United States General Accounting Office

GAO Testimony

Before the Subcommittee on Oversight, House Committee

on Ways and Means

For Release

on Delivery

Expected at

10:00 a.m. EDT

Thursday,

May 7, 1998

IRS’ YEAR 2000 EFFORTS

Status and Risks

Statement of Lynda D. Willis, Director, Tax Policy and

Administration Issues, General Government Division

GAO/T-GGD-98-123

Summary 

IRS’ Year 2000 Efforts: Status and Risks

The most critical issue IRS faces this year and in 1999 is the need to make

its computer systems Year 2000 compliant. Completing this complex task

involves correcting millions of lines of computer code and thousands of

commercial hardware and software products that IRS relies on to carry out

its mission. If these efforts are not completed, IRS’ tax processing and

collection systems may fail to operate or may generate millions of

erroneous tax notices, refunds, interest calculations, and account

adjustments. IRS has less than 9 months to complete the work that it

believes is necessary to reach its goal of having all of its systems Year 2000

compliant by January 31, 1999. IRS established this goal so it would have

almost a full year, including a filing season, to test and make additional

corrections to its systems.

As part of IRS’ conversion efforts, it needs to (1) convert applications,

(2) upgrade or replace the computer hardware and systems software that

the applications run on, (3) upgrade its telecommunication networks, and

(4) ensure that external data exchanges are addressed. Thus far, IRS has

made more progress in converting its applications than in converting its

information systems infrastructure, such as hardware, systems software,

and telecommunications, that support and affect IRS’ mission-critical

systems. As of March 31, 1998, IRS reported that it had converted the

applications for 59 (46 percent) of the 127 systems it has identified as

mission-critical. IRS officials said they are on schedule for converting the

applications for the other 68 systems by January 31, 1999. IRS either is

assessing or in the early stages of converting the hardware and systems

software for two of its three computing levels. Of the infrastructure areas,

telecommunications networks will likely present the most significant

challenge and may be at the highest risk for not being completed by

January 31, 1999. IRS is also experiencing some schedule delays in its two

replacement projects, but IRS officials said they expect to implement the

Year 2000 critical elements by January 31, 1999.

In January 1998, GAO identified two risks to IRS’ Year 2000 efforts. The first

risk was the lack of a master conversion and replacement schedule as

called for in GAO’s Year 2000 assessment guide. This schedule could be

used to track the status of the many interdependent tasks and the

associated resource implications. IRS is taking actions to develop this

schedule and, if properly developed, it could meet the intent of the guide.

However, GAO remains concerned about IRS’ narrow approach to

contingency planning, the second risk we identified. IRS’ approach calls for

developing contingency plans only for those business functions that are

supported by information systems projects that are known to be at risk of

Page 1 GAO/T-GGD-98-123
Summary 

IRS’ Year 2000 Efforts: Status and Risks

not being fixed on schedule. Under this approach, IRS’ business functions

will be ill-prepared to continue operations in the event of failures in

information systems that were made compliant on time but failed after

they were implemented.

Page 2 GAO/T-GGD-98-123
Statement 

IRS’ Year 2000 Efforts: Status and Risks

Madam Chairman and Members of the Subcommittee:

We are pleased to be here today to discuss the results of our work to date

on the Internal Revenue Service’s (IRS) efforts to have its information

systems function correctly when processing dates beyond December 31,

1999. These efforts are necessary because IRS’ information systems, many

of which are over 25 years old, were programmed to read two-digit date

fields. Therefore, if unchanged, beginning January 1, 2000, these systems

would interpret 2000 as 1900, and thus would seriously jeopardize critical

tax processing and collection operations. According to IRS, the failure to

change two-digit date fields before 2000 could result in generating millions

of erroneous tax notices, refunds and bills. IRS has less than 9 months to

complete the work that it believes is necessary to reach its goal of having

all of its systems Year 2000 compliant by January 31, 1999. Meeting this

goal is important to help ensure that IRS (1) can accurately process tax

returns during the 1999 filing season and (2) has almost a full year to test

the multitude of changes that are necessary and make additional

corrections so that its systems operate properly in the next millennium.

Our statement today is based on the work we did to prepare a draft report

on the status of IRS’ Year 2000 efforts. Our draft report is currently at IRS

for comment. In preparing that report, we interviewed officials from IRS’

National Office, computing centers, service centers, regions, and district

offices. We analyzed and compared IRS’ planning, budget, and

performance-monitoring documentation with our Year 2000 assessment

guide1

 as a part of a structured approach for reviewing IRS’ conversion

efforts.

