57

APPENDIX
Page 2 of 6

CAO Response to Year 2000 Audit
Page 2

September 9, 1997

Committee and House Officer users and user needs criteria will be honored . Industry best-
practices will be examined to determine the best approach for the House and an acceptable SDLC

process will be used. This group will report to the CAO. We plan to have the task force
operational by the first week of October 1997.

Second, the HIR AA will designate a project manager who will be responsible for the
management and coordination of Year 2000 issues across the HIR groups, the CAO and external
organizations with which we exchange data. He will ensure that the technical details of the Year
2000 project are fully addressed. The project manager will be responsible for insuring the timely
completion of all Year 2000 work. He will oversee development of detailed system plans for
each application and release updates of the Year 2000 plan as necessary. The first tasks will be
to establish schedules, milestones, and priorities, including addressing the Year 2000 audit
recommendations. Working with the HIR AA, he will establish priorities and resource
availability within the HIR groups. Critical issues will be escalated to the CAO as necessary.
The position will be staffed by either an HIR employee or a contractor, and the Year 2000 project
will be a full time assignment. We plan to have the project manager established by the end of
October 1997.

(b) Prepare a Year 2000 charter which formally assigns the authority and responsibilities
for the Year 2000 initiative to the project leader and staff within HIR, and defines the
project leader roles and respousibilities with respect to organizations/activities outside HIR
whose systems may be affected by the Year 2000 problem.

CAO Response: Concur

The charter of the Technology Coordination Task Force will include the authority and
responsibilities for the Year 2000 initiative.

The Task Force charter will define the role of the group in developing an overall Information
Technology strategy for the CAO organization. The primary objective will be to ensure that new
systems follow the strategic direction of the CAO. They will review all major information
projects within the CAO, including the Year 2000 project, the Payroll and OSM replacement
projects and new procurement systems.

A Statement of Work also will be developed for the Year 2000 project manager. It will detail the
specific duties, responsibilities, timelines, and deliverables of the project. The project manager
will provide staff support for the Technology Coordination Task Force, be responsible for the
technical aspects of the process to determine the technical needs of the House, and coordinate
resources within HIR. .


121

will be penalties and costs assessed to them as individuals through
no fault of their own because the system isn’t working.

Mr. Doparo. We’ve made recommendations to FDIC and other
banking regulators as well; they are doing an in-depth assessment
of financial institutions’ abilities, not only in the banks, but credit
unions and thrifts, where people could have their accounts, and
that is to be completed this summer. And that’s one of the issues
that we’ve recommended that the President’s Council needs to look
across the sectors at a broad level in order to assess readiness and
make sure you do end-to-end testing from the time that the files
leave the Social Security Administration—actually FMS has master
files there of Social Security recipients—until it actually gets to
that institution.

Mr. KOSKINEN. I don’t want to steal Mr. Flyzik’s thunder, espe-
cially since I have a set of small agencies waiting for me, but he
has a very good story to tell about the FMS resolution of this issue,
which is another correlary of contingency planning, because that’s
what we're really talking about.

If you’re in the middle of this maelstrom, what’s the appropriate
way to deal with it. I think he will be able to give you some reas-
surances that, at least in that case, they’ve been aware of the prob-
lem and I think are making the right judgments.

Ms. RIVERS. Great. Thank you.

Thank you, Mr. Chair.

Mr. Horn. I thank the gentlewoman. And Mr. Sununu, gen-
tleman from New Hampshire, 5 minutes.

Mr. SUNUNU. Thank you very much, Mr. Chairman.

Mr. Koskinen, do you have any significant dis: ments with
the report card format that Mr. Horn and the subcommittee has
put together, with the general assessments of the level of success,
or lack of success at the various agencies we've evaluated?

Mr. KOSKINEN. Well, I’m more aware of the basis and the back-
ground for the OMB judgment, so I think I’m a little more knowl-
edgeable about, and therefore comfortable, with the tier I, II and
Tl issues. As a general matter, there aren’t major disconnects.
There are three or four agencies about which OMB and the sub-
committee have different views, and it’s probably worth all of us
spending a little bit of time together to make sure we're on the
same wavelength.

Primarily because my goal is not to give to agencies better grades
than they deserve, but it is that if we need to focus all of our atten-
tion and theirs on the agencies that really have the most signifi-
cant problems. So if, in either of those reporting processes, we're
picking up the wrong signals, either way, I think it would be help-
ful for all of us to know that. But at this point I don’t have a basis
for saying there’s a major flaw in that analysis.

Mr. SUNUNU. In addition to the software problem that we've spo-
ken a great deal about, there’s also an issue with embedded proc-
essors, embedded logic. How do we deal with that problem and how
have you sized that problem?

Mr. KosKINEN. That is a significant problem. In some ways—and
degree of severity—obviously the software problems and the major
systems we've ed about, in terms of financial transfers, that are


23

Mr. Davis. Well, thank you, Mrs. Morella. I appreciate you mak-
ing those points, because [ was going to make them myself. It’s in-
teresting that Congress—and I appreciate the gentleman from
Michigan raising these issues—we had a full-time Y2K coordinator
before the Federal Government, and, yet, we're not nearly as inter-
connected or as dependent, and I hope that the House Oversight
Committee that has jurisdiction and not these committees will con-
tinue to stay on top of that situation.

Just a couple quick points, because I want to get to the cast we
have. First of all, to Mr. Koskinen, I can’t think of a better person
for the administration to bring in at this time. You’re very well re-
spected up here. I just think it’s a huge task ahead of you, because,
in my judgment, oing in, talking to agencies and people, there are
some agency heads who give them lip service but still don’t seem
to get the enormity of this problem and the cost.

ecause we have delayed so long and we're bidding up the cost

of programmers and the like, these costs are going to be far more
significant, I think, than they had to be and that maybe we had
earlier anticipated, but I think there’s still time, and we just will
pledge to you up here we're going to work with you in every way
to try to make sure that this gets completed, at least the critical
ings. There will be some small details that probably don’t get
ironed out for years, but if we can get the critical path laid here;
get plenty of time for testing, particularly, with State and local gov-
ernments who are behind the Federal Governments in some ways
but we talk to on a daily basis and interconnect with and run some
of those and get the bugs out there, I think that will be significant.

I know we'll talk, today, about the embedded chip problem in
some of the programs and the equipment that we have purchased
and how we handle that, but the testing helps work through some
of those issues as well. I just look forward to the hearing today,
which I think is going to be informative and will continue to keep
us on the right track and we're just really glad to have you on
board. Thank you. I yield back.

Mr. Horn. I th: the gentleman, and now I’d like to ask does
Ms. Stabenow of Michigan or Mr. Gordon of Tennessee have any
comments to make?

Ms. STaBENOW. Thank you, Mr. Chairman. I would, first, yield
a moment to my good friend from Michigan, Congressman Barcia.

Mr. Barcia. Mr. Chairman, I would request, also, that informa-
tion be submitted for the record, and it would be the audit report
of the General Accounting Office dated December 12, 1997, in
which my comments were lifted directly from this report, and I’d
just like to have it submitted for the record-——

Mr. Horn. Without objection.

Mr. Barcia [continuing]. And I think that we, in the Congress,
ought to lead by example and work with the administration.

e information referred to follows:]


152

several months the process for identifying the filing season related systems changes

that would be incorporated into the integrated plan.

Testing

Even prior to identifying the Century Date Conversion testing requirements, the
Information Systems Product Assurance Division, responsible for Systems
Acceptance Testing, lacked sufficient resources to fulfill its mission. In 1996, the
Division was able to test only 20 percent of the systems placed into production.
While some progress has been made, today the Division's testing operation is

limited to only 30 percent of the agency's production systems.

Given the critical need to undertake a comprehensive end-to-end Century Date
systems test beginning January 1999, it is imperative for the IRS to dedicate
significant govemment and contractor resources and day-to-day management

direction to the testing program.

Contingency Planning

Given the scope of the IRS program and its critical importance to both the nation’s
economy and its taxpayers, it is imperative that the Service's mission critical
systems continue to function properly in the new millennium. While the IRS has
made significant progress, the risks are significant. Accordingly, the IRS must
develop implementable contingency plans to neutralize any adverse impacts of a

less than fully successful century date program. These contingency plans must


147

of legacy systems each filing season, For example, the Taxpayer Relief Act of 1997

requires the IRS to effectuate more than 750 legacy systems changes for the 1999 filing

season.

Compounding our technical management challenge is the massive century date
conversion project. Most legacy application systems are programmed to display 00 in
the year fields beginning on January 1, 2000, thereby causing date-based calculations
unintentionally to interpret the year field as 1900. Failure to identity, recode and retest
each of these systems calculations could result in the generation of millions of
erroneous tax notices, refunds, bills, interest calculations, taxpayer.account
adjustments, accounting transactions and financial reporting errors. Put another way —
the IRS’ capability to carry out its mission could be jeopardized if the Century Date

program is not completed timely.

‘Adding to the challenge is the largely non-century date compliant technical
infrastructure which includes more than 80 mainframes, 1,400 minicomputers, 130,000
microcomputers and massive telecommunications networks comprised of more than
100,000 components. Because of the age, fragmentation, diversity and local field
ownership of the infrastructure, the Service's potential for success with this aspect of
the Century Date program is largely dependent on its ability to corporately manage,
monitor and accurately evaluate adherence with the program's schedule, budget and

deliverables plans. Lastly, it is essential that both the IRS and its landlord, the Genera!


COMMITTEE ON GOVERNMENT REFORM AND OVERSIGHT
DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York HENRY A. WAXMAN, California
J. DENNIS HASTERT, Iinois TOM LANTOS, California
CONSTANCE A. MORELLA, Maryland ROBERT E. WISE, Jr., West Virginia
CHRISTOPHER SHAYS, Connecticut MAJOR R. OWENS, New York
STEVEN SCHIFF, New Mexico EDOLPHUS TOWNS, New York
CHRISTOPHER COX, California PAUL E. KANJORSKI, Pennsylvania
ILEANA ROS-LEHTINEN, Florida GARY A. CONDIT, California
JOHN M. McHUGH, New York CAROLYN B. MALONEY, New York
STEPHEN HORN, California THOMAS M. BARRETT, Wisconsin
JOHN L. MICA, Florida ELEANOR HOLMES NORTON, Washington,
THOMAS M. DAVIS, Virginia DC
DAVID M. McINTOSH, Indiana CHAKA FATTAH, Pennsylvania
MARK E. SOUDER, Indiana ELIJAH E. CUMMINGS, Maryland
JOE SCARBOROUGH, Florida DENNIS J. KUCINICH, Ohio
JOHN B. SHADEGG, Arizona ROD R. BLAGOJEVIC! llinois
STEVEN C. LaTOURETTE, Ohio DANNY K. DAVIS, Illinois

SHALL “MARK” SANFORD, South JOHN F. TIERNEY, Massachusetts

Carolina JIM TURNER, Texas

JOHN E. SUNUNU, New Hampshire ‘THOMAS H. ALLEN, Maine
PETE SESSIONS, Texas HAROLD E. FORD, Jr., Tennessee
MICHAEL PAPPAS, New Jersey —
VINCE SNOWBARGER, Kansas BERNARD SANDERS, Vermont
BOB BARR, Georgia (Independent)

DAN MILLER, Florida
KEVIN BINGER, Staff Director
Daniel R. Mout, Deputy Staff Director
WruttaM MOscHELLA, Deputy Counsel and Parliamentarian
Juprta McCoy, Chief Clerk
Pun, ScuiLino, Minority Stoff Director

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND TECHNOLOGY
STEPHEN HORN, California, Chairman

PETE SESSIONS, Texas DENNIS J. KUCINICH, Ohio
THOMAS M. DAVIS, Virgini: PAUL E. KANJORSKI, Pennsylvania
JOE SCARBOROUGH. Florida MAJOR R. OWENS, New York
MARSHALL “MARK” SANFORD, South CAROLYN B. MALONEY, New York

Carolina JIM TURNER, Texas
JOHN E. SUNUNU, New Hampshire

Ex OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GeorGE, Staff Director and Chief Counsel
JOHN Hynes, Professional Staff Member
ROBERT ALLOWAY, Professional Staff Member
Marrew Esert, Clerk
FatTH Weiss, Minority Counsel

(dq)


117

Mr. KosKINEN [continuing]. No, I mean as we move forward. I
think the thing we have to avoid is duplicating work that’s already
going on. As you all know, this challenge is broad enough and in-
volves enough activities that I don’t think it is productive for me
to have a separate reporting process to the Council in addition to
the reporting process to OMB and in addition to the ongoing dialog
with Congress. So I think the Council’s role is to review the re-
ports, make suggestions where appropriate about changing either
the nature or frequency of those reports, but trying to zero in on
the obstacles to solving the problems revealed in those reports. I
think that——

Mr. Davis. Do we get a pass-fail on January 1, I guess, of 2000?

Mr. KOSKINEN. As I’ve told everyone, the great joy of this prob-
lem is that it’s not a question of arguing: gee we should have tried
harder. The performance measure is the systems either work or
they don’t. And it is pass-fail. I’m trying to get the agencies to focus
on the point that this is not a question of posturing as to who will
have the best argument about why they tried hard and it didn’t
work. The real issue over the next 21 months is to candidly address
the challenges we face and to ensure that these systems function.

In some of the critical systems we're talking about, failure is not
an option. No matter how hard we try, that won’t be good enough.
The answer here is some of these major systems have to be func-
tional. And our goal right now is to ‘Figure out where those prior-
ities and critical natures are, what the obstacles are, and to take
whatever actions are necessary to solve those problems.

Mr. Davis. Well, let me turn to the largest agency in the Govern-
ment, DOD. In the last 3 months, DOD finished 1.7 percent of its
mission-critical systems. In the previous 3 months, DOD also fin-
ished 1.7 percent of mission-critical systems. Now, that’s good con-
sistency, but it’s very bad productivity and with no improvement.
How do you intend to really address the problem agencies like
DOD, Education, or HHS? Obviously some are going to have a little
higher Priority than others.

tr. ‘OSKINEN. Right. Those are clearly three high-priority agen-
cies. I have a meeting with the Secretary of Defense. I’ve already
talked with the Deputy Secretary about DOD activities. I’ve also
talked with Mr. Valletta. I think what we need to do, and the as-
sessment we're making as we go agency-by-agency is: is there the
appropriate attention being paid by the senior leadership of the
agency? Do they have a management structure in place that is ca-
pable of dealing with this situation? If not, what can we all do to-
gether to provide additional resources where necessary?

I think, although I have this only on representation, the next
quarterly report from the Defense Department will show significant
improvement. They have in their representations to me said that
they have been very careful and cautious about moving systems
from one progress category to another, and they will, they think,
make a quantum leap forward in the next two quarters.

All of this raises the issue that GAO and others have raised, and
that is, I have talked with the inspectors generals and the agency
heads about the need for validation. That we need to ensure that
the information we're getting in response to these repo)

at

ting re-
quests is accurate. And again, one of my concerns is that while I


Report No. 96-CAO-AS
Office OF The Chiot Administrative Officer December 31, 1998

+ Prior Office of Inspector General (O{G) Audit Recommendations - Since the start of the
104” Congress through June 1996, the O!G has issued 24 reports related to the operations of
the CAO with a total of 249 recommendations. To date, the CAO has fully implemented 132
(53 percent) of these recommendations, while 68 (27 percent) recommendations are pastially
implemented or in process, and 49 (20 percent) have not been acted upon. (See Exhibit B for
the detailed status of all the audit recommendations.)

Although the CAO hes implemented numerous jnitiatives, improvements are still needed in the
managemeut and operations of the Office of the CAO to utilize resources more efficiently,
restructure operations, improve performance, and enhauce controls. This is demonstrated by the
following:

Immediate Office of the Chief Administrative Offiser

* Communications, planning, goal seting, and monitoring processes are weak, resulting in
inefficiencies, reduced morale, and potentially increased costs.

+ Current procedures to track and manage responses to numerous audit findings and
recommendations need to be improved to adequately monitor status and document
implementation,

Office of House Information Resources (HIR)

+ HIR has not updated the House's information systems plan to establish a conceptual direction
addressing long-term needs.

The House lacks adequate policies and procedures to manage system development activities
resulting in implementation delays and cost overruns.

+ HIR hes not completed a comprehensive needs analysis and costbenetit analysis of its
mainframe migration project that could conceivably result in inereased costs and decreased
service levels as it migrates from legacy mainframe systems to distributed client-server
systems.

a + HIR’s solution for Year 2000 issues relies on the assumption that all systems will be replaced
in connection with the mainframe migration project. In the event that mainframe migration
stalls, he House would be vulnerable to Year 2000 problems that could generatc incorrect
data and reports and potentially interrupt normal business operations.

Office of Finance

+ The Office of Finance has not prepared performance plans and, while it wacks operational
activities in terms of inputs and outputs, expected qualitative outcomes are not identified o
measured, Therefore, the CHO is not provided essential information necded to ensure that

Ofte at inspects Gave Pager
US. Mouse of Repraentatives


150

components are only now being made available in the market place. The IRS.
has initiated a proactive evaluation and testing process to validate the

compliancy of these components.

Telecommunications

The critical IRS network backbone is supported through the Treasury
Communications System contract. Having recently received the network
component inventory from the contractor, the IRS is in the midst of reviewing and
validating these data as well as the contractor's site specific plans to convert the
network. Given the need to upgrade or replace thousands of components within
the TCS network as well as additional IRS proprietary networks which
themselves comprise nearly 30,000 components, the network conversion

represents a significant challenge.

Non-Information Technology

A critical component of the non-information technology aspect of the program is
dependent on the General Services Administration which has recently begun
developing facilities inventories. Until the GSA and IRS inventories are
complete, it is evident that the government is exposed to both schedule and cost

risk.


17

global perspective, and I think the Council’s real contribution will
be made in coordinating the agencies’ work with those outside the
Federal Government, whether they be tribal, State, and local gov-
ernments; private sector organizations; or institutions operating
around the world.

To accomplish this, 1 do not believe the Council should create
and directly manage new national forums for specific economic sec-
tors such as financial institutions and the health care industry. In-
stead, the Council should be a catalyst, using existing structures
and resources to create an ongoing dialog on the year 2000 implica-
tions for these activities. Individual Federal agencies have a major
role to play in this regard. For example, I think that the Council
can be more effective by enlisting and supporting an agency like
the Treasury Department or the Federal Reserve as the coordinator
on outreach to financial institutions, and the Department of Health
and Human Services, there’s the coordinator on outreach to the
health care industry, empowering these agencies to determine the
appropriate measures the Government should take to assure
Pp s in these areas to the extent we can.

ile the Council will have a global perspective, I would like to
reemphasize that it will not be a centralized body that will relieve
the agencies and others of their individual responsibilities to actu-
ally do the work necessary to fix the problem. Not only would this
require an extremely large staff, it would be a misguided effort.
The work of fixing the year 2000 problem can only be done by those
on the front lines. Senior executives responsible for public and pri-
vate sector organizations are responsible, as well, for ensuring that
their mission-critical systems are ready. As Chairman Horn stated,
this is a management challenge as well as technological one.

In short, the President’s Council on Year 2000 Conversion needs
to be a catalyst, to ensure that individuals in the public and pri-
vate sector are aware of the problem and doing all they can to fix
it. The Council also should be a facilitator, to promote the fruitful
exchange of ideas and information on best practices and the resolu-
tion of common problems. Finally, the Council should be a coordi-
nator, to ensure that resources are being used effectively across or-
ganizational boundaries.

Td like to turn, for a few minutes, to describe in a little more de-
tail what the Council will be doing. In working with Federal agen-
cies, the Council will monitor the progress of those responsible for
fixing the problems in those Federal agencies. I’ve already begun
to embark on what I fondly refer to as my “Agency-of-the-Day
Tours,” where I’m meeting with agency heads, their deputies, their
chief information officers, and those leading their year 2000 efforts
to discuss their situations. In each meeting, I have been asking
three key questions: What are your major risks? What are the most
significant obstacles to removing those risks? And what contin-
gency plans are appropriate in light of that analysis.

1 am also talking to the agencies about the external systems with
which they interface, particularly, their data exchanges with State
and local governments. Even if all the Federal Government’s mis-
sion-critical systems function effectively on January 1, 2000, the
public will still suffer substantial adverse consequences if our sys-


18

Statement
Hon. James A. Barcia

Subcommittee on Technology
Government Wide Year 2000 Issues and the Department of Treasury

18 March 1998

1 want to welcome everyone to this morning's hearing and I want to commend you for
making it here so early

I want to congratulate Mr. Koskinen on his new position as Chair of the President's
Council on Year 2000 Conversion. He has a challenging task before him. I am
particularly pleased by the Administration's recent efforts to coordinate its activities
with States and other parties which exchange date-sensitive information with the federal
government. There isa high degree of information and system interdependence
between federal, state, and private sector, These interdependencies increase the risk
that a cascading wave of failures or interruptions of essential services could occur.

The latest OMB quarterly report and GAO’s latest assessment indicates much work has
been done and that much work still remains. I am encouraged by the Administration's
efforts to develop a more comprehensive Y2K plan, as well as moving compliance
deadlines forward. The Council has laid out an ambitious agenda with not much time to
complete it. However, at this point these are just plans and the devil will be in the
implementation details.

Our two Committees have been at the forefront of raising awareness of the Y2K
problem and in general, we have been very critical of the Administration’s efforts. In
preparing for this hearing, I wanted to know what the Congress is doing to address the
Y2K problem in its own computer systems. I reviewed the House Inspector General's
reports on House efforts to fix its computer systems and I was dismayed by what I
learned.

According to a December 1996 IG report, “HIR Does Not Have A Plan to Address
The Year 2000 Issue.” In a follow-up report issued almost a year later, the IG found,
“that HIR has not 1) established effective project management controls, 2) met general
government Year 2000 milestones, 3) prepared a comprehensive Year 2000 plan
covering critical stages of the initiative or disposition of all systems, 4) adequately
estimated the Year 2000 initiative costs or budgeted sufficient funds, 5) sufficiently
coordinated Year 2000 efforts with external groups, 6) incorporated Year 2000
warranty language in its procurement contracts to guarantee compliance on future
information technology purchases, and 7) secured software tools or contractor support
to assist in the conversion effort.” T understand that HIR has hired a Year 2000
coordinator subsequent (0 the latest IG report and that a comprehensive management


126

But the basic issue though is I think, our recommendation is first
that needs to be built in, that safety check in each agency, which
is what we’ve recommended.

Mrs. MALONEY. Well, I think that’s the key point, and I'd like to
see sort of in writing how that’s trying to be done. I think that’s
really critical.

(The information referred to follows:]

Although we are giving agencies discretion as to how they will handle end testing,
we have asked them to follow the guidance in GAO's guide entitled, Year 2000 Com-
puting Crisis: An Assessment Guide, published in Sey 1997, a section of that
guide lays out a sound approach to testing and verification. Of course, the specifics
will vary from agency to agency, and neither OMB nor the Office of Year 2000 Con-
version can generalize the way that all agencies are dealing with this issue. For ex-
ample, several agencies are considering running end-to-end testing over weekends
or long holidays.

Mrs. MALONEY. My time is running out. I want to ask two quick
questions. To follow up on one that I asked the last time we met
is, assuming we're doing everything right in the State Department,
what about the problems with our allies? That there is a world
emergency, and we have to communicate immediately to Britain,
and France, and Egypt, or whatever?

What if their systems are down and we can’t communicate? We
did hear testimony that we were going to be able to communicate
from our desk in America to our foreign desk that we control, but
there may be a need that we need to reach allies, or communicate
very quickly. And what are we doing to make sure that key sources
of power and support in the country are there to respond to us?

id very quickly, GAO, you’re always on the ball, and I read
about your six private sector national economic sectors, and how
important they are to interface, both in financial services and
health. We’ve seen a lot of reports in the paper about how the
health care industry is really not getting up to the standard that
they should in the private sector.

it are we doing, not within government, but reaching out to
those key sectors that you identified in your report that were abso-
lutely critical to the functioning of the country?

Mr. Horn. I thank the gentlewoman, and we have one less ques-
tioner, and——

Mrs. MALONEY. But can he answer the question?

Mr. Horn. Oh——

Mr. KOSKINEN. In my prepared testimony and in subsequent
questions and answers, I’ve stated that one of the Council’s critical
roles will be to energize the appropriate Federal agencies to take
leadership in those specific areas, and to ensure, to the extent they
can, and have control over it, that we keep not only our systems
operating, but that we encourage others on whom we depend to
have their systems operating as well.

Defense and intelligence are obviously critical, but we also have
major issues in financial transactions, and the operation of foreign
markets.

Mrs. MALONEY. I'll read your testimony.

But very quickly, what about interacting with our allies?

Mr. KOSKINEN. Yes, that’s part and parcel of it, and I have a
meeting scheduled with the Secretary of Defense to discuss that
issue.


132

This concludes my statement, and I'll be happy to answer any

questions for the record.
[The prepared statement of Mr. Schindel follows:]


12

Report No. 96-C40.15
Office Of The Chief Administrative Officer December 24, 1998

inding F:  HIR Does Not Have A Plan To Address The Year 2000 Issue

In order to minimize the disruption in services by the Year 2000, private industry and most
government agencies have alrzady begun addressing the potential impact by analyzing, planning,
and rewriting existing systems, as recomiended by technological exper. Although HIR hes
assessed its systems, it has not yet developed a plan for minimizing the potential impact that the
Year 2000 issue will bave on the House. HIR planning efferts have not begun because of the
expectation that with HIR’s migration to a network-centric computing environment, its existing
legscy maintrame system will no longer be in use by the Year 2000. However, in light of our
recommended needs analysis and cost/benefit analysis in Fincing E, it is conceivable that all
mainframe operations may not be completely phased out prior to the Year 2000. Affected
applications on systems that are not replaced may generate incorrect data, incorvect reports. and.
completely interrupt nonnel operations.

The Year 2000 poses one of the most significant challenges ever faced by the information
technology industry and will have enormous impact on business applications, package solutions,
and systems Software. The problem was created because of the limitations of earlier technology
and the historically bigher cost of storing information. In the 1960s and 1970s, storage space for
date was expensive, Assuming that those early systems would be replaced before the new
millennium, many companies opted for two-digit date codes to indicate the year, instead of using
all four digits, to reduce storage requirements. For example, the Year 1970 would be stored as
merely “70”, and not as "1970". Asa result, the Year 2000 would be stored as “00” and
processed by many programs as the Year 1900, rather than the Yeur 2000, thereby causing many
important programs to ful

Even as orgenizations moved to newer. more advanced systems, the date structure was not
modified to include ihe century, nor were applications modificd or upgraded, because of the
significant cost. Most government agencies and private companies have initiated extensive
efforts to identify Year 2000 issues and hegun recoding existing programms to address these
issues,

Computer Associates Intemational, Inc. provided a “Year 2000 Road Map” as part of its
testimony before the House Committee an Science's Subcomminee on Technology. it
recommended that development and maintenance tcams incorporate the following steps into
plans. in order to make informed decisions that are in concert with organizational goals:

+ Planning:
+ Taventory:
+ Impact Analysis;

© Source Code Analysis;

Code Conversion:

‘Gifice of inspector General Page 26
U.S. Mouse of Representatives


30

‘completion of the Year 2000 compliance efforts for the current
system. Failure to take advantage of migration has burdened the
House with both the cost of modification as well as requiring the
continued support of the mainframe system* until these legacy.
systems can eventually be

replaced.

(Of the three legacy systems that make up Group B, the FMS

payroll system and the OSM/OES system have been identified by
as either replacement or outsource candidates and are

included in the CAO's FY98 budget request at $2 million and

‘$800,000, respectively. The remaining system, MIN/ISIS is slated

tobe retired by the end of 1998 and current functionality replaced

bby Web browsers. With regard to the OSM/OES system, Media

and Support Services officials have known since the early 1990's

that their system was not Year 2000 compliant. Their solution to

this Year 2000 problem, as well as how they intend to address

overall system improvements, is replacement. However, at this

tate date, such fundamental SDLC practices as assigning

responsibility for the project, conducting a current

needs/requirements analysis, as well as the naming of a project Figure 1 - Current Mainframe Processing Usage

‘manager and team has yet 10 be accomplished. This inactivity and

the lack of direction may limit management's opportunities to choose the most effective course of action,

thereby resulting in a potential stop-gap interim solution, where the new system selected does not

adequately meet management's needs, and may need to be replaced. The Ad Hoe systems contained in

Group C (see Exhibit A) are currently scheduled to be migrated to standalone Desktop systems. Since the

type of systems contained in Group C are Ad-Hoc, and therefore by definition only are used on a periodic

basis, they are not included in the mainframe processing measurement statistics. Also representing a

significant ‘of mainframe processing usage isthe current mainframe E-mail system, which is

scheduled to be removed within the 1997 calendar year. The category identified as System Support

‘Overhead, represents those executive systems such as the operating and communication systems for

‘example, that support and maintain the application systems. Finally, the Unused Capacity category

(Currently 11 percent) represents that potion of the mainframe processor that is not being used.

Final Mainframe Disposition
Requires Careful ement Analy

‘The Group A application systems depicted in Figure 2 are the only systems that will without question
reside on the HIR mainframe after the Year 2000 project is completed, with the possible exception, albeit
‘temporary, of the FMS payroll and OSM/OES systems if they are not replaced before the deadline. With
the backdrop of such management directives as the House Resolution, and the CAO audit response to the
OIG audit of the CAO, management needs to identify benefits to be derived from these systems with
respect to future user needs and their continuing support costs, As an example, one might question the
purpose for continuing to support such minor systems as the Photography or Recording Stadio systems on a
‘mainframe platform when there may well be other, less costly and more effective options available.

“The replacement of HIR’s large scale mainframe with the CMOS server (which is actually a
small mainframe) resulted in a change in processing capabilities from 114 mips (millions of instructions pet
second) to 77 mips. HIR has the option of reducing the CMOS' processing capacity even lower - to 55
‘mips - but (a) has not done so and (b) does not have a documented, short-term strategy for doing so.


\ 101

Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14, September
1997)

Defense Computers: SSG Needs to Sustain Year 2000 Progress (GAO/AIMD-97-120R,
August 19, 1997)

Effort (GAO/AIMD- 57: 12, "August 13, 1997)

nting DLA in Addi
(GAO/AIMD-97-106, 6, August 12, 1997)

hallen
(GAO/AIMD-97-117, 7, August 11, 1997)

the New Millom OTs -AIMD97- 129, fy 10, 1997) :

Veterans Benefits Computer Systems. Uninterrupted Delivery of Bené
Timely Correction of Year-2000 Problems (GAO/T-AIMD-97-114, j.ne 26, 1997)
Veteran: i : Ri ‘ : fi

(GAO/AIMD-97-79, May 30, 1997)

ion. m: Su i
and Technical Weaknesses (GAO/AIMD-97-78, May 16, 1997)

Medica agerial and Té
Modernization (GAO/T- ‘AIMD-97- 91, May 16, 1997)
. Risk of

ee ions Calls for Agency Action Now (GAO/T: "-AIMD-97-52, Pebruaty 27, 1997)
Year 2000 Computing Crisis: Strong Leadership Today Needed To Prevent Future
Disruption of Government Services (GAO/T-AIMD-97-51, February 24, 1997)
High-Ri: ies: ition Mana (GAO/HR-97-9, February
1997)
(511455)

13


37

rou A Grou B Group. External Cusomers

Lis FMS Payroll Ad Hoe Systems- Congressional Budget Office
NCOA OSM/OES Page Profiles, General Accounting Office
MONIES MINASIS Franking Standards Prospective Payment

HOR inventory Press Gallery Assessment Commission
Photography NCOA - Executive Branch
Recording studio Agencies

Lobby Act

Parking

Using the current Year 2000 Plan as a baseline consideration, the proposed migration paths for these systems
are as follows:

Group A will be modified to become Year 2000 compliant.

Group B is scheduled for replacement by COTS, out-sourcing , or Web interface.

Group C are small, custom systems that can be migrated to COTS desktop systerns.

External Customers is a list of Non-House users who purchase time on the HIR mainframe—this study will
address the prognosis of these systems, and be incorporated into the Year 2000 planning effort,

2. Present the results of the assessment developed in recommendation 1 to the CHO with
recommendations as to how to proceed.

CAO Resgonse: Concur.

We will collaborate with the OIG study leader by performing background research and other tasks that may be
required to compiete the mainframe migration study requested in House Report 105-196.

3. Direct the Year 2000 project leader to incorporate specific mainframe migration issues for
consideration into the current Year 2000 plan,

CAO Response: Concur.

An outside contractor has been retained to perform project leadership of the Year 2000 effort. Mainframe
migration issues and recommendations from the OIG study will be taken into consideration, and incorporated in
updates of the Year 2000 implementation plan.

4. In concert with existing Year 2000 planning and implementation efforts, develop a mainframe
migration plan and present it to the CHO for approval, supported by a comprehensive, in-depth ueeds
analysis, that reflects the wishes of the House— as elaborated ia the ISPP, the CHO November 1995
directive, and/or feedback from recommendation 2 above.

CAO Response: Concur.

The efforts of the mainframe migration study group will be coordinated with all Year 2000 planning efforts for
the development of an analysis of mainframe alternatives based on the data center inventory, and the technical
alternatives (COTS, out-sourcing, client-server solutions) for Groups A, B, C and External Customers listed
above. Scheduling and deliverables will adhere to requirements set by the outcome of the mainframe migration
study.


162

vy ueyo

Aye yueweyduwy ayepyen
i

@yeAoUsy = SSASSY = OYE}S JON,

OOb
queoed

swia3shs | reonug uoIssiy aedoy
aseyd Aq swayshg jej0L

swa}shs op
| Asewuins SW4

BEIGO/ED JO SY
juawainseayy eOUeWOLad 000Z 122A
Sd1Aag JUsWabeuRYW jeoueul4



Office of Inspector General
Audit Report

Improvements Are Needed In The
Management And Operations Of The Office
Of The Chief Administrative Officer

Report No. 96-CAQ-15
December 31, 1996

U.S. House of Representatives


146

Intemal Revenue Service
Opening Remarks of Arthur A. Gross
Associate Commissioner for Modemization/
Chief Information Officer
Of the internal Revenue Service
For Presentation to the House Government Reform and Oversight

‘Subcommittee on Government Management, Information and Technology

March 18, 1998

Chairman Hom, Representative Kucinich and members of the Subcommittee, thank you
for the opportunity to discuss the Intemal Revenue Service's progress conceming the

Century Date Conversion project.

PROGRAM SCOPE AND STATUS

The Intemal Revenue Service (IRS) is a huge enterprise, employing in excess of
100,000 individuals located in service centers, regional offices, district offices and posts
of duty across the United States. A $1.5 trillion financial services program, the IRS is
largely dependent on highly automated processes as well as the currency,

comprehensiveness and availability of vast storehouses of computerized data.

The IRS information technology organization is particularly challenged given the breadth

of the legislatively mandated systems changes which require extensive reprogramming


33

then Administrator's comments that the retirement of the mainframe was still an open policy issue, the
issue as to the future direction of the House mainframe migration appears very much undecided.

Recommendations:

We recommend that the Chief Administrative Officer:

1. Assign a project leader with sufficient resources and appropriate authority to determine what has been
done and what still needs to be done with respect to the directive from the CHO regarding
development of a mainframe migration plan.

2. Present the results of the assessment developed in recommendation | to the CHO with
recommendations as to how to proceed.

3. Direct the Year 2000 project leader to incorporate specific mainframe migration issues for
consideration into the current Year 2000 plan.

4. In concert with existing Year 2000 planning and implementation efforts, develop a maintrame
migration plan and present it to the CHO for approval, supported by a comprehensive, in-depth needs
analysis, that reflects the wishes of the House--as elaborated in the ISPP, the CHO November 1995
directive, and/or feedback from recommendation 2 above.

‘Management Response
(On October 14, 1997, the CAO concurred with the recommendations in this finding (see Appendix).

‘The CAO agreed to implement the recommendations in collaboration with the OIG mainframe migration
study pursuant to the House Report 105-196 (Legislative Branch Appropriations Bill for 1998) on behalf of
the House community. An HIR study group has been appointed and participants have been identified to
‘work with the OIG to provide a comprehensive data center inventory of all information systems hardware
and software. The HIR study group will work closely with, and assist the OIG with study tasks involved in
estimation of costs of viable technical alternatives for each mainframe system. as well as other tasks that
may be required to complete the mainframe migration study.

‘An outside contractor has been retained to perform project leadership of the Year 2000 effort. Mainframe
migration issues and recommendations from the OIG study will be taken into consideration, and
incorporated in updates of the Year 2000 implementation plan. Scheduling and deliverables contained
within the Year 2000 implementation plan witl adhere to requirements set by the outcome of the mainframe
migration study.

Office of Inspector General Comments

The CAO’s current and planned actions are responsive to the issues we identified and,
when fully implemented, should satisfy the intent of our recommendations.


Report No. 66-CA0-15
Otfice Of The Chief Administradive Orficer December 31, 1995

$44.1 million, his significant reduction was due to effective process streamlining,
outsourcing, and downsizing, including:

‘+ Closing the “Folding Room,”

Privatizing House services including the Shoe Shine, Beauty Shop, and Barber Shop
operations,

Outsourcing internal House mail delivery to Pitney Bowes Management Services
(PBMS) and contracting the window opcrations to the U.S. Postal Service,

Reducing administrative staff from 1,063 to 600, and

‘© Canceling an unneeded warehouse lease, and auctioning off old furniture and equipment.

