Online Resources Adds SAS70 Type II Audit Opinion to Y2K ITAA Certification.

MCLEAN, Va.--(BUSINESS WIRE)--Feb. 22, 1999--

Technical Audit Includes Tests of Company's Remote Disaster

Recovery `Hot Site'

Online Resources & Communications Corporation, a leading service bureau in the Internet and remote banking industry, announced today it has successfully completed the stringent SAS 70 Type II audit.

The audit was requested by Online Resources to ensure its service to financial institutions provides the most secure and reliable environment for conducting online transactions. The audit included a review and test of the company's disaster recovery plan.

Online Resources also announced it has been Y2K certified by the Information Technology Association of America (ITAA), whose program examines the processes and methods used by companies to perform their Year 2000 software conversions. ITAA conducted extensive analysis in 11 discrete process areas deemed necessary to a successful Year 2000 conversion and found Online Resources has the core capabilities needed to address the Year 2000 challenge.

The SAS 70 Type II audit is the most rigorous of the SAS 70 audits. It requires specific tests whose results are published. These tests, which cover at minimum a 6-month period of time, demonstrate whether the controls outlined in the report are indeed effective.

As part of the Type II audit, Online Resources tested its disaster recovery plan, designing a simulation of an actual disaster and evaluating the recoverability of critical functions. The test showed those functions performed by Online Resources on behalf of its client institutions and their customers -- including telecommunications components, end-user connectivity, front-end servers, back-end processing, and customer service voice communications -- could be restored within 48 hours in the event its main production facility is destroyed. Online Resources maintains its own remote recovery "hot site" with all necessary system components to run its online banking service for months after a disaster.

A SAS 70 Type II audit also examines physical and electronic security measures, production scheduling, network access, encryption systems, software development and maintenance procedures, database controls for authorizations, and input controls for authorizations and validating data. The audit was conducted by the accounting firm of Ernst & Young.

McLean, Va.-based Online Resources & Communications Corporation (www.orcc.com) provides Internet and remote banking services to financial institutions that "privately brand" them. The company's patented ATM network-based architecture allows real-time bill paying and account information with major cost and quality benefits. And by merging various network access and device alternatives with comprehensive financial content and the banking industry's established payments infrastructure, Online Resources has developed a network of networks and a one-stop electronic commerce solution for financial institutions. The company, founded in 1989, is privately-held and serves 315 financial institutions nationwide.