4-Attachment C Scope of Work.docx

Scope of Work #KK26-6 Attachment: C

1. Introduction The Division of Finance seeks to procure a comprehensive, cloud-based travel and expense management system that will support all State employees in planning, booking, and reconciling official travel. The system must integrate travel booking, expense reporting, policy compliance, reporting/analytics, and administrative controls into a unified solution. The contractor will provide system implementation, ongoing support, maintenance, and upgrades to ensure uninterrupted service throughout the contract term.

2. Background The State of Utah currently utilizes SAP Concur as its travel and expense management platform. This system has provided robust capabilities for travel booking, expense processing, reporting, and compliance. With the current contract set to expire, the Division of Finance is seeking to establish a new contract that will either continue with the current system or transition to an equivalent solution that can provide comparable functionality.

Pursuant to Utah Administrative Rule R33-104-103, this solicitation references SAP Concur for descriptive purposes but invites responses from all vendors able to provide an equivalent system meeting the functional, technical, and performance requirements outlined in this Scope of Work.

3. Scope of Work The contractor shall deliver a travel and expense management system that includes, at minimum, the following core modules and services:

3.1 Travel & Expense Professional Module

· End-to-end travel booking and expense reconciliation.

· Configurable policies and approval workflows.

· Mobile access, receipt imaging, and personal mileage tracking.

· Configurable mileage rates to support standard and state-specific rates (e.g., business vs. personal mileage, two distinct state rates).

· Compliance with U.S. General Services Administration (GSA) per diem allowances.

· Integration with approved Travel Management Companies (TMCs).

3.2 Intelligence (Reporting and Analytics)

· Real-time dashboards and standard reporting tools.

· Downloadable and customizable reports for spend analysis, compliance, and trend monitoring.

· Capability to export reports to Excel, PDF, or other commonly used formats.

· Capability for end user supervisors to view direct and indirect report travel and expense data.

3.3 Request Module (Pre-Travel Authorization)

· Pre-travel approval functionality.

· Configurable forms, audit rules, and workflows.

· Linkage between request, booking, and expense reconciliation.

· Request documents and all information need to be transferred over to the expense report.

3.4 Advanced Care (Enhanced Support Services)

· Priority technical support with defined service levels.

· Dedicated account management and advisory support.

· Assistance with upgrades, configuration changes, and system optimization.

3.5 Additional Environments

· Capability for a separate environment for testing new configurations, workflows, and upgrades prior to production release.

· Accessible by administrators for training and troubleshooting.

· Ability to refresh/copy production data into the sandbox environment at least quarterly (4 times per year).

· Sandbox must be accessible to all employees via SSO.

· Capability for a completely separate disaster recovery environment that mimics production. If not available, the vendor must supply their disaster recovery plan including the Recovery Time Objective (RTO).

3.6 Scalability and Transactions

· Ability to handle approximately 65,000 transactions annually with base allotments and incremental transaction pricing.

· Transparent reporting of transaction counts and costs.

4. Requirements

· Cloud Hosting: U.S.-based data centers with FedRAMP or equivalent compliance.

· In compliance with the Utah terms and conditions, where the product does not already have a FedRAMP or verified GovRAMP status, the following provisions apply:

· At the time of contract execution, the product must be enrolled in the GovRAMP Progressing Snapshot Program and remain in the program until a verified status is achieved.

· The product must achieve a verified status of GovRAMP Core no later than 12 months after the date of contract execution and achieve a verified status of GovRAMP Moderate Authorized no later than 24 months after the date of contract execution.

· If the Contractor fails to maintain or achieve the security requirements outlined above, the Contractor may be subject to liquidated damages and/or the State of Utah may reevaluate the terms of the contract and determine whether the failure to comply justifies contract termination.

· Availability: 24/7 system access with 99.9% uptime.

· Integrations:

1. Solution must be able to integrate with ForgeRock Identity Cloud (SAML/OIDC), for Single Sign On authentication.

2. Capability to interface with State accounting and payroll systems supporting the import of employee/user data and the export of expense/reconciliation files through flat-file transfers, APIs, or web services.

· Security: Data encryption (in transit and at rest), multi-factor authentication, and compliance with state and federal privacy standards.

· Support:

1. All vendor contractors providing maintenance and support must reside within the United States.

2. Advanced Care service levels, ticketing, and escalation processes with clear resolution timelines.

· Training: Administrator training, end-user guides, and knowledge base access.

5. Compliance

· Applicable state and federal travel regulations.

· State IT security and accessibility standards.

· AI capabilities for receipt processing, compliance auditing, and expense categorization, including dedicated administrator and end-user training and support.

· Reporting requirements for system performance, usage, and SLA adherence

· Records management and privacy regulations in Utah Code § 63A-19 (GDPA), Utah Code § 63G-2 (GRAMA), and Utah Code § 63A-12 (DARS).

· Specified role for auditors and access to reporting tools.

6. Project Deliverables

· Configured production system with Travel & Expense, Intelligence, Request, and Advanced Care services enabled.

· Sandbox environment for testing and training.

· Implementation and configuration plan with defined milestones.

· Administrator and end-user training materials.

· System documentation (technical and functional).

· Monthly and annual performance reports.

· Ongoing system maintenance and upgrades.

· Documentation of AI/ML data governance and training data sources.