Microsoft Visual Studio .NETCustomer Solution Case Study

GMAC Commercial Mortgage Reduces Cost of Sarbanes-Oxley Compliance by

OverviewCountry or Region: United StatesIndustry: Financial services

Customer ProfileHorsham, Pennsylvania–based GMAC Commercial Mortgage (GMACCM) has more than 3,200 employees and 100 offices, with operations in the United States, Asia, and Europe.

Business SituationGMACCM needed an approach that was more efficient than spreadsheets and file shares to document and track the testing of thousands of controls for compliance with the Sarbanes-Oxley Act.

SolutionRMC, a solution based on Microsoft® developer and server technologies, provides a central information repository and reporting environment for managing all types of risk.

Benefits 50 percent reduction in cost of

Sarbanes-Oxley compliance 70 percent savings in solution

acquisition costs Visibility into risk and controls

environment across entire

“RMC enabled us to reduce the initial cost of SOX compliance by close to 50 percent. Similarly, we’re targeting a 50 percent reduction in the effort required for ongoing SOX compliance.”Larry Dunn, Executive Vice President and Chief Operations Risk Officer, GMAC

Facing the need to track more than a thousand business controls and manage several times as many documents for compliance with the Sarbanes-Oxley Act, GMAC Commercial Mortgage (GMACCM) knew that it would need more than spreadsheets and file shares. Risk Management Compass (RMC), developed using Microsoft® Visual Studio® .NET 2003 and the Microsoft .NET Framework, gives the company a comprehensive and robust solution for mapping, assessing, managing, and reporting on all risk categories. GMACCM saved 70 percent by developing its own solution instead of purchasing one, and the solution’s rich functionality has helped the company to reduce the cost of Sarbanes-Oxley compliance by 50 percent. GMACCM now enjoys improved visibility into its risk and controls environment, as well as increased ownership and accountability from the people who play a role in it.

SituationGMAC Commercial Mortgage (GMACCM) is a part of General Motors Acceptance Corporation, the financial services arm of General Motors Corporation (GM). The company is a leading financial services provider for the global commercial real estate industry, with offerings that include lending; loan servicing; nonperforming loan and asset management; investment advisory services; and real estate investment banking, structuring, and distribution.

Like other public entities and their subsidiaries, GM and GMACCM must conform to two main components of the Sarbanes-Oxley Act (SOX) of 2002: Section 302, under which a chief executive officer and chief financial officer must certify quarterly and annual financial reports; and Section 404, which requires management to periodically assess and attest to the effectiveness of the firm’s internal controls. External auditors must then attest to and independently report on management’s assessment.

The SOX effort at GMACCM began in April 2003. Instead of viewing it as merely an exercise in compliance, the company saw an opportunity to develop a comprehensive, ongoing framework for risk management. In addition, GMACCM realized that newly emerging controls under Basel II and other European banking requirements also were vital to effective self-governance, meaning that whatever approach it took to meeting SOX requirements also had to support the broader scope of Basel II, including the management of credit, market, and liquidity risk. Finally, as part of its

strategy for integrated risk management, GMACCM wanted to put data stewardship and quality—traditionally areas of IT focus—under business ownership.

GMACCM already had a sound internal controls environment in place, but the information about that environment was being managed using spreadsheets and file shares—an approach that provided poor visibility into status, progress, ownership, and exceptions. To implement a more sustainable and ongoing approach to risk management, the company needed a solution that could provide:

A logical and hierarchical framework for breaking down business processes into activities, associating risks to those activities, documenting the controls that mitigate the risks, and capturing evidence that the controls are in place.

Support for all GMACCM risk categories, including credit, market, liquidity, and operations.

Visibility across all business processes and at all organizational levels, including real-time reporting and built-in workflows for exception resolution.

Support for collaboration by team members in different locations, including the capability for GMACCM business users to work together with the company’s external auditors.

Rapid and cost-effective implementation, including

“Our risk and controls staff have become better communicators because they now work in a consistent framework and can easily visualize testing data, exceptions, and resolutions.”Larry Dunn, Executive Vice President and Chief Operations Risk Officer,

integration with other business systems.