Improved Policies and Procedures - A critical element of the CAO’s overall strategy has
‘been the development and implementation of standardized policies and procedures to support
key business processes, Prior to the 104” Congress many processes and administrative
activities of the House relied on the personal knowledge and experiences of employees. To
date, detailed policies and procedures have been implemented to document processes
including procurement, human resources, and computer and related equipment acquisition
and management.

New Training Initiatives - The CAO has initiated a number of raining programs during the
104" Congress, including general training to support overall CAO-wide Total Quality
Management (TQM) initiatives, as well as specific training to support detailed initiatives
such us the implementation of new procurement policies and procedures, new and enhanced
systems such as the Federal Financial System (FFS), and restructured operations such as mail
and printing operations

‘+ New Human Resources Programs - Prior to the 104” Congress, comprehensive formal
waitten job descriptions, documented Human Resources policies and procedures, and formal
objective setting and performance evaluation systems were not in place. The CAO has since
formally documented, in writing, all position descriptions and begun to implement a new
goal setting and performance evaluation system. Beginning with the 104% Congress, each
CAO employee is required to have a detailed individual Performance Plan and Evaluation
which documents detailed goals and objectives and provides a mechenism for evaluating an
individual's performance against goals.

+ New Procurement Activities - The CAO has designed, developed, and implemented the first
comprehensive set of procurement guidelines, systems, and policies and procedures in House
history. Prior to the 104 Congress, procurement activity was totally decentralized and
oversight was limited. ‘The new systems and guidelines establish an open, competitive, and
accountable procurement system that ensures the House receives the best valuc possible.

Office of inspector Generar Page:
US. House of Represencanves


102

aINJONS UOIEUIPIOND
[EUONEN O00Z 422A B Jo Bidwexy ovy



165

syodey rejoueUly @

SS000/q uieWAed


124

United States is the world’s most advanced and most dependent
user of information technology, so that it really transcends a lot of
vital services.

The key here is what we've advanced in our recommendations,
that is to get a complete picture of where the risks are, and right
now one does not exist at a national level or international level.
And our set of recommendations we’re advancing is for the Council
to use its auspices and resources to try to pull that together so they
can make those type of judgments of where the risks are as they
move forward over the next year.

Mr. Horn. I thank the gentleman. Now I yield 5 minutes to the
gentlewoman of New York, Mrs. Maloney.

Mrs. MALONEY. I’d like to thank the chairman for having this
hearing, and I’d like to welcome back Mr. Koskinen. You've retired
with great honors.

Mr. KOSKINEN. I refer to it as a sabbatical, but either way I was
gone.

Mrs. MALONEY. And now they have a tough problem, and you're
back in the hot seat. So welcome back. I know you have a distin-
guished career of solving problems, and we're glad you’re working
on this one.

I know you used to work for OMB, and I understand that now
in your new position you'll be sharing resources with OMB with
your Council. But what happens Mr. Koskinen if you and OMB dis-
agree? If your Council has one set of plans, and OMB has another,
who has the final say?

Mr. KOSKINEN. The President.

Mrs. MALONEY. The President, President of the United States.

Mr. KoSKINEN. The President of the United States appointed me.
I am an assistant to the President.

Mrs. MALONEY. So you have a final say.

Mr. KOsKINEN. I do not envision any major disagreements, but
ultimately, if there are different conflicting recommendations the
President will resolve them.

Mrs. MALongy. OK. I think it’s important to have a clear line of
authority.

One of the problems that bothers me is the end testing, the fact
that it’s actually going to work, and I understand that you're goi
to be contracting out to private contractors for some of this end
testing, and the final analysis. We’re getting everyone ready, but
the final question, Is it going to work and what are we doing to
make sure it works? :

You've been talking about end testing, but how do you know the
end testing’s going to work? What control have you over the private
contractors who are trying end test? Could you just elaborate a lit-
tle bit on end testing, how it works, how it’s enforceable, and how
are you sure that the testing system that you're setting up is going
to work?

Mr. KOSsKINEN. Well, you will never be totally sure until you
show up on January 1, 2000, and see how the systems operate.
What’s happening, end testing and validation is as varied as the
systems that are out there. The agencies have all agreed that they
need independent verification and validation of their systems.


43

are keeping the project leader informed on their progress, but that there was no mandatory
hierarchy that requires them to directly report to him while the initiative is ongoing. As a result,
the tasks attributed to the project leader have not been adequately addressed. For instance, the
responsibility has not been taken for concurrent tasks, prerequisites (e.g... addressing operating
systems changes before applications are integrated), internal and external coordination, and Year
2000 language for procurements. Also, while many of the HIR groups have issued letters to
vendors requesting the status of Year 2000 products they distribute or support, the Client
Services group has not sent letters to vendors of products listed on the “House Supported
Software List.” Instead, they are looking to an Internet web site that posts software products that
are, or will become, Year 2000 compliant. While this may be an acceptable, supplemental tool, it
cannot match the completeness or timeliness of vendor letters. This type of oversight would
normally have been identified by the project leader. While HIR had good intentions in appointing
a Year 2000 project leader, the effort is somewhat diminished if the project leader’s primary role
is oriented towards mainframe application efforts, rather than focusing on other, more “global”
aspects of the initiative.

Fixed Year 2000 Deadline Leaves Little Time For Delavs

Based on general government Year 2000 milestones,” we believe the House is behind in its efforts
to remedy the Year 2000 problem. The government milestone for completion of the awareness
phase, where the overall Year 2000 strategy is approved and which is the first of five phases, was
December 1996. HIR’s Year 2000 plan, which is a high-level plan containing few detailed steps
(and which has only recently been submitted to the CHO for approval on May 19, 1997), is still
undergoing changes. Further, while HIR has completed portions of the assessment or second
phase, it has not developed detailed system plans and schedules for which the recommended
milestone is June 1997. Delays in these initial two phases places the timeliness of completion of
the final three phases in question.

While most of the 200 systems in the House will be affected by the Year 2000 problem, the Year
2000 plan highlighted 3 high priority, mission-critical projects-replacement of OSM and the FMS
Payroll module, and the conversion of LIMS. We were told by the Year 2000 project leader that
the House is “rapidly approaching the behind stage” on implementing Year 2000 solutions for
these systems. Immediate decisions and actions are needed on the OSM and FMS Payroll module
replacement efforts to ensure a timely solution. While the initial conversion work for LIMS has
begun, such major steps as retaining contractor assistance and obtaining appropriate software
tools need to be initiated. Further. the Year 2000 project leader indicated that the time-frames in
the Year 2000 plan for these mission-critical systems and other systems are only general estimates
that still need to be refined. Many of the smaller systems will not be made compliant until 1999.
Moreover, while we generally found a sense of urgency regarding the Year 2000 initiative, that
sense of urgency was not apparent for the OSM replacement or the smaller systems. If the House
expects to meet the Year 2000 deadline. the CAO needs to make it clear that the Year 2000

Office of Management and Budget. in consultation with the Chief Information Officer Council, has set
government-wide milestones for completion of each phase of Year 2000 activities. These include Awareness
December 1996, Assessment--June 1997, Renovation--December 1997, Validation--January 1999, and
Implementation--November 1999, (See Exhibit, page 4, for an explanation of each of these phases).


85

21 months will be to address the challenges that lie before us, in a very aggressive but measured
sway, by marshaling the resources at our disposal in the most effective way possible.

I thank the subcommittees for their continued interest in the year 2000 problem. Your
efforts have made, and continue to make, a valuable contribution to the public dialogue atout this
matter. I look forward to working with you, and I would be happy to answer any questions that
you may have.


6

Mr. Horn. We have a lot of work to do and little time remaining.
We will go into the various panels, but I'd like at this time to yield
to the chairwoman of the Technology Committee of the House Com-
mittee on Science for her opening remarks and then we will ask
the ranking minority members on each of those committees for
theirs and any other Member that wants to put in some remarks.

I now recognize the gentlewoman from Maryland, Mrs. Morella,
the chairwoman of the Subcommittee on Technology.

Mrs. MorELLA. Thank you, Mr. Chairman. Talk about timing for
the year 2000, my timing today was just perfect. I hope we'll also
be ready in the year 2000 with that timing. Today, we are herald-
ing the beginning of a new era in our Nation’s ability to timely and
effectively correct that year 2000 problem. With the arrival of John
Koskinen to chair the newly created “President’s Council on the
Year 2000 Conversion,” a ray of hope is now piercing through the
clouds of doubt and gloom that had shrouded over questions about
the readiness of our public and private sectors to the year 2000
compliance by the beginning of the new millennium. Congratula-
tions to us, Mr. Koskinen.

Mr. Koskinen brings to his new position a level of experience and
the skills for government management that has very few peers. I’m
also very pleased that Sally Katzen, with her institutional knowl-
edge and brckground on this issue, has accepted the role of the
Vice Chair of the Council. Additionally, the Council will be well
served with the technical expertise of Federal chief information of-
ficers and the very capable Office of Management and Budget staff.

Yet, while I have great faith and confidence in the Council’s abil-
ity and motivation to get the job done by the immovable deadline
of January 1, 2000, I just hope it’s not too late. The job before the
Council is both gargantuan and thankless, and the executive
branch, to paraphrase Robert Frost, still has many promises to
keep and miles to go before it can sleep.

I don’t need to remind the Council that as we ring in the 21st
century, we'll be ushering in the mother of all computer _plitches,
one which could cripple critical government functions such as air
traffic control systems, veterans’ benefits, Social Security, and stu-
dent loans, as well as the everyday conveniences of modern life like
home security systems, video recorders, and elevators in high rise
buildings. It’s clear that without greater urgency and aggressive
agency management, Federal agencies are at risk of being unable
to provide services or to perform functions that are critical to their
mission and vital to the American people.

The reports that we’ve received from Federal agencies in our con-
gressional reviews are quite disturbing, prompting many to grimly
cast dire predictions about the failure of the government and indus-
try to operate effectively on the first business day of the new mil-
lennium, Monday, January 3, 2000. That’s why we have urged the
President for over a year to forcefully attack this impending catas-
trophe. We repeatedly appealed to him to create a year 2000 czar
with the mandate of making solving the problem the highest prior-
ity for both the public and private sector. At last, with his Execu-
tive order forming the Council, the President has finally given this
issue the attention it deserves. Now that this important step has
been undertaken, I am looking forward to working collaboratively


CONTENTS

Hearing held on March 18, 1998 .
Statement of:
Koskinen, John, Chair, President's Council on Year 2000 Conversion;
Gene Dodaro, Assistant Comptroller General, U.S. General Accounting
Office; and Michael P. Harden, president, Century Technology Services,

Inc.
Schindel, Dennis, Deputy “Assistant inspector General for Audit, Depart-
ment of Treasury; Jim Flyzik, Acting Chief Information Officer, Depart-

ment of Treasury; Arthur Gross, Associate Commissioner for Mod-

ernization and Chief Taformation Officer of the Internal Revenue Serv-

ice, Department of Treasury; and Constance Craig, Assistant Commis-

sioner, Information Resources Financial Management Services of the
Department of Treasury ..

Letters, statements, etc., submnitted for the record by:

Barel , Hon. James A, a Representative in Congress from the State

‘gan:
Audit report of GAO, dated December 12, 1997
statement of
Cr: aig ronstance, Assistant Commissioner, Information Resources Finan-
Management Services of the Department of Treasury, prepared
statement of

Dodaro, Gene, Assistant Comptroller General, U.S. General ‘Accounting

ice:
Information conce:
Prepared statement of

Flyzik, Jim, Acting Chi

prepared statement of ..

Gross, Arthur, Associate

formation Officer of the Internal Revenue Service, Department of
Treasury, ry, pre pared statement of ..

Harden, Michael P., President, Century ‘echnology Services,

pared statement of ...

Horn, Hon. Stephen, a Representative in Congress from the State of

California, prepared statement of ...

Koskinen, Jo in, Chair, residents “Council ‘on’ Year 2600” Conversioi
Information con liability
Prepared statement of

Kucinich, Hon. Dennis J., a Representative in Congress from the State

of Ohio, » prepared statement of

Morella, Hon, Constance A., a Representative in Congress from the State

of Marylanc
House of Representatives year 2000 activities
Prepared statement of

Schindel, Dennis, Deputy Assistant Inspector General for Audit, Depart-

ment of Treasury, prepared statement of

Sessions, Hon. Pete, a Representative in Congress from the State of

‘Texas, prepared statement of ....

independent verification

Ine., pre-

(vy)

75

130

24
13

157
126
89
139
146
106
129
80
17
21

133


148

Services Administration, ensure that applicable IRS facilities and infrastructure related

equipment are upgraded or replaced to ensure century date compliance.

Major elements of the program are as follows:

+ Application Systems Conversion
The IRS currently supports 126 mission critical application systems comprising
85,000 modules and approximately 50 million lines of code. The code conversion,
segmented into five sequential phases, each scheduled for six months in duration,
has been completed through three phases. At this time, the IRS has renovated 73
systems, tested and implemented 60 mission critical systems and is on schedule to

complete the systems conversion by January 1999.

* Mainframe Consolidation
Instead of investing more than $250 million in upgrading the agency's computer
mainframes to ensure century date compliance, the IRS proposed and received
Congressional approval for a mainframe consolidation program that consolidates 67
mainframes currently located at ten service centers into twelve mainframes located
at two computing centers. The program will provide for both century date
compliance and savings of more than $500 million over the ten-year business case
as well as position the IRS to implement its mainframe centric approach for
modemizing the Service's technology. The effort also standardizes a major
‘component of the IRS telecommunications backbone through the rollout of a century

date compliant open architecture network of nearly 20,000 desktop devices.


40

(LIMS), Office Systems Management (OSM), and Financial Management System (FMS Payroll)),
may fail or produce erroneous data. House systems that project future dates such as HIR’s
MONIES (Management Of Network, Income, Expense, and Services) and OSM have already
experienced Year 2000 date recognition problems. Before the Year 2000, the House must
complete a comprehensive Year 2000 initiative which includes identifying its computer systems
and software and converting problematic date fields using appropriate system development life
cycle techniques. While the problem is primarily mainframe-based, it also affects client/server
networks, workstations, distributed systems, telecommunication systems, networks, and
computer-controlled devices. Possible solutions to the problem include either system migration,
modification, replacement (e.g., commercial off-the-shelf systems), or system retirement. No
matter which solution or combination of solutions is employed, the House needs to ensure that it
is ready for the Year 2000.

Object Scope, And Methodology

Due to the increasing urgency of preparing for the Year 2000, the Office of Inspector General has
initiated this first of a series of periodic “snapshot” reviews of HIR’s progress in identifying and
resolving Year 2000 issues. Our December 31, 1996 audit report entitled, “Improvements Are
Needed In The Management And Operations Of The Office Of The Chief Administrative
Officer,” (Report No. 96-CAO-15), included a recommendation for the Acting Chief
‘Administrative Officer (CAO) to prepare a comprehensive Year 2000 strategy. We consider this
December 1996 audit report a baseline for Year 2000 issues against which this and follow-up
audits will be targeted. This audit focused on HIR’s newly developed Year 2000 plan to
determine if the House is positioned to resolve Year 2000 issues in a timely manner. We plan to
conduct additional reviews at critical phases throughout the House's Year 2000 initiative.

The objectives of this review were to (1) evaluate the adequacy of the House's Year 2000 plan,
(2) assess the status, allocation of priorities and resources, and timetable for completion of the
Year 2000 initiative, (3) determine whether generally accepted project management techniques
have been established, and (4) identify whether vendor supported hardware/software products will
be Year 2000 compliant. In light of the managerial deficiencies identified in our recent audit of
HIR"s management practices (HIR Management Practices Undermine The House's Ability To
Keep Pace With Technological Changes, report no. 97-CAO-09, dated May 8, 1997), we also
looked at techniques employed and decisions made by those given the responsibility for managing
the Year 2000 initiative. Successful implementation of this initiative requires a similar level of
project management and techniques as in a single, large information system development effort.

Our audit covered the period April 1997 through June 13, 1997, and was conducted in
accordance with Government Auditing Standards issued by the Comptroller General of the
United States. Since the House has recently prepared its Year 2000 plan, only limited
documentary evidence was available. Thus, most of the information provided was based on
numerous interviews with officials involved in the Year 2000 issue. Also, since this review was
meant to be a “snapshot” in time, it may not include management actions taken after our cutoff
date to remedy problems reported herein. Our next review will address any such issues in full.


159

* Renovation of our other systems will also be done by the end of 1998, except for a
portion of the Government On-line Accounting Link System (GOALS) which
collects, edits and transmits intergovernmental accounting data between FMS and
cuher Federal program agencies, That system is scheduled for completion in mid-

* By this summer, validation testing will be well underway internally aiid also with
‘our customers. Testing will continue until we are certain that all systems are
ready.

To provide a more up to date report on FMS's year 2000 program than was reflected in
the mid-February report to OMB, I have attached several charts (charts A, B, and C) to my
testimony that show the status of FMS’s 62 mission critical systems. Since that report was
compiled, we have implemented 2 replacement systems and completed repair on one system
requiring renovation, bringing to 13 the total number of Y2K compliant mission critical systems.
In addition, of the 39 systems still in need of repair, we have completed assessment on 32, 23 of
which are now in the renovation phase, and 9 are in validation testing.

In terms of problem areas, FMS is not as far along in completing its Y2K work as we
would like on our GOALS system-the system that edits and transmits intergovernmental
accounting data, FMS is planning to replace the existing GOALS system to provide new and
enhanced capabilities, however, development of all modules of the replacement system will not be
complete prior to the year 2000, Consequently, we must renovate the existing applications to
ensure that we have a GOALS system which will be year 2000 compliant after the turn of the
century. This work is now underway. We had a late start in fixing the year 2000 problem
because we had hoped to finish development of the GOALS I replacement system in time to
avoid the need to renovate the existing system. In spite of the late start, we are taking steps to
speed up the process. Our objective is to first renovate GOALS applications that are most critical


“al

Report No, S6-C40-15
Office OF The Chief Administrative Officer December 31, 1996

Office of Purchasing and Procurement

+ Develop and implement improved contract management policies and procedures and a
comprehensive contract tracking system.

+ Revise procurement approval authorities in the CAO to reduce review levels and distribute
small purchase authority to users.

fice of Publications and Distributio1

+ Modify the proposed delivery service policy to collect 2 uniform fee, per periodical, for
delivering all newspapers, magazines, and publications.

MANAGEMENT RESPONSE,

In the December 30, 1996 response to our draft repor. the Acting CAO agreed with the findings
and recommendations in this report, and indicated that currective actions have been initiated for
some steas and planned for the remaining areas. Details of the response to each Binding are
summarized under the Management Response section at the end of each finding. In addition, a
copy of the Acting CAO’s full response is provided as an Appendix to this report.

{OFFICE OF INSPECTOR GENERAL COMMENTS |

We fully concur with the initial and planned actions of the Acting CAO. These uctions are
responsive to the issues we identified, and when fully implemented, should satisfy the intent of
our recommendations.

Offca oT inspectar Caneral Pagavir
U.S. House of Representaives


80

STATEMENT OF JOHN KOSKINEN
CHAIRMAN

PRESIDENT’S COUNCIL ON THE YEAR 2000 CONVERSION
BEFORE THE
SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND
TECHNOLOGY
OF THE COMMITTEE ON GOVERNMENT REFORM AND OVERSIGHT
AND THE

SUBCOMMITTEE ON TECHNOLOGY
OF THE COMMITTEE ON SCIENCE
U.S. HOUSE OF REPRESENTATIVES

March 18, 1998

Good morning. I am pleased to be back before the subcommittees to discuss the year
2000 problem and my new role as Chair of the President's Council on the Year 2000 Conversion.

I welcome this opportunity, not only because of my prior experience in working with you
on a range of issues as Deputy Director for Management at OMB, but because of the ongoing
interest you have shown in raising public awareness about the year 2000 problem to help ensure
that computer systems are ready for January 1, 2000.

‘As you know, the President shares your concern. Last month, he issued Executive Order
13073 creating the Council, and has recently made it clear at a meeting of his Cabinet that agency
heads bear the full responsibility for the successful preparation of their agencies’ mission-critical
systems for the transition to the year 2000.

Chairman Horn, I have read your most recent report on year 2000 progress in Federal
agencies, As you know, last week OMB submitted to Congress its latest quarterly report. Both
reports share a common finding: agencies are making progress, but the rate of that progress needs
to increase. 1 think we all agree that no problem facing us is more pressing, especially since,
unlike other Washington problems, neither the President nor Congress can push the deadline back.
‘We have 653 days left until January 1, 2000, and the question is how can we work together to
ensure that the Federal Government, State and local governments, those in the private sector, and
leaders in other countries are doing all that they can to to minimize disruption to systems on
January 1, 2000.

The Council’s Role

In the days and weeks following my appointment as Chair of the President's Year 2000
Council, many people have told me that I must be in need of counseling, having resumed my


OVERSIGHT OF THE FEDERAL GOVERNMENT'S
YEAR 2000 EFFORTS

JOINT HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
INFORMATION, AND TECHNOLOGY

OF THE

COMMITTEE ON GOVERNMENT
REFORM AND OVERSIGHT

AND THE

SUBCOMMITTEE ON TECHNOLOGY

OF THE

COMMITTEE ON SCIENCE
HOUSE OF REPRESENTATIVES

ONE HUNDRED FIFTH CONGRESS
SECOND SESSION

MARCH 18, 1998

Committee on Government Reform and Oversight

Serial No. 105-153

Committee on Science

Serial No. 105-55

Printed for the use of the Committee on Government Reform and Oversight and
the Committee on Science

ae

U.S. GOVERNMENT PRINTING OFFICE
50-564 CC WASHINGTON : 1998

For sale by the U.S. Govemment Printing Office
Superintendent of Documents, Congressional Sales Office, Washington, DC 20402

ISBN 0-16-057700-4



106

STATEMENT OF
MICHAEL P. HARDEN, PH.D.
PRESIDENT AND CHIEF EXECUTIVE OFFICER
OF CENTURY TECHNOLOGY SERVICES, INC.
BEFORE THE
SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
INFORMATION, AND TECHNOLOGY
COMMITTEE ON GOVERNMENT REFORM AND OVERSIGHT

HOUSE OF REPRESENTATIVES

MARCH 18, 1998

Mr. Chairman and Members of the Subcommittee:

1am pleased to appear before the Subcommittee to discuss the Year 2000 problem. I
appreciate the opportunity afforded me to present to you, and the American people, what
I believe to be a critical, and perhaps even fatal aspect of the government's ability to
successfully deal with this massive problem. That issue is the possible inability of the
Federal government to provide, acquire, or maintain sufficient programming resources to
tackle the Year 2000 Problem in the short time remaining before January 1, 2000.

With only 653 days remaining, the prospects of achieving success appear ever more
remote. As we move toward the Year 2000, our ability to achieve success becomes more
dependent than ever on our ability to apply the necessary resources to the problem. Since
there simply aren’t enough programmers available to fix every system that may be


129

ple who are involved in the software design and implementation to
deliver a product. And I’m interested that they are responsible and
liable for what they do.

So when you write Mrs. Maloney, if you would just include a lit-
tle line in there about the liability clause which has to do with ac-
countability, to me.

[The information referred to follows:]

In addition to the normal performance and warranty conditions that apply to all
government contracts, we are handling this issue by making sure that agencies ac-
quire information technology (IT) products and systems that are Y2K compliant, as
required by law. Implementing procurement guidance was developed for inclusion
in the Federal Acquisition Regulations (FAR) with the help of the Chief Information
Officers Council’s committee on Y2K. This guidance was issued on January 2, 1997,
in Federal Acquisition Circular 90-45 (62 FR 273). It requires contractors to supply
only Y2K compliant products. We believe that this guidance, along with our general
guidance to agency heads that they are personally responsible for year 2000 compli-
ance, is addressing this issue.

Mr. KOSKINEN. Right.

Mr. SEssions. I'd appreciate that. And thank you, Mr. Chairman.

Mr. Horn. I thank you very much. And I thank the panel. You’ve
all given us excellent testimony.

And at this point I’m going to turn over the chair to Mrs.
Morella, and to swear in the second panel. We do have a call to
vote on the floor, so after swearing you in, we’re going to have to
recess until we can come back, and Mrs. Morella will be presiding
or Mr. Sessions as vice chairman will preside.

Mr. KOSKINEN. Thank you both.

Mr. Doparo. Thank you.

Mr. HARDEN. Thank you.

Mrs. MorELLa [presiding]. This is a time where we just have so
many things happening simultaneously. So I want to thank the
first panel also, and ask the second panel if they will come forward.

Constance Craig, Assistant Commissioner, Information Resources
Financial Management Services of the Department of the Treasury;
Jim Flyzik, who is the Acting Chief. Information Officer, Depart-
ment of the Treasury, here in Washington; Arthur Gross, Associate
Commissioner for Modernization and Chief Information Officer of
the Internal Revenue Service, Department of the Treasury; and
Dennis Schindel, who is the Deputy Assistant Inspector General for
Audit, Department of the Treasury, again here in Washington.

I think we’ve got everybody here. I’m going to ask you, because
it is the policy of this subcommittee to swear in everybody who's
going to testify, if you will raise your right hands.

[Witnesses sworn.]

Mrs. MoreLLA. Thank you very much. The record will dem-
onstrate affirmative responses. And at this point we're going to re-
cess for 15 minutes so that we can cast votes. So you can relax, un-
wind, and we'll be ready to go.

[Recess.]

Mr. SESSIONS [presiding]. The Subcommittee on Government
Management, Information, and Technology will now come to order.

I want to advise everyone who’s in the room, especially those
that are on this next panel, if for some reason you do not under-
stand what I’m saying, or if I’ve said it incorrectly, please correct


157

DEPARTMENT OF THE TREASURY

Financial Management Service
Statement of Constance Craig

Assistant Commissioner for Information Resources of the
Financial Management Service

for Presentation to the House Government Reform and Oversight
Subcommittee on Government Management, Information, and Technology,

and the House Science Subcommittee on Technology

Chairman Hom, Chairwoman Morella, and members of the Subcommittees, thank you for
the opportunity to appear today to discuss the Financial Management Service's (FMS) progress in
meeting the challenges posed by the year 2000 (Y2K) computer problem. In my capacity as
Assistant Commissioner of Information Resources, I have the responsibility for making the
program decisions to ensure that FMS computer systems are Y2K compliant.

‘The highest priority of the Financial Management Service is to adapt its mission critical
computer systems to the century date change. FMS is devoting all possible resources to ensuring
that the day-to-day services we provide to the American people, on behalf of other Federal
agencies, will not be disrupted on January 1, 2000 or thereafter.

During FMS's appropriations hearing on March 5, Representative Jim Kolbe made the
observation that FMS is one of the two or three Federal agencies that absolutely must meet the
year 2000 deadline. We agree - FMS plays a central and critical role within the government.
Virtually every Federal agency depends on FMS to facilitate the issuance of payments, collection

of revenue and delinquent debt, and accounting for the government’s receipts and outlays,




107

affected by the Year 2000, the law of supply and demand takes over. We are already
beginning to see this happen. In the last year, the number of open IT jobs has nearly
doubled. Programmers are now demanding and receiving salaries in the six figure range,
with “retention” bonuses to keep them from leaving for greener pastures elsewhere. As
the contention for these resources increases, so will the salaries that must be paid to
attract and retain these programmers. Indeed, it is estimated that computer programmer

salaries will double every six months through the duration of this problem.

Not applying sufficient resources today to fix the problem means that more resources will
be required later to accomplish the fix in time. By increasing the demand for
programmers, competitive forces will increase their salaries. So not only will we need
more programmers, but the hourly cost for this talent will also rise. Every wasted hour

today may cost us three or four times as much later for that same hour of work.

How will the government be affected? In at least five different ways:

1. Contractors that bid and won government contracts a couple of years ago on a
“fixed fee” basis, did so on a cost model that did not account for this new, rapid
rise in programmer salaries. Today, these contractors find that they must now pay
significantly more per hour for the same resources to fulfill their contracts. Since
the contracts are “fixed fee,” there is no capabil

yy to pass the increased labor
expense along to the government, so profits are greatly diminished. In some cases,
each hour worked on a contract may actually lose money for the contractor. The
result is that these contracts will either suffer diminished quality, or that they will
not be re-bid as they come up for renewal, or that the bid price will be so high as
to make the cost prohibitive to the government.

2. Government employees in Information Technology will see the rising salaries and
bonuses in the private sector continue to increase to a point where the temptation
to leave the government to take advantage of this opportunity is just too good to


28

HIR was directed by the CHO Resolution to submit a report on the specific issues that must be addressed in
order to retire the IBM mainframe system following retirement of the major legacy systems (MIN, ISIS,
LIMS, and FMS). The ensuing HIR draft report, dated September 5, 1996, was submitted to the CAO for
review prior to submission to the CHO. In its report, HIR recommended that prior to the retirement of the
‘mainframe, the House should adopt a client/server migration strategy that included applications on the
‘mainframe, support for extemal customers, and pre-retirement maintenance issues for the mainframe.
However, the then CAQ'S response fo HIR, dated October 1, 1996, rejected the report noting that it lacked
“... an objective cost and time-driven presentation of concrete altematives.” The then CAO noted that he
would recommend to the CHO the retention of a reputable outside organization to provide a mainframe
retirement plan to replace the mainframe applications with commercial off-the-shelf (COTS) client/server
solutions in the shortest possible time-frame. Subsequent action on the part of the then CAO to formally
request approval from the CHO to implement this recommendation was never carried out. These false
starts and inactions indicate that the existing HIR and CAO management oversight process was inadequate
to ensure that the goals and objectives were accomplished.

HIR Procurement And Budget Documents Misrepresent HiR’s

fait ¢ Migration Position

In November 1996, a $257,319 purchase order request from the CAO was approved by the CHO
authorizing the replacement of the mainframe processor with a smaller and less expensive CMOS‘
‘ainframe processor. The justification given by the CAO was that this proposal was an integral part of
“... the mainframe migration plan to be forwarded by December 15, 1996.” Though the purchase order
‘was approved and the CMOS processor installed, we found no further correspondence between the CAO
and the CHO regarding the mainframe migration plan,

During our HIR management review, the HIR Strategic Planning manager told us that HIR’s position was
that no formal decisions concerning whether or not to migrate trom the mainframe had been made. This
appears to be in conflict with the HIR FY98 budget proposal® which states that a $323,000 increase in the
Integration Group's budget would be“... to migrate services from the mainframe to the 3-tierclienuserver
architecture in FY98." When we pointed out tis discrepancy, HIR officials indicated that the increase was
primarily due to the request for contract services for the Year 2000 conversion effort. However, the Office
of Finance's Budget Director told us that they thought the funds were earmarked for the client/server
solution as documented in the budget request. When we informed the Budget Director of HIR’s response
to that question, he noted that other funds were clearly identified in the budget for Year 2000 purposes, and
this was the first Budget had heard of this claim by HIR.

‘The justification provided for the $257,319 purchase order for the CMOS server and the $323,000 budget
incréase for a migration effort that does not exist. certainly brings into question the degree of reliability the
House can place on prior HIR budget requests-the justifications were not what they appeared to be.

use Strategic Vision Of Retiremer d Mis Of House Legacy
sy: uted By HIR. it

The then Administrator stated that the Year 2000 plan was, in fact, a migration plan whose objective was to
move toward a network-centric environment. He also told us that part of the Year 2000 plan was to
conduct a costbenefit analysis for each mainframe system and decide the best course of action to take, ic.
migrate to client/server platform, outsource to another agency, or remain on the HIR mainframe. There
‘was some confusion, however, in that the Year 2000 project leader informed us that there were 10
resources available to carry out such an analysis. Furthermore. when asked his opinion as to whether a
formal decision had been made to retire the mainframe, the then Administrator stated “that prior political

* CMOS--Complementary Metal Oxide Semiconductor IBM Multiprise 2000 Model 135

enterprise server.
*HIR Budget Justifications Fiscal Year 1998, Integration Group, Fiscal Year 1998 Non Personne!

Budget Request. 9.28


87

act with one another and with the private sector. As was pointed
out today, there needs to be Governmentwide priorities.

For example, to pay benefit payments at the Federal level, and
even to pay the Government’s bill on time, individual agencies need
to interact with the financial management service at the Treasury
Department. The Treasury Department interacts with a vast net-
work of financial institutions to actually process and carry out
those payments. There’s a web, a network of systems, that provide
that basic Government service. The Government needs to ensure
that the priorities are set so all those system efforts are developed
at the same time, and agencies can ensure operational end-to-end
testing to make sure the system interfaces operated appro-
priatel . So, Governmentwide priorities are necessary in order to

it out.

so, it’s imperative that contingency planning be underway
right now for all agency activities. As we’ve discussed before these
two subcommittees last month, we recommended that FAA develop
contingency plans, because of the difficulties it’s facing and the late
start that it made. Also, great concern continues to revolve around
systems to pay Medicare claims. As you all know, it’s about 800
million claims a year. The Health Care Financing Administration
continues to be concerned that the Medicare contractors will not be
ready; all of them, on time, to meet the March 1999 deadline for
completing the implementation Phase.

So contingency planning in these areas where we've made spe-
cific recommendations to the agencies also needs to be done across
the Government. To assist agencies in doing that, we’re releasing
today an exposure draft of a contingency planning guide. We
worked with experts and the chief information officers were con-
sulted to develop this guide to assist organizations in developing
business continuity and contingency plans.

In addition, personnel needs must be taken into consideration
across the Federal Government. Several agencies in their last quar-
terly report reported that they and/or their contractors were experi-
encing difficulty in making sure that they were obtaining and re-
taining the proper amount of people that are needed to carry out
those activities. The CIO Council is meeting today to discuss this
issue. We recommend that they complete their strategy, not only
for retaining people currently in the Federal Government, but also
for eliminating disincentives to bring back experienced Federal re-
tired programmers to help and contribute to public service to help
the Federal Government deal with this problem.

Also in terms of perspective, as time draws closer toward the mil-
lennium, it is essential that the President’s Council and OMB have
complete and accurate reports from the agencies to have the best
available picture of what’s going on at the Federal level. In order
to do that, we’ve recommended that OMB expand the number of
agencies that are reporting in to ensure that all critical independ-
ent agencies are reporting as well as the 24 major agencies of the
Government, and that there be independent testing and validation
taking place for critical activities, particularly testing and contin-
gency planning.

It is also important, beyond the Federal Government level, to get
a broad perspective on what is going on nationally and internation-


82

responsibilities to actually do the work necessary to fix the year 2000 problem. Not only would
this require an extremely large staff, it would be a misguided effort. ‘The work of fixing the year
2000 problem can only be done by those who are on the front lines. Senior executives responsible
for public and private sector organizations are responsible for ensuring that their mission-critical
systems are ready.

1am adopting this approach in part because it is my experience as a crisis manager in both
the public and private sectors that once you get the senior people in an organization asking the
tight questions -- Do we have a problem? What is the nature of that problem? What should we
be doing to fix it? ~ the work gets done. I believe that most senior executives in the Federal
agencies are asking these questions, and the Council's job is to ensure that leaders outside the
government are asking them as well.

In short, the President's Council on the Year 2000 conversion needs to be a catalyst, to
ensure that individuals in the public and private sectors are aware of the problem and doing all
they can to fix it. The Council also should be a facilitator, to promote the fruitful exchange of
ideas and information on best practices and the resolution of common problems. Finally, the
Council should be a coordinator, to ensure that resources are being used effectively across
organizational boundaries.

Let me now tum to describing more specifically what the Council will be doing.

Working with the Agencies

First, the Council will monitor the progress of those responsible for fixing the problem in
Federal agencies. I have already begun to embark on what I fondly refer to as my “Agency of the
Day Tours,” where I am meeting with agency heads, their deputies, their CIOs, and those leading
their year 2000 efforts to discuss their situations. In each meeting, I have been asking three key
questions; What are your major risks? What are the most significant obstacles to removing those
risks? What contingency plans are appropriate in light of that analysis?

Tam also talking to agencies about the external systems with which they interface,
particularly their data exchanges with State and local governments. Even if all of the Federal
Government's mission-critical systems function effectively on January 1, 2000, the public will still
suffer substantial adverse consequences if our systems cannot communicate with the external
systems with which we need to exchange data to operate key Federal programs.

In January, OMB instructed agencies to inventory all of their data exchanges with outside
parties by February 1, 1998, and to coordinate with those parties by March 1, 1998 to determine a
transition plan, The agencies are making good progress in this area. Of the 24 agencies that
report regularly to OMB, 19 have completed their inventories of data exchanges and indicated
that communication with outside parties either was complete or would be complete by March 1,


10

In the coming months, | intend to work very closely with the Council,
especially assisting in the development of initiatives to ensure that the
private sector is moving forward with necessary dispatch.

Meanwhile, Congress - not just the Science Committee and the
Government Reform and Oversight Committee, but also a number of other
committees — will continue to hold hearings to determine the scope and
impact of the problem on the American public and to monitor agency
progress.

The Council and Congress must jointly seek solutions.
It is clear that we cannot meet a new era of opportunities, if two
years from now, our nation’s computers are moving backwards instead of

forward.

We must create a new paradigm of collaboration, for we all know that
we are facing an unforgiving deadline and time is running out.

The American people are expecting no less from us.


52

4. Coordinate data exchange issues with the external organizations that interact with the
House’s systems.

5. Adopt the standard Year 2000 contract language and incorporate this language into all
procurements relating to information technology purchases.

6. Expedite decisions regarding OSM and FMS Payroll replacement efforts, closely monitor
these activities to ensure timely completion, and prepare contingency plans, as necessary.

Management Response

On September 9, 1997, the CAO concurred with the recommendations in this finding (see
Appendix).