Our statement today includes the following points:

• For its existing systems, IRS has made more progress in converting

application software than converting its information systems

infrastructure, which includes hardware, systems software, and

telecommunications. Despite its progress on converting applications, IRS

fell short of its goal to have the applications for 66 of the 127 systems that

it considers mission-critical converted by January 1998. IRS is still

assessing or in the early stages of converting its hardware and systems

software for two of its three levels of computing

operations—minicomputers/file servers and personal computers. Of all the

infrastructure areas, according to IRS’ tracking systems,

1

Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14, Sept. 1997).

Page 3 GAO/T-GGD-98-123
Statement 

IRS’ Year 2000 Efforts: Status and Risks

telecommunications is at the highest risk for not being completed by

January 31, 1999.

• In addition to converting systems, IRS is undertaking two major system

replacement projects as part of its Year 2000 efforts. Both of these projects

have encountered some schedule delays.

• In a briefing to this Subcommittee in January 1998, we identified two

significant risk areas to IRS’ Year 2000 efforts. The first was the lack of a

master conversion and replacement schedule. The second was a limited

approach to contingency planning. IRS is taking actions to address our

concerns regarding the lack of a master conversion and replacement

schedule. However, we remain concerned that IRS’ current approach to

contingency planning does not address the likelihood that system failures

could occur once systems are implemented.

Status of Conversion

and Replacement

Efforts

To assist agencies in their Year 2000 conversion efforts, we developed an

assessment guide that includes a structured, step-by-step approach that

agencies may use for reviewing and assessing their readiness to handle the

Year 2000 problem. The assessment guide states that the Year 2000

conversion efforts should be managed as a single, large information

systems project. The assessment guide describes in detail the five phases

of a Year 2000 conversion process (i.e., awareness, assessment,

renovation, validation, and implementation). Each of these phases

represents a major Year 2000 program activity or segment. To successfully

address the Year 2000 problem, effective program and project

management is required for all five phases.

IRS’ Chief Information Officer (CIO) established several parallel efforts to

help ensure that IRS achieves Year 2000 compliance by January 31, 1999.

These efforts include creating the Century Date Change Project Office,

which is responsible for coordinating the conversion of most existing

information systems that can be made Year 2000 compliant as well as

ensuring that all systems are converted in accordance with a 14-step

conversion process. That process incorporates the five phases included in

our assessment guide. Some of the steps involved in converting existing

systems include (1) correcting millions of lines of application code;

(2) upgrading thousands of hardware and systems software products for

IRS’ three levels of computing operations—mainframes, minicomputers/file

servers, and personal computers, (3) upgrading telecommunications

networks; and (4) ensuring that external data exchanges are Year 2000

compliant.

Page 4 GAO/T-GGD-98-123
Statement 

IRS’ Year 2000 Efforts: Status and Risks

The other parallel Year 2000 efforts are two major system replacement

projects—the replacement of the Distributed Input System (DIS) and the

Remittance Processing System (RPS) with the Integrated Submission and

Remittance Processing (ISRP) system and the consolidation of the

mainframe computer processing operations at 10 service centers to 2

computing centers. IRS personnel use DIS to input taxpayer data and RPS to

input remittance data. According to IRS, these two systems are old, and it is

not cost-beneficial to make them Year 2000 compliant. Therefore, IRS

decided to replace DIS and RPS with ISRP. ISRP will be piloted in two phases

at the Austin Service Center. The first phase is underway and the second

phase is scheduled to begin July 31, 1998. Nationwide implementation is

scheduled for January 1999.

As a part of its mainframe consolidation effort, IRS is to (1) replace and/or

upgrade service center mainframe hardware, systems software, and the

associated telecommunications infrastructure; (2) replace about 16,000

terminals that support frontline customer service and compliance

operations; and (3) replace the Communication Replacement System (CRS)

that provides security functions for on-line taxpayer account databases.

Replacements of the terminals and CRS are critical to IRS’ achieving Year

2000 compliance.

Conversion of Existing

Systems

According to IRS, before January 1999, it needs to complete 12 steps of its

14-step process for converting (1) the applications for its existing systems;

(2) telecommunications networks; and (3) systems software and/or

hardware for mainframes, minicomputers/file servers, and personal

computers. In addition, before January 31, 1999, IRS needs to (1) make its

systems for external data exchanges Year 2000 compliant; (2) replace its

data input and remittance processing systems and, at a minimum, the Year

2000 portions of its mainframe consolidation program; and (3) modify

application software to implement tax law changes for the 1999 and 2000

filing seasons.

Much of IRS’ initial Year 2000 efforts focused on the awareness and

assessment phases for the applications for existing information systems

controlled by the CIO.

2

 In May 1997, IRS began assessing the date

dependencies of applications for information systems that were controlled

by either field offices or business functional areas (hereafter referred to as

field/customer systems). As a result of the CIO and field/customer system

2

CIO-controlled systems are generally large, mainframe-based tax processing systems. Field or business

functional area systems are smaller, more specialized systems that use a variety of platforms.

