Supplier Q & A - 3

Revised 02/11/11 SPD-SPR004

Supplier Q & A -3

RFP Number: 47400-DOR0000056 RFP Title: Fraud Management Solution Requesting State Entity: GA Department of Revenue

Date: 03/17/15

Issuing Officer: Arnaz Fanning RFP Initially Posted to Internet: 02/27/15 eMail Address: Arnaz.fanning@dor.ga.gov Telephone: 404-417-2188

The purpose of this document is to provide answers to supplier questions.

Please see Questions and Answers included herein.

Note: This document is intended for informational purposes only. Any changes to the RFX must occur through a published addendum (or through publication of a new version of the RFX in Team Georgia Marketplace™). If multiple Q & A documents are posted, the most recent Q & A shall govern in the event of a conflict.

QUESTIONS AND ANSWERS

# Questions Referenced

RFX Section Answers

1.

Is GA DOR implying some sort of testing or pre-production environment? Or is this functionality intended to be incorporated into the live production systems?

eRFP: 1.1 Purpose of Procurement Item 1

This functionality is intended to be incorporated into the live production environment. DOR wants a way to view the full impact of changing rules before actually applying the change.

2. 2

Specifically what type(s) of information will be shared, what kind of accounts will be added and what is the preferred method to add these accounts and share the data between states?

eRFP. 1.1 Purpose of Procurement Item 4

The preferred method depends on the solution and its ability to integrate. Windows is DOR’s preferred platform and Secure FTP and Connect Direct are protocols used to securely transfer files. DOR is currently sharing Taxpayer, return and Tax Preparer information with other states today.

3.

What does GA DOR define as “tax fraud” vs. “Identity theft”?

eRFP. 1.1 Purpose of Procurement Item 5

DOR defines Tax Fraud as a Taxpayer’s intent to defraud the government by not paying taxes that are lawfully due or obtaining a refund that is not due.

DOR defines Identity Theft as a means in which someone wrongfully obtains, assumes and uses another person's personal data in some way that involves fraud or deception, typically for economic gain or benefit in that person’s name.

4. 4

Will the DOR require this functionality and configuration to be changed dynamically and frequently throughout the season, or will this eRFP. 1.1 Purpose of Procurement Item 6

The functionality and configuration will be changed dynamically and frequently throughout the season. The solution must integrate or easily interface with

RFX Section

Answers configuration be done rather infrequently? Will an interface for this functionality be required?

DOR's current Integrated Tax Solution application.

5. What type(s) of consideration will be given – monetary or otherwise – in exchange for releasing proprietary source code? Will this be an exclusive arrangement between the vendor such that source code will never be shared with any external entity and will be kept exclusively within the Georgia Department of Revenue?

eRFP 1.1 Purpose of Procurement, Paragraph 4, 2nd sentence

The option for DOR to request ownership of all source code will depend on the solution and its ability to easily integrate with the existing Integrated Tax Solution application.

6. Are any future requirements known at this time?

eRFP 1.1 Scope of Services Paragraph 1, 2nd sentence

No future requirements are known at this time. However, we always look for areas of opportunity

7. Can you expand on this requirement? Maybe give a specific example?

eRFP, 1.1 Scope of Services, item 3

DOR needs to be able to control customer response management and work prioritization.

8. Items 3 and 43 of the Mandatory Questions document speak to staff being on-site at a DOR facility. Please clarify if the project manager and all Offeror personnel need to spend so many hours per week on-site or what the expected frequency is.

DOR requires that the Project Manager and the development team to be co-located with our existing team at our Century Center location for the duration of the project including post-implementation support.

9. What type of data from tax returns and prior tax returns is being utilized to ascertain identity?

Mandatory Requirements

Any and all Taxpayer return information can be used to verify identity.

10. Are there any anticipated volumes of returns that will be part of this process?

DOR receives approximately 4.3 million tax returns annually and less than 5% are sent for identity confirmation

11. For joint filings, will both filers be verified?

Yes, both filers will be verified for joint filings.

12. Does the State currently leverage a web portal that presents questions to individuals in an online authentication process? If so, is this RFP seeking alternatives to the current process?

Section 1 Introduction – Scope of Services

DOR in the past has leveraged a web portal to present questions to individuals in an online authenticated process. We would like our new Fraud Management Solution to perform identity verification in a similar fashion with the use of a web portal being our preferred solution.

