1. 1 Report from the Multi-State Consortium of the National Association of State Comptrollers Pat OConnor NASC Association Director NASACT

2. 2 The Idea In August 2006, Steve Allison, then deputy state controller in Idaho, proposed that NASC organize a group to explore the possibility of developing or acquiring a Web-based internal control tool that would meet states needs. The members of NASC endorsed the idea.

3. 3 The Problem Many states have in place manual and outdated internal control systems which are cumbersome and use old technology. These systems require a significant amount of effort to use and agencies perceive no direct benefit from using them. It seems that state agencies are making limited use of these systems, if they are using them at all.

4. 4 A Possible Solution Investigate a Web-based internal control tool that would: –Be easy to use. –Be customizable for individual agencies. –Provide a better understanding of the value of internal controls. –Give agencies value in return for their efforts (including better business processes).

5. 5 NASCs Role Form a Multi-State Consortium to: –Define the requirements of compliance software. –Examine off-the-shelf solutions. –If appropriate, consider the development of compliance software specifically for state (and local) government.

6. 6 Getting Organized The Consortium started with about ten members from seven states, and now has 28 members from 13 states. The group developed a vision and mission statement. It also developed a tool for evaluating the software demonstrations and a list of questions for software vendors.

7. 7 Getting to Work Rob Garagiola (Deloitte) provided the Consortium with a list of compliance management technology vendors. Some solutions focus specifically on Sarbanes-Oxley requirements, but others do not. The group viewed demos from seven vendors.

8. 8 Checking out Vendors Vendor Software Demonstration 80-20Leaders4 GRC SolutionMarch 15, 2007 CertusCertus 404/302February 8, 2007 IBMSarbanes- Oxley AcceleratorFebruary 22, 2007 OpenPagesFinancial Controls ManagementJanuary 25, 2006 Paisley ConsultingRick NavigatorMarch 8, 2007 SAP SAP Process Controls 2.0March 1, 2007 StellentStellent Sarbanes-Oxley SolutionDecember 19, 2006

9. 9 General Findings The software is very robust, maybe too robust for some states purposes. The software is expensive, as licenses are typically priced per user, and states contemplate users numbering well over one hundred. Vendors indicated that prices would go down with increased volumes (perhaps several states buying together).

10. 10 State Projects Massachusetts has developed and is using an Internal Control Questionnaire. Virginia has started a program, Agency Risk Management and Internal Control Standards.

11. 11 Decision Time The Consortium is now considering several alternatives: –Going through NASACT with an RFP. –States partnering to build something themselves. –Building upon Massachusetts Internal Control Questionnaire.

12. 12 Further Information Minutes of the Consortiums conference call meetings are posted on NASACTs Web site, www.nasact.org (Members Only, Committee Info, NASC Committees).www.nasact.org To find out more about the Consortium or to join the group, contact Pat OConnor at 859-276-1147 or at poconnor@nasact.org.