directly or indirectly, to any other or to any competitor; and 3. No attempt has been made or will be made by the Provider to include any other person, partnership, or corporation to submit or not to submit a information for the purpose of restricting competition. B. Information shall not be considered for award nor shall any award be made where A. 1, 2 and 3, above have not been complied with; provided however, that if in any case the Provider cannot make the foregoing certification, the Provider shall so state and shall furnish with the information a signed statement which sets forth in detail the reasons therefore. Where A.1, 2 and 3, above have not been complied with, the information shall not be considered for award nor shall any award be made unless the head of the purchasing unit of the state, public department or agency to which the information is made, or his designee, determines that such disclosure was not made for the purpose of restricting competition. C. Information provided by one or more corporations individually or as members or a joint venture or partnership shall be deemed to have been authorized by Provider s respective board or boards of directors as the case may be, and such authorization shall be deemed to include the signing and submission of the information and the inclusion therein of this non-collusive information certification as the act and deed of such respective corporations. FIRM NAME: BY: BY: TITLE: DATE: (Name-Signed) (Name-Signed) July2013Update Information For Providers 5100 IP-3

9 P.O. ADDRESS OF THE PROVIDER Company Name: Street Address: City: State/Province: Zip Code: Country: Address: Telephone No: Ext: Fax No: Fed ID No. ADDRESS FOR CHECK PAYMENTS: (If different from above) City: State/Province: Zip Code: Country: If a Corporation Name: Address President: Secretary: Treasurer: If a Partnership Name of General Partners: Address Name of Individual: If an Individual Address If a Joint Venture Name of General Partners: Address B-1

10 Request for Information (RFI) Enterprise Risk Management Software Solutions Table of Contents Background... 2 Business Need Overview... 2 ERM Software Functionality Requirements... 3 A. Risk Data... 3 B. Risk Features... 4 C. Risk Reporting... 4 D. Risk Administration... 5 E. Risk Security... 5 Information Requested... 6 IR 1

11 Background Request for Information (RFI) Enterprise Risk Management Software Solutions The New York Power Authority (NYPA) is the nation s largest state public power organization, with 16 generation facilities and more than 1,400 circuit miles of transmission lines. NYPA provides some of the lowest-cost electricity in New York State, which helps to support thousands of jobs statewide while reducing public-sector costs. State and federal regulations shape NYPA s diverse customer base, which includes a variety of governmental customers, job-producing companies, non-profit groups, municipallyowned and rural cooperative electric systems, investor owned utilities, and neighboring states. NYPA comprises of approximately 1600 employees across 8 facilities within New York State. NYPA is a leader among New York s electricity suppliers, and a national leader in promoting energy efficiency, the development of clean energy technologies and electric vehicles. Our energy services projects can be found throughout New York State, saving money and megawatts while helping to reduce greenhouse gas emissions. Today, NYPA remains true to its mission, serving the public without the use of any tax revenue or state credit. Business Need Overview The Enterprise Risk Management (ERM) Department at NYPA facilitates the proactive identification and management of risks to assure the achievement of NYPA objectives. ERM desires an established, systematic, logical and flexible software tool that provides a comprehensive framework for effective, efficient and coherent management of risks across the organization. Toward the above goal, NYPA is soliciting through this Request for Information (RFI) for Enterprise Risk Management Software solutions that will facilitate the systematic management of risk and sharing of risk data seamlessly across all levels of the organization. Desired ERM software solutions are to support all aspects of ERM processes from risk identification through to risk closure. This includes the capture of objectives, risk assessment, risk treatment, monitoring, reviewing and updating, as well as, communicating and reporting capabilities to stakeholders. The functionality NYPA is looking for in an ERM software solution is organized into the requirements categories listed below. A. Risk Data describes the data attributes minimally required for capture within the tool. B. Risk Features describes the processes and/or capabilities to be provided and/or supported by the tool. C. Risk Reporting describes the reports to be produced by the tool. D. Risk Administration describes the capabilities to manage risks within and/or via the tool. E. Risk Security describes user access needs to be provided by the tool. More information on each category can be found in the succeeding section ERM Software Functionality Requirements. The ERM Department resides at NYPA Headquarter Office located at 123 Main Street, White Plains, NY Please note: This request for information does not commit NYPA to contract for any supply, services or software whatsoever. NYPA is not seeking proposals at this time, but instead, information to identify software solutions that may be available to meet the business need and requirements as defined in this RFI. Responding or not responding to this RFI does not preclude participation in any future RFP, if any is issued. IR 2

