In April 2007, the Legislative Audit Bureau (LAB) completed A Review of
Information Technology Projects, Report 07-5 (report). The report provides a
detailed review of selected, high-risk information technology (IT) projects conducted
by executive branch agencies, other than the Board of Regents of the University of
Wisconsin System (agency or agencies). The report identifies the difficulties
agencies have encountered completing complex and costly IT projects within budget
and according to schedule. The report made a number of recommendations related
to planning for and monitoring IT projects pursued by agencies. The report
recommended that the Joint Committee on Information Policy and Technology
(JCIPT) be reactivated to exercise the oversight responsibilities recommended in the
report.

This bill adopts, with modifications, many of the recommendations of the
report. Specifically, the bill does all of the following:

---

1. Planning for IT projects in strategic plans. Under current law, each agency
must submit a strategic plan outlining the agency's use of IT to the Department of
Administration (DOA). The bill requires DOA to work with agencies to adopt written
policies. The written policies must establish a standardized reporting format for IT
projects that are included in the agencies' strategic plans and that either exceed
$1,000,000 or are otherwise vital to the functions of the agency. DOA must forward
a copy of the proposed policies for review by the Joint Legislative Audit Committee
(JLAC) and for approval by JCIPT.

2. High-risk projects and cost projections. The bill requires DOA, in
consultation with LAB and JLAC, to promulgate administrative rules applicable to
each agency that establish all of the following: (a) a definition of and methodology for
identifying large, high-risk IT projects; (b) standardized, quantifiable project
performance measures for monitoring large, high-risk IT projects; (c) policies and
procedures for routine monitoring of large, high-risk IT projects; (d) a formal process
for modifying project specifications when doing so is necessary because of changes
in program requirements; (e) requirements for reporting cost or time-line changes
to large, high-risk IT projects; (f) methods for discontinuing projects that are failing
to meet performance measures or modifying projects that are failing to meet
performance measures in such a way as to correct the performance problems; (g)
policies and procedures for the use of master leases to finance new IT system costs
and to maintain current IT systems; and (h) a consistent reference point in the
development of all large, high-risk IT projects at which an accurate estimate of the
costs and time line of the projects can be presented to DOA and JCIPT.

3. Use of commercially available IT products. The bill requires DOA to
promulgate administrative rules governing agency use of commercially available IT
products. The rules must include a requirement that, before an agency may initiate
work on a customized IT product, the agency must demonstrate to the satisfaction
of DOA why a commercially available IT product does not meet the needs of the
agency.

4. Use of master leases. Current law defines a master lease as an agreement
entered into by DOA on behalf of one or more agencies to obtain property or services
under which DOA makes or agrees to make periodic payments. The bill requires
DOA to, no later than October 1, annually provide to the governor and JCIPT a report
on IT projects funded in the previous fiscal year by master leases. The report must
include (a) the total amount paid towards IT projects under master leases in the
previous year; (b) the amounts approved to be paid towards IT projects under master
leases in future years; (c) the total amount paid by each agency on each IT project for
which debt is outstanding, together with a comparison of the total amount originally
approved for that IT project; and (d) a summary of repayments made towards any
master lease in the previous fiscal year.

5. Vendor contracts. The bill requires DOA and any agency that has been given
procurement authority by DOA to include a stipulation clause in any contract for a
high-risk IT project or an IT project with a projected cost of greater than $1,000,000.
The clause would require vendors to submit to DOA for approval by DOA any order
or amendment that would change the scope of the contract and have the effect of

---

increasing the contract price. The stipulation clause must also authorize DOA to
review the original contract and the order or amendment to determine whether the
work proposed within the order or amendment is within the scope of the original
contract or is necessary. The bill authorizes DOA to negotiate with the vendor
regarding any change to the original contract.

The bill also authorizes DOA or any agency that has been given procurement
authority to exclude the stipulation if all of the following conditions are satisfied: (a)
including the stipulation would negatively impact contract negotiations or
significantly reduce the number of bidders on the contract; (b) if the exclusion is
sought by an agency with procurement authority, the agency seeking the exclusion
submits to DOA a plain-language explanation of the reasons the stipulation is
excluded and the alternative provisions the agency will include to ensure that the
contract will be completed on time and within the contract budget; (c) if the exclusion
is sought by DOA, DOA prepares a plain-language explanation of the reasons for
excluding the stipulation and the alternative provisions DOA will include to ensure
that the contract will be completed on time and within the contract budget; and (d)
DOA or the agency seeking the exclusion obtains approval for the alternate
provisions from JCIPT.

6. Open-ended contracts. The bill requires each agency that has entered into
an open-ended contract for the development of IT to submit quarterly reports
documenting the amount expended on the IT project to DOA. The bill defines
"open-ended contract" as a contract for IT that includes one or both of the following:
(a) stipulations that provide that the contract vendor will deliver IT products or
services but that do not specify a maximum payment amount; and (b) stipulations
that provide that the contract vendor shall be paid an hourly wage but that do not
set a maximum limit n the number of hours required to complete the IT project. DOA
must compile and annually submit to JCIPT all reports it receives from agencies.

7. JCIPT review. The bill requires JCIPT to review all executive branch IT
projects identified by DOA as high risk or with an annual or projected cost of at least
$1,000,000 to determine whether the project should be continued or implemented.
DOA must submit semiannual reports to JCIPT. The reports must contain the
following information: (a) original and updated cost projections; (b) original and
updated completion dates for the project and any stage of the project; (c) an
explanation for any variation between the original and updated costs and completion
dates; (d) a copy of any contract entered into by DOA or the agency that has not
already been provided to JCIPT; (e) all sources of funding for the project; (f) the
amount of any funding provided for the project through a master lease; (g)
information about the status of the project, including any portion of the project that
has been completed; and (h) any other information requested by JCIPT about the
project or any related IT project.

In the event JCIPT is not organized, the Joint Legislative Audit Committee is
required under the bill to assume all of the responsibilities established for JCIPT
under the bill.