The CAO agreed to establish formal project management controls and techniques. Specifically,
the role of the Year 2000 project leader and its establishment as a full time position will be
addressed at two levels within the CAO. First, the CAO will form a Technology Coordination
Task Force (Task Force). This group will report to the CAO and consist of each Associate
Administrator and one of their staff, with the chairman being appointed by the CAO. The mission
of this group will be to ensure that information technology issues, including the Year 2000
project, are coordinated throughout the CAO. Under the guidance of the Task Force charter and
with CHO input, they will develop a CAO strategy for the deployment of mission critical
administrative applications, and will work to ensure that the plans and initiatives of each CAO
organization are consistent with overall CAO goals, including interoperability. As part of this
strategy, the Task Force will solicit input from Member, Committee and House Officer users and
it will honor user needs criteria. In addition, the Task Force will examine industry best-practices
to determine the best approach for the House and will use an acceptable SDLC process. The
CAO plans to have the Task Force operational by the first week of October 1997. Second. the
HIR Associate Administrator will designate a project manager who will be responsible for the
management and coordination of Year 2000 issues across the HIR groups, the CAO, and extemal
organizations with which they exchange data. This position will ensure that the technical details
of the Year 2000 project are fully addressed. The project manager will be responsible for
ensuring the timely completion of all Year 2000 work and oversee development of detailed system
plans for each application--releasing updates of Year 2000 plans as necessary. The project
manager’s first tasks will be to establish schedules, milestones, and priorities, including addressing
the Year 2000 audit recommendations. Working with the HIR Associate Administrator, the
project manager will establish priorities and resource availability within the HIR groups. Critical
issues will be escalated to the CAO as necessary. This position will be a full time assignment.
staffed by either an HIR employee or a contractor. The CAO plans to have the project manager
established by the end of October 1997.

In addition, the Task Force Charter will include the authority and responsibilities for the Year
2000 initiative. This charter will define the role of the group in developing an overall Information
Technology strategy for the CAO organization. The primary objective will be to ensure that new


169

Ms, Craic. I think that most Americans believe Social Security
checks and direct deposit Payments come from Social Security, and
that IRS payments come from IRS. So, we don’t really interface di-
rectly with the public, but we’re working very closely with our sis-
ter agencies to help them in any way we can.

Most of our customers really are the Federal program agencies.
They pass data back and forth to us, and we are working closely
with them. We are also issuing Treasury Financial Management
bulletins to keep them apprised of what we're doing.

Mr. SEssIoNs. Good.

I would now like to direct my questions to Mr. Schindel. We have
talked about the ability to keep people on the payroll, and there is
some indication—Mr. Gross indicated about 650 contractors on the
payroll at this time. Do you believe, from your inspector general ca-
pacity, that you are going to perhaps request of them to keep these
people on the payroll for 1 month or 2 afterward or 3 months, so
that you can complete, an evaluation and ensure compliance that
you're in line. Or there been any discussion along that line? Or
are they just fein. to get them off the payroll, and then you worry
about fixing the problems later? In other words, I’m talking about
burning-in of the process and then your evaluation and you bein;
able to go back and get properly fixed anything that’s wrong, an
have you had that discussion with them about having those con-
tractors available?

Mr. SCHINDEL. We have not had a discussion on that. Our expec-
tation would be that the documentation would be available for us
to go in and validate or verify that the problems have been fixed;
the conversion has taken place, and we would be able to go back
to the contractor, even if they are no longer working, to get that
information.

I know that, as I mentioned in my testimony, the IRS Chief In-
spector’s Office has been doing extensive work in the IRS from an
audit perspective, and they have been, for instance, looking at lines
of code that the IRS has certified as already being converted and
renovated, and they have actually gone in and reviewed a sample
of that code themselves to verify that, in fact, that is the case.

Mr. Sessions. Good.

If you'll please allow me just 1 minute, please?

[Pause.]

Mr. SEssions. In summary, I have heard the testimony today,
not only from Mr. Koskinen, but that others have given. I believe,
this committee has a realistic sense that the administration not
only is serious about the endeavor that is before them, but that
this panel has, if considered representative of the entire Govern-
ment, if we extrapolate it, which I believe it is, you’ve got some
complex operations, including Customs and the IRS, Social Secu-
rity. I find that I have not heard any competing testimony, that no
one is complaining that they’re not getting the resources that they
need. I’ve not heard anyone say that they cannot get the attention
of the President or the Vice President to make these tough deci-
sions.

I have not heard anything from this committee say that they are
not being listened to, that their boss is hearing what is going on,
nor have I heard anyone give us any bit of testimony that would


| 94

. The Securities Industry Association established a Year 2000 committee in
1995 to promote awareness and since then has established other committees
to address key issues, such as testing.

. The Electric Power Research Institute sponsored a conference in 1997 with
utility professionals to explore the Year 2000 issue in embedded systems.

= Representatives of several oil and gas companies formed a Year 2000
energy industry group, which meets regularly to discuss the problem.

= The International Air Transport Association organized seminars and
briefings for many segments of the airline industry.

In addition, information technology industry associations, such as the Information
Technology Association of America, have published newsletters, issued guidance, and
held seminars to focus information technology users on the Year 2000 problem.

ADDITIONAL ACTIONS CAN BE TAKEN,
TO REDUCE YEAR 2000 RISKS

As 2000 approaches and the scope of the problems has become clearer, the federal
government's actions have intensified, at the urging of the Congress and others. The
amount of attention devoted to this issue has increased in the last year, culminating with
the issuance of a February 4, 1998, executive order establishing the President's Council
on Year 2000 Conversion. The Council Chair is to oversee federal agency Year 2000
efforts as well as act as spokesman in national and international forums, coordinate with
state and local governments, promote appropriate federal roles with respect to private-
sector activities, and report to the President on a quarterly basis.

This increased attention could help minimize the disruption to the nation as the
millennium approaches. In particular, the President's Council on Year 2000 Conversion
can initiate additional actions needed to mitigate risks and uncertainties. These include
ensuring that the government's highest priority systems are corrected and that
contingency plans are developed across government.

Setting Priorit ‘tical

‘Agencies have taken longer to complete the awareness and assessment phases of their
Year 2000 programs than is recommended. This leaves less time for critical renovation,
validation, and implementation phases. For example, the Air Force has used over 45
percent of its available time completing the awareness and assessment phases, while the
Gartner Group recommends that no more than about a quarter of an organization's Year
2000 effort should be spent on these phases.

Consequently, priority-setting is essential. According to OMB's latest report, as of
February 15, 1998, only about 35 percent of federal agencies’ mission-critical systems
were considered to be Year 2000 compliant. This leaves over 3,500 mission-critical


168

Mr. Fiyzik. At the Department level, I can report I’ve already
testified as to the number of data exchanges, which, of course, are
dealing with outside entities, the broker community, State and
local governments, and other entities that we inte elec-
tronic data with. So that’s one set of customers being addressed
through that sort of formal process.

ve also had memorandums that were signed by the Assist-
ant Secretary for Management, and Chief Financial Officer, which
went out to every Assistant Secretary in the Treasury and every
bureau head in our component bureaus across Treasury, asking
each of those entities to make contact with all of the relevant enti-
ties they do business with, to begin having a discussion to assess
whether or not there are ‘impacts that we are missing in supply
chains or impacts in the way that we will be conducting business
after the year 2000. That process is ongoing, and we have estab-
lished a team to look at some of those impacts. We're particularly
concerned about international issues, as was brought up by the
first panel that testified here today.

At the bureau level, I defer to At and Connie.

Mr. Gross. Congressman Sessions, more than 100 million of our
customers are individual wage earners,“ind for the most part we
have sought both to reassure, but also honestly assess our progress
in this program. As you can imagine, there’s an awful lot of inter-
est in the country with respect to the IRS program. For the most
part, we have been able to provide those assurances that the sys-
tems that we have focused on are the systems that affect the indi-
vidual wage earners—the systems that process more than 100 mil-
lion tax returns each year, that issue tens of millions of refunds
each year, and that those systems, indeed, will be converted timely,
and we have extended those reassurances.

We also have a set of business partnerships with the commercial
sector, the tax practitioner community, for example, and in those
instances we have worked more intimately on a case-by-case basis,
and fortunately, the IRS possesses a fairly well-evolved infrastruc-
ture of contacts and communications because each year we modify
our forms and our reporting formats so that those processes and
the individuals who manage those processes have excellent net-
work relationships with those business communities. It’s through
those networks that we have kept business informed of our

Pee Se

Srssions. At any point do you believe—and, Ms. Craig, I’m
going to let you respond also—Mr. Gross, do you believe that you
will be communicating with customers to be proactive, to say, yes,
we feel like we've got it solved, but, “Customer, would you please
just do your own cross-check?” Do you believe that that’s a part of
a responsible statement that your agency may be making?

Mr. Gross. I think our agency, with respect to that issue, Con-
gressman Sessions, I think what we have done is primarily work
with the business community, the tax preparation community, and
its through those relationships that we have communicated those
thoughts.

Mr. SEssIons. Good. OK.

Ms. Craig.


73

Report Ne, 96:CAO-1S
Office Of The Chief Aaministrative Officer December 31, 1996

+ Testing and Debugging;
+ Regression Testing; and
+ Life Cycle Management.

Currently, HIR has begus an initial assessment of Year 2000 issues, but no documented plan
exists, Each Director is oversecing the work in their individual areas and systems, but no team
leader has been assigned to leud the effort, In addition, there are office level systems within the
House environment that are not under the direct control of HIR, although HIR assists in
maintaining these systens,. However, there is no assessment of these systems being conducted at
this time.

HIR has not developed a pian for addressing the Year 2000 issue because of the expectation that
conversion to a new distributed client-server architecture will replace its existing /egacy
mainframe architecture, and the interim new software to be installed will adequately address
Year 2000 issues. HIR’s “Report on Issues Related to Retirement of the {8M Meinframe”
(presented to the CAO on September 5, 1996) recommends not upgrading applications that exist
on the mainframe system, since the expectation is that the mainframe and its technology
applications will no longer be in use by the Year 2000. Consequently, staff are not doing the
work to upgrade applications.

However, no analysis has been done to determine the impact of phasing out the legacy
application systems and which legacy application systems should remain. In the case where the
House decides to continue using certain mainframe applications, those applications sould be
‘examined to correct any Yeur 2000 deficiencies.

Failure to prepare for the Year 2000 could:
© Generate incorrect data,
© Generate incomect management reports

‘+ Halcnormel operations of critical systems such as Members payroll, stoff payroll, and Human
Resources.

In order to minimize the potentiaj impact that the Year 2000 issue wil! have on the existing
maintrame, HIR should immediately begin planning what actions it intends to take to address
these issues. As recommended during the House testimony referred to above, [IIR should
consider a plan which includes a systems inventory, impact and code analysis, code conversion,
testing and debugging, regressing testing, and iife cycle management, In addition, HIR should:

+ Esablish target dates for completing different phases of the conversion process and track
the achievement of those milestone dates,

+ Proritize issues into critical, secondary. or tertiary issues, and

‘Giles of inspector General
U.S. House of Representatives


34

EXHIBIT A
Legacy Svstem Descriptions and Disposition
Legacy System | Functional Description I “Year 2000 DispositionTM
Group A
LIMS = Legislative ‘A composite of mission eritieal systems that | Remain on mainframe until 2008, then
Information support House legislative data collection and_| replace with clienvserver system

Management System

processing functions.

NCOA - National

Supports updates of Member office mailing

Remain on mainframe, no planned

Change of Address lists “replacement”
MONIES - ‘Supports the collection and pricing oF Remain on mainframe, ao planed
Management of individual call records from the House of —_| replacement

Network, Income,
Expense, and Services

Representatives System 85 Switch and the
1000 district offices.

HIR Inventory

Maintains records of all hardware and
software items acquired by the House offices.

Minor ADABAS system, to remain on
mainframe. no planned replacement

Photography

Billing system for the Office of the
Photographer which charges House offices
for photography services.

Minor ADABAS system. to remain on
‘mainframe, no planned replacement

Recording Studio

‘Automated scheduling, tacking and billing
system for the House Recording System.

Minor ADABAS system, to remain on
mainframe, no planned replacement

Labby Act

Provides for tracking and logging of lobbyists
and the quarterly reports they are required to
file

Minor ADABAS system, to remain on
mainframe, no planned replacement

Parking

“Tracks parking stickers issued by the Oifice
of the Garage.

Minor ADABAS system. to remain on
mainframe, no planned replacement

Group B

FMS Payroll - Financial
Management System
Payroll

Supports the House Human Resources Office
with the production of the House payroll

Either replace with COTS clenvserver
system of outsource

OSMIOES - Office
Systems Management!
Office Equipment
Systems

Supports and maintains the House-wide
inventory system for office equipment,

Replace with COTS clienvserver
system

MINISIS - Member
Information Network /
Integrated Systems and
Information Services

‘A composite of information and research
sources especially designed for House
Members, committees. and staff.

Retire and replace with Web browsers

Group €

‘Ad Hoe Systems

These sy stems are only critical to small
groups of users, ¢g., Page Profiles. Franking
Standards, and Press Gallery.

“Migrate to desktop systems

“These applications are commercial off-the-shelf software (COTS) products

Source of disposition comments is HIR's May 16, 1997 Year 2000 Plan (revised).

10



46

approach, which involves converting from a 2-digit to a 4-digit date field, requires the greatest
amount of resources since all date related files and programs which handle date routines would
have to be identified and then altered. However, HIR has not prepared a level of effort analysis
for this initiative which would help solidify resource requirements for individual tasks. While our
cost estimates may be high, we would rather ensure that the level of funding and the number of
resources are adequate to complete this critical initiative, as opposed to using what we believe are
unsupported and unrealistic estimates

HIR Has Not Budgeted Sufficient Funds For The Year 2000 Conversion Initiative

HIR estimated the Year 2000 initiative will cost about $1,243,000 but has not ensured adequate
funds have been budgeted for this initiative. The Year 2000 plan calls for $368,000 in 1997 to
initiate the work, however, this amount was not incorporated into HIR's FY 1997 budget request.
In fact, HIR did not specifically request any funds in FY 1997 for the Year 2000, but has
subsequently made $20,000 available.

The Year 2000 plan also calls for $755,000 for FY 1998, but to date no funds have been
approved for 1998. Again, the total amount anticipated for FY 1998 was not incorporated into
HIR's budget justification process. We found that HIR’s FY 1998 budget submission to the
CAO requested only $450,000 for the Year 2000 conversion effort, but contained no details to
support this cost estimate. We were told this amount represented all the money HIR could
“scrape together” without disrupting other projects. Because this estimate appeared low, the
Acting CAO subsequently added $500,000 to the request before it was submitted to the
Subcommittee on Legislative of the Committee on Appropriations. The Year 2000 plan estimates
that $120,000 is needed for FY 1999, however, the FY 1999 budget process has not started. The
chart below illustrates the funds planned, requested, and funded to date for Year 2000.

Year 2000 Budget

Year Plan’ Request Funded

FY 1997 ~ $20,000

FY 1998 $230,000 —_=

Subtotal $950,000 $20,000
EY 1999

Totals To Date $1,243,000 $950,000 $20,000

Because HIR has not ensured the budgeting of sufficient funds, they have not procured the
necessary resources critical to the Year 2000 initiative. For example, HIR has not been in a
position to purchase any software tools to assist with software conversion or hire a contractor for
LIMS to assist with the Year 2000 renovation. Even if the FY 1997 funds and the FY 1998
requested funds (totaling $970,000) are available, this funding level falls short of HIR’s projection
(S1,125,000) by $153.000.

dination Of Year 2000 Solutions Outside The House [s Needed

. ‘These numbers first appeared in an April 1997 draft HIR’s Year 2000 Plan and do not link to HIR's
budget process,


115

the figures on what they thought fiscal year 1998—the year we're
in—would be devoted to this over the next period up to the year
2000. And the estimate, as I remember, was the $2.3 billion that
Mrs. Morella mentioned. And we just didn’t believe it, and I think
we're right. And we held a hearing on that number alone, prac-
tically, and General Page in the Pentagon said: “Well, $1 billion of
that is mine; they asked for a figure and I gave them a figure, and
we haven't even started ascertaining what the code looks like. And
we don’t know now.” I guess they filled that Assistant Secretary
spot over there but we haven’t heard much from them. But the
agreement of Dr. Raines, certainly, and myself was to take most of
this money out of reprogramming at the end of the year.

Now, the appropriations committees did provide some money in
some of the areas. But have you had a chance yet to look at the
reprogramming situation and the degree to which that could be
done and what might be expected around August and September
at the end of this fiscal year that could be applied to this?

Mr. KOSKINEN. I have not. I don’t have any additional informa-
tion on that question.

Mr. Horn. OK. I think you're going to be closer to $10 billion
when we're done with this.

I now yield 5 minutes to the gentleman from——

Mrs. MorELLaA. Mr. Chairman, if I could just add to that question
to Mr. Koskinen to think about: would you then ask for a supple-
mental appropriations if you needed it?

Mr. KOSKINEN. At this point, obviously, the critical issue is to
solve this problem and the resources need to be found. As Chair-
man Horn noted, the process thus far has been for OMB and the
agencies and Congress to work within the agencies’ present budg-
ctary structures. We don’t, at this point, have any reason to £ be-
yond that. There have been needs for additional authority for re-
programming, to allow funds to be moved. In most cases, Congress

as granted that authority. But OMB in their ongoing management
and oversight of the agencies, will continue to review the budget
situation. I do not think it is appropriate for the Council to perform
for it to become the new budget agency on this issue. I think our
function is: if there is a critical need that the agencies have that
we will be supportive of and work with Congress to give you our
assessment of their needs.

Mr. Horn. I thank the gentleman. I think reprogramming will
solve a lot of it.

Five minutes to the gentleman from Michigan, Mr. Barcia.

Mr. Barcia. Thank you, Mr. Chairman.

I have two questions for Mr. Koskinen. Mr. Koskinen, you men-
tioned that agencies completed an inventory of their data ex-
changes with outside parties by February 1.

Mr. KoSKINEN. That was the goal, yes.
wt BARCIA. And will have determined a transition plan by

Mr. KosKINEN. Yes. The latest OMB report notes that five agen-
cies are still working on that matter. One of the issues I’m stress-
ing with every agency head and cabinet officer is that it is critical
for us to collect that information. We will talk about that issue this
afternoon with the chief information officers as well.


51

¢. Purchase software tools and secure a contractor, as necessary, to assist with
conversions and testing.

f. Determine whether all systems are needed and on which platform they will
reside.

g. Attend the CIO Council Subcommittee on Year 2000, as appropriate.

2. Revise and prepare follow-on document(s) to the Year 2000 plan which include the
following activities.

a. Prepare a schedule of Year 2000 tasks (e.g., PERT" chart concept) showing
milestones and interdependencies of issues/organizations.

b. Asnecessary, re-prioritize and accelerate out-year projects in the Year 2000
plan to meet remaining government milestones.

c, Develop detailed implementation plans for each system to be converted.

d. Expeditiously develop a follow-on document to the Year 2000 plan which
addresses, in detail, the last three phases of the Year 2000 effort for review and
approval by the CHO.

e. In preparing the follow-on document, as recommended in 2.d. above, develop
testing strategies, plans, milestones, and ensure testing capacity is available,
and quality assurance is an integral element.

3. As necessary, revise the Year 2000 cost estimates and prepare revised budget
requests based on these new figures.

"" Program Evaluation and Review Techniques,


136

Mr. SESSIONS. Thank you so much.

Our second witness today will be Mr. Jim Flyzik, CIO at Treas-
ury. And Mr. Flyzik, if I butchered your name, if you will please
correct me, I'll attempt to not do that in the future.

Mr. FLyziK. You've got it exactly correct, sir. Thank you very
much. And I appreciate the opportunity to be here. My detailed
statement has been submitted. ‘4 will synopsize.

Thank you for the opportunity to appear today to discuss the De-
partment of the Treasury’s progress in the year 2000 computer
problem. The year 2000 problem is our highest priority information
technology challenge. I am confident that Treasury has a strong
program in place to address this challenge, and while there is
much work ahead of us, we have made significant progress to date.

The Assistant Secretary for Management and Chief Financial Of-
ficer has the overall responsibility for our year 2000 date transi-
tion. As the Deputy Assistant Secretary for Information Systems
and the Chief Information Officer, I am the overall program man-
ager for this effort. The day-to-day responsibilities for this program.
reside in my office. In addition, we have contracted with several
firms, specializing in this work to assist us in our oversight and
management roles. Attached to my statement, I submitted an over-
all diagram, depicting the organization of this program for us.

Secretary of the Treasury Rubin is briefed periodically by myself
on the status of our year 2000 program, along with the istant
Secretary for Management; and the Assistant Secretary for Man-
agement and I meet each week with bureau heads to review their
progress. Working groups meet regularly for the Information Tech-
nology Team, the Non-Information Technology Embedded Chip
Team, and telecommunications components of our program.

The Department requires each bureau and office to submit de-
tailed monthly status reports. And additionally, the Secretary of
the Treasury has mandated that each bureau and office head select
an executive official to be in charge of their program. This individ-
ual, typically at the CIO or CFO level, or higher, is responsible for
ensuring their program is being addressed in a timely manner.

I would like to just describe briefly a status of some of our
progress to date. We have now identified 321 mission-critical IT
systems, and 272 mission-critical non-IT systems. At present we
have completed the assessments for 97 percent of our Treasury
mission-critical IT systems. We have renovated 51 percent of the
mission-critical IT systems that need to be converted, And we can
now report 119 out of 321 of the total mission-critical IT systems
are year 2000 compliant. Treasury's largest bureau, the Internal
Revenue Service, has renovated 75 out of 126 of its mission-critical
IT systems.

I believe that as a department we have made significantly more
progress that has been indicated by these figures alone. We are
conservatively not reporting progress until entire systems have
been renovated and tested.

For example, the Customs Service, like the IRS, manages its ren-
ovation efforts by components within systems. Customs reports on
three mission-critical systems, all of which require repair, which in-
clude 178 components. So although we report none of these overall
systems being completed renovation, testing, or implementation,


47

The House, like other organizations facing the Year 2000 issue, is vulnerable in areas outside of
its control, such as interfaces with the automated systems of other Legislative and Executive
Branch agencies, and software and hardware provided by commercial vendors. While the Year
2000 plan generally addresses the coordination issue through the issuance of compliance letters
with vendors and other organizations (e.g., Library of Congress, Congressional Research Service,
etc.), we suggest that a more formal coordination effort be employed in dealing with the latter
group. This is especially needed since some of the Legislative modernization efforts are going on
concurrently. While the House works on making its systems compliant, they still face the
possibility of failure if they interface with other non-compliant systems. For example, if
communication software at any of the Legislative Branch agencies (such as the Architect of the
Capitol, Government Printing Office, Congressional Budget Office, and Library of Congress) on
CAPNET? is not Year 2000 compliant, this may adversely impact the entire network. We raised
this issue at a June 12, 1997, meeting of the Legislative Branch Financial Managers Council to
find out if this possibility had been considered as part of their Year 2000 planning efforts, The
possibility of someone else’s non-compliant system adversely affecting the operation of the
CAPNET had not been considered. Architect of the Capitol representatives indicated there had
been no Year 2000 discussions or considerations regarding CAPNET. (CAPNET is managed by
a committee comprised of representatives of each Legislative Branch organization and is currently
chaired by a Senior Engineer of HIR Communications. CAPNET has traditionally fallen under
the umbrella of the Legislative Branch Telecommunications Network, a working group comprised
of each Legislative Branch Information Systems Organization, chaired by the Architect of the
Capitol.) Members of the Council expressed concern that action had not been taken with respect
to CAPNET and the Architect of the Capitol representatives promised to arrange a meeting as
soon as possible to discuss this matter. (That meeting had not been scheduled at the time this
report was completed.)

Also, since LIMS receives data from several extemal sources, including the Executive Branch,
LOC, Senate, and Government Printing Office, it is essential to coordinate data interfaces with all
these groups. We found that some coordination efforts have been initiated. For example, the
Year 2000 project leader mentioned that the Office of the Clerk was currently setting up a task
force to address legislative data transfers~—which would include data exchanges involving LIMS.
Also, HIR’s Intemet Services Group participates in joint, weekly meetings to ensure a smooth
and coordinated Member [nformation Network (MIN) migration. However, contact with other
entities that exchange data with the House should be initiated and coordinated by appropriate
House officials to ensure a complete transition to Year 2000 compliance.

Warranty leeds To Be Put Into House Contracts

The Year 2000 plan states that the House will acquire only Year 2000 compliant information
technology products using standard “Year 2000 Contract Protection and Warranty Language.”
However, the House has not adopted the standard language (e.g., compliance definitions and

warranty) and thus has not incorporated it into their solicitations and contracts. The Year 2000

° CAPNET is an electronic means for exchanging documents, files, and messages among all Legislative
Branch entities and for providing access to shared information resources, including image data,


76

mission, Mr. Chairman, I will submit my full statement for the
record and summarize it here this morning.

Mr. Horn. Yes; without objection, all statements automatically

o in the record, and we'd like you to summarize it, and we'll go

lown all three of you. You have excellent testimony, Mr. Harden
and Mr. Dodaro, and then we'll put forth questions to all three of
you.

Mr. KOSKINEN. Thank you. I am genuinely pleased to be back be-
fore the subcommittees to discuss the year 2000 problem and my
new role as chair of the President’s Council on Year 2000 Conver-
sion.

I welcome this opportunity, not only because of my prior experi-
ence in working with you on a range of issues as Deputy Director
for Management at OMB, but because of the ongoing interest you
have shown in raising public awareness about the year 2000 prob-
lem to help ensure that computer systems are ready for January
As you know, the President shares your concern, and, as you
have noted, last month, he issued Executive Order 13073 creating
the Council. He has recently made it clear at a meeting of his cabi-
net that agency heads bear the full responsibility for the successful
preparation of their agencies’ mission-critical systems for the tran-
sition to the year 2000.

Chairman Horn, I have read your most recent report on year
2000 progress in Federal agencies, and, as you know, last week,
OMB submitted to Co: ss its latest quarterly report. Both re-
ports share a common finding: agencies are maki if progress, but
the rate of progress needs to increase. I think we all agree that no

roblem facing us is more Pressing, especially since, unlike other
Washin n problems, neither the President nor Congress can push
the deadline back. As you note, we have 653 days left until Janu-
ary 1, 2000, and the question is: How we can work together to en-
sure that the Federal Government, and has been noted State and
local governments, those in the private sector, and leaders in other
countries are doing, all they can to minimize disruption to systems
on January 1, 2000?

There’s no question that the challenges are great, and I am con-
fident that the Council can play an important role in meeting
them. However, we need to carefully structure the Council’s activi-
ties to maximize its effectiveness. GAO—which has been noted and
I totally agree with—has done very valuable work in the year 2000
area generally, has recently circulated a draft report recommending
actions for the Council. We will be sharing our detailed comments
on the draft with GAO, but we generally agree with most of what
they have to say.

ym _my perspective, I think it is important for the Council not
to interfere with or duplicate the work that is currently under
way in the agencies and is being done by the Chief Information Of-
ficers Council and other interagency management councils. The
Council on the Year 2000 should also build on, rather than try to
replace, the important oversight role that OMB is playing in mon-
itoring and reporting information gathered from the agencies. How-
ever, as you note, we have an obligation to the public to view this
as more than just a Federal systems problem. We need to adopt a


86

Mr. Horn. Thank you very much for that most helpful overview
and statement. Our next witness is the long-time—probably gets
the longtime medal here for appearing before this subcommittee
over the years and that’s Gene Dodaro, the Assistance Comptroller
General of the United States for Accounting and Information Man-
agement Division of the U.S. General Accounting Office. So, Gene,
welcome, and we look forward to your summary of your statement.

Mr. DoparRo. Good morning, Mr. Chairman, Ms. Chairwoman,
members of the subcommittee. I’m pleased to be here today to dis-
cuss the year 2000 computing crisis.

In February 1997, GAO listed the year 2000 problem as one of
the high risk areas across the Federal Government. Since then,
we've been working proactively with agencies by providing guid-
ance on how they could structure successful programs and by
issuing a series of recommendations to individual agencies to help
strengthen their programs.

Like all the commenters this morning, we welcome the creation
of the President’s Council on Year 2000 Conversion. The Council’s
objectives of expediting the Federal Government’s activities and
outreach with State and local governments, the private sector, and
the international arena is much needed. As Mr. Koskinen men-
tioned, to assist the Council in formulating its initial strategy we’ve
advanced, at GAO, a series of recommendations, and this morning
Td like to outline those recommendations that we’ve made to Mr.
Koskinen for his consideration as well as the Director of OMB.

They fall in four themes: one, is the priority that needs to be
given to setting priorities across the Government—this is a critical
issue; second, is the importance of developing contingency plans to
ensure business continuity in the advent of year 2000 failures;
third, is the need to ensure adequate resources, personnel in par-
ticular, in order to carry out the remediation efforts at the Federal
Government level, and fourth, is the value of obtaining the broad-
est possible perspective on this problem at all levels: the Federal
level, the national level, and the international level.

Now, prioritization of the Government’s efforts are especially
critical, because it’s clear to us at the current pace that not all mis-
sion-critical systems are going to be fixed on time. As was pointed
out this morning, as of last month, only 35 percent of the Govern-
ment’s mission-critical systems were reported year 2000 compliant.
This leaves over 4,600 mission-critical systems to be replaced and
repaired over the next year. That’s not to mention the thousands
of other systems that also support and carry out Federal Govern-
ment activities. It is unlikely that agencies are going to be able to
complete this amount of work in the time remaining. Therefore,
setting priorities within each agency is especially important, and
we've encouraged Mr. Koskinen to work with the agency heads to
make sure that priorities are being set, because as with any man-
agement challenge, as has been pointed out today, setting the prop-
er priorities is really the first step toward resolving the problem.

In addition to priorities set at individual agencies, however, the
system-by-system approach that’s been advanced to date of fixing
the problems within each agency really needs, also, a Government-
wide perspective. Many of the Federal Government systems inter-


41

Internal Controls

During this review, we evaluated internal controls over the Year 2000 initiative. The internal
control weaknesses we identified are described in the Results of Review section of this report.

Prior Audit Coverage

Improvements Are Needed In The Management And Operations Of The Office Of The Chief
Administrative Officer (Report No. 96-CAO-15, dated December 31, 1996). This audit
addressed Year 2000 activities and determined that HIR had not yet developed a plan for
minimizing the potential impact that the Year 2000 will have on the House. This report
concluded that the House had not assigned a team leader, assessed the office level systems within
the House environment, or conducted an analysis to determine the impact of phasing out the
legacy application systems. The report recommended that the Acting CAO prepare a
comprehensive strategy addressing the potential impact of the Year 2000 issue for review and
approval by the Committee on House Oversight (CHO). The Acting CAO concurred with the
audit recommendation. In response, he instructed HIR to develop project management policies
and procedures to ensure appropriate planning and conversion for the Year 2000 issue addressing
the establishment of priorities and target dates for the phases of conversion including adequate
testing for all the systems. The Acting CAO also agreed to appoint a project manager to oversee
the conversion team, which will have representatives from all areas of HIR.

HIR Management Practices Undermine The House's Abitity To Keep Pace With Technological
Changes (Report No. 97-CAO-09, dated May 8, 1997). This audit concluded that HIR has failed
to timely address and develop a viable solution/plan to minimize the impact of the Year 2000
problem, and that HIR has not established certain minimal control practices such as project
management, quality assurance, and change control. In response to the report, the Acting CAO
agreed to improve the HIR management processes which, in tum, should positively impact the
Year 2000 effort.

1], RESULTS OF REVIEW

HIR' has recognized and is working towards meeting the Year 2000 challenge. To date, HIR has
(1) prepared a high-level Year 2000 plan for approval by the CHO, (2) appointed a project leader
and assigned personnel to work on the initiative, (3) estimated some costs, prioritized tasks for
mission-critical projects, and prepared broad target dates, (4) sent survey letters to commercial
vendors asking if their products will be Year 2000 compliant, and (5) initiated action to

reprogram date fields for LIMS. In addition, the House is continuing its efforts to replace the
FMS Payroll system through the preparation of a contractor statement of work that will result in a
needs analysis and the development of a request for proposal (RFP). However, House

' tn some instances we refer to HIR as the organization responsible for Year 2000 tasks and in others we
refer to the House. When we initiated this audit, we anticipated dealing with a Year 2000 project manager having
responsibility for all House Year 2000 issues. We quickly discovered that many Year 2000 tasks were being
addressed by various organizations throughout the House with limited coordination and the Project Leader had no
authority outside his immediate organization within HIR.



127

Mr. Doparo. I believe that the Defense Department and State
Department have had discussions along those lines, and we're in
the process of evaluating those kind of efforts.

Mrs. MALONEY. I’m glad you're back, Mr. Koskinen.

Mr. KoskINEN. Thank you.

Mr. Horn. I thank the gentlewoman, and now yield to the vice
chairman of the committee. He has been very patiently waiting for
all of us. Mr. Sessions of Texas. He’s done a great job in this area.

Mr. SEssions. Thank you, Mr. Chairman. I’m having trouble
with my voice today, so if I’m not loud enough, please let me know.

By the way, the gentlewoman from New York, I thought did a
great job in her questioning. She’s a lot of fun to have around.

Mr. Koskinen, I'd like to ask you several questions. In Texas we
relate a lot of things to football, and down in Texas we expect a
championship team every year, but it seems like we hire coaches
every year.

You've been asked to take over a team to win the championship
on January 1, 2000. When should you have been hired as coach?

Mr. KOSKINEN. I’m not sure that there’s an easy answer, an an-
swer that I’m aware of. In other words, I think ——

Mr. SESSIONS. But you know what I’m talking about. This com-
mittee has consistently asked the President to appoint someone for
quite some time, and you came on duty March 10.

Mr. KOSKINEN. Yes. As I said, I don’t have a view as to when
I should have been appointed. I have spent most of my time focus-
ing on what I’m going to do now that I have been appointed.

T don’t mean to be flip about it. I think there are a set of ques-
tions about how we got to where we are that actually, I think at
some point people need to focus on. I don’t think it’s productive for
me to spend a lot of time worrying about how I got this job, and
much more time needs to be spent just on going forward. We have
a goal line to cross; you're exactly right.

Mr. Sessions. I’m still trying to get at, does the administration
get it. Do they understand what’s ahead, and certainly you would
understand that there’s some reason to believe that people on this
side of the table—not on that side, but on this side——

Mr. KOSKINEN. The only reason I’m here is that the President
and the Vice President personally asked me to return to Govern-
ment to deal with this problem, which they ——

Mr. SEsSIONS. So in other words, you’re saying that in your opin-
ion, two elected officials in the White House, both of them are con-
cerned about this and both of them are responsible and accountable
for the activities of the Government.

Mr. KoOSKINEN. Surely.

Mr. SESSIONS. We had talked for a few minutes about what agen-
cies are doing and how they're approaching this, and maybe this
question is best left for someone like Art Gross or someone like
that, because I know we have some very capable people in the au-
dience, but do you believe that when agencies go through these ex-
ercises, that there may be some inward thought process to them
that maybe they need to, order to meet those dates, come to Con-
gress and say, look, we’ve got to change some of the ways we oper-
ate?


ili

Mr. Horn. Well, we thank you. That was a very helpful state-
ment.

Let me begin the questioning. It will be 5 minutes per Member.
We'll alternate between majority and minority. When each in the
minority has had a turn, then we will give everybody a turn on our
side—5 minutes.

OK, let me start, Mr. Koskinen, with you. When you and I chat-
ted last week, I mentioned the thought of a weekly report from the
various agencies to keep them tuned up to the fact the Government
is very serious about this. What did you think of that idea and are
you going to implement a weekly report?

Mr. KOSKINEN. I think it is important for the Government to
view the year 2000 problem as critical and of the highest priority.
At this stage, I have not decided to ask the agencies for weekly re-
ports, and it’s not clear to me that, again, weekly reports to me are
the issue. I’m now checking to see whether, in fact, the heads of
the agencies are getting weekly or biweekly reports. Because,
again, I think the place where this needs to be focused is on an
agency-by-agency basis. Thus far in my meetings with Cabinet Sec-
retaries and agency heads, I have been gratified to see the level of
senior management involvement. I think the monitoring of the time
lines has to be there. It’s clear that as we move forward we'll need
more than quarterly reports, but at this stage I’m not prepared to
suggest that agencies deliver external weekly reports to either
OMB or the Council.

Mr. Horn. I think the problem that has come with the quarterly
reports is an agency cannot do anything in that quarter, and no-
body catches it until it comes in. And what we had in the last little
grade exercise, which we will be doing fairly regularly as we near
this, we're ing about 653 days from now, we're talking about
7 quarters from now. So if we talk about seven quarterly reports,
I suspect some you will not catch up to if we keep it on just quar-
terly reports until it is too late. And you can’t give the management
thrust that is needed to get them to focus on the problem, that’s
what concerns us. There needs to be a real interaction with your
office knowing what are they reporting to the Cabinet officer in-
volved, or the under secretary, chief operating officer, whatever you
want to call it. And if you do it just on a quarterly basis; as I’ve
said, we looked at the last quarterly reports, some people had done
absolutely nothing. And then the way to get ahead, they said:
“Well, let’s redefine our critical mission systems.” So they just rede-
fined them out of the category which gave the illusion that progress
was made. They called it a duck by another name.

And I don’t think you want to be caught in that situation, so
something is needed to keep them on track and to let you know
what kind of progress. There’s nothing like a weekly report to
shape people up, I can assure you, having run a fairly large organi-
zation.