12 Request for Information (RFI) Enterprise Risk Management Software Solutions ERM Software Functionality Requirements To recap, NYPA is seeking information on established Enterprise Risk Management Software solutions that facilitate the systematic management of risk and sharing of risk data seamlessly across all levels of the organization. Desired functionality is categorized into requirements categories as follows: A. Risk Data describes the data attributes minimally required for capture within the tool. B. Risk Features describes the processes and/or capabilities to be provided and/or supported by the tool. C. Risk Reporting describes the reports to be produced by the tool. D. Risk Administration describes the capabilities to manage risks within and/or via the tool. E. Risk Security describes user access needs to be provided by the tool. Each category is further elaborated below. A. Risk Data The following generic attributes apply to the risk record. 1. Objective 2. Risk Criteria (internal and external) 3. Stakeholder(s) 4. Risk event identification 5. Risk event description 6. Risk analysis (includes qualitative, semi-quantitative or quantitative scoring to determine the magnitude across multiple dimensions such as likelihood, impact, velocity as well as risk tools) 7. Risk evaluation 8. Risk treatment (includes response plan(s) as well as expected outcome(s)) 9. Residual risk 10. Risk monitoring (includes risk metrics) 11. Risk reporting 12. Risk review 13. Risk update 14. Risk closure 15. System and/or pre-defined data IR 3

13 Request for Information (RFI) Enterprise Risk Management Software Solutions B. Risk Features The following describes capabilities to be performed upon risk records. 1. Ability to attach external files, include hyperlink to external files, and upload of external data files for risks, risk treatment, etc 2. Spell-check during data entry 3. Each risk shall contain the ability to link, correlate, cross reference, or identify dependencies between each or several risks 4. Each risk shall be able to be grouped multiple times under different risk categories, priority levels, and hierarchy levels 5. Ability to add, rename, modify or user-define fields 6. Ability to support and capture updates, reviews, tracking, monitoring, closing, audit trail and follow-ups C. Risk Reporting Risk reporting is a form of communication intended to address particular internal and/or external stakeholders, as well as, provide information regarding the current state of risks and their management. Listed below are risk reporting needs. 1. HTML Reports 2. PDF Reports 3. Ad Hoc Reports 4. Preformatted Reports 5. Custom Excel Reports 6. CSV Reports 7. Split Reports (text and graphical data on one page) 8. Filter & Sorting of Report Data 9. Scheduled Preformatted Reports with delivery to recipients 10. Exportable Preformatted Reports 11. Preformatted and Customizable dashboards 12. Heat maps for multiple risks at different levels 13. Ability to download to Excel, Word, Adobe, Power Point 14. Filters or key word search to customize and/or refine reporting 15. Risk profile 16. Executive summaries 17. Assessment summaries 18. Personalized views 19. Risk tools data (may include graphs, event trees, etc.) IR 4