RFX Section

Answers

13. Will the selected vendor be asked to develop a new and/or support a current web user interface for the authentication process?

Section 1 Introduction – Scope of Services

The selected vendor will be asked to develop a new web user interface for the authentication process.

14. Does the State require a solution with the flexibility to have State personnel make immediate modifications to the questions without requiring vendor support?

Section 1 Introduction – Scope of Services

Yes, DOR requires a solution with the flexibility to have state personnel directly define, manage and govern the quiz in the Fraud Management Solution with the ability to control: Pass/Fail thresholds, the number of available quizzes, the wording of questions, the wording and number of false and correct answers, the number of "None of the Above" available/correct answers, quiz expiration criteria, and the length of time a taxpayer has to take the quiz without requiring vendor support. This will include the ability to define questions that are sourced from public records and will include the ability for DOR to define questions that are sourced from DOR internal databases.

15. Does the state expect to benefit from the ability to ask more robust KBA questions based on both financial and non-financial questions to eliminate data that “may” be associated with the consumer, which drives up false positives, or even in some cases false rejects?

Section 1 Introduction – Scope of Services

Yes, the state expects to benefit from the ability to ask more robust knowledge based authentication questions using both financial and non-financial questions.

16. Does the state require the verification process to include a direct 1:1 matching of data to consumer, with a zero tolerance for associating data to the wrong consumer?

Section 1 Introduction – Scope of Services

Yes, the state requires the verification process to include a direct 1:1 matching of data to consumer to verify identity.

17. Could you please elaborate on the requirement to share data among states? What data will be shared?

What accounts will be created manually? What data will be stored?

Section 1 Introduction – Purpose of Procurement

DOR currently leverage the Gentax Data Exchange and the FTA SFE (Suspicious Filers Exchange) to facilitate information sharing between states. Some examples of information being shared can range from Taxpayer entity data, return data and tax preparer information. DOR on

RFX Section

Answers occasions have created Taxpayer accounts manually based on insider information. The data to be stored will include Taxpayer and return data.

18. Can the State please provide examples of their current fraud workflow processes for each of their current users? This would provide Offerors a better understanding of the fraud management system being sought.

Section 1 Introduction- Subsection 1.1 Purpose of Procurement- Item #1

As returns are processed, internal /external data sources along with historical data and internal fraud rules are utilized for flagging potential fraudulent returns.

Further information regarding the current fraud workflow cannot be divulged in a public document without compromising the current DOR fraud management process.

19. In the Introduction section of the eRFP, it references that DOR is not considering a hosted solution, but then also references that records will be transmitted between DOR and the Supplier. Is DOR expecting the new solution and all associated data and rule processing to be entirely deployed and hosted on premises (NADC) or is DOR expecting that Supplier‐hosted commercially available data and services will used, requiring that relevant DOR data will be securely electronically exchanged with the Supplier outside of the NADC‐ hosted solution?

Can DOR please clarify which operations it expects to be housed (and secured) entirely in the state’s NADC operating environment and when they will require data to be transmitted between DOR and the Supplier electronically in a secure manner to invoke Supplier‐hosed services or to secure Supplier‐provided data?

Can DOR please clarify, therefore, those portions of the operations, data evaluation, and rules

The preferred method depends on the solution and its ability to integrate. DOR expects the data input to Fraud Management to contain Federal Tax Information. Therefore, any proposed solution would have to be hosted in an IRS 1075 compliant data facility. At this point DOR is not aware of any public cloud provider with IRS 1075 compliance.

RFX Section

Answers processing that will be performed at Supplier’s location (i.e., the offices and plants of the Offeror) and not at

NADC?

20. This description conveys that the ITS platform is currently delivering many of the very same capabilities contemplated for the FMS, including use of internal and external data sources, historical data, fraud rules, information sharing (including IRS, presumably), and a workflow. Will these features of the ITS continue to be used when processing returns after the FMS is implemented, or will they be replaced? How does DOR anticipate coordinating the “internal fraud rules” already implemented within the ITS and those of the FMS?

Yes, the existing features of ITS will continue to be used when processing returns after the implementation of the FMS. Coordination depends on the solution.

21. Should vendors conclude that the desired FMS capabilities listed on Page 1, as well as the objectives listed on Page 4, are not currently being met by the ITS or do not fully address the Department’s needs, and that is the primary motivation for acquiring a separate system to deliver these capabilities, in the form of the FMS?

In an effort to stay relevant with evolving fraudulent schemes we always need additional tools to detect fraud.

