R I S KS I N P U B L I C P R O C U R E M E N T2 0 1 7 A G E N C Y P U R C H A S I N G C O N F E R E N C E

P R E S E N T E D B Y : J I M M Y M E A D O W S , G E N E R A L C O U N S E L

RISK

•What is it? •Where is it? And what can you do about it?

RISK DEFINED

• Probability that the expected outcome will not occur.

– Expectation – Project completed on time

• Risk – Project gets delayed.

– Expectation – Product will meet the intended need

• Risk – Product malfunctions or is unsuitable

RISK DEFINED• Loss of time or money (increase in liability)

– Example: Vendor personnel get hurt on the job

– Example: Vendor destroys state property

– Example: Vendor delay or slowness causes project timeline to be extended delaying government services to citizens

– Example: Vendor database of State personal information is hacked

RISK DEFINED

• Potential negative consequences associated with a given action.

– Example: Vendor violation of law causes multi-agency investigation

– Example: Vendor failure leads to bad press and political consequences

– Example: Vendor data breach leads to regulatory fines and unplanned costs

RISK ALLOCATION

• Less Risk on Vendor = Lower Price

– Is lower price worth the risk?

– Does less risk for the vendor always mean higher risk to State?

RISK ALLOCATION

• Some risk may be uncertain in contractual terms but it will always be fully allocated when something goes wrong.

– Example: Vendor has minimum auto liability insurance, vendor employee hits someone while working for agency, and damage is greater than insurance. Who shoulders the burden of that unallocated risk? Vendor? State? Society at large?

RISK ALLOCATION

• Best Practice – Allocate as much as possible up front.

• How?

– Spec Drafting

• FOB Destination

• Insurance Mandates

• Bonding

• Delivery Schedule with Time is of the Essence

• Security Requirements

RISK ALLOCATION

• Every Negotiation is an exercise in either risk allocation/shifting or profit maximization/cost reduction. (State has limited ability to do this)

– Negotiation as Risk Allocation

• Limitation of Liability

• Use of WV-96 as negotiation tool

RISK ALLOCATION

• Risk allocation up front leads to better results in competitive bidding and contracting.

– Vendors know what to expect

– Vendors pricing is more accurate and comparable to others

RISK ALLOCATIONExamples of Risk Allocation:

– FOB Destination – Delivery Cost and Risk on Seller

– FOB Shipping Point – Delivery Cost and Risk on State

• FOB Shipping Point represents a higher cost and risk to the State and must be accounted for in outgoing solicitation or Vendor proposing this is disqualified.

– Mitigation: State default is FOB Destination

RISK ALLOCATION

Examples of Risk Allocation:

– Solicitation mandates delivery in 45 days with liquidated damages of $500 per day after; Time is of the essence clause included, and vendor bid says will try to deliver in 45 days subject to manufacturer availability?

– What Do You Do?

RISK ALLOCATION

Examples of Risk Allocation:

– Price Escalation Clause or Price based on Index

• Risk of Price Change on State

• Mitigation: Not permitted without Purchasing Approval

• Ex: Gasoline, Finance Contract, Increases based on CPI

RISK ALLOCATION

Examples of Risk Allocation:

–Software Vendor includes provision attempting to limit liability to amounts paid under contract.

–What Do You Do?

TYPES OF RISK IN PROCUREMENT:

1. Bid Risk

2. Contractual Risk

3. Disclosure Risk

BID RISK 1. Need improperly identified

- Consequences:

• Ineffective product delivered

• Pay for more than is needed

–Mitigation•Discussion with end user•Determine need rather than want•Completion of Privacy Impact Assessment

BID RISK 2. Specs to Restrictive (cubic inches of glove box)

• Consequences:– No competition – No one meets specs causing rebid.

• Mitigation:– Better market research– Don’t favor brand or vendor

BID RISK 3. Specs too loose (Blue Car)

• Consequences:– Product may not meet need– Vendors price higher to account for vagueness

• Mitigation:– Better market research– Define the need

BID RISK 4. Failure to include required contract clauses

• Consequences:– Vendors refuse and rebid required– Problem develops and vendor fights over clause not included.

(Ownership of Intellectual Property)– Other agency kills the project (labor, capitol building commission,

etc.)

• Mitigation:– Use Standard Template and T’s and C’s– Communicate with Legal Staff– Heed advice of Purchasing Buyer

BID RISK 5. Improper communication and/or collusion

• Consequences

– Rebid

– Criminal penalties

• Mitigation

– Observe the blackout period

– Immediately disclose the violation, cancel the solicitation, and rebid

BID RISK 6. Mistake or improper award

• Negative Consequences

– Vendor protest

– Lawsuit

– Political Issues

• Mitigation

– Include Non-conflict form

– Properly evaluate bids

– Reverse Award

– Rebid

CONTRACTUAL RISK 1. Risk in Contract Formation

• Meeting of the minds failure

– Examples: Vendor fails to acknowledge addenda

– Examples: Is reactivation after power outage included in maintenance

– Mitigation

• Addenda acknowledgment

• Vendor signature on bid

• Clear scope of work

• Unenforceable or illegal terms included in contract

– Example: choice of law, liability limits, etc.