“Most of the commercially available solutions that we examined were little more than electronic filing cabinets—essentially document management systems that had been repositioned as SOX solutions,” says Larry Dunn, Executive Vice President and Chief Operations Risk Officer at GMACCM. “They didn’t offer much in the way of reporting or analytics, which is critical, considering that under Section 404 one of the opinions expressed by external auditors is on the ability of management to assess their own controls environment. None of the solutions we looked at could support the holistic, integrated approach to risk management that we envisioned.”

SolutionRisk Management Compass (RMC), the first phase of which was developed in four months by GMACCM sister company GMAC Commercial Mortgage Technology Europe Limited (GTEL), is a comprehensive solution for mapping, assessing, managing, and reporting on all risk categories. It was built using the Microsoft® Visual Studio® .NET 2003 development system and runs on the Microsoft .NET Framework—an integral component of the Windows® operating system that provides a programming model and runtime for Web services, Web applications, and smart client applications.

“As business sponsor for the project, I had to consider the question, ‘Should we build or buy?’ ” says Susan Rogers, Senior Vice President for Enterprise Risk Management at

GMACCM. “With the .NET Framework, we knew that we could build a very flexible and scalable solution in a short amount of time.”

Development of RMC started in early 2004. Within six weeks, GMACCM had a pilot solution up and running, including a first set of management reports. The delivery of version 1.0 took an additional six weeks, and the solution went into production in June 2004. “From the moment we entered pilot phase, the value provided by RMC continued to grow,” says Rogers. “What sold our executive team was the ability to see overall status at a glance and easily drill down into the details and the people accountable for any given item. Everyone agrees that there’s real value in a solution that makes it easier to identify, manage, measure, and reduce risk on an ongoing basis.”

How It WorksRMC provides a framework and tool set that supports GMACCM’s integrated approach to risk management. Risks associated with business activities and the controls to counteract those risks are identified through a process of Control Self-Assessment (CSA)—a series of workshops that are recommended by The Committee of Sponsoring Organizations of the Treadway Commission. Output from those CSA exercises is entered into RMC, which is then used for the assessment, testing, and monitoring of the controls that are put into place.

Data can be loaded into RMC in two ways: directly through its built-in administrative screens, or by importing and exporting Microsoft

“As business sponsor for the project, I had to consider the question, ‘Should we build or buy?’ With the .NET Framework, we knew that we could build a very flexible and scalable solution in a short amount of time.”

Office Excel® spreadsheets. The second method works like this: RMC exports spreadsheets that include drop-down text boxes for region, user roles, assignment of validators and reviewers to controls, and so on. Once populated, those same spreadsheets are then imported back into RMC, and the newly entered data is loaded into RMC’s database.

Security for RMC is role-based. Data can be secured at various organizational levels, including region, department, and so on. Every business unit has its own home page within RMC that shows the people involved in risk management and their responsibilities. RMC presents a personalized view that is tailored to each user’s role, so that users see only the data that they are authorized to view. The customized views are intuitive, visual, and designed to deliver timely and relevant information based on the workload and role of each user.

Validators and reviewers of controls see a Web-based workspace. An Inbox shows the tasks that they have to perform, which are color-coded based on when the tasks need to be completed. Clicking an Inbox item opens a control validation window, which provides guidance on how to validate that control. While performing that validation, the user can add comments and upload supporting documentation, which is passed—without any user intervention required—to the company’s Epitome document management system. RMC also integrates with the company’s PeopleSoft HR system to update user data on a nightly basis.

Sophisticated workflow capabilities are built into the solution. Users receive e-mail notification when new or changed items arrive in their RMC Inboxes, and management receives similar alerts when a user marks a control as “cannot validate” or “validated with exception.” Users can note potential issues or flag items for management reassessment, as may be needed when business processes change.

