United States General Accounting Office

GAO Report to the Chairman of the National

Credit Union Administration

January 1998 YEAR 2000

COMPUTING CRISIS

Actions Needed to

Address Credit Union

Systems’ Year 2000

Problem

GAO/AIMD-98-48

GAO United States

General Accounting Office

Washington, D.C. 20548

Accounting and Information

Management Division

B-278831 

January 7, 1998

The Honorable Norman E. D’Amours

Chairman

National Credit Union Administration

Dear Mr. D’Amours:

On October 22, 1997, we submitted testimony to the Senate Subcommittee

on Financial Services and Technology, Committee on Banking, Housing,

and Urban Affairs on the National Credit Union Administration’s (NCUA)

efforts to ensure that credit union computer systems are ready for the

upcoming Year 2000 date change.1

 In our testimony, we reported that

while NCUA had made some progress in addressing Year 2000 compliance

issues, more needed to be done to ensure that credit unions adequately

mitigate Year 2000 risks. This report (1) officially transmits

recommendations to assist NCUA in addressing the Year 2000 problem,

(2) responds to your comments on our testimony, and (3) recognizes

actions NCUA has taken in response to our recommendations. Our

testimony, which includes our objective, scope, and methodology, and

findings, conclusions, and recommendations, is reprinted in appendix I.

Your response to our testimony is reprinted in appendix II.

Recommendations As stated in our October 22, 1997, testimony, we recommend that NCUA

• accelerate its efforts to complete the assessment of the state of the

industry, collect the necessary information to determine the exact phase

of each credit union and vendor in addressing the Year 2000 problem, and

require credit unions to report the precise status (phase) of their efforts on

at least a quarterly basis, including progress in addressing system

interfaces;

• document its contingency plans;

• require credit unions to implement the necessary management controls to

ensure that these financial institutions have adequately mitigated the risks

associated with the Year 2000 problem, including (1) requiring credit union

auditors to include Year 2000 issues within the scope of their management

and internal control work and report serious problems and corrective

actions to NCUA immediately and (2) providing auditors with the

1

Year 2000 Computing Crisis: National Credit Union Administration’s Efforts to Ensure Credit Union

Systems Are Year 2000 Compliant (GAO/T-AIMD-98-20, October 22, 1997).

Page 1 GAO/AIMD-98-48 NCUA Year 2000 Challenges
B-278831 

procedures developed by NCUA for its examiners to use in assessing Year

2000 compliance and any other guidance that would be instructive;

• require credit unions to establish processes whereby credit union

management would be responsible for certifying Year 2000 readiness

including credit union compliance testing by a qualified independent third

party; and

• determine (before the end of 1997) the level of technical capability needed

to allow for a thorough review of credit unions’ Year 2000 efforts and hire

or contract for this capability.

Agency Comments

and Our Evaluation

In your October 30, 1997, letter response to our testimony, you stated that

the testimony contained useful recommendations and described actions

that NCUA is taking or has taken to implement our recommendations. These

actions included (1) implementing quarterly credit union reporting of Year

2000 status that includes having credit union officials certify their level of

progress, (2) developing written contingency plans to augment current

processes for administrative actions, and (3) using a contractor to perform

technical reviews of 10 electronic data processing vendors. You also stated

that, depending on the outcome of these reviews, NCUA would consider

contracting for additional reviews of other electronic data processing

vendors, credit unions that develop and maintain their own systems, and

large credit unions. In addition, in a November 12, 1997, letter to the

Congress, you said NCUA would be issuing a letter to credit unions in

December 1997 to describe the potential problems and develop

information on steps credit unions should take to manage the interface

issue. Finally, on December 1, 1997, you issued a letter, including

examination procedures, to the credit union supervisory committees

notifying them of the need for internal and external auditors to review

Year 2000 plans and testing processes.

However, you also raised a concern with one of our recommendations.

Specifically, you stated that, as part of its quarterly reporting process, NCUA

plans to require credit union managers to certify their progress in

addressing the Year 2000 problem. You also stated that independent third

party certification of progress would be unnecessarily burdensome to a

majority of credit unions. By requiring credit unions to certify their

progress, NCUA is effectively alerting credit unions that they are

responsible and accountable for addressing the Year 2000 problem and, as

such, is a step in the right direction. However, without independent

verification that credit union systems are Year 2000 compliant, NCUA will

be relying solely on management assertions and therefore will not have

Page 2 GAO/AIMD-98-48 NCUA Year 2000 Challenges
B-278831 

assurance that credit unions are progressing as reported. To effectively

mitigate this risk, NCUA needs to ensure that the information being

reported to it is accurate and reliable. Consequently, we reiterate our

recommendation that the certification process include credit union

compliance testing by a qualified independent third party and allow

sufficient time for NCUA to review the results and take appropriate action,

if needed, before the year 2000.

This report contains recommendations to you. The head of a federal

agency is required by 31 U.S.C. 720 to submit a written statement on

actions taken on these recommendations to the Senate Committee on

Governmental Affairs and the House Committee on Government Reform

and Oversight not later than 60 days after the date of this report. A written

statement also must be sent to the House and Senate Committees on

Appropriations with the agency’s first request for appropriations made

more than 60 days after the date of this report.

We are sending copies of this letter to the Chairmen and Ranking Minority

Members of the Senate Committee on Banking, Housing, and Urban

Affairs; the House Committee on Banking and Financial Services; the

Senate and House Committees on Appropriations; the Senate and House

Committees on the Budget; the Senate Committee on Governmental

Affairs; and the House Committee on Government Reform and Oversight.

We are also sending copies to the Director of the Office of Management

and Budget, the Chairman of the Federal Reserve System, the Comptroller

of the Currency, the Chairman of the Federal Deposit Insurance

Corporation, and the Director of the Office of Thrift Supervision. Copies

will also be made available to others upon request.

Page 3 GAO/AIMD-98-48 NCUA Year 2000 Challenges
B-278831 

Please contact me on (202) 512-6240 if you or your staff have any

questions on this report. Major contributors to this report are listed in

appendix III.

Sincerely yours,

Jack L. Brock, Jr.

Director, Information Management Issues

Page 4 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Page 5 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Contents

Letter 1

Appendix I 

GAO’s October 22,

1997 Testimony

8

Appendix II 

Comments From the

National Credit Union

Administration

18

Appendix III 

Major Contributors to

This Report

27

Abbreviations

NCUA National Credit Union Administration

Page 6 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Page 7 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 8 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 9 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 10 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 11 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 12 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 13 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 14 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 15 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 16 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix I 

GAO’s October 22, 1997 Testimony

Page 17 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 18 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 19 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 20 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 21 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 22 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 23 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 24 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 25 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix II 

Comments From the National Credit Union

Administration

Page 26 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Appendix III 

Major Contributors to This Report

Accounting and

Information

Management Division,

Washington, D.C.

Gary N. Mountjoy, Assistant Director

John B. Stephenson, Assistant Director

Ronald L. Hess, Senior Information Systems Analyst

Sabine R. Paul, Senior Information Systems Analyst

Keith A. Rhodes, Technical Director

Cristina T. Chaplain, Communications Analyst

(511109) Page 27 GAO/AIMD-98-48 NCUA Year 2000 Challenges
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100