Mr. Harden, I think, are we saying here with the six figures that
if you are a COBOL programmer and you’re happily retired Playing
golf in Bethesda or something will they be brought out of retire-
ment and given a contract to do the job? Because that’s part of the
problem, nobody remembers COBOL in some of these agencies. Or
nobody can even find the instructions to some of the computers


120

course, if everybody's Social Security check goes through the wire
to end up in the—there is no way to access it other than to have
a system that works. Would it be your recommendation if things
have not proceeded as well as you would hope, would your commit-
tee recommend that Social Security and/or the IRS would defer im-
plementation of their wireless operations?

Mr. KOSKINEN. That’s a judgment that what my committee or I
will recommend to the agencies is that they look at this question
very carefully and provide all of us with their judgment on it. I
don’t think there is a way for us to second-guess it judgment.
These are very complicated problems. Where we are pushing, al-
ready even in my 10 days here, is for people to confront that issue.
And there are a couple of places where we need to make sure that
the people knowledgeable about those systems and the risks in-
volved in the modernization take a look at it.

Our problem, obviously, with transferring funds is whether it’s
done electronically or by check. You still have issues with checks:
what happens with checks, what’s going on with the check-clearing
process, where are we going. So that in some ways, if we can get
the electronic fund transfers to work, that may more efficient
than loading the system up with more checks. But it is a classic
example of our need for the best people in the agencies to be look-
ing at that.

at we don’t want to do is take risks. If those systems cannot
function effectively, then we need to, in fact, slow down and back
off to make sure that there aren’t dislocations on January 1.

Ms. Rivers. Mr. Dodaro, do you want to speak to that?

Mr. Doparo. The critical issue here is going to be at the Treas-
ury Department in the Financial Management Service because it is
actually the operation that cuts the checks, Social Security checks,
and sends them either through electronic transfer to institutions or
in paper checks. And we're in the process of starting an intensive
look at the Financial Management Service because it’s a central
part of paying the Government’s benefit payments as well.

I agree with Mr. Koskinen. We need to make tradeoffs. And one
of the recommendations that we’ve made is really setting priorities.
And to a certain extent, moving toward the electronic benefit pay-
ment, or the all-electronic commerce, is a little bit, in the United
States, akin to trying to deal with the European currency issue at
the same time the year 2000 issue is occurring in Europe. And pri-
orities are going to have to be set, and we're going to look closely
at that issue. use I believe that the Financial Management
Service is not complete yet with all of its assessments, and there
is really an intricate set of relationships with both the Federal Re-
serve as well as financial institutions across the country. So you
raise a very good question, and that area needs to be carefully ex-
amined.

Ms. Rivers. In a report from the real world, there is substantial
fear in the general population, particularly with seniors, that they
are going to get caught up in this thing. The money that they rely
on each and every month is going to become unavailable to them,
and likewise there is concern that if the IRS is not operating at tip-
top form, people are going to get caught up in that and that there


125

OMB has moved up the deadline for implementation from No-
vember 1999 to the end of March 1999, to give people time to ulti-
mately, once systems are implemented, discover where the prob-
Jems are.

There is an ongoing focus on that. I have talked with all of the
inspectors general about their important role in ensuring that the
work is done appropriately, but I can again assure you that, in my
conversations with the agencies, no one is more focused on this
problem than the agencies’ senior management team because obvi-
ously as I said earlier, in my response to a question from the chair-
man, this is not a question of good efforts. This is actually a ques-
tion of actually having the systems work.

So this is an important issue, and I think we will find once we
get beyond March 1999, there’s going to be a lot of retesting and
a lot of additional work necessary, and that’s why we need that
extra time.

Mrs. MALONEY. My basic question is, you’ve mentioned you're
going to have independent verification that the end testing is work-
ing, but who's looking at this independent verification to make sure
they know what they’re doing? Would that be an appropriate role
for GAO to sort of ask these independent contractors, how do you
intend to test this and what assurances do you have that it’s actu-
ally going to work?

I mean, I think this is a critical question, Mr. Chairman, and I
think—personally, I would like, if it’s all right with the chairman,
to request that you get back to us, in writing, exactly how the end
testing is going to work, and how the verification of the end testing
is going to work, and who's looking at the verifiers?

I mean, if we hire all these private contractors, and they say
we're going to verify it works, and they say it’s working, and it
doesn’t, then we're really in a mess. I just think that that’s one
thing we should be looking at, at the end result now on how we're
going to make sure they know what they’re doing.

How are you selecting these independent contractors who are
making this decision of an independent verification?

Mr. Doparo. Basically, right now the agency heads are deciding
what type of independent verification resources they want to bring
to bear. Some of them are using the inspectors general; others are
hiring private contractors. There’s really no one model right now.

There are a couple of things that we’ve done and are planning
to do in this regard. One, our Initial Assessment Guide laid out
what the appropriate testing processes should be within the agen-
cies. We’re also working on some additional guidance in the testing
area that we want to put out through the CIO Council to the agen-
cies.

We're also in the set of recommendations we’ve just made to Mr.
Koskinen and the Council, is the fact that there will be some inde-
pendent verification of the testing processes that take place. So
we're trying to build into the process to make sure that there is a
double check within the agency. And then in selected areas where
the Congress is interested and ones that are really vital, we will
at GAO be looking at that process.


149

The Century Date components of the project are currently on schedule with respect
to the reprogramming of the Communications Replacement System and the
replacement of desktop devices. These project components are scheduled to be

completed by December 1998.

Other Information Technology Infrastructure Initiatives
Together with the mainframe consolidation project, the following initiatives comprise

the Service's Century Date infrastructure program:

A. Integrated Submissions and Remittance Processing System
Integrated Submissions and Remittance Processing (ISRP) replaces the
antiquated Distributed Input System (DIS) and Remittance Processing System
(RPS) which form the core of the tax processing input pipeline that processes
more than 200 million tax returns and accounts for tax revenues exceeding $1.5

trillion.

{SRP is currently being piloted at the Austin Service Center and is on schedule to

be fully implemented in ail ten service centers for the 1999 filing season.

A Tier il and Tier Ill Computer Platforms and Associated Systems Software
require replacement or upgrades. Century date compliance for the more than
1400 minicomputers and 130,000 microcomputers is largely dependent on

obtaining vendor upgrades and/or replacement products. Many of these


153

reflect the IRS functions as well as those of our data exchange partners. The overall
IRS contingency planning strategy is to focus our efforts on planning for only those

aspects of the program that may not be completed timely and/or fully successfully.

OPPORTUNITIES

While the primary focus is to timely complete the century date conversion, the IRS plans

to leverage a variety of opportunities stemming from the project including the following:

Utilize the business-owned and supported inventory of computer applications
(estimated at 20,000) to both eliminate duplicate applications and establish the
“pest in breed” as a national standard application while corporately managing the
growth of future business-owned applications. The IRS has already retired
3,000 business-supported applications.

.

Rebuild the IS Product Assurance Program

Leverage the SAT testing activities planned for century date conversion to rebuild _
the IS Product Assurance Program, which has been impaired as testing resource
levels were reduced in the 1990's to less than 30 percent of the minimum industry
standard.

@ Create, within IS, a project planning and management ethos. The century date
conversion is a massive project management challenge which requires the


COMMITTEE ON SCIENCE
F. JAMES SENSENBRENNER, Jr., Wisconsin, Chairman

SHERWOOD L. BOEHLERT, New York GEORGE E. BROWN, Jr., California RMM*

HARRIS W. FAWELL, Illinois RALPH M. HALL, Texas

CONSTANCE A. MORELLA, Maryland BART GORDON, Tennessee

CURT WELDON, Pennsylvania JAMES A. TRAFICANT, dr., Ohio

DANA ROHRABACHER, California TIM ROEMER, Indiana

STEVEN SCHIFF, New Mexico JAMES A. BARCIA, Michigan

JOE BARTON, Texas PAUL McHALE, Pennsylvania

KEN CALVERT, California EDDIE BERNICE JOHNSON, Texas

ROSCOE G. BARTLETT, Maryland ALCEE L. HASTINGS, Florida

VERNON J. EHLERS, Michigan** LYNN N. RIVERS, Michigan

DAVE WELDON, Florida ZOE LOFGREN, California

MATT SALMON, Arizona MICHAEL F, DOYLE, Pennsylvania

THOMAS M. DAVIS, Virginia SHEILA JACKSON LEE, Texas

GIL GUTKNECHT, Minnesota BILL LUTHER, Minnesota

MARK FOLEY, Florida DEBBIE STABENOW, Michigan

THOMAS W. EWING, Ilinois BOB ETHERIDGE, North Carolina

CHARLES W. “CHIP” PICKERING, NICK LAMPSON, ‘Texas
Mississippi DARLENE HOOLEY, Oregon

CHRIS CANNON, Utah ELLEN 0. TAUSCHER, California

KEVIN BRADY, Texas. ‘VACANCY

MERRILL COOK, Utah VACANCY

PHIL ENGLISH, Pennsylvania
GEORGE R. NETHERCUTT, JR.,
‘Washington.
TOM A. COBURN, Oklahoma
PETE SESSIONS, Texas
Topp R. ScHULT2, Chief of Staff
Barry C. BERINGER, Chief Counsel
Patricia 8. SCHWARTZ, Chief Clerk /Administrator
Vivian A. TessiEr!, Legislative Clerk
Ropert E. PALMER, Democratic Staff Director

SUBCOMMITTEE ON TECHNOLOGY
CONSTANCE A. MORELLA, Maryland, Chairwoman

CURT WELDON, Pennsylvania JAMES A. BARCIA, Michigan
ROSCOE G. BARTLETT, Maryland * BART GORDON, Tennessee
VERNON J. EHLERS, Michigan EDDIE BERNICE JOHNSON, Texas
THOMAS M. DAVIS, Virginia LYNN N. RIVERS, Mic
GIL GUTKNECHT, Minnesota DEBBIE STABENOW, Michigan
THOMAS W. EWING, Illinois PAUL McHALE, Pennsylvania
CHRIS CANNON, Utah MICHAEL F. DOYLE, Pennsylvania
KEVIN BRADY, Texas ELLEN O. TAUSCHER, California
MERRILL COOK, Utah

*Ranking Minority Member

**Vice Chairman

ID


143

mission critical systems in time to avoid disruption to any critical systems. Nothing less
than 100% compliance will be acceptable to the American public, or to me personally.

I recognize that Chairman Hom’s ratings suggest that Treasury has significantly
greater problems with the Year 2000 problem than my testimony suggests. I do not
underestimate the challenge of achieving significant compliance. However, we have
purposefully taken a conservative approach at Treasury with respect to measuring our
progress on the Year 2000 problem. We are requiring an end-to-end testing of all our
systems before we will consider them to be 100% compliant.

Thank you for the opportunity to meet with you today to discuss the actions being
taken by the Department of the Treasury in addressing the Year 2000 computer problem.
I will be happy to answer any questions you may have regarding this important matter.

-30-


104

The second area is that Government employees will see the ris-
ing salaries outside in the private sector and it may eventually be-
come possible for a Government employee to leave the job they are
in today and to find work in a Government contractor or a private
sector source and actually be able to make as much money in the
next few years as they would have made in 10 or more years of ac-
tual service with the Government. That temptation is sometimes
too much to resist. And I believe that we are going to see an exodus
of Government programming talent into the private sector.

The third thing that will affect the Government is the inability
of the Federal Government to retain programming staff and will re-
quire that the Federal Government hire contract programmers and
go out and find contractors to do the work. The irony of that situa-
tion is that the very same Government employee who today may
be working on a system could very well leave, come back, sit in the
exact same cubicle, work on the exact same system, but be charg-
ing the Government three times the salary they were making as

‘ederal employee.

The fourth point that we have to look at is that the unplanned
increase in costs associated with this supply and demand in labor
literally throws all the budget calculations that we’ve made so far
to the wind. In fact, the Gartner Group’s estimates that the world-
wide cost for fixing the year 2000 problem of $600 billion was
based on the then current cost for programming talent. As that cost
has increased, those estimates have gone up and we’re now hearing
that the estimate is over $1 trillion. Obviously, that will affect any
of the Government’s budgets as those prices increase.

And the fifth and final way that I think that we're going to be
faced with a problem due to the contention for resources is that as
the demand for programmers to fix the year 2000 problem in-
creases, those programmers will be drawn away from other areas
that they need to focus on. Can the FAA modernize its systems?
Can the IRS implement changes to the Tax Code if the resources
are being appli to the year 2000 problem?

And by the way, this is not just unique to the United States. I’ve
traveled to Europe and Asia and the situation there is equally as
bad. And in fact, in Europe, the contention for resources based
upon the year 2000 problem and the conversion to the European
currency necessitates almost doubling the amount of effort to fix
the problem. In fact, in the United Kingdom today, what we're find-
ing is that there is only enough resources available to fix the year
2000 problem in about 3,000 of the 12,000 major corporations or
major companies there.

e States have faced this problem too. Texas, Missouri, Califor-
nia, and a number of others fave already cited the fact that they
are unable to attract and retain the resources that they need to fix
their problems. And we're finding headhunters out there actually
paying bounties to attract that staff.


64

IMPROVEMENTS ARE NEEDED IN THE MANAGEMENT AND OPERATIONS OF
TRE OFFICE OF THE CHIEF ADMINISTRATIVE OFFICER

Report No. 96-CAO-15
December 31, 1996

RESULTS IN BRIEF

CONCLUSIONS}

Al the beginning of the 104" Congress, the House of Representatives (House) undertook
extensive measures to improve opcrations and efficiencies, as well as financial reporting and
accountability. The position of Chief Administrative Officer (CAO) was established in January
1995 at the beginning of the 104" Congress to take responsibility for the non-legisiative
administrative operations of the House, Each of the three Officers of the House set baseline
objectives in order to prinritize their transition roles. The CAO had $4 baseline objectives when
the 104” Congress convened. These baseline objectives are organized into the following broad
categories

+ Privatization
+ Accountability

+ The Open Congress
+ Efficiency

+ intemal CAO Actions

‘The CAO's 54 baseline objectives arc included in Exhibit 4. The CAO fully implemented 37 of
the $4 baseline objectives, partially implemented 16 objectives and has not initiated action with
respect to one objective during the 104" Congress. In addition, the CAO has completed 3
number of other significant actions during the 104 Congress to improve operations and resource
management. These improvements include the following

Reduced House Administrative Services Operating Costs - The CAO receives 100 percent
of its operating budget from Federal appropriations. For the Fiscal Year (FY) ended
September 30, 1995 the CAO's appropriations totaled $69.7 million; however, the office only
used $56.8 million. The CAQ’s appropriations for the FY ended September 30, 1996 was
$45 5 million, and appropriations for the FY ending September 30, 1997 is a projected

Office of inspector Genera! Page!
US, Mouse of Representatives


50

to obtain a contractor for a needs assessment, requirements analysis, system specifications, RFP,
and an initial evaluation. A contract for this initial phase is scheduled to be awarded by October
1997 with an estimated completion date of June 1998. Once this initial phase is completed and a
contractor is selected, actual system replacement will commence. The replacement is estimated to
take 18 months and be completed by December 1999. In effect, the entire implementation
schedule for the replacement equates to 27 months, and as of October 1997, the Year 2000
deadline will also be 27 months away. Our concem is that this schedule has no slack time and
leaves no room for errors or unforeseen circumstances. If any delays occur, the critical path of
the project will be affected. As in the OSM replacement effort noted above, we suggest
extremely close monitoring of this effort, and recommend that a contingency plan be developed
(ie, contracting with a service provider to issue payroll checks for a short-term period) to
safeguard the House in the event that the replacement project goes beyond the Year 2000.

Conclusions

‘The House has recognized and is attempting to meet the Year 2000 challenge. However, in order
to be successful, ie., institute changes that guarantee Year 2000 compliance so that systems will
be running smoothly on January 1, 2000, the House needs to take this effort to a higher level.
HIR management has to refocus its objectives, dedicate additional resources, and raise its
priorities in planning, budgeting, technology, and every other facet of project management in
order to address the Year 2000 issue. Considerable work has been expended but not all of itis
focused or channeled in the right direction. Problems still exist and management needs to take
immediate action to correct them.

Recommendations:

We recommend that the CAO:
1. Establish formal project management controls and techniques as follows.

a. Define the role of the Year 2000 project leader and establish it as a full-time
position.

b. Prepare a Year 2000 charter which formally assigns the authority and
responsibilities for the Year 2000 initiative to the project leader and staff within
HIR, and defines the project leader roles and responsibilities with respect to
organizations/activities outside HIR whose systems may be affected by the
Year 2000 problem.

c. Institute a status reporting mechanism to inform upper management of Year
2000 progress.

d. Conduct a detailed level of effort analysis which estimates the resources
needed to complete the initiative.


171

CONGRESSMAN

PETE SESSIONS

1318 Longworth House Office Building

FOR IMMEDIATE RELEASE

(Washington, D.C.) -- Federal agencies are in a bind. They have yet to soive the Year 2000 computer
software problem and the new millennium is right around the comer. At a press conference today,
Congressman Pete Sessions joined his colleague, Congressman Stephen Horn (R-CA), in releasing
grades measuring the progress of major Federal agencies on the Year 2000 computer problem.

“If the Federal Aviation Administration's (FAA) computer system doesn’t work, then pilots can’t safely
fly and this will force a slowdown throughout our economy, not to mention endanger the lives of those

risking to fly,” said Congressman Sessions. “If the Justice Department’s National Criminal Information
Center’s computers don’t work, then no one will know who the criminals are.”

‘The Year 2000 problem is an inability by some computer software to recognize any year not beginning
with the digits “1 - 9.” When the year changes from 1999 to 2000, computers throughout the public
and private sectors will not recognize the “00.”

‘The grades measure the progress of 24 departments and agencies within the Federal government, These
agencies have been graded twice in the past -- July 1996 and September 1997. In September of last
year, almost half of the 24 agencies received a “D" or “F”. According to Congressman Sessions, “This
‘quarter, while some agencies have improved, we still see 11 agencies with ‘D’ or ‘F’. We must strive
for continuous improvement.”

Another area of concem to Congressman Sessions and Congressman Horn was the number of systems
classified by the Executive Branch as “mission critical.” Congressman Sessions said, “The year 2000
‘issue has taken on a life of its own. Publicity about the problem is not a concern to me, But, with this
heightened publicity, I hope the federal government is not burying its head in the sand. ‘This concerns
me when we look at the number of systems classified as mission critical.”

Congressman Si described the issue of “mission critical” systems, He said, “Supposedly, a system
is ‘mission critical’ if tis absolutely necessary to the performance of an agency’s mission. I won't take
the easy hit and talk about the difficulty agencies are having just defining their missions. But, | am
gravely concerned by the fact that in August of 1997, we had 9,100 mission critical systems, and in
‘November we had 8,840, a reduction in mission critical systems of 260. Today, we learn that there are
{990 fewer mission critical systems than there were in November. We have to ask the Administration,
are there actually fewer mission critical systems, or are we seeing agencies conveniently reclassifying
systems to avoid the hard work of solving this problem.”



99

Many organizational and managerial models exist that the Conversion Council could use
to build effective partnerships to solve the nation’s Year 2000 problem. Because of the
need to move swiftly, one viable alternative would be to consider using the sector-based
approach recommended recently by the President's Commission on Critical
Infrastructure Protection as a starting point.

This approach could involve federal agency focal points working with sector
infrastructure coordinators. These coordinators would be created or selected from
existing associations and would facilitate sharing information among providers and the
government. Using this model, the President's Council on Year 2000 Conversion could
establish public/private partnership forums composed of representatives of each major
sector that, in turn, could rely on task forces organized along economic-sector lines.
Such groups would help (1) gauge the nation's preparedness for the year 2000, (2)
periodically report on the status and remaining actions of each sector's Year 2000
remediation efforts, and (3) ensure the development of contingency plans to ensure the
continuing delivery of critical public and private services.

In conclusion, while the Year 2000 problem has the potential to cause serious disruption
to the nation, these risks can be mitigated and disruptions minimized with proper
attention and management. Continued congressional oversight through hearings such as
this and those that have been held by other committees in both the House and the
Senate can help ensure that the Year 2000 problem is given the attention that it deserves
and that appropriate actions are taken to address this crisis.

Mr. Chairman and Ms. Chairwoman, this concludes my statement. I would be happy to

respond to any questions that you or other members of the Subcommittees may have at
this time.

a.


24

‘Jobn WA. Raingact IV
ase 6a
‘Office of Inspector General
GH. House of Representatiors
Washington, WE 20515-9990
MEMORANDUM.
TO: James M. Eagen IL
ief Administrative Officer
Cee =
FROM; 7 Cai
Inspector General
DATE: December 12, 1997

SUBJECT: Audit Report - Despite CHO And CAO Mandates, HIR Has Not Begun
Development Of A Mainframe Migration Plan (Report No. 97-CAQ-15)

This is our final report containing the results of our audit of HIR's mainframe migration plan,
‘The original objective of this audit was to evaluate the adequacy and effectiveness of HIR’s
mainframe migration planning process. However, preliminary survey work revealed that there
was no mainframe to clisa/server migration plan, nor were there any known long-term planning
efforts related to this issue. As a result, the original objective of this audit was revised to (1)
identify the course of management actions that have led up to this condition, and (2) determine
their effects. In this report, we noted inconsistencies with regard to mainframe migration that
invoive planning, budgeting, communications, and a general misconception regarding the
Committee on House Oversight’s (CHO) intentions with regard to mainframe migration. Asa
result, the House is now in a position of having to first implement costly Year 2000 solutions,
and then readdress migration for these very same legacy systems, rather than accomplishing both
tasks in unison, as originally envisioned.

{n response to our July 18, 1997 draft report, your office fully concurred with our findings and
recommendations. Your October 14, 1997 management response is incorporated in this final
report and included in its entirety as an appendix. The corrective actions taken and planned by
your office are appropriate and, when fully implemented, should adequately respond to the
tecommendations. Further, the milestone dates provided for implementing corrective actions
appear reasonable,

We appreciate the courtesy and cooperation extended to us by your staff. [f you have any
questions or require additional information regarding this report, please call me or
Robert B. Frey Tl at (202) 226-1250.

ce: Speaker of the House
Majority Leader of the House
Minority Leader of the House
Chairman, Commines on House Oversight
Ranking Minority Member, Committee on House Oversight
Members, Commintee on House Oversight


20

Mr. Horn. I thank the ranking gentleman, and I’m going to yield
to Mr. Davis who in turn will yield to Mrs. Morella for the inser-
tion of a statement and a comment.

Mr. Davis. I'd be happy to yield to my friend from Maryland.

Mrs. MorRELLA. Oh, I thank you. I thank the gentleman for yield-
ing. I really was going to ask my good friend, Mr. Barcia, to yield,
but it went too quickly, because I heard him comment on the fact
that we, in Congress, are derelict in moving to become more com-
pliant, and I have a statement here which I would like to ask to

inserted in the record, Mr. Chairman.

Mr. Horn. Without objection, so ordered.

Mrs. MoRELLA. Basically, it says the GAO is working with Mem-
bers, committees, and offices of the House to make sure that per-
sonal computers, the software running on them, and other office
equipment are compliant and all House supported software, with
one exception. Lotus 1-2-3 accounting is already year 2000 compli-
ant and software necessary to check the basic input, output system,
the IOS, our epergonal computers have been selected; will be made
available to House offices. Just synopsizing, basically, there is
a strategy. We have selected a full-time year 2000 project manager.
That was done on September 29, 1997. A year 2000 project team
has been established as well. There’s a Technology Coordination
Task Force [TCTF] to coordinate technology projects and to ensure
interoperability of GAO systems. A TCTF also oversees of the work
of the year 2000 project manager. So, we have a methodology bases
on government and private industry. We have a baseline pro-
gram—the baseline program will be due March 31, 1998.

All of this, and what we will have in the record, Mr. Chairman,
will point out that we are in a stage of readiness and do have that
strategy, so Congress will be ready, and I thank the gentleman for
yielding.

[The information referred to follows:]


103

Mr. Horn. Well, we thank you very much for that statement.

And it is now my pleasure to introduce Michael Harden. Dr.
Harden is the founder and president of the Century Technology
Services, Inc. It is a company dedicated to conducting research into
the year 2000 problem and developing various solutions, tools, and
methodologies to deal with that situation. I was particularly
pleased to read your testimony since you’ve been saying what this
committee has been saying for 2 years: that the closer we get to
that deadline, the scarcer human resources will be. And you’ve
given us some very interesting figures which I hope you will elabo-
rate on in your summary.

Your remarks have been put in the record at this point. Most of
us have read them, just give us a summary of that very fine state-
ment that you made.

Mr. HARDEN. Thank you, Mr. Chairman.

Tm pleased to be here today because I believe the issue that
we're dealing with in the year 2000, particularly as it applies to the
human resources side. I certainly believe that I can state for myself
and my colleagues in the industry, that we believe that the Govern-
ment is faced with an issue here that may certainly impede its
ability to effectively deal with the year 2000 problem. That issue
is the possible inability to be able to hire, maintain, and to keep
in place those resources necessary to actually tackle the year 2000
problem.

With only 653 days remaining, as this timetable compresses
itself, the need for resources will become more and more acute. And
those resources will be impacted by the laws of supply and de-
mand.

We're already beginning to see this happen. Just in the last year,
the number of open Information Technology [IT] positions in this
country has doubled. Programmers are now demanding and receiv-
ing six-figure salaries, and contractors and other service providers
are paying those people retention bonuses to keep them in place so
that they won’t leave for greener pastures elsewhere. Indeed, it’s
estimated that computer programmers will see their salaries dou-
ble every 6 months through the duration of this problem.

There will be a severe impact on this Government’s ability to
deal with the problem. And specifically, there are five ways—or five
areas—that I think will be impacted.

The first is that contractors in the past that have bid contracts
for the Government—not necessarily year 2000 contracts, but just
Government contracts in general—bid those on a fixed-fee basis.
The cost model that they used to create that was based on a salary
at that time for programmers. Those salaries have increased rap-
idly since that time and since they are fixed-fee contracts they can’t
pass along their increased cost to the Government. That means
that for every hour that they work, they may not make a profit;
they may actually, in some cases, be losing money. The impact to
the Government is that the quality of those contracts will be great-
ly diminished, or when those contracts come up to be rebid, they
won't be bid, or that the cost of that bid will be prohibitive to the
Government.


160

to the government and those that have implementation dates for the redesigned GOALS II system
that extend well into 1999. We are confident that we will complete all necessary work — whether
redesign of applications for the new GOALS II system or renovation and testing of existing
GOALS applications — to ensure compliance well before the end of 1999.

FMS is in relatively good shape in replacing the systems that are critical to issuing
payments and collecting Federal revenues. For example, we have made critical progress with the
Social Security Administration to ensure that monthly direct deposit and check payments will
continue to go out accurately and on time after January 1, 2000. Social Security disbursements
comprise almost two-thirds of our overall payment volume. Each month, FMS issues 33 million
electronic fiunds transfer/direct deposit payments and 17 million check payments to Social
Security recipients. The vast majority of these payments are issued by our Philadelphia Regional
Financial Center.

The FMS Philadelphia office and the Social Security Administration have been working
closely together to coordinate the required program and format changes needed for Y2K
compliance. All of the programming changes necessary to begin Y2K validation have been
completed, and testing between Social Security and FMS began this month. Testing will be
accomplished through all SSA and FMS processes, including the transmission of input from SSA
to FMS, processing of that information in FMS’s payment system, end to end testing from the
payment system to FMS claims and accounting systems and the Federal Reserve, and transmission
of output back to SSA. We will complete all of our testing by July, and implement Y2K compliant
systems for both Title II (old age and survivors benefits) and Title XVI (supplemental security
income) payments in August. Chairman Horn, Chairwoman Morella, and members of the


163

queyd

Ayea5 quawejdiu) = ayepyjep, ayeaousy ssessy PeLe}s JON

Swiayshs | yeonug uotssiy aedoy.
aseyd Aq apop-so-saury [e301

LGIGO/EO 40 SW
Juawainseay soueWOLag 000Z 1e2A

adlAJag juowabeueW [eIoueUls

| 907 we8z's
freuung SW


167

In terms of the report cards, we have a little different approach.
You heard Art Gross and me testify that infrastructure components
are part of critical-mission systems. What we're doing at Treas-
ury—and let me give you an example. Within that, Customs, which
reports three mission-critical systems, those 178 components might
be modifying or renovating a data base in Washington, DC, at their
Newington Data Center. They can complete the renovation, testing,
validation, and we could report those as completed. For scoring
card Purposes or report card purposes. However, we also know that
all of the border crossings all around the United States, all of the
airport crossings, all the cargo, are going to be communicating with
those systems here in the Washington, DC area. We also know that
a lot of the component infrastructure, the commercial products, the
telecommunication switches, the modems, the devices, and the com-
mercial infrastructure, are going to be upgraded over the next year
as vendor schedules allow those upgrades to take place.

Therefore, when we are saying we are reporting conservatively,
I am not ready to guarantee compliance of all those mission-critical
systems until I test them with the changes made in the infrastruc-
ture. Therefore, I think in my statement I’m indicating that, I
think our progress in fixing our internal systems is far greater
than what a report card perhaps would indicate, again, because of
our conservative approach to waiting for end-to-end testing of all
components.

ly feeling is, after you fix a system, validate it, test it, imple-
ment it, if you make a change in the infrastructure, you really
should go through the cycle again. You should do another assess-
ment, another validation, and another testing. Therefore, we're re-
porting our numbers conservatively, but our feeling is to con-
centrate on the problem. I believe that these committees have been
helpful, very helpful, by keeping the pressure on us through the re-
port card process.

Mr. SESSIONS. As we approach this timeframe that we get close
to the year 2000, I think at some point it’s going to be important,
and I think that today’s opportunity for us to be together gets us
closer to understanding where you are and where we think you are.
It will be important for us to not scare the public. It will be impor-
tant for us to be responsible as we enunciate this as a date where
there are going to be changes, but that we should not build into
anyone’s mind an expectation of failure, but, rather, an expectation
that you’ve got a new computer system that’s up and working with
different parameters.

How are you dealing with—and this is for anyone of the four of
you—how are you dealing with communicating with your cus-
tomers that there could be some things that might look different
or that might be wrong, and that you’re asking those customers to
carefully review that that they are receiving? And are you doing
that in a proactive way to where you can anticipate major changes,
to where you can ask your customers to please pay attention with
you? Have I been specific enough? I’m not talking about a PR bat-
tle. I’m talking about a real-life discussion with your customer of
what you’re going through, the changes that are happening, and
asking them to look at your product and do an evaluation also. Has
that been thought of within the context of what you’re doing?


32

Revenues Generated Coa Peta s SRYITS a]
GAO, Social Security “Adminsswation = NCOA, CBO, ($2,900,000) ($2,800,000)
ProPAC
Total Revenue ($2.900,000) ($2,800,000)
‘Systems Support Costs FFG RIBERA |
‘System Hardware / Software” 2, aX 000. 2,012,000
VTAMTM 22,560
Ncoat 120,000
MONIES 50,000
Total Sug Costs 2,720,560. 2,204,560
a :
Enterprise Computing 1,330,000 1,530,000
Tategration 1,586,250" 1.163.250"
Total Personnel Costs. 3,116,250, 2,693,230
Total Costs. 5,836,810 4,897,810
[ Nee (acon VE pce ROSIE 52,936,810 co

Figure 4 - Estimated Mainframe Costs for Fiscat Years 1997 and 1998,

Although support costs have recently decreased, the Year 2000 project as now planned, will resutt in the
House having to retain the mainframe system weil into the first decade of the 21" century. Rather than
having solved both these issues in one step, the House will now be forced to address the migration process
ina costlier, multi-step approach later on. As an example, HIR management estimates that the LIMS
system will need to continue to reside on the mainframe system to at least 2004, when it is anticipated to be
migrated to a LIMS client/server system.

Conclusion

The issues discussed in this report demonstrate the negative consequences that the absence of a viable
strategic plan has had on HIR. These events began with the still outstanding CHO request for analysis of
the retirement of the mainframe; to the short-term and costly solutions contained in the Year 2000 project;
and ended in HIR management's indecisiveness regarding the furure direction of House information
systems. As cited in our HIR management review, the underlying cause for these deficiencies implies a
lack of strategic planning, as well as management direction and oversight that would be used to guide
HIR’s information management teams. As documented within this audit report, and culminating with the

“These figures have been reduced by the annual cost for the NCOA system, since this cost is

displayed separately within the able
Virtual Telecommunication Access Method - A set of programs that maintain control of the
communications between terminais and application programs running under certain operating systems.

asa result of the automated correction processes contained within the NCOA system (e..
devection of duplicate addresses), Members of the House have experienced regular mail savings benefits,
for example the House realized a cost avoidance of $3.3 million in calendar 1996.

'S This figure represents an adjustment of budgeted/actual personnel costs of the authorized 61
staff for the Integration Group. HIR advised that they have actual staff of approximately 50, of which
approximately 30 are designated as supporting mainframe systems.

'S This figure represents an adjustment of budgeted personnel costs of the documented 61 staff for
the Integration Group. HIR advised that they are in the process of implementing a new reorganization of
the Integration Group, pending formal CHO approved. The new Integration Group will then only consist
of about 22 mainframe support staf.


113

juestion is whether I can work with the agencies and respond to

eir needs in this area. For instance the Chief Information Offi-
cers Council is meeting with OPM this afternoon to talk about per-
sonnel issues. It was done, to some extent, at my request when I
was first appointed. So I think, what I will be and what the Coun-
cil will be is sort of one-stop-shopping point for the agencies to
raise critical issues as they come up.

We've received great expressions of support from Congress—from
the leadership as well as the minority in both the House and the
Senate—that whatever is needed legislatively, you all are prepared
to consider it promptly. OPM is looking through all of its authori-
ties and regulations to determine what is necessary.

Clearly, as we move forward, one of our strategies will be to look
at resources and ensure that across agency boundaries that we’re
using them effectively. As one agency completes its work and has
personnel or contractors who have completed their work with that
agency, it may be important for us, and it may take some legisla-
tive or other authority, to move those resources to other agencies
that have work that remains. This is not to encourage agencies to
wait for somebody else to show up on their doorstep, but that
doesn’t seem to me to be our problem. Our problem will be, and I
think it is appropriate to worry about it, how do we marshal these
resources which ultimately are finite, and making sure that we
have applied them to the right areas.

, I’m confident, the President has made it clear that, as Assist-
ant to the President, 1 have whatever authority I need. And I’m
comfortable and satisfied that Congress has made it clear that
whatever legislative authority is needed, we will get it. But ulti-
mately, at heart, as you have all stressed from the start, this is a
management challenge for the agencies themselves. And one of the
things I stressed to the President when I talked to him about this
is, I did not want my appointment or the establishment of the
Council to be viewed by any agency head as relieving them of re-
sponsibility for the day-in-and-day-out operations of their agencies.

Mrs. MORELLA. That sounds very good and I’m encouraged by it.
But can you issue an Executive order?

Mr. KoOsKINEN. I cannot personally, but no one in the Govern-
ment can issue an Executive order except for the President. But if
I need one, I’m sure the President would be willing to issue it.

Mrs. MORELLA. OK. And how do you respond to the cost esti-
mates, in terms of the escalation? What are you going to do about
it?

Mr. KoSKINEN. The cost estimates continue to be a focus. We are
stressing with agencies that they need to continually scrub those
costs. We’re going to encourage the agencies to ensure that when
they make those cost estimates, they clear them through their
budget offices so that issues like these can be considered.

At this stage, we do not have an indication that there is likely
to be a substantial increase in those costs. I think the advice is
well taken. And the advice we are giving is that the work needs
to be done promptly, not only to allow time for testing, but to avoid
the rush at the door as we go forward. In one meeting, a Member
of Congress noted the irony of my position is that the more success-


184

Having said that, let me brietly describe the OIG’s oversight of Treasury's Y2K
conversion effort. This year our Y2K audit work will be done in two phases. The first phase is
nearing completion. As part of our financial statement audit work, we have been evaluating the
Department's compliance with the Y2K provisions of the Federal Financial Management
Improvement Act (the Brown Bill). We have found that the Department is meeting OMB’s
quarterly reporting requirements and that the quarterly reports show the Department as a whole is
meeting OMB's milestones.

While encouraging. these results must be qualified in two respects. First, our results are
based primarily on the quarterly status reports provided to OMB. We have not yet performed
extensive tests to verify the accuracy and completeness of this information. Second, the
milestone dates that have been met thus far do not cover the real meat of the Y2K conversion
process. They cover what GAO defines in their Year 2000 Assessment Guide as the awareness
and assessment phases. The next three phases--renovation, validation and implementation--will
be crucial in making a successful conversion.

Our phase | review identified two areas of concem that the Department is already
working to address. The first is the need tor a standard Year 2000 certification process. The
second is the need for more complete and descriptive Year 2000 contingency plans to ensure
continuity of Treasury's core business processes in the event of a Year 2000 induced system
failure.

In our phase 2 audit, starting this month, we will substantially increase our audit effort.
We will look behind the information in the quarterly status reports to verify the progress being
reported to OMB. More importantly, we will examine the next two crucial phases in the Y2K
conversion process--renovation and validation. Our audit work will focus on three main areas:

1. Management Oversight

We will evaluate both the Department's and each bureau's Y2K conversion oversight
process. As part of this effort, we will assess how project status is validated. how conversion
waivers are managed. and the completeness and accuracy of cost models.

2. Centification Process

We will determine if a certification process exists and is effective for ensuring that a system
is Y2K compliant. We will examine data exchanges with external trading partners and the
processing of data in an integrated environment. We intend to pertorm independent testing of
certified systems with the help of an outside contractor.