A “rollover” feature saves time each quarter by allowing GMACCM to archive the current status of all work and reset controls to a prevalidated state. RMC stores a history of previous versions of the control environment along with associated documentation, action plan details, and an audit trail of collaboration and communication among reviewers, validators, and the CSA department. This complete history provides users, and more importantly auditors, with full visibility into the life cycle of the controls environment.

Figure 1. Risk Management Compass (RMC) provides an intuitive, visual dashboard that lets GMACCM executives easily monitor progress toward SOX

RMC also includes extensive reporting capabilities, allowing users to view data in many ways. Executives see a visual, Web-based dashboard (Figure 1), which helps them discern overall status at a glance. Clicking dashboard items provides more detailed views, allowing executives to quickly see where problems exist and determine who is accountable. Users can choose from predefined reports or create their own ad hoc queries, and can easily export those reports to formats such as XML, Excel files, or Adobe Acrobat files. For Section 302 attestation, RMC creates a snapshot of current status as an Adobe Acrobat file.

Progress to DateGTEL has continually enhanced RMC since delivering an initial version in mid-2004. Version 2.0 was released in

September 2004, followed by version 3.0 in 2005. Version 3.1 marked the first version of RMC that GMACCM released as a commercially available solution—a move consistent with the company’s history of commercializing internally developed IT assets. GMACCM and GTEL recently began working together to define a new module, which will address the risks associated with disruption of business continuity.

The RMC installation at GMACCM has approximately 300 total users, including roughly 100 concurrent users on any given day. Those numbers are increasing; the company recently made the solution available to its entire management team.

Some other measurements that help illustrate the scope of the solution’s use at GMACCM include:

1,600 SOX-related controls, with four to five documents per control

600 additional controls related to Basel II (expected to grow to 3,000 to 4,000)

164 business processes, 19 of which are critical accounting estimates

Four primary locations (two in North America, one in Asia, one in Europe)

24 applications in scope

Close to 80 percent balance sheet coverage (which surpasses the expectations of external auditors)

BenefitsRMC has helped GMACCM to successfully meet Sarbanes-Oxley

requirements, with all major milestones achieved one to three months ahead of schedule. Furthermore, the solution’s flexibility will allow the company to manage the full spectrum of operational risk.

“At GMACCM, we believe that everyone is a risk manager,” says Dunn. “Our goal is not to create more bureaucracy, but rather to implement effective risk management within the framework of our everyday operations. With RMC, we can map business processes, activities, risks, and controls in extensive detail, easily track their status, and tie that status to the departments and people in our organization in a holistic manner.”

Reduced Sarbanes-Oxley Compliance CostsAlthough RMC is expected to deliver value far beyond achieving SOX compliance, GMACCM has seen significant cost savings in reaching that critical milestone. A large part of the savings came from reduced reliance on outside consultants. With RMC, GMACCM was able to limit its reliance on external consultants to five people or fewer for four to six months, resulting in consulting costs of about U.S.$500,000. Dunn estimates that if the company had not deployed RMC, it would have needed three times as many consultants for 15 months, resulting in close to $4 million in consulting costs. Moreover, because GMACCM was able to limit the roles of consultants to documentation and process mapping, the company can keep knowledge in-house and reduce its long-term reliance on external resources.

Even with all costs factored in, the overall savings are substantial. “RMC enabled us to reduce the initial cost of SOX compliance by close to 50 percent,” says Dunn. “Similarly, we’re targeting a 50 percent reduction in the effort required for ongoing SOX compliance.”

Flexible and Cost-Effective Solution DevelopmentGMACCM also realized significant cost savings by building its own solution instead of buying one. “Visual Studio .NET 2003 and the .NET Framework helped us to build exactly what we needed quickly and cost-effectively,” says Rogers. “Instead of buying a modified document management system being sold as a SOX solution, we built a comprehensive solution for identifying and managing risk and connected it to an existing document management system. We now have a far richer solution than anything we could have bought—and were able to implement it at about one-third the price.”