14 D. Risk Administration Request for Information (RFI) Enterprise Risk Management Software Solutions Risk administration pertains to the capability to easily manage and adapt the tool to NYPA needs without vendor approval, intervention or support. This includes, but not limited to, the following: 1. Customizable work flow to align with risk management process designed for the Authority 2. Flexibility to alter terminology in software to align with risk management process designed for the Authority 3. Ability to upload documents such as multiple risks or mitigation plans at once 4. Template approach for risk record items 5. Select fields to be mandatory to proceed in workflow 6. Alerts to a dashboard or which can be set and or controlled by administration 7. Ability to load 1 or more frameworks 8. Customizable Risk Categories, Priority and Hierarchy number of levels 9. Ability to create FAQ sections and On-screen user help features 10. The software should allow transparencies between the Enterprise Risk and their client so details can easily be shared to validate accuracy 11. Logging of changes (Audit Trails of Specific Fields) 12. Scalable and Customizable Risk/Control Matrix E. Risk Security NYPA requires the capability to create and manage user access / security profiles similar to the following within the tool: 1. Super User Enterprise Risk Management Department 2. Administrator Add people, change passwords 3. Facilitator Input risk, view and reporting 4. Stakeholder Input risk, edit, and reporting 5. Executive Level Reporting 6. Views should be customizable depending on security level IR 5

15 Information Requested Request for Information (RFI) Enterprise Risk Management Software Solutions NYPA requests providers of Enterprise Risk Management software solutions to respond to this RFI with information as outlined below. 1. Provider Profile Describe the organization proposing the product / solution. Include provider information such as the following: a. Company name, address, city, state, zip code, telephone and fax numbers, web address, financial information, and background (such as number of years in business, nature of business, number of employees, client base, industry awards / recognition, awarding party and date received, experience in the government and/or utility sector, and any third party alliances, relationships, or dependencies) b. Primary contact name, title, address, telephone and fax numbers, and address 2. Solution Profile Detail the product / solution being proposed. a. Include information such as product name, release date of the original version, current version available, projected date for next product update, deployment options (hosted, cloud, on premise, etc), recommended deployment and why this would be advantageous b. Describe features / capabilities and identify functionality applicable to the requirements categories of Risk Data, Risk Features, Risk Reporting, Risk Administration, and Risk Security as defined earlier in the ERM Software Functionality Requirements section. Include the following as applicable: export capabilities, product limitations, compatibility, scalability, and third party integration capabilities c. Outline all software and technical characteristics of the proposed solution. Sample characteristics as follows: i. Software technology and architecture. This includes database(s), programming language(s), and type of user interfaces to manage and operate the tool, for example, role based, hierarchy, client application, web application, etc ii. iii. Environment & Network infrastructure including network devices, appliances, ports/protocols and speed of network lines; minimum and recommended specifications for servers/hosts, desktops and laptops; client operating system(s); operational system requirements for availability, storage, redundancy, and backup; mobile device capability and requirements; virtual environment supported Additional characteristics (such as operating systems, applications and licensing, maintenance, and third party integration) not included within the product but necessary for its operation 3. Assumptions / Exceptions State assumptions and/or exceptions relevant to the solution for consideration by NYPA 4. References Supply three (3) references from organizations utilizing a full implementation of the solution or comparable need as described in this RFI. Include name, location, contact information, description of use and date implemented IR 6

16 Request for Information (RFI) Enterprise Risk Management Software Solutions Providers are also requested to include in their responses a summary view, as illustrated below, of the above requested detailed information. Provider Profile: Solution Profile: Assumptions / Exceptions: References: Company Information: Contact: Product Information: Recommended Deployment & Why: Functionality: Software & Technical Requirements: Assumptions: Exceptions: Customer 1 Customer 2 Customer 3 Name, address, city, state, zip code, telephone and fax numbers, web address, financial information, and background Primary contact name, title, address, telephone and fax numbers, and address Product name, release date of the original version, current version available, projected date for next product update, deployment options (hosted, cloud, on premise, etc) Describe features / capabilities and identify functionality applicable to: A. Risk Data B. Risk Features C. Risk Reporting D. Risk Administration E. Risk Security Software Characteristics Technical Characteristics Additional Characteristics Name, location, contact information, description of use and date implemented IR 7