3. Contingency Planning

We will determine if contingency plans exist and are reasonable and complete to effectively
mitigate the risk of a Y2K failure. In addition, we will assess the adequacy of the Department's
and bureaus’ business impact prioritization of their mission critical systems


APPENDIX
ie of the Page 1 of 6
Chiet Apministrative Gtticer
GS. Bouse of Representatives
‘Bashington, BE 20515
MEMORANDUM
TO: Joba W. Lainhart, IV
Inspector General
co
FROM: Jay Eagen,
Chief. istrative Officer
DATE: SEP 09 1997
SUBJECT: Draft Audit Report - Year 2000 Audit

‘Thank you for the opportunity to comment on your draft report. We have carefully reviewed the
draft audit report, “House Needs to Refocus Its Efforts To Meet The Year 2000 Deadtine”
and carefully considered the recommendations contained therein. We appreciate the thought that
has gone into the document and we are generally supportive of the recommendations.

Our specific responses to the recommendations are as follows:

1. Establish formal project management controls and techniques as follows.

(a) Define the role of the year 2000 project leader and establish it as a full time position.
CAO Response: Concur

This recommendation will be addressed at two levels within the CAO.

First, the CAO will form a Technology Coordination Task Force. Each of the CAO AA’s and
one of their staff will participate. The chairman of the task force will be appointed by the CAO
with input from the HIR AA. The mission of this group will be to ensure that i

technology issues are coordinated throughout the CAO, including the Year 2000 project. Under
the guidance of the charter described in 1(b) and with CHO input, they will develop a CAO

strategy for the deployment of mission critical administrative applications, and will work to
ensure that the plans and initiatives of each CAO organization are consistent with overall CAO


110

Background Profile

Michael P. Harden, Ph.D.

Dr. Harden is the founder and President of Century Technology Services, Inc., a company
dedicated to conducting research into the Year 2000 Problem. and developing various
solutions. tools, or methodologies to enhance the ability of Year 2000 service providers to

deal with the problem more effectively.

Dr. Harden has over twenty years of experience in the computer and data processing
industry, primarily in the banking and government sectors. He has held high level
positions in companies such as Citicorp, Sterling Software, BancTec, Inc.. AMR
Information Services, and Fiserv, Inc, Dr. Harden has traveled to Asia and Europe to
study the Year 2000 Problem in those areas of the world, and to discuss the problem with

government officials and local business leaders in those locations.

Century Technology Services, Inc. is located at 1313 Dolley Madison Blvd., Suite 203,
McLean. VA. 22101, telephone 703-749-7840, facsimile 703-749-1210, email
ctsi2000@aol.com, web site http://www.ctsi2000.com.


74

Report Ne. 3-CAO-NS
Otfiee Of The Chief Administrative Orficer ‘December 31, 1896

Assess the projected costs and human resources and budget for them

Allow for one full fiscal year of testing so unforesecu problems can be identified,
addressed, and resolved,

+ Assign cesponsibility for the conversion to a Project Leader,
+ Create « project team consisting of representatives from all exeus within HR,

+ Dete:

ownership and maintenance responsibilities for office level systems, and
© Ensure thet appropriate time and resources are available for implementation of the plan.

Finally, in the event that HIR moves to a distributed client-service architecture, dual plans should
be developed, one co address the architecture as it currently exists, and another to address the
architecture that will exist as HIR moves to a distributed client-server environment.

Recommendation

We recommend that the Chief Administrative Officer prepare a comprehensive statez¥
addressing che potential impact of the Year 2000 issue, for review and approval ay the
Comminee on House Oversight. The strategy should include the requirements discussed in th's
finding.

Management Response

‘The Acting CAC concurred with the recommencation ia this finding. HIR will adopt projec:
ramyement policies and procedures to ensure appropriate planning anc conversion Zor yea:
2000 issues sdaressing the establishment of priorities and target dates for the phases of

and adequate testing for all the sy

Office of Inspestor General Comments
The planned actions are responsive to the issues we ident and when fully implement:

should satisfy the intent of our recommendation,

“Ghice af inspector Generat Page 0
U.S, House of Representatives


26

creation, storage, access, and delivery. HIR further stipulated that a migration strategy had to be adopted
prior to retirement of the mainframe. This migration plan would need to answer key questions and identify
critical decision points relating to the establishment of a client/server network in order to ensure support for
the new clientiserver systems.

‘The ISPP called for the House to begin planning for the retirement of the mainframe legacy systems several
years in advance of actual replacement. The migration plan would thus need to outline the retirement of the
‘mainframe processor as well as place a high priority on the retirement of legacy systems, and outdated
desktop systems that would have otherwise continued to drain resources needed for new programs. This
planning effort was especially needed for the IBM mainframe processor, since it was not expected that this
processor would be required to run any mission critical applications once MIN (Member integrated
Network ), ISIS (Integrated Systems and Information Services), LIMS (Legislative Information
Management System), and FMS (Financial Management System) were replaced. In the case of the House,
‘a well-conceived migration plan would be especially important since it had to include not only a plan to
provide continued service for its mission-critical systems until they could be replaced, but also a plan for
retiring formal agreements with outside clients, such as the General Accounting Office (GAO) and the
Congressional Budget Office (CBO), as well as provide alternative services for those systems, such as the
National Change Of Address (NCOA), that are not regarded as mission-critical

Objective, Scope. And Methodology

The original objective of this audit was to evaluate the adequacy and effectiveness of HIR's mainframe
migration planning process. However, preliminary discussions with the Directors of Integration and
Enterprise Computing, as well as follow-up discussions with the Associate Administrator, HIR*
(hereinafter referced to as the Administrator), revealed that there was no mainframe to clienvserver
migration plan, nor were there any known long-term planning efforts related to this issue. As a result, the
original objective of this audit was revised to (I) identify the course of management actions that have led
up to this condition, and (2) determine their effects. The audit was conducted from April 18, 1997 to July
3, 1997

We interviewed staff members in the Clerk's Legislative Computer Systems Office; the Acting Associate
Administrator, as well as the Director of Budgeting for the Office of Finance; the Acting Associate
‘Administrator for Media and Support Services: and the Legal Counsel within the Office of the Chief
‘Administrative Officer (CAO). We also interviewed the Administrator, Group Directors, and selected staff
in HIR. We visited and conducted interviews with the Director, information Systems Services and staff,
for the Small Business Administration, as well as the information Systems Audit Manager for the Federal
Home Loan Mortgage Corporation - Freddie Mac.

We conducted this audit in accordance with the Government Auditing Standards prescribed by the
Comptroller General of the United States and included such tests as we considered necessary under the
circumstances. While we are aware that the House is not required to follow Executive Branch guidance,
‘we applied this guidance, as well as standard industry practices. because we believe they establish a
reasonable framework or reference for best management practices,

Internal Controls

During this review, we evaluated internal controls over management practices and the planning process
involved in the development and implementation of HIR’s mainframe migration plan. The internal control
weaknesses we identified are discussed in the Results of Review section of this report.

* It should be noted that the Associate Administrator at the time of this audit resigned on August 4,
1997


92

Consequently, in October 1997 the Commonwealth of Pennsylvania hosted the first
State/Federal CIO Summit. Participants agreed to (1) use a 4-digit contiguous computer
standard for data exchanges, (2) establish a national policy group, and (3) create a joint
state/federal working group.

Key Economic Sectors at Risk of Year 2000 Failures

America’s infrastructures are a complex array of public and private enterprises with
many interdependencies at all levels. Key economic sectors that could be seriously
impacted if their systems are not Year 2000 compliant are: information and
telecommunications; banking and finance; health, safety, and emergency services;
transportation; utilities; and manufacturing and small business.’ The information and
telecommunications infrastructure is especially important because it (1) enables the
electronic transfer of funds, (2) is essential to the service economy, manufacturing, and
efficient delivery of raw materials and finished goods, and (3) is basic to responsive
emergency services. Illustrations of Year 2000 risks follow.

= According to the Basle Committee on Banking Supervision—an international
committee of banking si per-isory authorities--failure to address the Year 2000
issue would cause banking institutions to experience operational problems or even
bankruptcy. Moreover, the Chair of the Federal Financial Institutions Examination
Council, a U.S. interagency council composed of federal bank, credit union, and
thrift institution regulators, stated that banking is one of America’s most
information-intensive businesses and that any malfunctions caused by the century
date change could affect a bank's ability to meet its obligations. He also stated
that of equal concern are problems that customers may experience that could
prevent them from meeting their obligations to banks and that these problems, if
not addressed, could have repercussions throughout the nation’s economy.

« According to the International Organization of Securities Commissions, the Year
2000 presents a serious challenge to the world’s financial markets. Because they
are highly interconnected, a disruption in one segment can spread quickly to
others.

= FAA recently met with representatives of airlines, aircraft manufacturers, airports,
fuel suppliers, telecommunications providers, and industry associations to discuss
the Year 2000 issue. Participants raised the concern that their own Year 2000
compliance would be irrelevant if FAA were not compliant because of the many
system interdependencies. Representatives went on to say that unless FAA were

“These sectors are compatible with the critical infrastructures identified by the President's
Commission on Critical Infrastructure Protection. The Commission deemed these
infrastructures so vital that their destruction or incapacity would have a debilitating
impact on our defense and economic security.

4


7

with the Council to do everything we can to avert catastrophic fail-
ure of government and industry computer systems.

Minimizing the year 2000 problem will require a major techno-
logical and managerial effort. Not only must the Council act to en-
sure that no critical Federal program experiences disruption be-
cause of the problem, but it must also assist State and local gov-
ernments; cooperate with the private sector in important national
and local systems including the financial, telecommunications,
health, transportation, and energy sectors; as well as communicate
with our international allies to raise awareness and generate coop-
erative international arrangements to address this problem. In the
coming months, I intend to work very closely with the Council; es-
pecially assisting in the development of initiatives to ensure that
the private sector is moving forward with necessary dispatch.

Meanwhile, Congress, not just the Science Committee and the
Government and form and Oversight Committee, but also a
number of other committees, will continue to hold hearings to de-
termine the scope and impact of the problem on the American pub-
lic and to monitor agency progress. The Council and Congress must
jointly seek solutions. It’s clear that we can’t meet a new era of op-
portunity if 2 years from now our Nation’s computers are moving

ackward instead of forward. We must create a new paradigm of

collaboration or we all know that we're facing an unforgiving dead-
line and time is running out. The American people are expecting
no less from us, and I yield back, Mr. Chairman, and thank you
also for the kind of gargantuan work that you have unde:
also with regard to correcting this problem.

[The prepared statement of Hon. Constance A. Morella follows:]


75

Mr. Horn. Yes, and, of course, we don’t have any jurisdiction
over that in this committee. Our jurisdiction is simply limited to
the executive branch. House Oversight has that jurisdiction, and,
as Mrs. Morella noted, there has been a coordinator appointed even
before John was appointed, so we are making progress here, be-
cause we had chi that informally months ago. Go ahead, the
gentlewoman from Michigan.

Ms. STABENOW. Thank you. First, to Chairman Horn, thank you
and Chairwoman Morella. We have held, I know in our Technology
Subcommittee, a number of important hearings as has this commit-
tee, and this is an incredibly important subject. I would only add
that as we take responsibility in the Congress for what we need to
be doing that the administration do the same, I would also urge
that we work closely with our local units of government and small
businesses. I have been very concerned about the lack of awareness
in my State of Michigan in terms of the small business community.
Tm holding a series of forums on Monday, in fact, to address this
and provide information to them. But I think each of us has a re-
sponsibility, and rather than deciding who is doing better than the
other, I’m hopeful that we will all address this together, so that we
will provide the maximum amount of information to local units of
government and small businesses so that they may also address
the impact of this serious challenge. Thank you.

Mr. Horn. Thank you. Does the gentleman from Tennessee have
any comments?

ir. GORDON. Thank you, Mr. Chairman. On this important
issue, I think my best contribution can be to be quiet and let the
expert panel go forward. [Laughter.]
. Horn. I thank the gentleman from Tennessee. He always
has great wisdom on these comments. [Laughter.]

It’s a great pleasure, now, to have the first panel—and gentle-
men, you know the routine—we do swear all witnesses before the
subcommittee, so if you'll rise and raise your right hands.

[Witnesses sworn.

Mr. Horn, The clerk will note that all three witnesses have af-
firmed, and it’s a great Pleasure to have our friend, John Koskinen,
come out of retirement like the Lone Ranger riding out of the shad-
ows to deal with evil doers. So, John, we welcome you here. When
T co tulated him on his first day at work last Monday, he said
he’d like a week or so to find out what’s going on with some of his
colleagues. So, we look on this as not the definitive word that you
will have but what your strategy is, and we’re delighted the Presi-
dent appointed you.

STATEMENTS OF JOHN KOSKINEN, CHAIR, PRESIDENT’S
COUNCIL ON YEAR 2000 CONVERSION; GENE DODARO, AS-
SISTANT COMPTROLLER GENERAL, U.S. GENERAL AC-
COUNTING OFFICE; AND MICHAEL P. HARDEN, PRESIDENT,
CENTURY TECHNOLOGY SERVICES, INC.

Mr. KOSKINEN. Thank you, Mr. Chairman. I'd like to thank all
of you for your kind comments. This may be a classic example of
a situation where I should quit while I’m ahead, but, nonetheless,
we have a couple of years of work ahead of us. With your per-


81

career in public service by taking on a job that some think is impossible. Senator Moynihan, who
has also been concerned about the Federal Government's response to the year 2000 problem for
some time, has said that the overall challenge facing me is analogous to the “13th labor of
Hercules.”

‘There is no question that the challenges are great, and I am confident that the Council can
play an important role in meeting those challenges. However, we need to carefully structure the
Council’s activities to maximize its effectiveness. GAO, which has done very valuable work in the
year 2000 area generally, has recently circulated a draft report recommending actions for the
‘Council. We will be sharing our detailed comments on the draft with GAO, but we generally
agree with much of what they have to say.

From my perspective, I think it is important for the Council not to interfere with or
duplicate the good ‘work that is currently underway in the agencies and is being done by the CIO
‘Council and other interagency management councils. The Council should also build on, rather
than try to replace, the important oversight role that OMB is playing in monitoring and reporting
information gathered from the agencies.

The Council needs keep informed of the progress resulting from these efforts, which have
‘been appropriately focused primarily on systems managed by or for the Federal Government.
However, we have an obligation to the public to view this as more than just a Federal systems
problem. We need to adopt a global perspective, and I think the Council’s real contribution will
be made by coordinating work by the agencies with those outside the Federal government,
whether they be tribal, state and local governments, private sector organizations or institutions
operating around the world.

To accomplish this, I do not believe the Council should create and directly manage new
national forums for specific sectors of the economy such as financial institutions and the health
care industry. The Council should be a catalyst, using existing structures and resources to create
an ongoing dialogue on the year 2000 implications for these activities. Individual Federal
agencies have a major role to play in this regard. For example, I think that the Council can be
more effective by enlisting and supporting someone like the Treasury Department or the Federal
Reserve as the coordinator on outreach to financial institutions, and HHS as the coordinator on
cutreach to the health care industry -- empowering them to determine the appropriate measures
Government should take to assure progress in these areas. For example, the agencies may work
through existing private sector groups, such as those identified in GAO’s testimony, as part of
their outreach effort. The senior executives in each agency responsible for the work in such
sectors or partnerships will be the agencies’ representatives on the Council, which will then be
able to monitor and coordinate these agency activities and help ensure that there are not gaps in
the coverage.

‘While the Council will have a global perspective, I would like to emphasize that it will
not be a centralized body that will relieve the agencies and others of their individual


3

computer chips. We cannot allow all of these so-called nonmission-
critical systems to fail, but we must first deal with the mission-crit-
ical systems and properly so.

The mission-critical systems cannot be the only systems fixed;
they must be the first but not the last. We cannot ignore thousands
and thousands of these secondary systems. The collective confusion
of the tens of thousands of secondary systems failing would be cata-
strophic. The standard of acceptable year 2000 conversion must re-
alistically be high enough to protect the American people. It needs
to include the completion of 100 percent of all mission-critical sys-
tems in the Federal Government and key economic sectors such as
banking; thorough and complete testing of all mission-critical sys-
tems; contingency plans for all mission-critical functions, even
those with finished and tested systems; completion of 100 percent
of all data exchanges; and a reasonable certainty that the Nation’s
telecommunications systems and public infrastructure such as elec-
tric utilities will continue to function through the date change.

An overly pessimistic recovery plan, frankly, is needed as a
backup. We have a responsibility to the American people to mini-
mize the effect of this situation on their livelihood. We must live
up to this responsibility, we must really move ahead very rapidly,
and we're ing about 24-hour days in many of these agencies.
We must develop contingency plans for the systems that are fin-
ished and tested. We must develop a recovery plan for possible fail-
ures. It’s our responsibility to be careful, very careful, with the eco-
nomic well-being of America.

It’s amazing, but true, the year 2000 computer bug could harm
the world’s largest and most robust economy. It’s our responsibility
to squash this bug; to fix it; test it, and test it again; to finish it,
and to have a contingency plan.

{The prepared statement of Hon. Stephen Horn follows:]


109

the tax code be accomplished while resources are also needed on the Year 2000

Problem? The obvious answer to these questions is that it just isn’t possible.

Recently, Capers Jones, a noted authority on the Year 2000 Problem, estimated that the
amount of labor needed to find, fix and test all of the Year 2000-impacted software was
over 700,000 person-years. With less than two years left. there is no way possible to
complete the task for everyone. Many state governments have already felt the pinch.
California, Texas, Missouri, Maryland, and many others have reported difficulties in
retaining current programming staff or in hiring new staff, They cannot compete with the
private sector salaries being offered. Private sector recruiters have resorted to offering
“bounties” for trained programmers. And the problem is not isolated to the United States.
In the United Kingdom, industry analysts estimate that all available programmers will be
working on either the Euro conversion or the Year 2000 problem by April 1, 1998, Out of
the 12,000 major UK companies needing assistance, there are only enough resources for
3,000. In Japan, there is an estimated shortfall of 200,000 programmers to fix the problem

in time.

In conclusion Mr. Chairman, I cannot overstate the challenge that the Federal government
faces in being able to assure itself of having the resources necessary to fix the Year 2000
Problem in time. Nor can I overstate the general industry consensus that the rising costs
associated with hiring and retaining talented programming staff will impede the
government's ability to achieve success in its Year 2000 battle, I urge the Subcommittee
to focus itself on determining whether existing budget projections for the Year 2000 are
still valid, and to quickly examine what measures can be taken to allow the government
to compete on an equal footing with the private sector for the limited amount of resources
available. The government of the United States cannot afford to find itself sitting on the
sidelines watching commercial entities lure every possible resource out of the public
sector, leaving the government hamstrung in its ability to deal effectively with the Year
2000 Problem.


79

tant to increase worldwide attention to the urgent necessity of solv-
ing this problem, we need to avoid creating unnecessary panic and
precipitous counterproductive activity. The best way for us to spend
the next 21 months will be to address the challenges that lie before
us, in a very aggressive but measured way, by marshalling the re-
sources at our disposal in the most effective way possible.

I thank the subcommittees for their continued interest in this
problem. Your efforts have made, and continue to make, a valuable
contribution to the public dialog about this matter. I look forward
to working with all of you, and I would be happy to answer any

juestions you may have after the other statements are made.
Thani you.
[The prepared statement of Mr. Koskinen follows:]


105

So, in conclusion, Mr. Chairman, I don’t believe that I can over-
state the challenge that the Federal Government will face over the
next 2 years to actually find and maintain the staff it needs to fix
its problem. I urge the subcommittee to focus itself, as one of its
many tasks, to determine whether the existing budget projections
are indeed accurate and as to what contingencies can t: lace in
this Government to handle the lack of resources that this Govern-
ment will face.

Thank you.

[The prepared statement of Mr. Harden follows:]


90

While actions by government and industry are underway throughout the nation, the
recent creation of the President's Council on Year 2000 Conversion represents a much
needed approach to orchestrate the leadership and public/private partnerships essential
to confronting the unprecedented challenges posed by the Year 2000 crisis. Our
testimony today outlines Year 2000 risks and presents actions that should be taken by
the President's Council. We have provided for comment a draft report on these issues to
the Chairman of the President's Council on Year 2000 Conversion and the Office of
Management and Budget (OMB) and expect to issue it soon.

RELIANCE ON COMPUTERS AND INTERDEPENDENCIES
AMONG SECTORS CREATE RISK OF SERVICE DISRUPTION

The public faces a risk that critical services could be severely disrupted by the Year 2000
computing crisis. Financial transactions could be delayed, airline flights grounded, and
national defense affected. The many interdependencies that exist among governments
and within key economic sectors could cause a single failure to have adverse
repercussions. While managers in the government and the private sector are taking
many actions to mitigate these risks, a significant amount of work remains, and time
frames are unrelenting.

tion to Government Services Is

The federal government is extremely vulnerable to the Year 2000 issue due to its
widespread dependence on computer systems to process financial transactions, deliver
vital public services, and carry out its operations. This challenge is made more difficult
by the age and poor documentation of the government's existing systems and its
lackluster track record in modernizing systems to deliver expected improvements and
meet promised deadlines.

Unless this issue is successfully addressed, serious consequences could ensue. For
example:

= Unless the Federal Aviation Administration (FAA) takes much more decisive
action, there could be grounded or delayed flights, degraded safety, customer
inconvenience, and increased airline costs.

= Payments to veterans with service-connected disabilities could be severely delayed
if the system that issues them either halts or produces checks so erroneous that it
must be shut down and checks processed manually.

= The military services could find it extremely difficult to efficiently and effectively
equip and sustain its forces around the world.

“Ye
(GAO/T-AIMD-9

Fail

2


APPENDIX
Page 3 of 6

CAO Response to Year 2000 Audit

Page 3
September 9, 1997

(©) Institute a status reporting mechanism to inform upper management of Year 2000
progress.

CAO Response: Concur

The Year 2000 project manager will develop a standard reporting mechanism that will advise
‘management of progress and inform them regarding issues and problems as necessary. The
reports will be delivered to the Task Force, the CAO and others as appropriate. Regular
reporting will assure House management that milestones are being met and alert them to
potential problems. Status reporting will also facilitate resolution of any cross-organizational
issues. New or additional work requirements will be documented, assessed, and prioritized.

(4) Conduct a detailed level of effort analysis which estimates the resources needed to
complete the initiative.

CAO Response: Concur

The Year 2000 Plan estimates the overall resources to solve the Year 2000 problem. In the next
phase, detailed plans for each application will be developed. The first step will be to develop a
master schedule of when each individual plan will be completed.

The detail plan for each system will include the proposed olution, detailed analysis of the
impact including end user involvement, resources required, unit and integrated test plans, and an
implementation plan. Major milestones for each major phase will be established and
intermediate milestones will be detailed. Both storage space and processing capacity will be
documented within each plan. The estimates of computer resources will be compared with
available resources as early in the process as possible. The plans will be reviewed and updated
regularly. Our objective is to have an implementation plan in place by the end of March 1998.

(© Purchase software tools and secure a contractor, as uecessary, to assist with conversions
and testing.

CAO Response: Concur

HIR is actively researching the market for Year 2000 tools, especially ones that can process
Adabas/Natural code. Plans are to hire contractors who are experts with the software tool and
who can train CAO staff on optimum use of the tool, as well as assist with the conversion effort.
This effort will proceed based upon the availability of funding and resources.

(O Determine whether all systems are needed and on which platform they will reside.


54

with outside organizations that exchange data with the CAO and keep them informed of the
CAO’s progress and plans. Communication Services is already planning for the readiness of
remote networks (including CAPNET). An inventory of files that are exchanged with outside
organizations has been compiled. Items on this inventory will be monitored, and a dialog with the
organization will be maintained.

‘The CAO has adopted the standard Year 2000 contract language and incorporated this language
into all procurements relating to information technology purchases. HIR, in conjunction with the
Office of Procurement and Policy (OPP), has already modified the GSA standard Year 2000
Warranty language for incorporation into solicitations for contracts drafted by HIR. This
language was used in the House's Wide Area Data Communications solicitation, OPP will
develop similar, appropriate language for incorporation into the standard House Terms and
Conditions applicable to purchase orders.

The CAO agreed that progress is needed on OSM and FMS Payroll replacement initiatives. The
Task Force will closely monitor both projects and work to expedite the process. HIR expects to
work closely with OSM and Human Resources on the replacement of both of these systems.
OSM and Human Resources will have the lead role in their respective projects, and HIR will
assist on technical and requirements issues. The Task Force will work to ensure that these
projects are coordinated and receive the required resources. The implementation of these new
systems is critical to the overall HIR Year 2000 conversion effort. Both systems represent a
major software conversion effort, and failure to implement new systems before Year 2000 would
adversely impact the success of the Year 2000 Plan.

Office of Inspector General Comments

The CAO’s current and planned actions are responsive to the issues we identified and, when fully
implemented, should satisfy the intent of our recommendations.


16

and we have to recognize it’s also going to be difficult, but staff is
going to be critical to this.

Moreover, as we move toward the next millennium, certain vital
economic sectors may fall behind in their year 2000 conversion. The
Federal Government must be prepared to prevent a potential na-
tional crisis arising from a failure of an economic sector such as the
utility industry or the banking community.

Mr. Chairman, it is crucial that we succeed. To fail, would jeop-
ardize the health and the safety of Americans. Benefit checks, upon
which so many Americans rely, could be delayed or could be erro-
neous; air travel could be impacted; missile systems can be af-
fected; electric power could be interrupted; phone service could be
disturbed. Clearly, the potential consequences can be enumerated
far into the future. They're far reaching; they’re dramatic.

I, once again, want to thank the chairman and all the witnesses
who are here today for their hard work on the year 2000 conver-
sion. I look forward to a productive working relationship, and,
again, thank you very much, Mr. Chairman.

[The prepared statement of Hon. Dennis J. Kucinich follows:]


45

Based on current industry practices/standards covering Year 2000 conversion costs, it is possible
that HIR’s cost estimates’ may fall short of actual funds needed for this initiative by as much as
$2,387,000. HIR's Year 2000 plan estimates costs for the initiative at $1,243,000--which equates
to roughly $1.00 per line of code times 1.25 million lines of code.* We found that HIR’s estimate
for lines of code and rate per line for the initiative may be understated as follows.

Lines of code Rate per line Totals

HIR estimate 1,250,000 $.9944 $1,243,000
OIG estimate 1,650,000 $2.20 $3,630,000
HIR understatement ($2,387,000)

While a November 1996 Year 2000 contractor report estimated the lines of code at 1.29 million,
the same contractor indicated a change in the number of lines to 1.65 million ina March 1997
update to its initial report. The second report attributed the line increase to the fact that certain
House applications were not included in the initial inventory. When presented with these
contradictory numbers, the Year 2000 project leader said the 1.65 million was incorrect, but
provided no rationale for this position. (The contractor did not provide HIR with any of the
supporting work papers for the original or the updated numbers so neither HIR nor we can
determine the accuracy of the contractor's numbers.) Even if we use HIR’s lower rate per line,®
at 1.65 million lines, the estimate is still short by about $400,000.

Moreover, the $1.00 rate per line of code may be understated. The Gartner Group's 1997
estimate® puts the rate per line of code at $2.20.’ This rate can be used with the actual number of
lines of code in an organization to determine a rough Year 2000 cost estimate for budget
purposes. We used the $2.20 rate because it represents one of the most current, comprehensive,
generally accepted industry benchmarks available. Also, since HIR has limited actual cost data for
the remaining three project phases-which account for the majority of a Year 2000 initiative costs-
ve felt that the $2.20 rate should be used until better cost data is available. One method that can
reduce this rate is to use in-house resources rather than contracting-out, however, the mix of
services needed has not as yet been determined. In addition, the number of lines could be reduced
if certain Group 3 support systems are not converted, a decision which has yet to be made.

In addition, the Gartner Group also estimates needing one FTE for every 100,000 lines of codes.
At 1.6 million lines of code, this would equate to approximately 16 FTE's. HIR’s Year 2000 plan
indicates that eight FTEs are available in FY 1997, but in our discussions with HIR we were told
that there are a number of employees participating in the initiative on a part-time basis from
various groups and that five of them are working on LIMS, but only on a part-time basis. HIR’s

? Estimates do not include the FMS Payroll module and OSM replacement costs.

“A generally accepted method of estimating Year 2000 costs is to multiply the number of lines of source
‘code in an application(s) by the current rate per line Programmers, with the assistance of available software tools,
review the individual lines of source code to locate and convert date fields.

> HIR said it was purely coincidental that the |.25 million lines equated to about $1.00 rate per line.

* Gartner Group, Inc. is recognized as one of the authorities on the Year 2000 issue.

” The Gartner Group estimated rate for converting a line of code was at $1.10 in 1996 and the current rate
is $2.20 aline. Other estimates per line are as high as $8.80 as the Year 2000 deadline approaches.


49

an added level of assurance when converting date fields. Further, the use of a software tool could
assist with date field conversions in the smaller House systems, the total of which exceeds
881,000 lines of code.

Although the Year 2000 plan contained high level conversion strategies, the Year 2000 project
leader indicated that detailed implementation plans will be prepared for each individual system
conversion. We obtained and examined the three-page LIMS detailed implementation plan and
found it contained a limited number of detailed steps and milestones to monitor the preliminary
conversion phase, but did not contain programs, data issues, file conversions, resources, and
continuous milestones as prescribed in the higher level Year 2000 plan. Additionally, as in the
Year 2000 plan, the Validation (testing) and Implementation phases were not covered sufficiently
in the detailed plan. Because LIMS is a highly integrated system, HIR officials indicated that
problems are already anticipated with the testing phase of LIMS. Moreover, the Year 2000 plan
identified eight full-time employees to be assigned to the LIMS project in FY 1997, however, to
date only five HIR Integration Group personnel are working on this effort~all on a part-time
basis. The existing detailed implementation plan needs to be expanded and standardized for LIMS
and the other systems needing Year 2000 attention. These detailed implementation plans should
be prepared when decisions are made about the disposition of each system. Together, the Year
2000 plan covering the five conversion phases, and the detailed implementation plans should serve
as a basis for successfully completing the Year 2000 initiative.

Action Needed On OSM Systet jlacement

While $800,000 has been identified as being needed for the OSM system replacement and
preliminary inquiries have been made on alternatives, the House has not taken significant action to
ensure timely replacement. Although the Acting Associate Administrator, Media and Support
Services was aware that the system needs to be replaced because it is not Year 2000 compliant,
she told us that she believed HIR was taking the lead on the replacement project. As previously
mentioned, the Year 2000 project leader indicated that HIR had not taken the lead on this effort,
and in tum, referred us to OSM. The Acting Associate Administrator, Media and Support
Services agreed that OSM, HIR, and the Office of Procurement and Purchasing (OPP) needed to
get together to develop a replacement plan, but, to date, that has not happened. In our view,
planning for this should be done immediately. This would include, but not be limited to,
appointing a project leader to report and oversee the progress of the OSM replacement effort,
assigning formal roles and responsibilities, and establishing milestones for the replacement project.
The actual system replacement effort should be planned--from the initial stages (.e., complete a
needs analysis, requirements definition, and RFP, etc.) to system implementation. We suggest
extremely close monitoring of this project, and again recommend that a contingency plan be
developed in case the replacement effort goes beyond the Year 2000.

No ime For FMS Pavroll System Replacement
Although the FMS Payroll replacement project has identified $2 million dollars as being needed

for funding, its status remains in the preliminary planning stage. A discussion with the Acting
Associate Administrator, Office of Finance indicated that a statement of work has been prepared


78

tems cannot communicate with the external systems with which we
need to exchange data to operate key Federal p: \.

Second, the Council will be working closely with existing inter-
agency councils to increase the coordination of agency year 2000 ef-
forts and better facilitate the exchange of year 2000 information
and ideas among the agencies. As I said, I don’t believe the Council
should be duplicating those efforts, but I do think we can play an
important role in energizing and coordinating the good work of
these groups and in increasing their visibility to ensure that agen-
cies can benefit from each other’s experiences.

Third, and most important, the Council will be reaching out to
those outside the Federal Government to increase awareness of the
year 2000 problem and to offer appropriate assistance and support.
A year ago, if you were to ask me to name our greatest challenge,
I would have said—as this subcommittee noted—that it was mak-
ing those within the Federal Government aware of the problem. I
think, in substantial part because of the good work that’s been
done in the administration and on the Hill, we have now achieved
that awareness on the Federal level. A critical challenge over the
next 6 months will be to reach out to State and local governments,
to the private sector, and to foreign entities to increase their
awareness and determine not only how they are dealing with the
problem, but whether there is anything the Federal Government
can do to help in those efforts.

I’ve already mentioned the importance of Federal interfaces with
State and local governments, but there are other solely State and
local services on which people depend—from public safety to pay-
ment of State pension benefits —t it could be affected by the year
2000 problem. Last October, we made a good start in our dial
with State and local officials when Sally Katzen, who has
to be vice chair of the Council, met with representatives from State
and local governments at a conference in Pittsburgh. A Federal-
State working group has been established, and I look forward to
continuing that dialog and seeing how the Federal Government can
be of assistance to State and local governments as they work to fix
their systems.

Finally, in a global economy that is increasingly lependent upon
the electronic exchange of financial and other data, we need to do
everything we can to ensure that other nations are devoting the ap-
propriate level of attention to this issue. Having traveled exten-
sively in Southeast Asia prior to my starting to this job, I can tell
you from personal experience that many countries are focused on
more immediate economic problems than solving the year 2000
problem. While this is one area in which the Council may have the
greatest difficulty in exercising influence, we need to do everythi
we can to raise awareness in other countries. So, the Council wil
work with Federal agencies to leverage the influence of inter-
national organizations like the United Nations, the World Bank,
and the International Monetary Fund to increase awareness and
facilitate the exchange of information among nations.

There is no doubt that the year 2000 problem poses significant
challenges to our Government, our Nation, and the world. Those of
us who are committed to solving this problem will have to perform
a delicate balancing act over the next bt months. While it is impor-



140

2000 program. This individual, typically at the CIO or CFO level or higher, is
responsible for ensuring that the Year 2000 program at their bureau or office is completed
in a timely manner.

I would now like to describe the overall status of Treasury’s Year 2000 program.
some successes we have experienced, and some remaining challenges we must address.

Treasury has now identified 321 mission critical IT systems and 272 mission
critical Non-IT systems. At present. we have completed the assessments for 97.1% of
Treasury's mission critical IT systems, We have renovated 125, or 51.4% of the mission
critical IT systems that need to be converted. We can now report 119 out of 321 (37.1%)
of the total mission critical IT systems are now Year 2000 compliant. Treasury's largest
bureau, the Internal Revenue Service (IRS), has renovated 75 out of 126 (59.5%) mission
critical IT systems, and validated 60 out of 126, or (47.6%).

I believe that, as a Department, we have made significantly more progress than
has been indicated by the above figures. We are conservatively not reporting progress
until entire systems have been renovated and tested. For example, the Customs Service,
like the IRS, manages its renovation efforts by components. Customs has three mission
critical systems, all of which require repair, which include 178 components. Although we
report none of these three Customs mission critical IT systems as completed renovation,
testing. or implementation. the fact is that 63.8% of the components within these systems
have been renovated. 27.7% have been tested. and 19.24% have been implemented. Over
73% of the total Customs inventory of lines of code have been converted.

Treasury operates one of the largest enterprise telecommunications networks int
the Government. In order to address Year 2000 challenges. a Year 2000
Telecommunications “Command Center” has been established to serve as a central
location for telecommunications activities, including the Telecommunications Executive
Body and Working Group meetings. Charts and graphs depicting current hardware and
sofiware status of each corporate telecommunications program, the independent
verification and validation (IV&V) testing process, and overall progress tracking are
displayed prominently for use by program managers and executives. Contractors
supporting the telecommunications programs are co-located with the dedicated Year 2000
telecommunications program staff in the room to ensure ongoing. timely
communications. To further promote communication among the CIO, Executive Body,
program areas, working groups and bureaus. the Department has established a
telecommunications site on the Treasury Year 2000 Intranet web site. Current
information is published on the web site. including schedules, inventories and
assessments, correspondence. and other relevant information.

Treasury has established a test laboratory for testing components of the system
before implementing the changes in the operational environment. In addition, the
Department has engaged a telecommunications company to perform independent


133

EMBARGOED UNTIL 9:30 A.M. EST
‘Text as Prepared for Delivery
March 18, 1998

TREASURY ASSISTANT INSPECTOR GENERAL FOR AUDIT DENNIS SCHINDEL
HOUSE GOVERNMENT REFORM AND OVERSIGHT SUBCOMMITTEE ON
GOVERNMENT MANAGEMENT, INFORMATION AND TECHNOLOGY

Mr. Chairman, Members of the Committee, I am pleased to appear before you today to
discuss the Office of Inspector General's oversight of the Department of the Treasury’s efforts to
address the Year 2000 (Y2K) problem.

One thing is clear: this problem must be fixed, and failure is not an option. The two
bureaus represented here today--the Internal Revenue Service (IRS) and the Financial
Management Service (FMS)—provide services that are essential not only to government but to
the public as well. Those who pay taxes and those who receive tax refunds and other
government payments have a great deal at stake in the successful Y2K conversions of these two
bureaus.