The integration capabilities provided by Microsoft .NET technologies also helped GMACCM to build a solution that can connect to multiple databases, document management systems, and other enterprise systems, such as those for financials and human resources. Such flexibility makes it possible for GMACCM to resell RMC to other companies and realize an additional return on its investment.

“RMC was conceived and developed as a commercially viable product, with expert guidance from the risk management team at GMACCM,” says Will Gessner, Vice President of GTEL.

“With RMC, we can map business processes, activities, risks, and controls in extensive detail, easily track their status, and tie that status to the departments and people in our organization in a holistic manner.”Larry Dunn, Executive Vice President

“We have a solid product develop-ment plan that includes continued input from GMACCM, have closed business outside GMAC, and are pursuing a number of serious prospects.”

Improved Visibility and TransparencyIn the past, information on risks and controls was locked away on network shares, and employees had to manually assemble and update reports. Today, GMACCM manage-ment can instantly visualize the risk and controls environment at all levels of the organization. “There’s great value in being able to give a definitive answer on the status of our controls environment instead of having to respond based on faith that the manual reporting process is robust and accurate,” says Dunn. “I know for certain that all data is centrally maintained and that the testing status is consistently rolled over. We can focus on testing those controls on a quarterly and annual basis instead of manually sorting through thousands of documents to determine their status.”

RMC also makes it easier for managers to be more proactive. “When risks and controls are well understood, managers can more pro-actively address their areas of responsibility,” says Dunn. “RMC gives us a window into how we can improve by laying out the most critical processes and risks across the organization, which allows business managers to step back and look for areas of opportunity. With RMC, processes are so well defined and organized that managers can easily see the landscape of their

environments and direct their resources more efficiently.”

In addition, RMC has helped to improve communication and credibility by providing consistent documentation across all business units in the global organization. “Our risk and controls staff have become better communicators because they now work in a consistent framework and can easily visualize testing data, exceptions, and resolutions,” says Dunn. “Our external audit firm also enjoys a consistent and transparent view across the organization, which lends credibility to our internal controls environment and to our management’s evaluation of that environment. If we had chosen a commercially available solution instead of building our own, we would have had to build that credibility around a filing-cabinet approach.”

Increased Accountability and OwnershipRMC helps GMACCM manage people instead of just the documents they deliver. Because data from the company’s human resources system is integrated into RMC, managers can easily understand how the company’s risk and controls environment maps to its organizational structure, thereby reinforcing personal and organizational accountability. The solution also helps GMACCM to better connect its business with its IT infrastructure by providing views of how the company’s many technology systems relate to its business processes. (Approximately half of the 1,600 controls that were tested for SOX compliance are technical controls.)

“We now have a far richer solution than anything we could have bought—and were able to implement it at about one-third the price.”Susan Rogers, Senior Vice President, Enterprise Risk Management, GMAC Commercial Mortgage

“We get better support from business groups because they can get real-time reports on their own risk and controls environment any time they like,” says Dunn. “Through RMC, we’ve been able to demonstrate to management that there is real business value from a comprehensive approach to risk management. People are more motivated to document processes and to maintain that detail on an ongoing basis. The real measure of value will come next year, when we can compare the number of deficient controls with data from the previous year.”

(The remainder of this document describes the technical architecture of the solution and the challenges faced in building it.)

Architecture SynopsisRMC is based on a four-tier logical architecture, as illustrated in Figure 2. The solution was built using the Microsoft Visual Studio .NET 2003 development system and runs on the Microsoft .NET Framework. At peak, the solution development team consisted of 12 to 14 software developers, two to three business analysts, and two to three testers.

Microsoft software used in building RMC included Microsoft Windows Server™ 2003—the operating system foundation of Windows Server

System™ integrated server software—and Microsoft SQL Server™ 2000, which is also part of Windows Server System. Desktop software used in conjunction with RMC includes the Microsoft Windows XP Professional operating system, Microsoft Office Professional Edition 2003 (primarily Office Word for documentation and Excel for the importing of data and exporting of reports), and Microsoft Office Visio® Professional 2003 drawing and diagramming software for documenting processes.

