THE RFP PROCESS
• A Request For Proposal (RFP) is generally issued at an
early stage in the procurement process where an
invitation is presented to vendors to submit a proposal
on a specific product and/or service
• The RFP process brings structure to the procurement
decision and is meant to allow the benefits, risks and
costs to be clearly identified upfront
THE RFP PROCESS
• The RFP is only one component of the overall due
diligence process when reviewing potential vendors
• Before starting vendor due diligence and the RFP,
review NCUA Letter to Credit Unions No. 07-CU-13
(dated December 2007), and its enclosure, NCUA
Supervisory Letter No. 07-01 (dated October 2007)
both with the subject line of “Evaluating Third Party
Relationships”
THE RFP PROCESS
“Yeah, yeah, okay Lennie; where’s the meat & potatoes?”
“What goes in the RFP?”
THE RFP PROCESS
Section 1 – STRATEGIC DIRECTION
•
OVERVIEW – Brief paragraph on your credit union or CUSO (herein, CU shall mean
either credit union or CUSO) including name, quick history, where located, serving
who, how many members and/or households, number of locations, asset size,
type of charter, etc.
•
PURPOSE OF RFP – Who/what the CU currently uses (if applicable); explain how
the current process or product provides benefits (if applicable) and why the CU
seeks a new or a different solution. List the high-level strategic requirements the
CU is seeking in a bulleted manner unless you wish to number them in a
prioritization from most important to least important
THE RFP PROCESS
Section 2 – Administrative Requirements
•
Introduction – Name and contact information on the contact person at the CU
regarding the RFP
•
Schedule – All dates to include: release of RFP, RFP response Proposal due date,
selection of finalists, vendor presentations (at vendor and/or CU), selection of
vendor, contract finalization
•
Primary Contractor Responsibility – Mandatory that if vendor outsources and/or
procures products/services from other vendors, the primary RFP vendor will provide
all other required information/documents, etc. from “sub-contractor vendors” and
act as an aggregator for the entire solution
THE RFP PROCESS
•
Proprietary Material – Mutual Confidentiality Agreement(s) between CU and vendor
on all proprietary information and “trade secrets” to also be binding on “subcontractor vendors” of primary vendor; proprietary information should be marked as
such in the RFP and the vendor’s subsequent Proposal
•
Rejection of Proposal – CU reserves the right to reject the Proposal at any time
without reason or cause and without any penalties - monetary or otherwise
•
Incorporation of RFP and Information in Contract – The RFP, its appendices and
amendments, and all promises, warranties, commitments and representations
made in the Proposal shall be binding and become part of the contractual
obligation
THE RFP PROCESS
•
Proposal Format – Vendor will be required to complete all tables, questions, and user
requirements requested in the RFP
•
RFP Evaluation Requirements
Functionality: As demonstrated by vendor’s response to CU’s requirements in RFP
Technical Architecture: Vendor’s systems and compatibility with CU’s systems
Vendor Strength: Vendor’s management’s approach, expertise and capability as
described in Proposal
Risk: Vendor’s ability to mitigate technological, conversion, operational and other
applicable risks
Financial Specifications: Vendor’s financial strength, stability, flexibility, and ability to
withstand economic downturns
THE RFP PROCESS
Section 3 – Vendor Information & CU Requests
•
General Information (for vendor to complete) - Company name, address, general contact
information, website address, specific contact’s name & title & his/her contact info
•
Vendor company overview, major products/services, other companies/entities the
vendor owns or is owned by, etc.
•
Vendor’s mission, vision and overall strategy
•
Length of time in business? Time offering this particular product/service?
•
Vendor’s Annual Reports or financials, audited if possible
•
Publicly traded? What is ticker symbol, what exchange traded on and when did company
go public?
•
What is future direction of vendor’s products/services and how will that benefit CU?
•
Total customers? Customers acquired in last one-, two- and three-year periods?
THE RFP PROCESS
•
Customers (preferably CUs) vendor has that are similar in size, scope, and business
model of CU providing RFP?
•
Any awards, media articles, independent benchmarking or independent assessments of
vendor’s products/services?
•
Vendor’s number of employees? Org Chart?
•
Does vendor sponsor conferences, seminars, workshops, etc., to enhance best practices
when using/selling its products/services?
•
Is vendor SAS-70 Type II or equivalent certified? (Please provide copy of certification.)
•
Applicable warranties or guarantees from vendor? (Product related and/or service
related to include Service Level Agreements and potential vendor penalties if vendor’s
Service Level Agreements are not met? Any gross and/or net revenue guarantees to CU?)
•
Describe training process in detail: who, where, when, how often, how/when do you train
new employees hired by CU, etc.? Can training be customized for CU?
THE RFP PROCESS
•
What is revenue payment schedule to CU?
•
What tracking reports provided to CU? Can they be customized for CU? Can they also
be individualized down to a branch(es), other location(s), department(s), division(s)
or individual employee(s) level at CU? Note: This is very useful for sales tracking,
promotions, recognition awards, contests, etc. at the CU.
•
What is/are the distribution channels for this product/service the vendor can and
will support--face-to-face, website, Skype, audio/video kiosk, telephone, mobile
applications, etc.? Does vendor support e-statement, 24/7 info such as market
values of investments, electronic signature of all (or some) documents to purchase
product/service, i.e., what can be done anywhere & anytime and what can’t?
•
Is the product/service scalable?
•
Can the product/service be personalized by the CU or the CU’s members?
THE RFP PROCESS
Section 4 – Product/Service Information
•
Here is where CU lists everything the product/service must do/meet the needs of,
etc. and vendor responds on each and every requirement (this is where a table
works well). List functional, administrative, reporting and technical requirements
as applicable.
•
How does product/service meets needs of CU?
•
What are the hardware/software requirements?
•
Pricing: Per transaction, or monthly fee, or one-time software purchase, or other,
or a combination of these?
•
Implementation timeline at CU?
THE RFP PROCESS
Section 5 – Security Considerations
•
Vendor must describe in detail how the products/services and vendor maintains
compliance with all state, federal, applicable regulatory entities, and organizations having
jurisdiction over the vendor, the vendor’s industry, the products/services, etc. Has the
vendor or the vendor’s subcontractors ever been fined, sanctioned, or otherwise
admonished for any violations?
•
Does vendor have a written Information Security Program/Policy (include copy with the
Response)?
•
Does vendor have a written risk management program and if yes, is it updated at least
annually?
THE RFP PROCESS
•
Is all data encrypted both in databases and in transit? Describe methods that NonPublic Personal Information (NPI) is protected. Has a breech ever occurred (provide
details).
•
Does vendor have written Business Continuity Plan and/or Disaster recovery Plan? Is it
tested at least annually and can we see copy of most recent results?
•
Describe compliance (methods, processes, oversight, testing, audits, etc.) with the
provisions, laws and regulatory requirements of GLB, FinCEN, BSA, AML, OFAC, etc.
THE RFP PROCESS
Some Final Thoughts…….
•
The NCUA and states’ DFIs are mandating and auditing credit unions for vendor due
diligence “up front” as well as their ongoing review of existing vendors and business
partners (suggested annually)
•
The NCUA wants to have the regulatory jurisdiction to audit CUSOs, too
•
There is no such thing as “set it and forget it” with vendors you are currently using. You
must demonstrate ongoing oversight and replacement if warranted
•
The RFP, as part of your robust due diligence effort, will help you identify the business
partners your credit union or CUSO will be best served by today and tomorrow…….
“Measure twice and cut once!”