– Mitigation:

• Legal review

• Utilize WV-96

• Use Standard Terms and Conditions

CONTRACTUAL RISK 2. Price/Cost Variation

• Firm fixed price = most risk on vendor / low risk to State. – Negative: Vendor not adequately compensated and breaches contract– Mitigation: Breach of contract suit

• Price escalation = risk shifted to State– Negative: State’s Price Increases Significantly– Mitigation: Prohibited without State approval in solicitation

• Cost plus contract = risk shifted to State.– Negative: Vendor has no incentive to control cost

CONTRACTUAL RISK 3. Performance (Quantity)

– Exact quantity = lowest risk possible to all parties.

– Estimated quantity: establishes reasonable expectations

• Negative: Vendor cannot supply quantity required (Road Salt)

• Negative: Vendor not happy about quantity ordered (lawn maintenance contract)

– No quantity is highest risk possible to all parties.

CONTRACTUAL RISK 4. Performance Risk

– Vendor fails to fulfill contractual obligations

• Ex: Sundial Refuse Pile

• Mitigation:

– Performance bond

– Retainage (wvOASIS)

– Breach of contract suit

– Vendor fails to pay subcontractors (Not exactly performance risk since dispute not with contracted party)

• Ex: Various claims on labor bond

• Mitigation: Labor & Material payment bond

CONTRACTUAL RISK 4. Performance Risk

– Vendor fulfills all obligations but is late in doing so.

• Ex: Car dealer can’t make delivery deadline

• Ex: Accounting Auditor doesn’t submit report timely

• Mitigation:

– Liquidated damages

– Time is of the essence clause

– Vendor performs in a way that causes harm to others.

• Ex: Vendor damages neighboring building

• Mitigation: Insurance

• Ex: Vendor allows personal information to be taken

• Mitigation: Cyber liability insurance

DISCLOSURE RISK FOIA Requirements

– State obligated not vendor

• Problem: legal fees paid by loser

• Mitigation: Purchasing Division Defaults to Disclosure

• Example: Charleston Gazette Lawsuit

– Violation of Trade Secrets Act

• Problem: whole bid marked confidential/trade secret

• Mitigation: Notice of Public Document in T’s and C’s

• Example: Lottery Bid for New System

DISCLOSURE RISK FOIA Requirements

– Protected information disclosed

• Problem: Violation of law requiring lack of disclosure

• Mitigation: Cyber liability policy or shift risk to vendor

• Mitigation: Privacy, Security, Confidentiality clause• Example: SSN’s disclosed in hacking

– Private emails disclosed to public.

• Problem: Embarrassing or detrimental email disclosed

• Mitigation: Momma’s advice• Example: Disagreement with prior AG attorney

DISCLOSURE RISK Privacy Protections

– HIPAA

• Problem: Cannot disclose PHI and penalties for failure

• Mitigation: BAA assigns risk to vendor• Example: Many DHHR contracts

– Social Security Numbers

• Problem: law prohibits disclosure of SSN’s

• Mitigation: advise agencies not to request, Purchasing Staff Review bids, Notice of Public Disclosure, Privacy Security, Confidentiality Clause

• Example: Bidders include SSN’s of employees

PURCHASING EFFORTS TO HANDLE RISK

– Standard Terms and Conditions

– Templates

– Forms like addendum acknowledgement

– Risk Assessment

– Business Associate Addendum

– Privacy Security Clause

– FOB Destination

– Training

OTHER CONSIDERATIONS:COMMON INSURANCE TYPES

– Commercial General Liability – insurance issued to business entities that covers bodily injury, property damage, limited contractual liability, and products liability

– Auto Liability – insurance to cover vehicle accidents and can be full coverage or liability only

– Professional/Malpractice/Errors & Omission – insurance to cover economic and financial loss caused by professionals (lawyers, doctors, engineers, architects, etc.)

COMMON INSURANCE TYPES– Commercial Crime & Third Party Fidelity – Insurance to

cover commercial crime and/or theft by employees

– Cyber Liability – Insurance to cover damage arising from breakdowns, system failures, etc. and also includes privacy breaches.

– Builders Risk - insurance that protects materials, fixtures and/or equipment being used in the construction or renovation of a building or structure as well as the structure itself during construction.

COMMON INSURANCE TYPES – Workers Compensation – insurance to pay compensation and

benefits to injured workers. It is required by law of companies with employees.

– Umbrella – insurance that increases limits set by insurance that a company already has in place. It does not add additional areas of coverage.

– Renter’s Insurance – Provides insurance on a tenant’s personal property kept in a leased facility.

– Garage Liability – insurance on vehicles stored in a garage or other facility and generally covers damage caused to those vehicles when owned by someone other than the garage owner.

OTHER CONSIDERATIONS:BUSINESS ASSOCIATE ADDENDUM

– Established by the State’s Privacy Office

– Agency responsible for inclusion in solicitation

– Must properly identify protected health information (All PHI is not sufficient)

– Don’t just throw it in there

• If included and it doesn’t need to be then vendor thinks there is more risk than actually exists and will increase prices.

– Talk to your agency privacy officer

OTHER CONSIDERATIONS:RISK ASSESSMENT

– Constitution prohibits taking on liabilities of another

– Risk Assessment proves this won’t happen

– Elements of Risk Assessment

• Risk

• Cost of Risk

• Probability of Risk

• Total Risk Value

• Total liability limit

• Risk Value must be less than liability limit

C O N TAC T U S• Don’t forget to sign the

attendance sheet.

• Jimmy Meadows

• 304-558-8806

• James.D.Meadows@wv.gov