Presentation LayerThe user interface (UI) layer of RMC is based on Web Forms, the classes in the .NET Framework for the development of rich Web-based solutions. This layer was developed using the Web Forms Designer in Visual Studio .NET and runs in the Microsoft ASP.NET environment under Internet Information Services (IIS) version 6.0, the built-in Web server in Windows Server 2003.

Altogether, the UI for RMC consists of some 70 to 80 Web pages, all of which are driven by style sheets. (GTEL brought in a design company to help optimize the UI’s look and feel.) The Web pages consist of custom controls, which are based on standard ASP.NET controls with additional properties added for validation, localization, and more. For instance, developers took a standard button and added behaviors that change the button’s label when it is clicked and prevent it from being clicked more than once. All controls reside on a base page that uses a page

Risk Management Compass (RMC)Presentation Layer(ASP.NET) Web page

User Controls

SQL Server 2000

FutureFuture

Integration Layer

Class Factory Pattern

File-based Epitome FutureFuture

File Server

Web page

Reporting Services Control

Business Logic Layer(Visual Basic .NET)

Data Access Layer

Class Factory Pattern

Data Access Application

Block for .NET

Caching Localization Security WorkflowSupport

DocumentManagement

System

Web page

User Controls

Figure 2. The RMC architecture uses a class factory pattern to facilitate flexible database access and integration with other systems.

controller pattern, allowing functionality such as localization and security to be inherited. Reports are rendered by a SQL Server Reporting Services control that runs within a container page.

Business Logic LayerAll business logic layer components are written in the Microsoft Visual Basic® .NET 2003 development language. Components within the business logic layer include those that support security, localization, caching, workflow support, data access, and integration with other systems. Some highlights of that functionality include:

Caching. Static, reusable data is cached at the business logic layer. Visual dashboard data also is cached because its retrieval can be fairly database intensive. Web page controls are bound to the caching layer, which in turn calls the database through the data access layer.

Localization. When the application starts, it queries the database for a list of localizable tags relevant to the requested language and stores them in its cache. Upon loading, the base page looks up those localizable tag names and passes them to its controls. This approach allows GTEL to localize RMC for new languages by exporting the tags from the database into an Excel spreadsheet and sending the spreadsheet off to a localization service.

Security. Application-level security is based on Microsoft Windows NT® authentication. GMACCM

authenticates users through the Active Directory® service, although RMC can connect with any directory service compliant with the Lightweight Directory Access Protocol (LDAP).

Workflow support. RMC currently supports e-mail–based workflows, which it does through the Simple Mail Transfer Protocol (SMTP) services in Windows Server 2003.

Data Access LayerRMC uses a class factory approach for database access. In the case of SQL Server, which GMACCM uses, the data access provider is based on Microsoft ADO.NET and the Data Access Application Block for .NET. (RMC also uses the Exception Management Application Block for .NET.) Other databases can be supported by porting the stored procedures used to access the database—a procedure that a third-party service could accomplish in a few weeks.

Integration LayerIntegration also is handled through a class factory approach, which promotes loose-coupling by eliminating the need to bind application-specific classes into the code, making it easy to extend and configure RMC to connect with new systems. A new .NET assembly is created and placed in the proper directory, and the web.config file is modified to use that assembly. RMC currently supports two types of document management systems: those that are file-based; and GMACCM’s Epitome system, to which RMC connects using a Web service. The importing of PeopleSoft data is handled by a Windows service, which

receives a nightly feed from the PeopleSoft system, moves the data into a flat staging table in the RMC database, and then loads the data into the solution’s primary database tables.

DatabaseThe database for RMC runs on Microsoft SQL Server 2000. GTEL designed the database from scratch, using the SQL Server Enterprise Manager for data modeling. To maximize security and performance, all database access is done through stored procedures—no inline Structured Query Language (SQL) is used. Reporting functionality is provided by SQL Server Reporting Services. Developers used the Report Designer add-in for Visual Studio .NET 2003 to create the solution’s predefined reports.