There is a great deal of focus on Y2K both in Treasury and throughout the Federal
government. Plans are in place. a structured approach has been established that defines the
various phases for a Y2K conversion, milestones have been set, and a progress reporting
mechanism is in place,

Despite these accomplishments, two factors create a igh risk that significant problems
could occur to prevent a successful Y2K conversion. First, the sheer size and magnitude of the
work to be done will make it difficult to manage. Second, the deadline cannot be extended: it is
January 1, 2000—and, for some operations, sooner than that, With the amount of work left to be
done and everyone competing for scarce information technology staff resources, this presents an
enormous challenge. It will take many people working very hard and efficiently between now
and the year 2000 to get the job done.

RR-2305


11

Mr. Horn. I thank the gentlewoman and now yield to the rank-
ing minority member on the Subcommittee on Government Man-
agement, Information, and Technology. We're glad to welcome Mr.
Kucinich of Ohio.

Mr. KucINicH. Thank you, Chairman Horn, and as a courtesy, I
would like to yield, first, to the ranking member of the subcommit-
tee on Technology, Congressman Barcia of Michigan.

Mr. BarciA. Thank you very much, Mr. Chairman, and I want
to thank you, Mr. Kucinich. | want to welcome everyone to this
morning’s hearing, and I want to commend you for making it here
so early. I want to congratulate Mr. Koskinen on his new position
as Chair of the President’s Council on the Year 2000 Conversion.
He has a challenging and daunting task before him.

I am particularly pleased by the administration’s recent efforts
to coordinate its activities with States and other parties which ex-
change date sensitive information with the Federal Government.
There is a high degree of information and system interdependence
between the Federal, State, and private sectors. These interdepend-
encies increase the risk that a cascading wave of failures or inter-
ruptions of essential services could occur. The latest OMB quar-
terly report and GAO’s latest assessment indicates much work has
been done and that much work remains to be done.

I am encouraged by the administration’s efforts to develop a
more comprehensive Y2K plan as well as moving compliance dead-
lines forward. The council has laid out an ambitious agenda with
not much time to complete it. However, at this point, these are just
plans, and the devil will be in the implementation details.

Our two committees have been at the forefront of raising aware-
ness of the Y2K problem and, in general, we have been very critical
of the administration’s efforts. In preparing for this hearing, I
wanted to know what Congress is doing to address the Y2K prob-
lem in its own computer systems. I reviewed the House Inspector
General’s reports on House efforts to fix its computer systems, and
I was dismayed by what T learned.

According to a December 1996, IG report, House Information Re-
sources does not have a plan to address the year 2000 issue. In a
follow) report, issued ost a year later, the Inspector General
found t has not established effective project management
controls; met general Government year 2000 milestones; prepared
a comprehensive year 2000 plan covering critical stages of the ini-
tiative or disposition of all systems; adequately estimated the year
2000 initiative costs or budgeted sufficient funds; sufficiently co-
ordinated year 2000 efforts with external groups; incorporated year
2000 warranty language in its procurement contracts to guarantee
compliance on future information technology purchases; and se-
cured software tools or contracts for support to assist in the conver-
sion effort.

I understand that HIR has hired a year 2000 coordinator subse-
quent to the latest IG report and that a comprehensive manage-
ment plan will be completed shortly. However, once again, the devil
will be in the implementation details.

These two IG reports indicate that we are behind the curve in
addressing the Y2K problem. If we intend to take a leadership role,
we must lead by example and get our own house in order. Many


185

We plan to report deficiencies as they are identified. Our goal is to alert the Department
and bureaus to any significant vulnerabilities that they need to quickly address to reduce the risk
of a Y2K failure. We plan to complete our phase 2 audit work in August and issue a
consolidated report to the Department in September. Based
on the results. we will determine the scope of additional audit work for the remainder of 1998
and into 1999

We. as well as the Department and the bureaus, have a great deal of work ahead of us.
One of our challenges will be to tind a way within our existing resources to give adequate
coverage to this area. We will have some help in this regard. especially at IRS

The IRS Chief Inspector's Office has an extensive audit effort underway at IRS. They
recently issued a final report on IRS" project planning and project management methodology and
made several recommendations tor improvement. They have nine additional audits that are
either ongoing or planned. to cover various pieces of the IRS Y2K conversion effort

Also, the Department's contractors are providing management support and Year 2000
assessments, We used these assessments in our phase | audit work and will leverage off of some
of this work in phase 2.

Finally, we are aware that GAO will be conducting reviews of Y2K conversion efforts in
Treasury. We are coordinating with both GAO and the IRS Chief Inspector to avoid duplication
and leverage our resources. Among the three audit groups we hope to give audit coverage to
most, if not all, of the critical Treasury operations.

This concludes my opening statement. | will be happy to answer any questions that you
may have.
-30-


53

systems follow the strategic direction of the CAO. The Task Force will review all major
information projects within the CAO, including the Year 2000 project, the Payroll and OSM
replacement projects, and new procurement systems. Also, the CAO will develop a Statement of
Work for the Year 2000 project manager. This statement will detail the specific duties,
responsibilities, timelines, and deliverables of the project. The project manager will provide staff
support for the Task Force, be responsible for the technical aspects of the process to determine
the technical needs of the House, and coordinate resources within HIR. Further, the Year 2000
project manager will develop a standard reporting mechanism that will advise management of
progress and inform them regarding issues and problems as necessary.

In the next phase of the Year 2000 Plan, detailed plans for each application will be developed.
The first step will be to develop a master schedule of when each individual plan will be completed.
The detailed plan for each system will include the proposed solution, detailed analysis of the
impact, and an implementation plan. Major milestones for each major phase will be established
and intermediate milestones will be detailed. The estimates of computer resources will be
compared with available resources as early in the process as possible. The plans will be reviewed
and updated regularly. The objective is to have an implementation plan in place by the end of
March 1998. Also, HIR is actively researching the market for Year 2000 tools. The CAO plans
to hire contractors who are experts with the software tool and who can train CAO staff on
optimum use of the tool, as well as assist with the conversion effort. This effort will proceed
based upon the availability of funding and resources. Final decisions on most of the applications
identified in the Year 2000 Plan should be made over the next 6-8 months with guidance and
coordination from the Task Force. For replacements of retired systems, the necessary analy'sis
will be completed to determine the system that best meets requirements. Subsequent versions of
the Year 2000 Plan will document these decisions. The CAO will also involve both management
and staff in Year 2000 groups. The CIO Council has been contacted, and the CAO will begin
participating in the activities of this Council.

The CAO also agreed to revise and prepare follow-on document(s) to the Year 2000 Plan,
including additional levels of detail, as needed. Milestones, dependencies, and issues will also be
documented, and appropriate charts prepared to illustrate project resources, milestones,
dependencies, and overall sequence. In addition, the Task Force will continue to monitor the
Year 2000 project and make any necessary adjustments. Those applications that are mission
critical to the entire House will continue to receive the highest priority.

In addition, the CAO agreed to revise the Year 2000 cost estimates and prepare revised budget
requests based on these revised figures. Updates of the Year 2000 Plan will be released regularly.
These updates will reflect any policy changes, new requirements, and necessary revisions to
overall time and cost estimates. Updates to the plan will drive the budget requests for FYs 1999
and 2000.

Also, the CAO will coordinate data exchange issues with the external organizations that interact
with the House’s systems. The CAO is a member of the Legislative Branch Technical
Coordination Group that is addressing Year 2000 issues among Legislative branch organizations.
The Year 2000 project manager, in conjunction with the Task Force, will coordinate activities




172

Agency Chief Operating Officers will provide reports to OMB by the fifteenth of May, August, and
November through November 1999, detailing their progress in dealing with the Year 2000 problem.
‘The Subcommittee on Government Management. Information. and Technology will continue to monitor

these reports, and insist on the highest level of effort on the part of the Executive Branch to solve this
problem.

Congressman Sessions, in addition to being Vice Chairman of the Subcommittee on Government
Management, Information, and Technology, is Chairman of the Results Caucus. The Results Caucus is
coalition of reform-minded members of Congress who share the common goal of realizing a smaller,

smarter, common-sense government by getting major management problems off of GAO's high ris
one of which is the problem concerning the year 2000.

ae

12)


161

Subcommittees, based on the fact that our testing will be completed at least 15 months before the
year 2000 deadline, we can be confident that all Social Security payments will be issued correctly
and on time by FMS when the next century begins.

‘We view systems preparation for the year 2000 as our absolute highest priofity, enabling
‘us to successfully maintain payment and collection operations in the next century. While we have
made significant progress in these areas, the Administration has proposed a supplemental request,
to provide Secretary Rubin with the discretion to fund FY 98 needs, which for FMS amounts to
57.4 million. Additional year 2000 funding will be used to provide supplementary contractor
resources to accelerate the conversion, validation, and implementation of FMS’s information
systems, including GOALS and the Regional Financial Center payments and claims systems,
Furthermore, funds will be used to provide increased computer capacity in our Hyattsville,
Maryland data center to allow for concurrent testing of FMS’s information systems that have been
renovated for year 2000 compliance. FMS will assign whatever resources are needed to ensure
we do not fail to accomplish these changes to our computer systems.

‘Thank you for allowing me the opportunity to discuss FMS’s plans to complete the
massive work necessary to enable us to meet the year 2000 computer challenge, We recognize
the importance and enormity of the challenge and are working to ensure that important
government services are not disrupted on January 1, 2000. I would be happy to answer any
questions you may have regarding this issue.


10

Report No. 96-CA0-15
Office OF The Chief Administrtive Officer December 31, 1996

+ Reassess the need for continued contractor services after the recently proposed reorganization
is approved and implemented, and prepare a new comprehensive contracting proposal for
services needed

+ Establish a single point of contact within Finance for documentation, retention, and
discribution ofall financial operating policics and procedures.

Office of Media and Support Services

+ Consolidate inventory control activities within the Asset Manegement unit of the Furniture
Resource Center. Maintain a single physical inventory of all capital equipment und develop
appropriate inventory control policies and procedures to ensure accurate inventory
management.

‘+ Increase the customer focus of Media Services by addressing the hours of service required by
Members, assessing technology necds, analyzing the cost of providing these services to
Members, and restructuring the fee schedule accordingly.

+ Conduct a cost of service study for the Supply Store to ensure the Store covers all costs.
Expedite the privatization of the Gift Shop

Combine the ONECall unit with the Food Services’ Mecting, Press Conference, and Special
Events team to fully utilize available staff.

+ Develop service and quality tracking systems for Food Services’ Meeting, Press Conference,
and Special Events operations and survey customers regularly

‘+ Develop a plan to streamline and restructure processes related to the purchase of computers
and computer related equipment.

+ Transfer the Depanments of Payroll and Meraber Services to the Office of Human
Resources. Establish 2 payroll service agreement between the Office of Finance and the
Office of Human Resources.

+ Expedite the selection and implementation of a new comprehensive Human Resources
System to accommodate all of the human resources ueeds of the House.

‘+ Centralize responsibilities for processing and monitoring worker's compensation claims and
unemployment compensation claims in the Office of Human Resources. Appoint a Program
Courdinator in Human Resources to manage the worker's and unemployment compensation
programs.

Office oP ingpectar Ganeral Page
U.S. House of Representatives


25

DESPITE CHO AND CAO MANDATES,
HIR HAS NOT BEGUN DEVELOPMENT OF A
MAINFRAME MIGRATION PLAN

I, INTRODUCTION

The retirement of the US. House of Representatives’ (House) legacy systems was identified as a high
priority in the House Information Systems Program Plan (ISPP). This plan noted that the Hlouse legacy
systems were outdated and no longer able to support critically important activities effectively. In the one
and a half years since its endorsement by the Committee on House Oversight (CHO), migration planning
attempts have experienced false starts, misleading direction, disagreement, and eventual inaction. In
actuality, there is no mainframe to network-centric or clientever migration plan. As a result, the House is
now in a position of having to first implement costly Year 2000 solutions, and then readdress migration for
these very same legacy systems, rather than accomplishing both tasks in unison as originally envisioned
‘The omission of strategic planning by management resulted in reactive planning practices that limited
management efforts to coordinate and implement timely and cost-effective solutions. Strategic planning
and the lack of management direction, which were cited as intemal control weaknesses in our review of
House information Resources (HIR) management’, appear to be the basic problems with respect to the
mainframe migration initiative as well.

Background

At the start of the 104% Congress, a vision was established by the Speaker for a CyberCongress. The vision
involved transforming the House from its reliance on cumbersome, paper-based information, to an
institution supported by universally available electronic information. Once implemented, it would remove
restrictions of time and space for Members, Committees, and staf, allowing them the flexibility to perform
their work at the best time and place. At the same time and using the same technologies, timely access to
House information and activities would be available. At the request of the Speaker, a special group was
formed by the CHO and named the Computer and Information Services Work Group (CISWG). This,
Group, which was comprised of three Members, concentrated its efforts primarily on computer technology
and infrastructure issues and reported directly to the CHO. On November 15, 1995, the CHO approved, in
concept, the House Information Systems Program Plan presented by the CISWG. The ISPP, and the
accompany ing resolution, were intended to provide HIR the impetus for translating the Speaker's
CyberCongress vision into reality

Through the ISPP, the CHO had requested HIR to identify the elements surrounding the retirement of, and
‘migration from, the mainframe computer system. in response, HIR identified mission-critical applications
that would be migrated to a client/server. architecture based on a network-centric? approach to information

' GIR Management Practices Undermine The House's Ability To Keep Pace With Technological
Changes (Report No. 97-CAO-09, May 9, 1997).

*Clienvserver is an architecture in which a system’s functionality and its processing are divided
between the client personal computer (the front end) and a database server (the back end). System
functionality, such as programming logic. business rules, and data management. is segregated between the
client and the server machines. The end user uses the front-end application to request information from
the database server. The database server receives these requests, processes them. and sends the results back
to the client to be displayed.

> Nework-centric, or what is now knowa as distributed client/server computing. can be defined as
all clients, servers. and Local Area Networks (LAN) being connected and controlled through the network
backbone



Report No. 96-CAO-15
Office Of The Chief Administrative Officer December 31, 1996

© The current process for Mcinbers to acquire computers and related equipment is confusing
and duplicative. Lack of communication and coordination between administrative office
units, such as HTR, OSM, and the Office of Procurement and Purchasing, can result in poor
service to Members.

Office of Human Resources,

+ Separation of personnel, benefits, and payroll activities has resulted in reduced efficiency and
effectiveness overall

«The need for a new payroll and personnel system has been identified by the Offices of
Finance and Human Resources, yet little action has been taken to address the necd,

+ Decentralization of workes's compensation and unemployment compensation processing
leads to potential financial and operational risks. Worker's corapensation claims are
processed and filed within each office, and unemployment compensation claims are not
properly verified prior to payment.

Office of Purchasing and Procurement

‘+ Standard contract management policies and provedures have not been put in place at the
House. The lack of standard policies and procedures increases both the financial and
operational risk to the House.

© The procurement approval process requires an excessive number of approvals within the
CAO organization, for even the smallest purchases. These numerous bureaucratic approvals,
generate bottlcuecks, delay purchases, and create an atmosphere where employees do not
perceive that they are empowered and trusted.

cof ut

‘+ The House approved a standard fex structure for the delivery of publications to Members,
Comuittess, and other House offices. However, this fee structure is not applied to all
publications equally. If the House charged all vendors for delivery according to the stated
rates, revenue totaling $168,000 would be available to offset postal costs.

oiflee oVinspector General agee
US. House of Representatives


144

Mr. Sessions. Thank you, Mr. Flyzik.

Our next panelist is a distinguished gentleman, who is new to
the IRS. Mr. Art Gross, I’d like to welcome you to this subcommit-
tee.

Mr. Gross. Thank you, Congressman Sessions.

As in Treasury, the Internal Revenue Service has established
Y2K as its highest information technology project. We have focused
our most accomplished and senior executive technology managers
on this program, and most recently with the confirmation of Com-
missioner Rossotti. The commissioner has established an Executive
Steering Committee, chairing a Y2K oversight effort to ensure
timely compliance with the program.

The program in the IRS is enormous by any measure. We have
expectations at this point that the program expenditures will ex-
ceed $900 million. We currently have more than 650 IRS personnel
on the ground, more than 250 contractors, and those numbers are
projected to pertain through the balance of the 1998 fiscal year.

fe have reviewed the program, and report the program in essen-
tially three or four components as follows. With respect to the ap-
plication systems, as Treasury has reported this morning, our ap-
plication systems, the mission-critical systems, comprise fully 126
different applications. Of those we have fully renovated 75. And
perhaps more importantly, we are on schedule to timely complete
the renovation of those mission-critical systems.

The second component, often misunderstood, but critically impor-
tant to the conversion effort, is the renovation of our infrastructure,
meaning the computer platforms, telecommunications, and other
hardware devices that support these applications systems. With re-
spect to the infrastructure, while we have made significant
progress, I would suggest to you that, like most other agencies and
private sector organizations, I think that that is one of the areas
of greatest risk and exposure insofar as there continue to be a sig-
nificant number of commercial products which are essential to the
proper functioning of these infrastructures that have not yet been
made Y2K compliant. And until those products are made available
in the marketplace, fully integrated into our environment, and then
fully tested in conjunction with the application systems, I don’t
think anyone in a senior position can comfortably assess risk and
provide assurances with respect to the overall success of the pro-

m.

a believe it’s also important for the Government as well as the
private sector to continue to focus intensely on these infrastruc-
ture-related issues. That also applies to the category of noninforma-
tion technology, meaning specifically with respect to the operation
of facility-supporting systems; HVAC systems, security systems,
badge systems. All of those are relevant, all of those need to be
inventoried, all of those need to be replaced or upgraded as applica-

le.

With respect to external trading partners, the IRS also has as-
sumed some risk, given the amount and the extent of our exchange
programs with both other Federal Government agencies, State
agencies, and certainly the private sector. We are completing our
risk assessment and expect that analysis to be available for review
in April 1998.


61

APPENDIX

Page 6 of 6
CAO Response to Year 2000 Audit

Page 6

September 9, 1997

the organization will be maintained. The CAO format for this inventory will be used by other
legislative branch organizations.

5. Adopt the standard Year 2000 contract language and incorporate this language into all
procurements relating to information technology purchases.

CAO Response: Concur

HIR in conjunction with OPP has already modified the GSA standard Year 2000 Warranty
language for incorporation into solicitations for contracts drafted by HIR. This language was
used in the House's Wide Area Data Communications solicitation. The OPP will develop similar,
appropriate language for incorporation into the standard House Terms and Conditions applicable
to purchase orders.

6. Expedite decision regarding OSM and FMS Payroll replacement efforts, closely monitor
these activities to ensure timely completion, and prepare contingency plans, as necessary.

CAO Response: Concur

The CAO agrees that progress is needed on these two major initiatives. The Task Force will
closely monitor both projects and work to expedite the process. HIR expects to work closely with
OSM and Human Resources on the replacement of both these systems. OSM and Human
Resources will have the lead role in their respective projects, and HIR will assist on technical
and requirements issues. The Task Force will work to ensure that these projects are coordinated
and receive the resources that they require.

The implementation of these new systems is critical to the overall HIR Year 2000 conversion
effort. Both these systems would represent a major software conversion effort, and failure to
implement new systems before Year 2000 would adversely impact the success of the Year 2000
plan.


18

However, it appears that they are not all working quickly enough to
complete their task by 2000. Many agencies have only just begun to
identify non-information technology systems such as building security,
telecommunication, heating, and transportation systems that may present
conversion problems. Computer chips embedded in personal computers,
printers, phones, vehicles, weapon systems, laboratory equipment, or other
machinery must be located and modified if they are non-compliant.

Some of the most significant issues involve the ability of the
government to prioritize its systems so that mission critical systems will not
suffer undue disruption. Agencies must consider the need for independent
verification and validation of their systems and assure sufficient time for
end-to-end system testing. Coordinating data exchanges with other public
and private entities and assuring seamless transitions across agency
jurisdictions will be a government-wide challenge. Retaining qualified Year
2000 staff capable of converting systems at each agency will become
increasingly difficult.

Moreover, as we march towards the next millennium, certain vital
economic sectors may fall behind in their Year 2000 conversion. The
federal government must be prepared to prevent a potential national crisis
arising from a failure of an economic sector such as the utility industry or
the banking community.

It is crucial that we succeed. To fail jeopardizes the health and safety
of Americans. Benefits checks upon which so many Americans rely could
be delayed or erroneous. Air travel could be drastically curtailed. Entire


35

‘ON 33H WO

aaquuaseq parep

Tonsjduroy
Joa
painpayas

pauuryd 40/PUY
way] suONIY 9AN994405 wo sjuautUTO:)



155

Mr. SEssions. Thank you, Mr. Gross.

Our next witness will be Constance Craig, Assistant Commis-
sioner, Information Resources, Financial Management Services, De-
partment of the Treasury.

Ms. Craig.

Ms. CraiG. Thank you for the opportunity to appear today.

The highest priority of the Financial Management Service is to
adapt our mission-critical computer systems to the century date
change. FMS is devoting all possible resources to ensure that the
day-to-day activities and services we provide to the American peo-
ple will not be disrupted after January 1, 2000.

FMS plays a critical and central role within the Government.
Virtually every Federal agency depends on FMS to facilitate the
issuance of payments, to collect revenue and delinquent debt, and
to account for the Government's receipts and outlays.

Each wear FMS issues over 850 million payments, with a dollar
value of more than $1 trillion. We issue these payments on behalf
of civilian agencies, such as the Social Security Administration, the
Department of Veterans’ Affairs, and the Internal Revenue Service.

'MS also provides debt collection services and man: the proc-
essing of roughly $1.4 trillion in Federal revenues. FMS also main-
tains the central accounting and reporting systems that track the
Government’s monetary assets and liabilities. Making sure our sys-
tems are year 2000 compliant is absolutely essential.

In terms of a brief summary of our actions so far, we have care-
fully identified and assessed our mission-critical systems. We are

underway in making the necessary changes to our software
code, and, most important, implementation of Y2K compliant pay-
ment and collection systems is planned and is on schedule for com-
pletion by the end of 1998.

Renovation of our other systems will also be done by the end of
1998, except for a portion of the Government On-line Accounting
Link System. This is a system that edits and transmits intergov-
ernmental accounting data between FMS and other Federal pro-
gram agencies. The GOALS system is scheduled for completion in
mid-1999. By the end of the summer—or in summer, rather—vali-
dation testing will be well underway internally and with our cus-
tomers, and testing will continue until we are certain that all sys-
tems are ready.

FMS is in relatively good shape in replacing the systems that are
critical to issuing payments and collecting Federal revenues. As an
example, we have made critical progress with the Social Security
Administration to ensure that monthly direct deposit and chec!
payments gall continue to go out accurately and on time after Jan-
u > .

iach month FMS issues 33 million direct deposit payments and
17 million check payments to Social Security recipients. The major-
ity of these payments are issued by our Philadelphia office. t
office and the Social Security Administration have been working
closely together to coordinate the required program and format
changes needed for Y2K compliance. b ting he

of the programming changes necessary to begin testin, ve
been completed, and testing between Social Security and. FMS
began earlier this month. We will complete the testing by July and


Exhibit

YEAR 2000 DATE CONVERSION PHASES"?

The Year 2000 problem is the most challenging project in terms of size and scope ever undertaken
by any Information Technology organization, In order for the project to be successful,
government and private industry sources recommend the following five project management

phases be adhered to.

AWARENESS:

ASSESSMENT:

RENOVATION:

VALIDATION:

IMPLEMENTATION:

Define the Year 2000 problem and gain executive level support and
sponsorship. Establish Year 2000 program team and develop an
overall strategy. Ensure that everyone in the organization is fully aware
of the issue.

Assess the Year 2000 impact on the enterprise. Identify core business
areas and processes, inventory and analyze systems supporting core
business areas, and prioritize their conversion or replacement. Develop
contingency plans to handle data exchange issues, lack of data, and bad
data, Identify and secure the necessary resources.

Convert, replace, or eliminate selected platforms, applications,
databases, and utilities. Modify interfaces.

Test, verify, and validate converted or replaced platforms, applications,
databases, and utilities. Test the performance, functionality, and
integration of converted or replaced platforms, applications, databases,
utilities, and interfaces in an operational environment.

Implement converted or replaced platforms, applications, databases,
utilities, and interfaces. Implement data exchange contingency plans, iff
necessary.

0s were derived from the General Accounting Office “Year 2000 Computing Crisis: An


21

House of Representatives Year 2000 Activities

CAO is working with Members, Committees and Officers of the House to make sure that
personal computers, the software running on them and other office equipment are
compliant. All House-supported software, with one exception (Lotus 1-2-3 accounting)
is, already, Year 2000 compliant. Software necessary to check the basic input output
system (BIOS) of personal computers has been selected and will be made available to all
House offices. This will enable every personal computer at the House to be checked
and, if non-compliant, either upgraded or replaced well before the year 2000. All
suppliers of other date-sensitive equipment, such as telephones, office copiers, fax
machines, pagers, and the like, have also been contacted and a comprehensive vendor
report is being prepared. A comprehensive Member and Committee office outreach
campaign will begin in May, 1998

Generally, have completed the assessment phase and are into the renovation and
validation phases of the program

--Completed renovation of the Legislative Information Management System, a
key system used by the Clerk to track and report the business of the House
Validation testing is under way

~-Contracted with Booz-Allen & Hamilton to undertake a requirements/needs
analysis and business process engineering study on the House payrolll system
which is not Y2K compliant. Completion of both due by mid-April
Concurrently, an interim contingency Y2K fix for the present payroll system is
being tested jointly by House Information Resources and the House Inspector
General

--Contracted with Grant Thornton to undertake a requirements/needs analysis and
business process re-engineering study on the House inventory systems which are

not Y2K compliant. Both have been completed and the House expects to issue a

Request for Proposals in March

--Completed renovation of 5 other major mainframe applications (House
Recording Studio, Lobby, Photography, Labels and Financial Disclosure) that
will need to run until the mainframe migration is completed. All services
requiring renovation are scheduled for completion by the end of 1998

~-Begun migration of Member Information Network (MIN) and ISIS services and
will have over 40 of the 150 services migrated by the end of March, 1998. The
remaining are on schedule for migration by the end of calendar 1998.

Selected a full time Year 2000 project manager on September 29, 1997. A Year 2000
Project team has heen established as well

Formed a Technology Coordination Task Force (TCTF) to coordinate technology
projects and ensure interoperability of CAO systems. TCTF also oversees the work of


142

planning and asked the bureaus and offices to accelerate their schedules for the
development of these plans. Since then, Year 2000 Contingency Management Plans
have been developed at several bureaus and offices for mission critical IT systems and
components. Factors such as failure date, time to implement, dependencies, interfaces,
resources, responsible office, impact, and criteria for invoking the plans are included.
‘The bureaus’ and offices’ contingency planning efforts will be expanded to address Non-
IT mission critical systems and telecommunications items.

In spite of our best efforts to date and our aggressive plans for the future, the Year
2000 problem is far from solved. Indeed, several significant key issues pose special
challenges for us, and possibly for other Government agencies as well.

One issue that concerns us is vendor schedules for Year 2000 compliant versions
of their commercial off-the-shelf hardware and software products. Some vendors have
yet to release Year 2000 compliant upgrades of their products. While we are continuing
to work on our renovation efforts. our testing cannot be completed until we have
obtained and integrated the Year 2000 compliant versions of these products. This
problem may become especially troublesome in the Non-IT area, where vendors have
been, as a group. slower to recognize and respond to the challenges posed by the Year
2000 problem.

‘Treasury's cost estimates for fixing the Year 2000 computer problem have
continued to rise. In our submission to OMB for the February 15, 1998, report, we
estimated a total cost of $1.43 billion, with the bulk of that cost being incurred in this
fiscal year. Our cost estimates were initially based in large part on a Year 2000 cost
model that focused on costs associated with mainframe lines of code. In the period since
those initial estimates were provided. Treasury bureaus and offices have made
significant progress in their inventory and cost estimate efforts for repairing and testing
IT items, telecommunications items, and Non-IT items. In the February 15, 1998,
quarterly report, we estimated Non-IT program costs of $68.6 million, and $295 million
for telecommunications costs.

In addition to funding challenges. we must also contend with the increasing rate of
attrition within our information systems workforce. Skilled programmers -- especially
those with skills in legacy system platforms -- are in strong demand within the private
sector, which can pay significantly higher salaries than the Government. The loss of
these critical resources represents a risk to the Year 2000 program.

Finally, while we are fortunate that many of our external interfaces are Year 2000
compliant, scheduling and testing all these interfaces are a challenge. Ultimately, we
cannot test external interfaces unless our data exchange partners are ready to do so.

I believe that Treasury has an aggressive overall Year 2000 progeam in place, and
we are on target to complete the conversion, testing, validation, and implementation of all


88

ally. Currently, there exists no complete picture of the Nation’s
readiness to attack the year 2000 problem successfully. We have
recommended that the President’s Souneil attempt to orchestrate
such a complete Picture as soon as possible in order to see exactly
where we are and what the challenges are.

Also, John and the Council face a tremendous coordination chal-
lenge in bringing about all the outreach efforts that we've talked
about. And I your attention to an idea we advanced for them
as a starting point. Please look to the board on your left. There’s
also a handout in your package of this organizational structure.

Tf you think back a few months earlier and look to the right side
of the board, we basically had in place a situation where OMB was
working with the Federal agencies. Last fall, the outreach activities
extended to the States, as Mr. Koskinen mentioned, with Sally
Katzen meeting with them in October to start a dialog between the
Federal and State governments. In February, the President’s Coun-
cil was created, which we've outlined in the center of the coordina-
tion activities there to work with agencies to provide quarterly
progress reports to the President.

e’ve also suggested, because of the time constraints, that the
Council use the sector-based approach that was recently used by
the President’s Commission on Critical Infrastructure Protection as
a starting point. So you have key senior Federal officials working
with those critical sectors of the economy to assess the Nation’s
readiness, to provide advice to the Council, and to work through
contingency plans if needed. That structure could be augmented
with advisory councils and task forces that could be created as
wi

And I want to emphasize we're not proposing this as the defini-
tive model, but we thought it would to offer this to the
Council as it undertakes this enormous effort to coordinate across
national and international fora.

Tn closing, I'd like to emphasize and reiterate GAO’s support to
continue to help in solving the Nation’s computing crisis. I also look
forward to working with John, Federal agencies, and others as we
all tackle this problem. And I’d like to, as other people have, com-
mend your two subcommittees for bringing attention to this issue.
And continued congressional oversight will be essential to solving
this unprecedented technology challenge.

Thank you and I'd be happy to answer any questions later.

[NoTE.—The report entitled, “Year 2000 Computing Crisis: Busi-
ness Continuity Contingency Planning—Exposure Draft” may be
found in subcommittee files.]

(The prepared statement of Mr. Dodaro follows:]


170

indicate that there is something that is out there that you're fear-
ful of, but, rather, that what lies ahead of you is a great deal of
work; that you are approaching that in a systemic, logical al perspec:
tive; and that you feel like that, by working hard at the effort, you
will achieve the .

Tve also he: further testimony today that clearly says that
major systems that millions of Americans depend on will be tested
and retested and prepared and be ready to go on that date.

I want you to know that this committee is intensely interested
in the job that you are performing. We will continue to offer our
insight, and even evaluation, due to our ability to have oversight.
I want you to know that any time something changes in regard to
what you have provided in testimony today, I encourage you to
please go back up your chain of command; please keep this commit-
tee updated. We rely on you doing the work. Whether we, our
members, be Republicans or Democrats, I think you see that we
have great faith and confidence in what you are doing.

I would like to thank each and every one of you for taking your
time to be with us today. If I hear nothing further, unless anyone
has a closing remark, then we will end the earing.

Ms. Craig, do you have anything, or anyone else on this panel?
Does anyone—

Mr. Gross. No, sir.

Mr. SESSIONS. Does anyone disagree with my analysis of this
hearing and the conclusions that this chairman has drawn?

Mr. SCHINDEL. No, sir.

Mr. SESSIONS. With that said, we will now adjourn.

{Whereupon, at 12:25 p.m., the subcommittees adjourned subject
to the call of the Chars

[The prepared statement of Hon. Pete Sessions follows:]


42

management has to refocus its objectives, dedicate additional resources, and reassess its priorities
in order to meet the Year 2000 challenge.

To The Year 2000 Ini

In attempting to recognize the positive aspects of the work HIR has done in preparation for the
Year 2000, we should also point out that its efforts to date have merely scratched the surface of
an issue that should have been addressed years before. Because the urgency of this issue was not
adequately recognized, HIR may have to redouble its efforts in order to become Year 2000,
compliant. Specifically, we found that the HIR has not (1) established effective project
management controls, (2) met general government Year 2000 milestones, (3) prepared a
comprehensive Year 2000 plan covering critical stages of the initiative or disposition of all
systems, (4) adequately estimated the Year 2000 initiative costs or budgeted sufficient funds, (5)
sufficiently coordinated Year 2000 efforts with external groups, (6) incorporated Year 2000
warranty language in its procurement contracts to guarantee compliance on future information
technology purchases, and (7) secured software tools or contractor support to assist in the
conversion effort. We also found that the House is only at the initial stages for OSM and FMS
Payroll replacement efforts which leaves no time for unanticipated problems or delays.

Effective Project Management Controls Are Needed

Effective project management controls have not been established. The Year 2000 solution is not
strictly, or primarily, a technical challenge. It requires sound planning and good management to
be successful. While a project leader has been assigned, this official has not been given the
formal authority to lead the overall effort and is only acting as a “coordinator” for intemal HIR
issues. Moreover, the project leader spends only 15 percent of his time on Year 2000 issues, and,
according to him, 90 percent of that time is focused on mainframe application systems. In our
view, the Year 2000 project leader position is more than a part-time job; it requires a full-time
effort at critical stages. We also found there are at least 16 ernployees (including those working
on the physical conversion of the LIMS date fields) involved in the Year 2000 effort in some
capacity, yet no formal charter outlining their specific roles and responsibilities exists. In addition,
HIR has not instituted regular meetings (internal or external to HIR) to track progress and share
information on Year 2000 readiness, nor have status or progress reports been utilized to keep
senior management informed on an ongoing basis. Thus, no organized attempt has been
established to track and measure the progress in addressing the Year 2000 effort. Omitting such
key project management elements could hinder the success of the Year 2000 initiative.

When we asked the project leader about the status of OSM and FMS Payroll replacements, he
indicated that he has not taken the lead on these and referred us to OSM and Finance,
respectively. If, in fact, these systems are outside the purview of the project leader, this fact needs
to be acknowledged in the charter. Also, the project leader told us he has no authority over the
internal HIR Year 2000 groups such as those in Communications. Enterprise Computing. Client
Services, and the Intemet Services Group. He told us his role as project leader was only t0
coordinate with these other HIR groups and did not see these groups playing a big role in the
effort. Discussion with Communications and Enterprise Computing personnel indicated that they


83

1998. OMB is following-up with the remaining five agencies to assure that they complete the

‘Working Through Interagency Management Councils

Second, we will be working closely with existing interagency management councils to
increase the coordination of agency year 2000 efforts and better facilitate the exchange of year
2000 information and ideas among agencies, As I said, I don’t believe the Council should be
duplicating these efforts, but I do think we can play an important role in energizing and
coordinating the good work of these groups and in increasing their visibility to ensure that
agencies can benefit from each other's experiences.

To further this goal, I will be meeting on a regular basis with the President's Management
Council, the Chief Information Officers Council, the Chief Financial Officers Council, the
President’s Council on Integrity and Efficiency, the Executive Council on Integrity and
Efficiency, and the Interagency Council on Administrative Management to encourage information
sharing on best practices and system challenges to ensure there is effective coordination across the
Government, 1 will also be joining the Vice President and the staff of the National Partnership for
Reiaventing Government as they continue to work with the 32 Federal agencies identified as
having a “high impact” on our citizens to improve their customer service. Nothing is more central
to improved customer service than a smooth transition to the year 2000.

Outreach: Beyond the Federal Government

Third, and perhaps most important, the Council will be reaching out to those outside the
Federal Government to increase awareness of the year 2000 problem and to offer appropriate
assistance and support.

‘The Federal Government has a responsibility to exercise leadership in this area. Everyone
+has an interest in a smooth transition to the year 2000 by organizations operating independently of
‘the Federal government. The inability of a stock market in another country to open on Monday,
January 3, 2000, the slowing of a local mass transportation system to a crawl, or the failure of a

- medium-sized business could affect us all. A year ago, if you had asked me to name our greatest
challenge, I would have said that it was making those within the Federal Government aware of the
problem. I think we have now achieved that awareness at the Federal level, and a critical
challenge over the next six months will be to reach out to State and local governments, to the
private sector, and to foreign entities to increase their awareness and determine not only how they
are dealing with the problem, but whether there is anything that the Federal Government can do to
help them in their efforts.

re


APPENDIX
Page 5 of 6

CAO Response to Year 2000 Audit

Page 5

September 9, 1997

See Item 1d above.

(& Expeditiousty develop a follow-on document, develop testing strategies, plans,
milestones, and ensure testing capacity is available, and quality assurance is an integral
element.

CAO Response: Concur

See Item 1d above.

(©) In preparing the follow-on document, as recommended in 2d above, develop testing

strategies, plans, milestones, and ensure testing capacity is available, and quality assurance
is an integral element.

CAO Response: Concur
See Item Id above.

3, As necessary, revise the Year 2000 cost estimates and prepare revised budget requests
based on these new figures.

CAO Response: Concur

Updates of the Year 2000 plan will be released regularly. These will reflect any policy changes,
‘new requirements, and necessary revisions to overall time and cost estimates. Updates to the
plan will drive the budget requests for FY1999 and FY2000.