Page 5 GAO/T-GGD-98-123
Statement 

IRS’ Year 2000 Efforts: Status and Risks

assessments, as of March 31, 1998, IRS had identified 127 mission-critical

systems, including 7 telecommunications systems.

IRS has made more progress in converting its applications than in

converting its information systems infrastructure. Specifically, as of March

31, 1998, IRS reported that it had completed the first 12 steps of its 14-step

conversion process for applications for about 59 (46 percent) of its 127

mission-critical systems. IRS’ goal is to convert the applications for the

remaining 68 mission-critical systems by January 31, 1999. IRS officials said

they believe they are on track for meeting that goal.

IRS has completed its assessment of the hardware and systems software

for its mainframe computers. Conversion efforts for other infrastructure

areas —hardware and systems software for minicomputers/file servers

and personal computers, telecommunications networks, and external data

exchanges—are, for the most part, either in the assessment phase or the

early stages of conversion. According to IRS, of these areas,

telecommunications networks will likely present the most significant

conversion challenge and may be at the highest risk for not being

completed by January 31, 1999.

According to IRS, the capability to exchange information, both voice and

data, among various computer systems is the backbone of IRS’ ability to

perform all of its tax processing and customer service functions. IRS uses a

telecommunications network that is supported through the Department of

the Treasury and additional networks that are unique to IRS. As of March

10, 1998, IRS had an inventory of the components that are included in

Treasury’s network and was verifying a preliminary inventory of the

components in the networks unique to IRS. A contractor is currently doing

a risk assessment to help develop a conversion schedule so that the most

important work will be scheduled first to minimize adverse impacts if IRS is

unable to complete all of its telecommunications work by January 31,

1999.

System Replacement

Efforts

The two major system replacement projects included in IRS’ Year 2000

efforts are experiencing some schedule slippages. For example, certain

software development for ISRP that was to be completed in April 1998 is

now scheduled to be done in June 1998. As a result, the time available for

testing before the start of the second phase of the pilot has been reduced.

ISRP officials do not believe this two-month delay will affect either the start

of the second phase of the ISRP pilot or its nationwide implementation.

Page 6 GAO/T-GGD-98-123
Statement 

IRS’ Year 2000 Efforts: Status and Risks

According to IRS officials, IRS has revised its mainframe consolidation

completion schedule because of field office concerns about the ambitious

schedule and pending expanded business requirements. Under the revised

schedule, IRS plans to delay the consolidation of data processing

operations of five service centers from 1998 until after June 1999. IRS

officials said they expect to complete the Year 2000 portions of mainframe

consolidation (e.g., terminal replacement and CRS) by January 31, 1999.

However, according to IRS’ weekly status reports on mainframe

consolidation, CRS has been experiencing some difficulties and is

somewhat behind its original schedule for system testing.

IRS Is Taking Actions

to Develop a Master

Conversion and

Replacement

Schedule

In our January briefing to your office, we identified two major risk areas

for IRS’ Year 2000 effort: (1) the lack of an integrated master conversion

and replacement schedule and (2) a limited approach to contingency

planning. IRS is taking action to have a contractor develop a master

conversion and replacement schedule. A master conversion and

replacement schedule, according to our Year 2000 assessment guide,

should be a part of an agency’s Year 2000 Program Plan. This schedule

could be used to track the progress of concurrent and interdependent

projects that must be ready for integrated systems testing at the end of

January 1999. This year, IRS has a host of activities that it must complete

concurrently so that its systems will be able to function correctly in 2000.

Managing the interdependencies of these activities is critical to help IRS

ensure the timely completion of its Year 2000 effort.

A master conversion and replacement schedule could (1) establish the

sequential relationships between the tasks associated with the Year 2000

conversion and replacement activities, (2) identify how much a task can

slip without affecting other tasks or the overall Year 2000 effort, (3) help

determine whether programming and testing resources are likely to be

available when needed, and (4) provide a tool for prioritizing and assigning

programming and testing resources that are essential to the success of all

Year 2000 efforts in the most efficient manner.

Recognizing that several major and complex projects, including

application software changes that are needed to implement recent tax

legislation, must be completed before the 1999 filing season, in

November 1997, the Commissioner of Internal Revenue announced the

establishment of an executive steering committee. This committee is to

identify risks to the 1999 filing season and the entire Year 2000 effort and

take actions to mitigate those risks. As a part of this effort, IRS developed a

Page 7 GAO/T-GGD-98-123
Statement 

IRS’ Year 2000 Efforts: Status and Risks

Century Date Change Project Schedule for its Year 2000 activities.