Technical ChallengesGTEL faced a few key technical challenges in developing RMC but has overcome them all. Some of the most important design considerations included a rich, visually intuitive user interface that shows overall status and the ability to drill down into details.Asynchronous Processing and IntegrationTo facilitate compliance with Section 302, RMC creates an Adobe Acrobat document that contains the current status of all controls under each individual’s responsibility. The original design used a Web service call to Reporting Services to render the document, followed by another Web service call to insert the document into the document management system. However, because of the large amount of data in those reports,

processing them synchronously took 2.5 minutes, during which time the user was prevented from doing anything else.

To avoid that delay, developers created a Windows service that handles the job asynchronously. The application places the request in a database queue polled by the Windows service, freeing the Web application to continue running. “With Visual Basic .NET, writing a Windows service is far easier and can be done in one-third the time that it used to take with Visual Basic 6.0,” says Mark Bate, Software Development Manager at GTEL.

Validation of Spreadsheet DataRMC allows users to build a controls framework in two ways: through Web-based administrative windows or by exporting and importing an Excel spreadsheet. What the technical team needed was a way to pass a set of rules into that spreadsheet upon exporting, so that the data entered by users could be validated right away. Otherwise, users would not know that they had entered invalid data until the data was imported back into RMC, creating extra work for all involved.

To address that challenge, developers used the XML mapping capability of Excel 2003. When RMC exports a spreadsheet, columns in that spreadsheet are mapped to XML elements that define validation rules. Excel then enforces the validation rules upon data entry, ensuring that any errors—such as a data value that is out of range—are immediately caught and presented to the user for correction. Implementing this

mechanism took one developer a few weeks.

Microsoft Visual Studio .NETThe Microsoft .NET Framework is an integral Windows component for building and running the next generation of applications and Web services.msdn.microsoft.com/netframework

Microsoft Visual Studio .NET is the rapid application development (RAD) tool for building next-generation Web applications and Web services. Visual Studio .NET empowers developers to rapidly design broad-reach Web applications for any device and any platform. In addition, Visual Studio .NET is fully integrated with the Microsoft .NET Framework, providing support for multiple programming languages and automatically handling many common programming tasks, freeing developers to rapidly create Web applications using their language of choice.

For more information about Visual Studio .NET, go to:msdn.microsoft.com/vstudio

To acquire Visual Studio .NET, go to:

For More InformationFor more information about Microsoft products and services, call the Microsoft Sales Information Center at (800) 426-9400. In Canada, call the Microsoft Canada Information Centre at (877) 568-2495. Customers who are deaf or hard-of-hearing can reach Microsoft text telephone (TTY/TDD) services at (800) 892-5234 in the United States or (905) 568-9641 in Canada. Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access information using the World Wide Web, go to: www.microsoft.com

For more information about GMAC Commercial Mortgage Technology Europe Limited (GTEL), visit the Web site at: www.clonmore.net/gtel

For more information about GMAC Commercial Mortgage, visit the Web site at: www.gmaccm.com

© 2005 Microsoft Corporation. All rights reserved. This case study is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Microsoft, Active Directory, Excel, the .NET logo, Visio, Visual Basic, Visual Studio, the Visual Studio logo, Windows, Windows NT, Windows Server, and Windows Server System are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.

Document published May 2005

Software and Services Microsoft Visual Studio .NET 2003 Microsoft Office System

− Microsoft Office Professional Edition 2003

− Microsoft Office Excel 2003− Microsoft Office Visio

Professional 2003− Microsoft Office Word 2003

Microsoft Windows Server System− Microsoft Windows Server 2003

Standard Edition− Microsoft SQL Server 2000

Standard Edition

Technologies− Internet Information Services 6.0− Microsoft .NET Framework− SQL Server Reporting Services− Web services

Hardware One Compaq DL380G2 server (Web

server) Two Compaq ProLiant ML570

servers (main database, Reporting Services)

Partners GMAC Commercial Mortgage

Technology Europe Limited (GTEL)

msdn.microsoft.com/vstudio/howtobuy