4. Coordinate data exchange issues with the external organizations that interact with the
Honse’s systems.

CAO Response: Concur

‘The CAO is a mevaber of the Legislative Branch Technical Coordination Group that is
addressing Year 2000 issues among Legislative branch organizations. The Year 2000 project

organizations has been compiled. Items on this inventory will be monitored, and a dialog with


84

I’ve already mentioned the importance of Federal interfaces with State and local
governments, but there are other solely State and local services that people depend on ~ from
public safety to payment of State pension benefits ~- that could be affected by the year 2000
problem. Last October, we made a good start in our dialogue with State and local officials when
Sally Katzen, Vice Chair of the Council, met with representatives from State and local
governments at a conference in Pittsburgh. A Federal-State working group has been established
and I look forward to continuing that dialogue, and to seeing how the Federal Government can be
of assistance to State and local governments as they work to fix their systems. In fact, just last
‘week I met with James Lee Witt, director of the Federal Emergency Management Ageacy, who
agreed that his agency will begin to work closely with State and local disaster authorities to
determine the status of their year 2000 efforts and offer whatever support they can.

Some have described economic doomsday scenarios that could take place when we reach
the year 2000, To ensure that doesn’t happen, the Council will work to raise awareness and offer
support to private sector firms, Small and medium-sized businesses are of special concer,
because many of them do not have adequate institutional resources to devote to fixing the
problem. We are also reaching out to them. For example, through its Web page, the Small
Business Administration is sharing with small business owners information on best practices for
dealing with the transition to the year 2000. And as I mentioned earlier, I think the Council can
be effective in using existing structures and resources to create a dialogue between the Federal
Government and the private sector in many key areas of the economy.

Finally, the Council will have a world-wide focus. We live in a global economy that is
increasingly dependent upon the electronic exchange of financial and other data. Unfortunately, it
is not clear that all other nations are devoting the appropriate level of attention to the year 2000.
‘Having traveled extensively in Southeast Asia prior to my starting this job, I can tell you from
personal experience that many countries are focused on more immediate economic problems,

‘While this is the one area in which the Council may have the greatest difficulty in
exercising influence, we need to do everything that we can to raise awareness in other countries.
‘Again, once senior leadership begins to ask the right questions, the work will get done. So the
Council will work with Federal agencies to leverage the influence of international organizations
Tike the United Nations, the World Bank, and the International Monetary Fund to increase
awareness and facilitate the exchange of information among nations.

‘The Balancing Act

There is no doubt that the year 2000 problem poses significant challenges to our
Government, our Nation, and the world. Those of us who are committed to solving this problem
will have to perform a delicate balancing act over the next 21 months. While it is important to
increase world-wide attention to the urgent necessity of solving this problem, we need to avoid
creating panic and precipitous, counterproductive activity. The best way for us to spend the next


119

ment—or bid to the Government—will continue to increase as this
market demand increases. So either way, the Government is going
to Ry for that.

. Davis. My time is up. I have got more questions, but the
chairman will ask them. Thank you.

Mr. Horn. Now I yield 5 minutes to the gentlewoman from
Michigan, Ms. Rivers.

Ms. Rivers. Thank you, Mr. Chair.

I know that Treasury is going to speak on the next panel, but
I assume that you have some sort of broad umbrella sort of author-
ity to watch what everyone is doing. And I’m specifically, Mr.

skinen—what I’m specifically concerned about is concurrent with
our march toward the year 2000, and this problem is the desire on
the part of several agencies to Res paperless operations, specifi-
cally Social Security and the . And I’m concerned about, in
1999, when we start the Social Security system on a paperless op"
eration, within a few months of that we are going to run smack-
dab into this year 2000 problem. And the same thing with the IRS
as we push more people to file electronically. How do you see the
problem intersecting with those initiatives in both of those depart-
ments’

Mr. KosKINEN. Well, and they obviously, they are not the onl:
departments trying to harmonize modernization efforts with deal.
ing with the year 2000 problem. Obviously in those agencies where
they have completed modernization and moved from legacy systems
to new systems, in general they then have avoided the year 2000
problem. FEMA is an example of that, where their new emergen:
management system will mean that they won’t have to deal witl
the archaic prior system.

The problem you have highlighted, it runs through several major
agencies—is that their modernization programs move over and
transcend the year 2000 problem. So the very difficult problem is
to figure out what part of those systems do you solve the year 2000

roblem, trying not to waste time or money on solving the problem
for a system that’s going to be replaced between now and then. We
are encouraging the agencies, and they are doing it on their own,
to err on the side of being very conservative. So to some extent,
again, this will be an additional expenditure. But we need to make
sure that we are not totally reliant on replacement.

In some agencies, it is going to mean that we're going to have
to defer and put off some of that modernization because the critical
issue is that we need these systems to run on January 1, 2000, and
not mecessarily be modernized and up and running only on January

So there is no easy answer. The agencies I have met with thus
far are very sensitive and aware of that question. There are a cou-
ple of very difficult decisions in some of these agencies that we're
going to have to make. But ultimately, the balance has to be drawn
on the fide of making sure that all the systems can function in the
year .

Ms. RIVERS. To go to the Social Security issue, in particular,
given that we will have both sides of the equation having difficulty,
the Government in trying to update its system, and the individual
banks having to update their systems at the same time. And of


122

huge and to some extent dwarf that problem, but that doesn’t mean
it isn’t a critical challenge.

I think the only way to deal with the embedded chip issue is to
break it down item by item. There is no “embedded chip” answer,
so you have to worry about what is the problem in building sys-
tems; what is the problem embedded and operating, whether it be
in cars or actual hardware systems.

Again, I think the only way we can get a handle on this—and
that’s what I’m trying to do—is to ask agency by agency say, what
in your area of operations, either in your laboratories, in your rela-
tionships with private sector people working in those areas, what
are the embedded chip problems in those areas and how can we
deal with those.

Because you're going to find that there are a number of them,
some of which are unknowable. It’s clear that we have in various
devices embedded chips; it’s not clear whether they're date sen-
sitive or not, or whether it matters.

Mr. SUNUNU. But having the agencies size and plan for the em-
bedded system problem is part of the planning process ——

Mr. KOSKINEN. Yes.

Mr. SUNUNU [continuing]. That they’re going through now.

Mr. KOSKINEN. Yes; the CIO council already in his working

ups has set up, in effect, embedded chip subcommittees. GSA is
looking at building systems. HHS has already reached out to help
their medical device companies to ask them for a review as to their
assessment if there are embedded chip problems in anything they
are selling to the public, and whether it’s being used in health care.

Mr. SuUNUNU. Have private sector contractors, people who are
procuring equipment, been pretty responsive in trying to identify
whether or not their equipment or their systems have problems?

Mr. KOSKINEN. Yes; the reports I’ve received that, generally, the
level of cooperation among private sector vendors, the industry,
and the Government is very high. There are some places where we
have a bit of a disconnect, but I think there’s a private sector view
that they cannot afford to have their clients fail, and to the extent
that they do a lot of business with the Federal Government, their
hope isn’t that we create more problems so they have more busi-
ness. Their concern is that if we get into difficulty, it will be a dif-
ficulty for them as well.

So I think the dialog is good and that we're getting appropriate
support.

ir. SUNUNU. I’ve heard a little bit about a potential problem or
a theoretical problem with the September 9, 1999, date. Is that real
or imagined? Have you begun to at least look into it as part of your
Council, and are the agencies themselves taking a look at whether
that September 9 problem is a concern?

Mr. KoskINeEn. I have raised that issue. It is again, in the spec-
trum the year 2000 problem obviously dwarfs it. As a general mat-
ter, the 999 problem, which was used years ago as either a holding
area years ago or a way of giving instructions to go somewhere, is
much smaller in dimension. It is ultimately not a good program-
ming practice.

en it was done, it was often 99/99/99, which is not a date that
would affect people. But I am also advised that this problem, while


29

decision makers called fora retirement of the mainframe and movement toward a client/server
‘environment; this political decision was made prior to my tenure at HIR.” In his opinion, “the question of
retiring the mainframe is still an open policy issue.”

When questioned about the shor- and fong-term direction of House application systems in relation to the
client/server platform, the then Administrator responded by restating that the Year 2000 process would
address the overall migration plan. He added that no one had been pushing him to get off the mainframe,
but they had been pressing HIR on the Year 2000 issue. We reminded him that the directive to retire the
legacy systems had been outstanding since November 1995. Even so, he commented that a significant
client/server migration would not be considered by HIR before all systems are made Year 2000 compliant,
since they were understaffed and facing an issue that could not be postponed. Ironically, the Year 2000
project and associated costs may have been avoided or mitigated somewhat if the migration issue had been
addressed as originally directed.

In response to the audit report on the Office of the CAO, the Acting CAO directed HIR to prepare a
comprehensive needs and cost/benefit analysis to document the mainframe migration plan to be presented
to the CHO by March 1, 1997. The Acting CAO further stated that HIR will adopt an implementation plan
based on the migration strategy and direction provided by the CHO using this analysis. During follow-up
discussions with the Director of Integration, he acknowledged that he was unaware of these directives and
that there were no resources available to work on such an analysis. During similar discussions with the
then Administrator, it was noted that HIR had not performed a needs and cost/benefit analysis and had no
plans to do one in the future.

ised Migration O} it ave use
With Limited And Costly Options
‘The most immediate consequence of the absence of a House migration plan is the limited options available
to management regarding the Year 2000 problem. Instead of solving this issue with a proactive approach
as originally envisioned, management is left with reactive, short-term solutions. As a result, the Year 2000

initiative will now have to be undertaken with a sense of urgency. in addition, management may be forced
to implement systems that neither fully meet user needs nor are cost-effective.

‘The Year 2000 plan has identified the projected disposition of the mainframe legacy systems as either (1)
remaining on the mainframe (Group A); (2) being repiaced with a COTS client/server system, outsourced
of retired (Group B); (3) migrating o a desktop system (Group C); or (4) those servicing ouside client
systems such as CBO, GAO and ProPAC’’. Figure ! on page 7 depicts each group’s processing usage as a
percent of total processing capacity. (See Exhibit A for a complete list of system names, descriptions and
dispositions.)

‘The legacy systems in Group A, for example, will remain on the mainframe following Year 2000
modification efforts at an estimated cost of $670,000. Using LIMS as an illustration, the Office of the
‘Clerk had intended to replace its older system with a client/server system that was to contain improvements
in both business design and operations. This objective, which the Clerk believed would solve the Year
2000 problem as weli, was not achieved in time and the House found itself behind on the migration issue
and looking into the face of a fast approaching Year 2000 deadline, As a result, LIMS migration has now
been placed on hold awaiting

Improvements Are Needed in The Management And Operations of The Office Of The Chief
Administrative Officer (Report No, 96-CAO-15, December 31. 1996)
The Prospective Payment Assessment Commission (ProPAC) is a Congressional Commission
that provides recommendations to Congress for Medicare funding,


154

thoughtful development and faithful execution of a rigorous plan. We aim to
leverage aspects of the century date project management experience (e.g., project
management tools, project management training and experience) as we instill the
systems life cycle best practices, policies and procedures to support future

information technology investments.

Rollout core elements of the future IRS computing infrastructure to provide for
both century date compliance and data center consolidation that would also
achieve significant savings. The infrastructure framework would also support the
planned Modemization in accordance with-the IRS. Technology Modemization

Blueprint.


Roughly speaking there are 8,000 mission-critical systems plus 60,000 second and third tier
systems. In addition, there are thousands of data exchanges with foreign, State, and local governments,
businesses, and citizens, There are telecommunications systems, biomedical devices, and uncounted
millions of embedded computer chips. We can not allow all of these so-called non-mission-critical
systems to fail.

We have focused our efforts on mission-critical systems -- and properly so. However, mission-
ctitical systems can not be the only systems fixed — they must be the first, but not the last. We can not
ignore thousands and thousands of secondary systems. The collective confusion of tens of thousands
of secondary systems failing could be catastrophic.

The standard of acceptable Year 2000 conversion must be high enough to realistically protect
the American people. It must include:

1) completion of 100 percent of all mission-critical systems in the Federal Government and key
economic sectors such as banking

2) thorough and complete testing of all finished mission-critical systems

3) contingency plans for all mission-critical functions (even those with finished and tested systems)

4) completion of 100 percent of all data exchanges

5) reasonable certainty that the Nation’s telecommunications systems and public infrastructure such
as electric utilities will continue to function through the date change

6) an overly pessimistic recovery plan as back-up.

We have 2 responsibility to the American people to minimize the effect of this Year 2000
computer problem. We can not live up to this responsibility if we are overly optimistic. Rather, we
must be overly pessimistic. We must test and re-test mission-critical systems that are supposedly
finished. We must develop contingency plans for systems that are finished and tested. We must
develop a recovery plan for possible failures in key sectors such as finance, utilities, and transportation.

It is our responsibility to be careful, very careful, with the economic well-being of America. It
is amazing, but true, that the Year 2000 computer bug could harm the world’s largest and most robust
economy. It is our responsibility to squash this bug. To fix it, test it, and test it again. To finish it and
have a contingency plan. Our responsibility requires over-kill.

We have a lot of work to do and little time remaining. Our first panel today will discuss
‘governmentwide actions to improve overall Federal efforts. We are facing a governmentwide problem
that demands a governmentwide strategy. That strategy must set clear priorities and begin focusing
intense attention, expertise and resources on the most critical systems. The goal must be to make
certain that the most important systems at the most important agencies can function in the new century.

Our second panel will discuss a specific example of this need for prioritization: the Department
of the Treasury. The Financial Management Service, within the Treasury Department, writes the
checks for virtually every Federal agency. This means that it is not good enough for Social Security or
the Small Business Administration to fix all their computers when Treasury, and the Financial
Management Service within it, are lagging behind and are not fixed. We look forward to a substantive
discussion on this and other Year 2000 issues at the Treasury Department.



137

the fact is that 63.8 percent of the components within these sys-
tems have been renovated, 28 percent tested, and 19.2 percent im-
plemented. Over 73 percent of the total Customs inventory of lines
of codes has now been converted.

Treasury also operates one of the largest enterprise tele-
communications networks in Government. In order to address the
year 2000 challenges, a year 2000 Command Center, telecommuni-
cations command center, has been established to serve as a central
location for telecommunications activities, including the tele-
communications executive body and working group meetings;
charts and graphs depicting current hardware and software status
of each corporate telecommunications pro; ; independent ver-
ification and validation testing process; and overall progress track-
ing are displayed prominently for use by all program managers and
executives. Contractors supporting the programs are co-located
with our dedicated year 2000 telecommunications program staff to
ensure timely communications.

To further promote communications among myself, the executive
body, program areas, working groups, and bureaus, we have estab-
lished_a telecommunications site on our internal Treasury year
2000 Intranet website. Current information is published on the
website, including schedules, inventories and assessments, cor-
respondence, and all other relevant information.

e have established a test laboratory for testing all components
of a system before implementing the changes in an operational en-
vironment. In addition, we have en; a telecommunications
company to perform independent verification and validation of all
of our telecommunications infrastructure for year 2000 compliance.

As of March 6, 1998, Treasury bureaus and offices identified
6,898 external data exchanges of which 3,169 were incoming and
3,729 outgoing. We have assessed 6,878 of the 6,898 or 99.7 percent
of these external data exchanges, and found that 87 percent are
year 2000 compliant or have been granted a waiver. Of the 2,551
interfaces with the U.S. private sector, Treasury bureaus and of-
fices thus far have contacted 2,446 of these entities, and reached
agreements with 2,391.

The bureaus and offices are working to meet the established
milestone date of March 31 for reaching final agreement.

In early 1996, we established September 1998 as a program mile-
stone for the completion of contingency plans. During a series of
meetings with bureaus and officers, the Department emphasized a
need for contingency planning, and asked the bureaus and offices
to accelerate their schedules for the development of these plans.

In spite of our best efforts to date and our aggressive plans for
the future, the pe" 2000 problem is far from solved. Indeed, sev-
eral significant key issues Bose special challenges for us.

One issue concerns vendors’ schedules for year 2000 compliant
versions of their commercial off-the-shelf hardware and software.
Treasury's cost estimates for fixing the year 2000 computer pro-

am have also continued to rise. In our submission to OMB on

‘ebruary 13, 1998, we estimated a total cost of $1.43 billion to fix
the problem, with the bulk of that cost this fiscal year.

In addition to funding challenges, we must also contend with the
increasing rate of attrition with our information systems work


145

Let me conclude by summarizing as follows: I think that the
greatest risks with respect to the IRS program that I think pertain
to other agencies as well is the ability of the Government to obtain
the relevant infrastructure products, integrate those products into
its environment, and then perform very comprehensive end-to-end
testing of both the application systems and those infrastructures.

The second greatest risk is to retain our legacy programmers and
our staff who are critical to the ongoing maintenance and support
of our programs and operations. An important element of that pro-

could be to leverage some of the Government’s capabilities
that, frankly, the private sector does not offer. The private sector
has offered, as you've all heard in the earlier panel, incentive bo-
nuses to either be recruited or to be retained. The reality is that
market forces in the year 2000 are going to be changing, and many
of the programming staff who are leaving the Government to ob-
jain these near-term bonuses may have job security issues in the
future.

Well, as it turns out, we all know that the Government can offer
certain security around jobs, and I believe that the Government
has within its grasp certain tools with respect to commitments to
training, commitments to job security, commitments to restructur-
ing their organizations that could provide incentives that will not
dwarf the private sector financial incentives, but for many people
in the IT business, I believe the Government has opportunities to
afford different types of incentives or packages of incentives that
could facilitate the retention of these critically important personnel.

Last, I would like to conclude my comments by offering my ap-
preciation and my gratitude to both, subcommittees for the impor-
tant work they've done in focusing Government agencies and in
overseeing our efforts. I think certainly more of that, as we move
closer to the day, rather than less of it, will be critical to the suc-
cess of this program.

ank you.
{The prepared statement of Mr. Gross follows:]


151

+ External Trading Partners
The IRS is but one of many data dependent public and private sector organizations
which both send data to and receive data from one another. At this time, IRS efforts
to validate the accuracy of both incoming century date compliant data from a variety
of sources and IRS century date compliant outputs to public and private sector

organizations are on schedule.

MITIGATING RISK

Without exception, the Century Date Conversion in conjunction with the annual filing
season systems changes are the Service's highest technology priorities. While the IRS
has assigned its most senior and qualified management to the program, Commissioner
Charles O. Rossotti has reinforced the project's priority standing by organizing and

chairing an Executive Steering Committee dedicated to overseeing these efforts.

Regardless of the extent of the management commitment, however, the IRS must

proactively develop and manage the following risk mitigation strategies:

« Planning and Implementing an Integrated Century Date Conversion and 1999
Filing Season Strategy
Given the extent of the Taxpayer Relief Act mandated systems changes that require
reprogramming many of the same legacy systems that must be made century date
compliant by January 1999, it is essential to develop and implement an integrated

Century Date/1999 Filing Season Plan. To mitigate risk, the IRS has accelerated by


44

initiative should be one of their highest priorities, and provide or request sufficient resources to
carry it out.

Renovation, Validation (Testing). And [mplementation Phases.

Not Sufficiently i e Year 2 lan

‘The generally accepted makeup of a successful Year 2000 plan includes five distinct phases that
provide an organized approach to identifying and implementing a solution. (See Exhibit, page 15).
However, the House’s Year 2000 plan primarily covered only the first two phases (Awareness
and Assessment). While we did find broadly stated elements of the other three phases
(Renovation, Validation, and Implementation) in the Plan, these phases were neither spelled out in
detail, nor were there references to future provisions in the Year 2000 plan for their completion.
Of the five phases involved in a Year 2000 plan, the last three generally account for about 75
percent of the time and cost of the initiative. The Validation phase alone, which includes testing,
may take over a year to complete and may actually consume about half of the Year 2000 budget
and resources, Since these phases primarily drive budget and resources requirements, itis critica!
to incorporate them early on in the Year 2000 initiative.

Detailed implementation plans for the Renovation phase need to be developed immediately for all
systems. These plans should help in determining the resource requirements and detailed
schedules. Pre-requisites for the Validation phase need to commence as well, including the
development of detailed test methodologies and test plans. Methodologies should be developed
to nun different tests which ensure that corrections are functioning according to design and that
ties to external customers and systems do not compromise the effectiveness of the House's Year
2000 compliant systems. Furthermore, plans need to be made to ensure effective quality
assurance and system, integration, and acceptance testing are carried out. These tests should be
as rigorous as tests used in initiating new systems. While we were told testing capacity within
HIR should not be a problem and that they have budgeted for software testing tools, capacity
planning and scheduling requirements need-to be determined and verified to ensure sufficient
computer resources can be allocated for testing purposes.

Since Year 2000 is a phased process and detailed implementation plans are not available on a
system-by-system basis, we believe HIR would benefit by preparing a follow-on document to the
existing Year 2000 plan which addresses in detail the latter three phases of the initiative. One
source of information on strategies for these three phases is the Chief Information Officer (CIO)
Council Subcommittee on Year 2000, which provides group sessions on Year 2000 issues.
Participants have gained valuable information and excellent opportunities to share experiences
and ideas with others engaged in similar efforts.

Cost Estimates May Fal! Short Of Actual Funds Needed


See —- Congress of the United States pee

poate Bouse of Representatives iceman

et seersea COMMITTEE ON GOVERNMENT REFORM AND OVERSIGHT =
Sener 2:87 Ravourn House OrFce SuR.MG a |
Beets wero om Wastnarow, OC 20515-6149 Foret

“Governmentwide Year 2000 Issues
and the Department of the Treasury”

March 18, 1998

OPENING STATEMENT
REPRESENTATIVE STEPHEN HORN (R-CA)

Chairman, Subcommittee on Government Management,
Information, and Technology

The Subcommittee on Government Management, Information, and Technology began hearings
‘on the Year 2000 computer problem on April 16 of 1996. Working with the Technology
subcommittee chaired by Mrs, Morella, we have made considerable progress since that time.

We have established that the problem is real and substantial. We have raised awareness in the
Federal Government and private sector. We have initiated agency quarterly progress reports. We have
graded agency progress and, thereby, stimulated increased progress. We have induced the White
House to act - a major step forward that is illustrated by Mr. Koskinen’s presence here today. We are
all happy to welcome our respected friend to this challenge.

These accomplishments, however, are the prelude. They are necessary, but not sufficient, to
finish the Year 2000 conversion. We begin today the next phase. We have gone from questioning the
reality of this problem to deploying thousands of technical and managerial professionals

‘We have expanded from looking only at mission-critical systems to considering possible
problems in data exchanges with other governments both domestic and foreign. We have recognized
that there are critical connections between public and private computer systems and that vital
infrastructure such as electric utilities and power distribution could be vulnerable to disruption.

Ithas been 701 days since our first Year 2000 hearing on April 16, 1996. There are 654 days
remaining until the inevitable, unmovable deadline. Over 50 percent of the available time has expired,
but only 35 percent of our mission-critical systems are compliant. In short, we are behind schedule and
it will require the cooperation of Congress, the White House, and the Federal Departments and the
agencies themselves to solve this problem on time.

‘We have no choice but to double our rate of progress. Then, we must double our rate of
progress again. As we look at the Year 2000 conversion effort today, we must constantly remind
ourselves that the mission-critical systems we talk about are but the tip of the iceberg — approximately
one eighth of the installed base of systems.


Jobn CAL. Laingart IV
praskepseat
@ftice of Inspector General
|. Bouse of Representatives
TO: James M. Eagen It
ef Administrative
FROM: . Aes ez
Inspector General
DATE: September 29, 1997

SUBJECT: Audit Report - House Needs To Refocus It’s Efforts To Meet The Year 2000
Deadline (Report No. 97-CAO-13)

This is our final report of our audit of HIR’s progress in identifying and resolving Year 2000
issues. The objectives of this audit were to (1) evaluate the adequacy of the House’s Year 2000
plan, (2) assess the status, allocation of priorities and resources, and timetable for completion of
the Year 2000 initiative, (3) determine whether generally accepted project management
techniques have been established, and (4) identify whether vendor supported hardware/software
products will be Year 2000 compliant. In this report, we identified Year 2000 management
controls involving planning, budgeting, internal and external coordination issues, procurement,
and conversion practices that can be improved. We also found that the House is only at the
initial stages for OSM and FMS Payroll replacement efforts which leaves no time for
unanticipated problems or delays.

In response to our September L1, 1997 draft report, your office concurred with our findings
and recommendations. Your September 9, 1997 management response is incorporated in this
final report and included in its entirety as an appendix. The corrective actions taken and planned
by your office are appropriate and, when fully implemented, should adequately respond to the
recommendations contained in this report and other long-standing recommendations contained in
prior OIG reports. Further, the milestone dates provided for implementing the corrective actions
appear reasonable.

We appreciate the courtesy and cooperation extended to us by your staff. If you have any
questions or require additional information regarding this report, please call me or
Robert B. Frey IIT at (202) 226-1250.

cc: Speaker of the House
Majority Leader of the House
Minority Leader of the House
Chairman, Committee on House Oversight
Ranking Minority Member, Committee on House Oversight
Members, Committee on House Oversight


118

think it’s important to have awareness, I don’t want to drive the
agencies into a shell during this period, where they are saying
things they think will keep them out of the limelight, and in fact,
delu iding emselves, or us, into assuming that the problem can be
solved.

Mr. Davis. That’s a good point. I’ve noticed in some of the agen-
cies that come up here that there are a lot of retirements that have
gone on during this process. The chairman has called and they've
said: they are not around if things go bad. They give great reports
at lower levels.

Mr. KOSKINEN. I would like to say, that thus far in my meetings
with agency heads, I have been gratified to see the level of interest
and concern by the Cabinet Secretaries and their deputies person-
ally in this matter. I think that everyone is increasingly focused on
the point that this is not a question as I say of posturing between
now and January 1, 2000. It is a question of how do we ensure that
basic services to the public and necessary services for the economy
are maintained.

Mr. Davis. Let me—I’m going to ask you one more question, But
if I could move over to Mr. Harden for just a second because I was
a senior V.P. at PRC before I was selected—so I’m out of the busi-
ness a little bit. Fortunately we did very few fixed-fee contracts in
our business. So still, you have to come back and get some kind of
innovation sometimes to come back as the costs rise for your pro-
grammers. How much fixed-fee is going on? What’s going to happen
to the contracts that are out there right now where the costs of] pro-
ducing the people are going up exponentially almost?

Mr. HARDEN. Well, you’re actually seeing, in some cases, where
organizations that do a lot of government contracting are announc-
ing record revenues and lower profits. And part of the reason for
that is the fixed-fee contract roblems they have gotten into where
those programmers are now charging so much more that they can’t
pass that along. I think we'll see less and less of those contracts,
and I think when they come up for rebid, we'll see less and less
companies wanting to bid on those. And the Government will either
have to change the way those contracts are bid, or just throw up
their hands and say: we don’t even have time to do this or we can’t
find an: ly because our focus is on the year 2000.

Mr. Davis. Well something that I have been talking about for a
long time, is what is happening. Procurement, of course, has
changed markedly over the Short period of time, but one of our con-
cerns in terms of Betting good people and moving these through the
procurement cycle is the Federal Government doesn’t have the
qualified people, can’t afford to keep the qualified people to even
oversee some of these. And we have a lot of contracting and out-
sourcing in this area, but I think it is going to have to increase be-
cause I just don’t think we can afford to keep it in-house given our
pay les and the way these things are coming up. And that’s the
way I see it evolving. Any comment on that?

Mr. HARDEN. I think you are absolutely correct in that assump-
tion. There is going to be more and more contracting of this to
outsourcers and other service providers. But once again, those pro-
viders themselves will be competing for those same resources,
which will mean that the prices that they charge to the Govern-


7

The Honorable Dennis J. Kucinich

Opening Statement
“Oversight of the Federal Government's Year 2000 Efforts”

Meeting the challenges presented by the Year 2000 conversion will
require the commitment of significant resources from both the public and
private sectors. The federal government, in particular, must take a
leadership role. It is not enough that the federal government fix its own
systems, the government must also facilitate private sector conversion.

| commend the Chairman's leadership on the Year 2000 conversion.
Oversight by this Subcommittee has served to increase public awareness of
potential problems facing the federal government. Moreover, the GAO has
provided invaluable assistance on the federal Year 2000 conversion.

The President's recent decision to establish the Council on the Year
2000 Conversion is a much needed step. This Council can provide high
level guidance for Executive Branch agencies. It will also be able to
develop national policies to assure coordination with other governments
and private sector entities. It will serve as the federal liaison to the
international community.

Converting all the federal computer systems requires the attention
and dedication of senior level management within each agency. Federal
agencies currently are addressing the technological changes that must be
made to their systems to minimize disruption by the century change.


12

of the criticisms leveled at the administration are the same failings
of House efforts. I hope that we will spend as much time critically
evaluating our own strategies to fix House computer systems as we
have been of the administration’s efforts.

The year 2000 computer problem is not a Republican versus
Democratic issue. It is not an administration versus Congress
issue. The Y2K issue is a technical problem which unless it is fixed
in both the executive and legislative branches will seriously com-
promise the Government’s ability to serve the people who elect us
to office and who pay their taxes. Thank you, Mr. Chairman.

[The prepared statement of Hon. James A. Barcia follows:]


OVERSIGHT OF THE FEDERAL
GOVERNMENT'S YEAR 2000 EFFORTS

WEDNESDAY, MARCH, 18, 1998

House oF REPRESENTATIVES, SUBCOMMITTEE ON Gov-
ERNMENT MANAGEMENT, INFORMATION, AND TECH-
NOLOGY, COMMITTEE ON GOVERNMENT REFORM AND
OVERSIGHT, JOINT WITH SUBCOMMITTEE ON TECH-
NOLOGY, COMMITTEE ON SCIENCE,

“ Washington, DC.

The subcommittees met, pursuant to notice, at 9:37 a.m., in room
2154, Rayburn House Office Building, Hon. Stephen Horn (chair-
man of the Subcommittee on Government Management, Informa-
tion, and Technology) presiding.

Present: Representatives Horn, Morella, Sessions, Davis,
Sununu, Ehlers, Kucinich, Barcia, Maloney, Gordon, Rivers, and
Stabenow.

Subcommittee on Government Management, Information, and
Technology staff present: J. Russell George, staff director and chief
counsel; John Hynes and Bob Alloway, professional staff members;
Matthew Ebert, clerk; Ellen Rayner, minority chief clerk; and Faith
Weiss, minority counsel.

Subcommittee on Techno! staff present: Richard Russell, staff
director; Ben Wu, counsel; Michael Bell, staff assistant; Adrienne
Woodward, deputy communications director; Mike Quear, minority
professional staff member; and Mary Sanchez, minority staff assist-

ant.

Mr. Horn. The Subcommittee on Government Management, In-
formation, and Technology will come to order, a quorum being
present. This is a joint meeting with the Subcommittee on Tech-
nology of the House Committee on Science.

en the Subcommittee on Government Management, Informa-
tion, and Technology began hearings on the year 2000 computer
problem, on April 16, 1996, we didn’t see everything that was going
to be before us, but we knew something had to be done very rap-
idly. Considerable progress has been made in alerting the adminis-
tration, and we have this morning as our first speaker on the
subject the individual the President’s brought back out of private
life in order to give some leadership to this which has been lacking
in the executive branch.

What we're talking about here, for the uninitiated, is the prob-
lem created by the two-digit year versus the four-digit year. Those
of us that were in graduate school in the fifties or early sixties, re-
member we were looking for more capacity in the computers we
were using. This whole room would now be a laptop in terms of

@



130

me. I’m having trouble with my voice today, and I’m on some medi-
cation.

My mother might say it another way, and that is, with me in this
chair, God save the United States.

With that said, I would like to begin with the second panel. For
the record, I believe that Mrs. Morella has sworn in each of these
witnesses that are before us, so I’d please remind you that you are
sworn witnesses.

We will start, please, with the first opening statement from Mr.
Dennis Schindel, Inspector General of the Treasury.

Sir.

STATEMENTS OF DENNIS SCHINDEL, ASSISTANT INSPECTOR
GENERAL FOR AUDIT, DEPARTMENT OF THE TREASURY; JIM
FLYZIK, ACTING CHIEF INFORMATION OFFICER, DEPART-
MENT OF THE TREASURY; ARTHUR GROSS, ASSOCIATE COM-
MISSIONER FOR MODERNIZATION AND CHIEF INFORMA-
TION OFFICER OF THE INTERNAL REVENUE SERVICE, DE-
PARTMENT OF THE TREASURY; AND CONSTANCE CRAIG, AS-
SISTANT COMMISSIONER, INFORMATION RESOURCES FI-
NANCIAL MANAGEMENT SERVICES OF. THE DEPARTMENT
OF THE TREASURY

Mr. SCHINDEL. Thank you, Mr. Sessions. I think there is defi-
nitely a distinct disadvantage in being the second panel.

I think most of the words of wisdom that you will hear come out
of my mouth, you will swear you heard somewhere before, and
quite recently. However, I will make my statement brief, and talk
primarily about what the Treasury ins] r general’s doing to
oversight the Department of the Treasury's efforts to solve the year
2000 problem.

One thing is definitely clear, the problem must be fixed and fail-
ure is not an option. To the bureaus that are represented here
today, Internal nue Service and the Financial Management
Service, along with many other Government agencies, provide serv-
ices that are not only essential to Government, but to the public
as well.

There has been a great deal of focus on this problem in Treasury
as well as throughout Government. There are plans in place. There
is a process that’s been established which defines the various
phases for a year 2000 conversion. There are milestone dates set.
And there is a progress reporting mechanism in place.

Despite all this, I think that there are at least two factors that
present a high risk that problems could occur, and a successful con-
version not take place. First the sheer size and magnitude of the
problem, and the work that needs to be done, will make it difficult
to manage and control. Second, there can be no extension to the
deadline; it is January 1, year 2000, and for some operations even
sooner. With the amount of work that’s left to be done and the
scarce resources that are available to do it, and everyone competing
for those scarce resources, it presents an enormous lenge.

Having said that, let me briefly describe what we are doing to
oversee ury’s efforts.

Our audit work this year will be in two phases. The first phase
is nearing completion. As part of our financial statement audit


108

pass up. It may eventually become possible for a government employee to quit,
join a commercial corporation, and to make as much money in a few years as they
would have in ten years of government service. Today, the Federal government is
unable to compete with its private sector counterparts. An exodus of government
programming talent will likely occur, thereby making the task of fixing the Year
2000 problem much harder than imagined.

The inability of the Federal government to retain its programming staff will
necessitate the hiring of contractors to provide this resource. The price for this
staff will be significantly more than current budgets have allowed. In fact, itis
very likely that the government employee who once worked on a particular
system will return as a contract programmer, sitting in the same cubicle, working
on the same systems, but at a contractor rate of three times what he was

previously paid as an employee.

|. The unplanned increased costs for programmers to work on Year 2000 projects
will throw all previous budget projections to the wind. Current estimates in both
the government and private sectors were based on the then prevailing
programming rates. As these rates increase, expected Year 2000 costs will
skyrocket. The obvious result is that current cost estimates are no longer valid. It
is interesting to note that the original Gartner Group estimate of a $600 billion
worldwide cost for the Year 2000 was based on programmer salaries at that time.
Due to the financial competition for talent that is underway, many industry
experts are now pushing the figure up to as high as $1 trillion.

. As the demand for programmers to focus on the Year 2000 problem increases,
resources will be shifted away from other programming needs. Maintenance of
existing systems will be jeopardized. Computer upgrades, modemization efforts,
and many other projects will suffer. How will the FAA or the IRS fix their Year
2000 problems while simultaneously modernizing their systems? Can changes to


Report No, 96-CAO-AS
Oftice OF The Chiet Administrative Officer December 31, 1998

Finance operations are effectively planned and executed, and that the much needed
improvements are being made.

+ The unique nature of the House consists of an unusually large number of high-level
customers who require the direct personal atention of Finance's Associate Administrator.
Because this direct customer service takes foremost priority, the Associate Administrator is
tunable to devote a significant amount of time to oversecing financial operations. As a result,
financial management operations are not being effectively managed

‘+ Despite continued reorganizations and re-assignments of personnel within the Office of
Finance, the workload exceeds current staffing capabilities. The reason for the imbalance is
largely attributable to the recent implementation of FFS. In order to accommodate the
excessive on-going workload, contractor staff were hired to perform duties ordinarily carried
‘out by in-house staff; however, continued use of contractor staff for certain functiors may not
be a suitable long-term solution.

+ Recently, Finance improved documentation of its operating policies and procedures,
particularly in conjunction with the implementation of FFS. However, while documentation
of operational guidelines and manuals was generally adequate, policies and procedures could
be expanded upon in some departments, while they should be more refined in others. There
is a need for consistency in financial procedures documentation and organizstion of materials
so they can be easily retrieved when needed

Office of Media and Support Services

+ Systems and controls to track capital equipment are duplicative. The House has one system
that tracks equipment, maintained by Office Systems Management (OSM), and a separate
system that tracks furniture, maintained by FRC. The lack of a single centralized inventory
control system creates financial and operational risks to the House.

‘+ Utilization of services provided by Media Services is low, resulting in subsidies of
photography and recording studio operations, Fees generated from the Photo Studio and
Recording Studio are insufficient to cover expenses.

‘+ Despite prior year audit recommendations -- Changes In Operation Practices Could Save
Office Supply Store And Gifi Shop $1.3 Million Annually Report No. 95-CA0-07, dated July
18, 1995) ~ the Supply Store and Gift Shop have not adequately changed their operating
practices, As a result, these [House retail stores continue to incur losses from operations.

+ Based on the volume of calls received. current ONECall staffing is excessive, Operators in
the ONECall office handle less then three calls per hour, resulting in large amounts of
downtime,

‘+ There is no system to measure performance such as Member satisfaction and utilization of
resources to determine the efficiency and effectiveness of services.