22. It is understood that the DOR has recently undertaken considerable steps to improve the compliance with employer‐reported electronic W‐2 data submission and that this data will play a large part in the new fraud rules of the FMS. Could DOR please explain where this data resides currently, how and with what regularity is it updated with new employer submissions, and how will the data be made available to the

FMS?

The data will be accessible through the Oracle Exadata Appliance. This information is updated regularly.

23. Is it expected that the new FMS will be the system that issues these

Mandatory Requirements

Please refer to requirement #41.

RFX Section

Answers letters, provides case management functionality, and manages case follow‐up activities (i.e., “work types”) related to the various fraud workflow processes, or will these letters, cases, and related fraud workflow processes be managed within the existing ITS?

If the various cases, workflow processes, and letters are to be issued from and managed within the existing ITS, how is it envisioned that the FMS will influence the various noticing, cases, and workflow processes in the existing ITS for the solution?

An Offeror that proposes a solution with open and defined integration/interface approaches to effect the necessary integration with the DOR’s current Integrated Tax Solution application can’t be assured that integration is possible without additional information related to how the assumed integration points will be supported by the Integrated Tax Solution, and this is outside of the Offeror’s control. Can the DOR please provide additional details regarding the assumed integration points and approaches with the Integrated Tax Solution application and the boundaries of responsibility for the Offeror for Requirement #41?

#41 The preferred method depends on the solution and its ability to integrate.

24. Is the expectation here to apply the rules to prior year returns for analysis or to apply the rules to current pending returns (e.g., for that day’s processing) and to analyze the population percentages and make a “user decision” before routing the returns to specific workflow actions?

Mandatory Scored Requirements #13

The expectation is to apply the rules to prior and current year return for analysis in a live production environment.

25. Given the nature of the subject RFP RFP Section The State will not consider waiving the

RFX Section

Answers and the fact that it is difficult for software vendors to secure the type of the sureties being required due to the proprietary nature of the industry, and if Offerors are proposing a previously developed and proven off the shelf solution (as opposed to a custom-developed from the ground up solution), would the State consider waiving the requirement for a performance bond or letter of credit or alternately consider a percentage holdback (perhaps like 15%) of the total price until the system is fully accepted?

3.2. Bonds

and/or Letter of Credit requirement for a performance bond or letter of credit.

26. Question #14 references “the ten

(10) unique data sources” and refers to question #33 which in turn references “at least fifteen (15) unique data sources.” Could DOR please confirm how many unique data sources DOR is expecting to use within the FMS?

Mandatory Scored Requirements #14 v/s Mandatory Scored Requirements #33

DOR expects at least 10 unique data sources.

27. Does the DOR expect the Offeror to present a defined set of data sources and assume that they will be included in project scope, or will the DOR present these defined data sources to the Offeror at the start of the project?

DOR expects the Offeror to present 10 unique data sources to be integrated with our existing sources.

28. Has the DOR already procured and assembled these sources, and can obtain updates to them over time, so that they are prepared for use in the upcoming filing season within the FMS? Can the DOR please provide that list of data sources so that Offerors may include their incorporation into FMS as part of the assumed project scope?

DOR has procured some sources and do receive updates. Further information regarding data sources cannot be divulged in a public document without compromising the current DOR fraud management process.

29. Could DOR please explain what information it is intending to share between states, i.e., all returns identified as potentially fraudulent or

DOR currently leverage the Gentax Data Exchange and the FTA SFE (Suspicious Filers Exchange) to facilitate information sharing between states. Some examples

RFX Section

Answers only those confirmed after some number of days?

Also, could DOR please explain what the “ability to add accounts manually and store data historically” means?

Where does DOR intend to add these accounts and for what purpose?

of information being shared can range from Taxpayer entity data, return data and tax preparer information. DOR on occasions have created Taxpayer accounts manually based on insider information. The data to be stored will include Taxpayer and return data.

30. With approximately only one (1) week between receiving DOR responses to questions and the proposal due date, and given the nature of some critical questions from the eRFP and how the answers may require adjustments to an Offeror’s response, would DOR kindly consider extending the due date, allowing at least four (4) weeks between the final responses to all questions and the proposal due date?

Unfortunately, no.

31. Also, would the DOR please consider allowing a short round of follow‐up questions, based on responses received to initial questions?

After the Offeror’s conference on March 18th, questions may be submitted through 4:00PM on March 23rd.