Although the project schedule identifies the tasks for major Year 2000

activities, their corresponding start and finish dates, and the primary

organizations responsible for them, the schedule does not yet establish a

link between related tasks or analyze how the timing of the various tasks

may affect resource availability. Until these actions are complete, IRS

cannot project whether resources will be available when needed for

concurrent tasks. Thus, IRS faces the risk that resources may not be

available when needed.

IRS currently has a contractor working on the development of an integrated

schedule of its Year 2000-related efforts, including making all of the

necessary tax law changes for 1999. If properly developed, this schedule

should meet the intent of the master conversion and replacement schedule

called for in our assessment guide. But time is running out for completing

such a schedule. Unless IRS obtains this schedule soon, its value as a

management tool to help anticipate bottlenecks is diminished.

IRS’ Contingency

Planning Approach

Poses Risk to

Continuity of

Operations

Contingency planning was the second risk area we identified in our

January 1998 briefing. In part, due to concerns that the same resources

that are doing Year 2000 conversion work would be needed to do

contingency planning, IRS officials decided to develop a contingency

planning process that would minimize the number of contingency plans

that would have to be developed. Accordingly, IRS’ “Century Date Change

Contingency Management Plan” calls for developing contingency plans

only for those business functions or processes that are supported by

application projects that are at risk of not being made Year 2000 compliant

on schedule.

The Century Date Change Project Office has established criteria to identify

such projects. For these projects, IRS is to initiate a business function

impact analysis. Once that analysis is complete, technical and business

owners evaluate available alternatives, including using any existing

contingency procedures, such as manual procedures, or using an

alternative technological solution, such as commercial off-the-shelf

software. IRS plans to use a similar approach for initiating contingency

plans for business functions when the conversion of infrastructure areas

such as systems software, external data exchanges, and

telecommunications network components fall behind schedule.

Page 8 GAO/T-GGD-98-123
Statement 

IRS’ Year 2000 Efforts: Status and Risks

IRS’ “Century Date Change Contingency Management Plan” does not

address the likelihood that information systems that are converted on

schedule may experience system failures. As a result, IRS will be

ill-prepared to effectively manage all Year 2000-induced system failures

that could affect core business processes. IRS’ contingency management

plan does not address the possibility that (1) IRS may have overlooked a

date dependency during its assessment phase of applications or

infrastructure areas or (2) even if system conversion and replacement

efforts are completed on time and fully tested, unexpected system failures

may occur.

Aspects of contingency planning are under way for IRS’ replacement

projects (i.e., ISRP and mainframe consolidation). For example, the ISRP

project office has developed a contingency plan that identifies (1) various

risks to the ISRP pilot and nationwide implementation, (2) the probability

of those risks, and (3) contingency options for addressing those risks.

Also, as part of a larger effort to enhance IRS’ disaster recovery

capabilities, IRS officials said they hope to finalize expanded disaster

recovery requirements for service center data processing in May 1998 so

that those requirements can be included in the mainframe consolidation

project.

Our exposure draft on business continuity and contingency planning states

that agencies must start business continuity and contingency planning

now to reduce the risk of Year 2000 business failures.3

 Among other things,

the exposure draft states that agencies need to do a business impact

analysis to determine the effect of mission-critical system failures on the

viability of agency operations. This analysis is to include examining

business priorities; dependencies; service levels; and, most importantly,

the business process dependency on mission-critical information systems.

According to our exposure draft, the business impact analysis triggers the

development of contingency plans for each core business process,

including any information system components that support that process.

Contingency plans would also address the actions IRS may take, for

example, to notify taxpayers in the event that Year 2000 failures cause

significant delays in processing tax returns and issuing refunds.

In summary, IRS established the goal to complete its Year 2000 work by

January 31, 1999, so that it would have converted and replaced systems

implemented for the 1999 filing season. By establishing this goal, IRS built a

3

Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD-10.1.19,

Mar. 1998).

Page 9 GAO/T-GGD-98-123
Statement 

IRS’ Year 2000 Efforts: Status and Risks

safety net into its schedule to allow time to work out problems with

converted and replaced systems before January 1, 2000. However, given

the conversion status of some of its infrastructure areas, IRS runs the risk

of not completing all of its work by the January 31, 1999, milestone.

Moreover, even if all of IRS’ work is completed according to schedule, the

potential exists for failures in systems that were fully assessed, converted,

tested and implemented according to schedule. We remain concerned

about IRS’ narrow approach to contingency planning which focuses on

developing contingency plans only for business functions that are

supported by information systems projects that have a known risk of not

being completed according to schedule. Under this approach, IRS has no

assurance that its core business processes will be able to continue to

function, albeit, possibly at some reduced level of service, in the event that

Year 2000-induced system failures occur in systems that were converted

according to schedule.

That concludes my prepared statement. We welcome any questions that

you may have.

(268851) Page 10 GAO/T-GGD-98-123
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100