Enterprise Risk Management Software

The New York State Office of the State Comptroller (OSC) is seeking a cloud-based Enterprise Risk Management Software-as-a-Service (Solution) to replace its current manual risk assessment processes. Currently, OSC uses Microsoft Excel, Word, and Access to manage risk assessments, with reports generated through Tableau, which involves significant manual data manipulation. The primary objectives of this procurement are to automate risk assessment data collection and streamline risk reporting to executive management, while demonstrating compliance with the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Framework. The Solution will replace existing manual processes where business units report risks, corrective actions, and complete risk assessment questionnaires through spreadsheet templates and Word documents. Key deliverables include a comprehensive software implementation that integrates with OSC's current data management approach and provides automated reporting capabilities. The contract opportunity was posted on September 8, 2025, with proposals due by October 14, 2025, through OSC's discretionary purchasing authority under State Finance Law 163(6).

This procurement opportunity is exclusively limited to New York State businesses certified under two specific designations: Article 15-A of the New York State Executive Law (which typically relates to minority and women-owned business enterprises) and Article 3 of the New York State Veterans' Services Law (which likely pertains to veteran-owned businesses). While specific budget ranges are not explicitly stated, the comprehensive nature of the software solution suggests a significant investment in enterprise risk management technology. The current infrastructure involves manual data transfers between Excel spreadsheets, Word documents, an Access database, and Tableau reporting tools, indicating that the selected vendor will need to provide a robust integration solution. The procurement seeks a qualified contractor who can not only provide the software but also implement it effectively, replacing the current labor-intensive risk assessment and reporting processes. The Solution must demonstrate the capability to collect risk assessment data automatically, create streamlined reports for executive management, and ensure compliance with established risk management frameworks.