Office at tiapeetar Generat Fagen
US. House of Representatives


the Year 2000 project manager

Adopted a Year 2000 methodology based on Government and private industry best
practices Conducted training in project management methodology for Year 2000
projects

Developed System Development Life Cycle procedures for all CAO technology projects.
This will ensure good business practices in all renovation or replacement for Year 2000
work as well as all other technology activities

Marshaled CAO-wide resources for the Year 2000 effort and established specific
responsibilities for the 31 major projects that comprise the bulk of the Year 2000 work
Conducting ongoing project review meetings for those 31 projects to identify any
obstacles to completion of responsibilities on time.

Developed a standard for information exchanges within the Legislative branch and
coordinating all exchanges outside the legislative branch to ensure operability with all
partners who rely on data exchanges with the House.

Completed a program assessment, December 24, 1997, of the House’s ¥2K program and
identified the critical next steps. Identified 718 systems for the assessment

Developing a baseline program plan, due March 31, 1998, to schedule all required
activities for the year 2000 program, This plan will be the baseline for measuring
performance in the future.

(March 17, 1998)


141

verification and validation (IV&V) of the telecommunications infrastructure with respect
to Year 2000 compliance.

Thus, for our inission critical systems, Treasury is on schedule to meet the
implementation milestone date of December 1998 with the exception of the IRS phase 5
system applications and Financial Management Services Government On Line
Accounting Link System (GOALS). The IRS systems will be completed by January
1999 in accordance with the IRS Year 2000 program plan. which calis for implementing
renovated systems in 6 month phases, each January and July, through January 1999. This
implementation strategy was created to accommodate tax processing season
considerations. The Department is working closely with Financial Management Service
to determine actions that can be taken to accelerate the GOALS schedule, as described in
the Financial Management Services” testimony

Since the kickoff of the Treasury Non-IT Working Group on August 28, 1997,
Non-IT efforts have been continuing. The management planning and the definition of
bureau and office specific Treasury Year 2000 Non-IT management plans began on
October 16, 1997. These plans are based on the standard plan format, overall process,
and content requirements as defined in the “Treasury Year 2000 Non-IT Baseline
Management Plan,” dated October 16, 1997. This Treasury plan has been used as a
model by the General Services Administration (GSA) for addressing Non-IT systems.

The Non-IT effort is supported by a central Non-IT database, on the Treasury
Intranet Year 2000 site. which provides a tracking too! to determine the compliance status
of vendor products.

As of March 6, 1998, Treasury bureaus and offices had identified 6,898 external
data exchanges, of which 3,169 were incoming and 3,729 were outgoing. The
Department has assessed 6.878 out of 6,898 (99.7%) of these external data exchanges,
and found that 87.3% are Year 2000 compliant or have been granted a waiver. Of the
2.551 interfaces with the US private sector, Treasury bureaus and offices thus far have
contacted 2.446 and reached agreements with 2.391. The bureaus and offices are working
to meet the established milestone date of March 31, 1998, for reaching agreement with all
state governments with which Treasury exchanges data.

At the Department level, coordination on Year 2000 data exchanges has been
‘ongoing with other government agencies. Treasury has held a series of meetings with
executives and staffs from the Department of Defense and the Department of
Agricultures National Finance Center to address and resolve data exchange issues and
readiness for Year 2000 testing.

In early 1996, Treasury established September 1998 as a program milestone date
for the completion of contingency plans. During a series of meetings with bureau and
offices heads in June 1997. the Department emphasized the need for contingency


‘SUBCOMMITTEE ON TECHNOLOGY
‘COMMITTEE ON SCIENCE

U.S. HOUSE OF REPRESENTATIVES
WASHINGTON D.C. 20515

Opening Statement of
Chairwoman Constance A. Morella

Government Wide Year 2000 Issues and the Department of Treasury
March 18, 1998

Today we are heralding the beginning of a new era in our nation’s
ability to timely and effectively correct the Year 2000 problem.

With the arrival of John Koskinen to chair the newly created
President's Council on the Year 2000 Conversion, a ray of hope is now
piercing through the clouds of doubt and gloom that had shrouded over
questions about the readiness of our public and private sectors to be Year
2000 compliant by the beginning of the new millennium.

Mr. Koskinen brings to his new position a {evel of experience and a
skill for government management that has very few peers.

1am also very pleased that Sally Katzen, with her institutional
knowledge and background on this issue, has accepted the role of Vice
Chair of the Council.

Additionally, the Council will be well served with the technical
expertise of federal Chief Information Officers and the very capable Office
of Management and Budget staff.

Yet, while | have great faith and confidence in the Council's abilities
and motivation to get the job done by the immovable deadline of January 1,
2000, | just hope it’s not too late.

The job before the Council is both gargantuan and thankless, and
the Executive Branch, to paraphrase Robert Frost, still has many promises
to keep and miles to go before it can sleep.


139

EMBARGOED UNTIL 9:30 A.M. EST
Text as Prepared for Delivery
March 18, 1998

TREASURY DEPUTY ASSISTANT SECRETARY FOR INFORMATION
SYSTEMS AND CHIEF INFORMATION OFFICER JAMES J. FLYZIK
HOUSE GOVERNMENT REFORM AND OVERSIGHT SUBCOMMITTEE
ON GOVERNMENT MANAGEMENT, INFORMATION AND TECHNOLOGY

Chairman Hom. Representative Kucinich, and members of the Subcommittee,
thank you for the opportunity to appear today to discuss the Department of the Treasury’s
progress on the Year 2000 computer problem. The Year 2000 computer problem is our
highest priority information technology challenge. 1 am confident that Treasury has a
strong program in place to address this challenge. and while there is much work ahead of
us. we have made significant progress to date.

The Assistant Secretary for Management and Chief Financial Officer (CFO) has
overall responsibility for the Year 2000 date transition. As Deputy Assistant Secretary
(Information Systems) and Chief Information Officer (CIO). 1 am the overall program
manager for the Year 2000 effort. The day-to-day responsibilities of the Year 2000
program reside within my office. in addition, Treasury has contracted with several firms
with specialized skills in the Year 2000 problem to assist the Department in its oversight
role. Attached to this statement are copies of the Year 2000 Program Organization at the
Department of the Treasury

Secretary of the Treasury Rubin is briefed periodically on the status of our Year
2000 program, and the Assistant Secretary for Management and CFO and myself meet
weekly with bureau heads to review their Year 2000 progress. Working groups meet
regularly for the Information Technology (IT), Non-IT, and Telecommunications
components of our program. The Department requires each bureau and office to submit
detailed monthly status reports. Additionally, the Secretary of the Treasury has mandated
that each bureau and office head select an executive official to be in charge of their Year

RR-2304


Prior Audi

‘overage

Improvements Are Needed In The Management And Operations Of The Office Of The Chief Administrative
Officer (Report No. 96-CAO-15, dated December 31, 1996). One of the areas reviewed during this audit
was the HIR mainframe migration project. This resulted in a determination that additional research in this
migration project was required. The audit report recommended the CAO conduct a comprehensive needs
and cost/benefit analysis to determine the best approach to mainframe migration, and adopt an
implementation plan that balances the need for an aggressive timeline with user needs, hardware and
software, personnel and budget requirements. The Acting CAO concurred with the recommendations and
indicated that HIR will adopt an implementation plan based on the migration strategy and direction
provided by the CHO using the analysis which HIR would provide by March 1, 1997. During follow-up
discussions with the Administrator, we were told that HIR had not performed a needs and cost/benefit
analysis and had no plans to do one in the future.

HIR Management Practices Undermine The House's Ability To Keep Pace With Technological Changes
(Report No. 97-CAO-09, dated May 9, 1997). Among the significant points identified in this audit report,
‘we noted that HIR had not fully implemented fundamental management practices or established a fully
functional information systems planning process. The related audit recommendations directed the CAO to
develop a detailed HIR strategic and operational plan based on the ISPP vision; adopt a more proactive
leadership approach that requires formal communication and documentation of key decisions; develop and
implement a mix of effective control mechanisms that ensure compliance with management-approved plans
and policies; and formalize the process and improve the information and reports provided to upper
management to facilitate more informed decision-making. With regard to the problems involving planning,
‘we recommended the CAO establish a formal, integrated planning and budgeting policy that requires
‘management involvement at aif levels; and formulate a comprehensive HIR budget package that links
individual Groups’ budgets and operational plans according to the strategic objective(s). The Acting CAO.
fully concurred with these findings and the accompanying recommendations and indicated that corrective
actions have been initiated for some areas and are planned for the remaining areas.

U, RESULTS OF REVIEW

Contrary to a key recommendation in the ISPP and a proviso of the CHO's Noveriber 1995 House
Resolution that HIR develop a mainframe migration plan, no such plan exists today. Furthermore, our
review disclosed that (I) neither HIR nor the CAO provided a response to the original CHO Resolution
requesting a mainframe retirement issue report; (2) the CAO justified procurement of a smaller mainframe
processor indicating it was an integral part of the House’s mainframe migration plan; (3) HIR’s FY98
budget request included an increase of $323,000 to migrate services from the mainframe to a 3-tier
client/server architecture in FY98, despite the fact that there is no migration plan; (4) HIR management
ignored the CAO’s agreement to prepare a comprehensive needs and cost’benefit analysis to document the
agreed upon migration plan; and (5) HIR's Associate Administrator at the time of this audit considered the
‘question of retiring the mainframe an open policy issue. Asa result, the House is now in a position of
having to first implement costly Year 2000 solutions, and then readdress migration for these very same
legacy systems, rather than accomplishing both tasks in unison, as originally envisioned.

HO Directives End In False Starts



164

86/60/E0 JO sy

%S' vl
goejday-uoisiaAuoy

IYO
deday-uolsiaauog

SUIa}SAG [EONUD UOISSIW ZG $}] 10} BOURITGWIOD ZA EASIYDE |IIM SW YOIUM Aq poyyel eu) SMOYS

ABaye1)g Bouel|dwoy 000Z 1e28A
ad1Alag JUOWabeuRW [eloueul4


96

completed a phase when they have not. Our enterprise guide provides
information on the key tasks that should be performed within each phase.”

Mr. Chairman, in your December 1997 letter to OMB, you expressed similar concerns
that OMB reports be more comprehensive and reliable.

i PI erativi

In January 1998, OMB asked agencies to describe their contingency planning activities in
their February 1998 quarterly reports. These instructions stated that contingency plans
should be established for mission-critical systems that are not expected to be
implemented by March 1999, or for mission-critical systems that have been reported as 2
months or more behind schedule. Accordingly, in their February 1998 quarterly reports,
several agencies reported that they planned to develop contingency plans only if they
fall behind schedule in completing their Year 2000 fixes.

Agencies that develop contingency plans only for systems currently behind schedule,
however, are not addressing the need to ensure the continuity of a minimal level of core
business operations in the event of unforeseen failures. As a result, when unpredicted
failures occur, agencies will not have a well-defined response and may not have enough
time to develop and test an effective contingency plan. Contingency plans should be
formulated to respond to two types of failures: those that can be predicted (e.g., system
renovations that are already far behind schedule) and those that are unforeseen (e.g., a
system that fails despite having been certified as Year 2000 compliant or a system that
cannot be corrected by January 1, 2000, despite appearing to be on schedule today).

Moreover, contingency plans that focus only on agency systems are inadequate. Federal
agencies depend on data provided by their business partners as well as on services
provided by the public infrastructure. One weak link anywhere in the chain of critical
dependencies can cause major disruptions. Given these interdependencies, it is
imperative that contingency plans be developed for alll critical core business processes
and supporting systems, regardless of whether these systems are owned by the agency.

In its latest governmentwide Year 2000 progress report, issued March 10, 1998, OMB
clarified its contingency plan instructions. OMB stated that contingency plans should

be developed for all core business functions. Today, we are issuing an exposure draft of
a guide to help agencies ensure the continuity of operations through contingency

"°GAO/AIMD-10.1.14, September 1997.

4 US. Office of Management and Budget, as of
February 15, 1998.

8


188

force. Skilled programmers, especially those with skills in legacy
system platforms, are in strong demand with the private sector,
which can pay significantly higher salaries than Government. The
loss of these critical resources represents a risk to the year 2000

program.

"Finally, I believe that Treasury has an aggressive overall year
2000 program in place, and we are on target to complete the con-
version, testing, validation, and implementation of all mission-criti-
cal services in time to avoid disruption to any critical systems.
Nothing less than 100 percent compliance will be acceptable to the
American public or to me personally.

I recognize that Chairman Horn’s ratings suggest that Treasury
has significantly greater problems with the year 2000 program
than my testimony might suggest. I do not underestimate the chal-
lenge of achieving significant compliance; however, we are pur-
posely taking a conservative approach at Treasury with respect to
measuring our progress on the year 2000 problem. We are requir-
ing end-to-end testing of all our systems before we will consider
any of them to be 100-percent compliant.

Thank you for the opportunity to meet with you today to discuss
the actions at the Department of the Treasury. I will be happy to
answer any questions you may have on this important matter.

[The prepared statement of Mr. Flyzik follows:]


89

Mr. Chairman, Ms. Chairwoman, and Members of the Subcommittees:

We are pleased to be here today to discuss the Year 2000 computing crisis. According to
the report of the President's Commission on Critical Infrastructure Protection, the United
States--with close to half of all computer capacity and 60 percent of Internet assets--is the
world’s most advanced and most dependent user of information technology.’ As a
result, the upcoming change of century is a sweeping and urgent challenge for public
and private-sector organizations.”

For this reason, we designated the Year 2000 computing problem as a high-risk area’ for
the federal government and published guidance‘ to help organizations successfully
address the issue. During the past year, we have issued over two dozen reports
detailing specific findings and recommendations related to the Year 2000 readiness of a
wide range of federal agencies!

While some progress has been made in addressing the federal government's Year 2000
readiness, serious vulnerabilities remain. Many agencies are behind schedule. At the
current pace, it is clear that not all mission critical systems will be fixed in time. Much
more action is needed to ensure that federal agencies satisfacturily mitigate Year 2000
risks to avoid debilitating consequences. Vital economic sectors of the nation are also
vulnerable. These include state and local governments; telecommunications; banking
and finance; health, safety, and emergency services; transportation; utilities; and
manufacturing and small business.

‘Critical Foundations: Protecting America’s Infrastructures (President's Commission on
Critical Infrastructure Protection, October 1997).

*For the past several decades, automated information systems have typically represented
the year using two digits rather than four in order to conserve electronic data storage
space and reduce operating costs. In this format, however, 2000 is indistinguishable
from 1900 because both are represented only as 00. As a result, if not modified,
computer systems or applications that use dates or perform date- or time-sensitive
calculations may generate incorrect results beyond 1999.

‘High-Risk Series:_Information Management and Technology (GAO/HR-97-9, February
1997).

‘Our enterprise readiness guide--Year 2000 Computing Crisis: _An Assessment Guide
(GAO/AIMD-10.1.14, September 1997)--offers a structured, step-by-step approach for
reviewing the adequacy of agency planning and management of a Year 2000 program.
This guide was released to the public as an exposure draft in February 1997 and issued
in September 1997.

5A listing of our publications is included as an attachment to this statement.


1 don’t need to remind the Council that as we ring in the 21st
Century, we will be ushering in the mother of all computer glitches -- one
which could cripple critical government functions, such as air traffic
control systems, veterans’ benefits, Social Security, and student loans, as
well as the everyday conveniences of modern life, like home security
systems, video recorders, and elevators in high-rise buildings.

itis clear that without greater urgency and aggressive agency
management, federal agencies are at risk of being unable to provide
‘services or to perform functions that are critical to their mission and vital
to the American public.

The reports that we have received from federal agencies, and our
own Congressional reviews, are quite disturbing, prompting many to grimly
cast dire predictions about the failure of the government and industry to
operate effectively on the first business day of the new millennium,
Monday, January 3, 2000.

That is why we have urged the President for over a year to forcefully
attack this impending catastrophe.

We repeatedly appealed to him to create a Year 2000 Czar with the
mandate of making solving the problem the highest priority for both the
public and private sector.

At last, with his Executive Order forming the Council, the President
has finally given this issue the attention it deserves.

Now that this important step has been undertaken, | am looking
forward to working collaboratively with the Council to do everything we
can to avert catastrophic failure of government and industry computer
systems.

Minimizing the Year 2000 problem will require a major technological
and managerial effort.

Not only must the Council act to ensure that no critical federal
program experiences disruption because of the problem, but it must also:
assist state and local governments; cooperate with the private sector i
important national and local systems, including the financial,
telecommunications, health, transportation, and energy sectors; as well as
communicate with our international allies to raise awareness and generate
cooperative international arrangements to address the problem.



95

systems, as well as thousands of nonmission-critical systems, still to be repaired, and
over 1,100 systems to be replaced. It is unlikely that agencies can complete this vast
amount of work in time. Accordingly, it is critical that the executive branch identify
those systems that are of the highest priority. These include those that, if not corrected,
could most seriously threaten health and safety, the financial well being of American
citizens, national security, or the economy.

Agencies must also ensure that their mission-critical systems can properly exchange data
with other systems and are protected from errors that can be introduced by external
systems. For example, agencies that administer key federal benefits payment programs,
such as the Department of Veterans Affairs, must exchange data with the Department of
the Treasury which, in turn, interfaces with financial institutions, to ensure that
beneficiary checks are issued. As a result, completing end-to-end testing for mission-
critical systems is essential.

Reporting on Agency Progress Needs to Be Improved
OMB’s reports on agency progress do not fully and accurately reflect the federal

government's progress towerd achieving Year 2000 complia:.ce ¢esause not all agencies
are required to report and OMB's reporting requirements are incomplete. For example:

= OMB had not, until recently, required independent agencies to submit quarterly
reports. Accordingly, the status of these agencies’ Year 2000 programs has not
been monitored centrally. On March 9, 1998, OMB asked 31 independent
agencies, including the Securities and Exchange Commission and the Pension
Benefit Guaranty Corporation, to report on their progress in fixing the Year 2000
problem by April 30, 1998. OMB plans to include a summary of those responses
in its next quarterly report to the Congress. However, unlike its quarterly
reporting requirement for the major departments and agencies, OMB does not
plan to request the independent agencies to report again until next year. Since the
independent agencies will not be reporting again unti] Apri 1999, it will be
difficult for OMB to be in position to address any major problems.

= Agencies are required to report their progress in repairing noncompliant systems
but are not required to report on their progress in implementing systems to
replace noncompliant systems, unless the replacement effort is behind schedule by
2 months or more. Because federal agencies have a poor history of delivering
new system capabilities on time, it is essential to know agencies’ progress in
implementing replacement systems.

. OMB's guidance does not specify what steps must be taken to complete each
phase of a Year 2000 program (i.e., assessment, renovation, validation, and
implementation). Without such guidance, agencies may report that they have


100

GAO REPORTS AND TESTIMONY ADDRESSING THE YEAR 2000 CRISIS
r_2¢ in a
(GAO/AIMD-10.1. 1 Exposure Draft, March 1998)

Year 2000 Readiness: NRC's Pi
(GAQ/AIMD-98-90R, March 6, 1998)

‘isis: Federal 's Eff
Bank Systems Are Year 2000 Compliant (GAO/T-AIMD-98-73, February 10, 1998)
ing Cris it i Prev
(GAO/T-AIMD-98-63, February 4, 1998)
FAA Comput stems: Limite I; I
Dramatically (GAO/AIMD-98-45, January 30, 1998)
e s:_Air Force Ni

98-35, January 16, 1998)

ia Compliance, But Challenges Remain (GAO/AIMD# BBR November 7. 1997)

4

000. c Crisis: Credit Uni . SE E
Credit Union Systems Are Year 2000 Compliant (GAO/T-AIMD-98-20, October 22, 1997)
urity Administrati lade is ff it
Risks Remain (GAO/AIMD-98-6, Gctober 2, 1397)
: 1
(GAO/AIMD-98-7R, October 21, 1997)

Defense Computers: LSSC Needs to Confront Significant Year 2000 Issues
(GAO/AIMD-97-149, September 26, 1997)

Veterans Affait ymputer 7 We
Resolve Year 2000 Crisis (GAO/T-AIMD-97-174, September 25, 1997)

isis: ends Upon Strong Management and.
Structured Approach (GAO/T-AIMD-97-173, September 25, 1997)

12


116

Mr. Barcia. Thank you. You already answered my next one:
What agencies have completed transition plans that had been
agreed upon by all parties?

Mr. KOSKINEN. All but five, and those five are working on them
at this time. Our expectation is that by the time the State CIO’s
come to Washington next month, that all agencies will be able to
provide them with the listings of their interfaces with the States.

Mr. Barcia. That leads me to my second question, my last ques-
tion: the General Accounting Office lays out specific recommenda-
tions for the Council as well as an assessment of Federal agencies
efforts to address the Y2K problem. What is your assessment of the
General Accounting Office analysis? And on what specific points do
you differ from their recommendations? Highlight what you agree
with and what you don’t.

Mr. KOSKINEN. That’s a good question. I'll be happy to share with
you our written response when the process of formulating a written
response to GAO is done. As a general matter, I think we're all
moving in the same direction. I think it is critical. It is a subtle
but important distinction in the chart, as Mr. Dodaro and I have
discussed, that I think we need to challenge the agencies to be the
gector responsible operations that we can coordinate that at the

yuncil.

If you are dealing with international financial markets, those
partnerships and dialogs and discussions have to be headed up by
the appropriate Federal ncies, rather than centralized in the
Council’s operations. But the Council then needs—and the mem-
bers of the Council will include senior representatives from each of
the agencies working in those areas so that we can coordinate
across agency lines what ha} 8.

There is an issue on contingency y planning as well, in terms of
prioritization and how we do that. resources are tight. I think
the focus is exactly right: we need to ensure that, whatever hap-

we provide the maximum amount of services we can. What
’m concerned about is that we make sure we don’t unnecessarily
devote resources to contingency planning in areas where we're rea-
sonably confident that we're going to actually have those problems
solved within another few months. But as a general matter, I think
as they would say in the law: we're pretty close to being on-all-
fours with GAO. I think they have done good work, provided an ex-
cellent outline, and we'll need to move forward in these areas. We
may implement some of their recommendations in a slightly dif-
ferent way, but I think we're headed in the same direction.

Mr. Barca. Thank you for that response.

Mr. Horn. I thank the gentleman from Michigan. I now yield 5
minutes to the gentleman m Virginia, Mr. Davis.

Mr. Davis. you. Mr. Koskinen, let me start with you. You
know that Chairman Horn is a former university professor. He
issues his own rey cards on the agencies. OMB currently has
their own sort of rankings with tier 1, 2, 3. Will you consider
maybe your own report card and making it public to hold agencies

accountable?
. KOSKINEN. Again, I think at this stage——
Mr. Davis. Not yet, but, I mean, as we move——


Fobr WH. Lainhart LV

Sse et
Ottice of Inspector General
GS. Bouse of Representatives
ashingtan, BC 20515-9990
MEMORANDUM
TO; Jeff Trandahi
ing ineipinig tive Officer
FROM: RG! Ashe ia
faspector General
DATE: December 31, 1996

SUBJECT: Audit Report - Opportunities Exist To Improve The Management Of The
Office Of The Chief Administrative Officer (Report No. 96-CAO-15)

This is our final report on the audit of operations of the Office of the Chief Administrative
Officer (CAO). This audit was part of our annus! audit plan and was approved by the Committee
on House Oversight. The objective of our review was to provide an operational assessment of
‘the CAO during the 104” Congress, In this report, we identified 22 findings and made 45
recommendations for corrective action.

In response to our Novernber 15, 1996 drait report, your office fully concurred with our
ings and recommendations. The December 30, 1996 management response is incorporated
into this final report and included in its entirety as an appendix.

We appreciate the courtesy and cooperation extended to us by your staff, If you have any
questions or require additional information regarding this report, please call me or
Craig W. Silverthome at x61250

ec: Speaker of the House
Majority Leader of the House
Minority Leader of the House
Chairman, Committee on House Oversight
Ranking Minority Member, Committee on House Oversight
Members, Committee on House Oversight


Report No. 96-C40-15
Office Of The Chief Administrative Officer Docember 31, 1996

RECOMMENDATIONS |

We recommend that the Chief Administrative Officer:

+ Strengthen management processes through enhanced communications, standardized planning
and decision-making documents, and structured annual goal setting and monitoring,

+ Enhance audit tracking and followup processes to support the timely implementation of audit
recommendations.

Office of House Information Resources

+ Create an updated information technology strategy based on a current needs analysis.
Communicate the objectives and goals to all HIR emplovees and review HIR management
and staffing levels to determine that appropriate resources are allocated to effectively
implement the strategy.

+ Develop detailed project management policies and procedures based on a formal System
Development Life Cycle (SDLC) methodology, including appropriate change management
controls. Provide appropriate training for employees and require employces to manage HIR
projects using this methodology.

= Conduct a comprehensive needs analysis and cost/benefit analysis to determine the most
appropriate approzch to the mainframe migration project, balancing the aggressive timeline
with user needs, available technologies, and budget requirements,

«Prepare and implement a comprehensive Year 2000 strategy that provides for legacy systems
which might be required to continue in use beyond the Year 2000.

Office of Finance

© Establish realistic performance measures for key finance processes and establish realistic
milestones and targeted completion dates for financial systems projects and process
implementations, and track actual performance and accomplishments accordingly.

+ Track and repor qualitative outcomes (efficiencies und effectiveness) of key performance
indicators for financial operations

© Provide the CHO with sufficient detailed information in order to make informed management
decisions regarding Finance operations

‘+ Expedite the re-submission of Finance's reorganization package including sufficient details
in support of the proposed reorganization.

ofice oT Tnapactor Generar Bagew
US. House of Representatives


14

plan will be completed shortly, However, once again the devil will be in the
implementation details.

These two IG reports indicate that we are behind the curve in addressing the Y2K
problem. If we intend to take a leadership role, we must lead by example and get our
own House in order. Many of the criticisms leveled at the Administration are same
failings of House efforts. I hope that we will spend as much time critically evaluating
our own strategies to fix House computer systems as we have been of the
Administration’s efforts.

The Year 2000 computer problem is not a Republican versus Democratic issue. It is not
an Administration versus the Congress issue. The Y2K issue is a technical problem,
which unless it is fixed in both the Executive and Legislative Branches will seriously
compromise the Government's ability to serve the people who elect us to office and
who pay their taxes.


158

Each fiscal year, FMS issues over 850 million payments, with a dollar value of more than
$1 trillion. We issue these payments on behalf of civilian agencies such as the Social Security
Administration, the Department of Veterans Affairs, and the Internal Revenue Service. Our
payment services touch the lives of over 100 million people, and literally tens of millions of
‘Americans depend on FMS systems to meet lifeline needs every month. FMS also provides debt
collection services and manages the processing of roughly $1.4 trillion in Federal revenues, which
include corporate and individual income taxes, customs duties, and Federal fines. And, FMS
maintains the central accounting and reporting systems that track the government's monetary
assets and liabilities, 7,500 separate Congressionally enacted accounts in all. Making sure our
systems are year 2000 compliant is absolutely essential to our operations and the integrity of our
systems for paying, collecting and accounting for money government wide. Obviously, all Federal
agencies are counting on FMS to ready its systems in order to meet the basic financial needs of
our constituents and the Federal government as a whole.

FMS is dependent on automated systems to make payments and collections. In
order that these, as well as our other important functions, are not interrupted, we must make
certain that our automated systems are modified to run in the year 2000. To make the necessary
modifications for the century date change requires a massive, all out effort that touches every part
of FMS. Here is a brief summary of our actions thus far:

* We have carefully identified and assessed our mission critical systems.

* Weare well underway with making the changes to our software code to have our
‘systems in compliance.

. Implementation of Y2K compliant pdyment and collection systems are scheduled
for completion by the end of 1998.


oT

planning." The Chief Information Officer Councit worked with us in developing this
guide and intends to adopt it for federal agency use.

Independent Verification of Progress Needed

OMB's assessment of the current status of federal Year 2000 progress has been
predominantly based on agency reports that have not been consistently verified or
independently reviewed. Without such independent reviews, OMB and others, such as
the President's Council on Year 2000 Conversion, have no assurance that they are
receiving accurate information. OMB has acknowledged the need for independent
verification and asked agencies to report on such activities in their February 1998
quarterly reports. While this has helped provide assurance that some verification is
taking place through internal checks, reviews by Inspectors General, or contractors, the
full scope of verification activities required by OMB has not been articulated.

It is important that the executive branch set standards for the types of reviews that are
needed to provide assurance regarding the agencies’ Year 2000 actions. Such standards
could encompass independent assessments of (1) whether the agency has developed and
is implementing a comprehensive and effective Year 2000 prox um; \2) the accuracy and
completeness of the agency's quarterly report to OMB, including verification of the status
of systems reported as compliant; (3) whether the agency has a reasonable and
comprehensive testing approach; and (4) the completeness and reasonableness of the
agency’s business continuity and contingency planning.

bilit ve

The Chief Information Officers Council's Subcommittee on the Year 2000 has been useful
in addressing governmentwide issues. For example, the Year 2000 Subcommittee
worked with the Federal Acquisition Regulation Council and industry to develop a rule
that (1) establishes a single definition of Year 2000 compliance in executive branch
procurement and (2) generally requires agencies to acquire only Year-2000 compliant
products and services or products and services that can be made Year 2000 compliant.
The subcommittee has also established subgroups on (1) best practices, (2) state issues
and data exchanges, (3) industry issues, (4) telecommunications, (5) buildings, (6)
biomedical and laboratory equipment, (7) General Services Administration support and
commercial off-the-shelf products, and (8) international issues.

The subcommittee’s effectiveness could be further enhanced. For example, currently

agencies are not required to participate in the Year 2000 subcommittee. Without such
full participation, it is less likely that appropriate governmentwide solutions can be

a i

2000. se Busi ity a
(GAO/AIMD-10.1.19, Exposure Draft, March 1998).
9


19

missile systems may be rendered useless. Power could be interrupted in
the middle of winter. Telephones may go dead. Clearly, the potential
consequences are far-reaching and dramatic.

| thank the Chairman and all the witnesses here today for their hard
work on the Year 2000 conversion. | look forward to a productive working
relationship.


48

project leader indicated that he does not plan to issue standard contract language or procurement
guidance because most of the vendors will be compliant by the Year 2000. Without incorporating
standard warranty language in vendor contracts, the House is unnecessarily exposing itself to the
costs of premature software replacements and potential Year 2000 compliance upgrades.
Warranty language would place the burden on vendors to make their products Year 2000
compliant, and would protect the House with its interim hardware and software purchases.
Subsequent discussions with other HIR officials indicated that any contracts they let will contain a
modified version of the General Services Administration standard contract language. However,
we were told that the House's version of the language is not ready for incorporation into House
contracts to date because it is undergoing review by OPP and legal counsel. Nevertheless, we
recommend that the House establish procedures requiring incorporation of Year 2000 language
into the boilerplate section of all procurements relating to information technology purchases as
soon as possible.

Systems In The Year 2000 Plan May Not Need To Be Converted

While the Year 2000 plan makes recommendations on individual system dispositions, HIR has not
yet determined, through a needs study or contact with users, whether all systems are necessary or
‘on which platforms they will ultimately reside. These individual systems are classified in the Year
2000 plan in priority Groups 2 and 3, and include such systems as Lobby, Photography, and
Studio Billings. For instance, several Year 2000 plan recommendations involving individual
systems include the annotation “replace, for instance, with Foxpro” however, other alternatives
need to be considered such as Program Office Desktop. Other, smaller House systems are
identified as “outsourcing candidates,” but this option needs further clarification, Thus, formal
studies need to be conducted immediately to assess the disposition of these systems and the true
scope of the initiative. Since our initial inquiries, we were told that the {ntegration Group initiated
a needs survey for those systems listed in the Year 2000 plan under MIN migration. This effort
needs to be expanded to the other systems listed in the Year 2000 plan as well. Also, the Year
2000 plan assigns completion dates for many of these systems in late 1999. HIR should determine
whether these time-frames can be shortened through increased resources or re-prioritization to
make sure these systems are compliant by the Year 2000.

So! tailed Implementation Plan Are Needed

Because HIR had not ensured adequate funding, it could not take advantage of any of the Year
2000 software tools to help assist them in the LIMS date expansion effort. LIMS has
approximately 766,000" lines of code which need to be examined in order to change affected date
fields, and HIR is handling the process manually. In our view, manually examining the code, line-
by-line, will result in more errors or omissions involving date changes and date interdependencies
than would result in an automated review, aided by software tools, that would require a fraction
of the time to complete. Although there are no fool-proof automated solutions, the software
tools available are set up to identify as much as 90-95 percent of the dates in a system and to help
track their flow as they are passed from field to field. In addition, software tools should provide

'® A March 1997 contractor report stated LIMS contains 766.155 lines of code; HIR officials told us LIMS
thas approximately 600,000 lines of code, and the Year 2000 plan states 504,000 lines of code for LIMS.


93

substantially Year 2000 compliant on January 1, 2000, flights would not get off the
ground and that extended delays would be an economic disaster.

. Another risk associated with the transportation sector was described by the
Federal Highway Administration, which stated that highway safety could be
severely compromised because of potential Year 2000 problems in operational
transportation systems. For example, date-dependent signal timing patterns could
be incorrectly implemented at highway intersections if traffic signal systems run
by state and local governments do not process four-digit years correctly.

. One risk associated with the utility sector is the potential loss of electrical power.
For example, Nuclear Regulatory Commission staff believe that safety-related safe
shutdown systems will function but that a worst-case scenario could occur in
which Year 2000 failures in several nonsafety-related systems could cause a plant
to shut down, resulting in the loss of off-site power and complications in tracking
post-shutdown plant status and recovery.

® With respect to the health, safety, and emergency services sector, according to the
Department of Health and Human Services, the Year 2000 issue holds serious
implications for the nation's health care providers and researchers. Medical
devices and scientific laboratory equipment may experience problems beginning
January 1, 2000, if the computer systems, software applications, or embedded
chips used in these devices contain two-digit fields for year representation. In
addition, according to the Gartner Group, health care is substantially behind other
industries in Year 2000 compliance, and it predicts that at least 10 percent of
mission-critical systems in this industry will fail because of noncompliance.”

One of the largest, and largely unknown, risks relates to the global nature of the
problem. With the advent of electronic communication and international commerce, the
United States and the rest of the world have become critically dependent on computers.
However, there are indications of Year 2000 readiness problems in the international
arena. In September 1997, the Gartner Group surveyed 2,400 companies in 17 countries
and concluded that "[t]hirty percent of all companies have not started dealing with the
year 2000 problem.”

Although there are many national and international risks related to the year 2000, our
limited review of these key sectors found a number of private-sector organizations that
have raised awareness and provided advice. For example:

"Healthcare Is Ear Behi ar 2 ance (Gartner Group, Document #1GG-
020498-02, February 4, 1998).
“Year 2000-World Status (Gartner Group, Document number M-100-037, November 25,

1997).
5


31

‘The House’s primary purpose for leasing computer resources is to supplement costs by maximizing excess
capacity, not to provide computer services for outside clients. However, using FY92 as the baseline as
noted in Figure 3, the benefit of the revenue

generated by the House mainframe system has steadily declined from a high of $12.7 million to a projected
revenue of $2.8 million in FY98. This declining

revenue is in stark contrast to the increasing unused Yauseg Group
processing capacity of 65.7 percent’. Figure 4 on Capacity 5%

page 9 shows costs and revenues for continuing the ey

support of the mainframe. These numbers were

obtained

from the CAOs proposed FY98 budget and System

costs/revenue estimates that were supplied by HIR Support
officials. They show that the continued use of the Overman

‘mainframe will have an estimated annual cost of
$4.9 million for FY98. The downsizing of the
mainframe processor to the current CMOS
processor (with its associated system software), as
well as the replacement of the direct access storage Figure 2 - Mainframe Processing Usage After
devices with new RAID (Redundant Array Of Completion Of The Year 2000 Project
Inexpensive Disks)

steg 127 2

3120
$10.0
$8.0
36.0
$49

$2.0
FY 92 FY83 FY 94 FY95 FY 96 FYS7 FY 98

Figure 3 - Mainframe Revenues” ($000,000) for FY92 thru FY98

technology, has resulted in an estimated overall decrease in system support costs of $516,000 (see total
support costs in Figure 2). Therefore, the projected net expense for continuing the support of the mainframe
and the remaining systems for FY98 will be approximately S2.1 million.

* I should be noted that the total capacity of the HIR CMOS processor is based on the current
1997 configuration of 77 MIPS (million instructions per second). HIR has anticipated that the furure
configuration of the CMOS processor will allow for a decrease in total MIPS, thereby lessening support
costs.

"© Source: Legislative Branch Appropriations for 1995, Hearings Before a Subcommittee of the
Committee on Appropriations, House of Representatives; H.1.S. Funding History FY92 thru FY95;
Enterprise Computer Group. estimated revenues for FY96 thr FY98.


166

Mr. Sessions. Thank you, Ms. Craig.

Tm going to extend my conversation to you first, please, because
we heard Mr. Koskinen earlier today say, and I will paraphrase,
something like: You really don’t know what’s going to happen until
the 1st of the year comes and the first checks go out. But I have
heard you rather clearly today enunciate that you are going to have
a period of time where you not only have a burn-in, but you’ve done
a total audit of what you’ve done. It sounds like to me that you are
being responsible, and you can accurately predict your compliance
well before that date.

Tm not asking you at all to disagree with any testimony that’s
been given today, but rather it seems like that you've got, in
to your system, a good handle to comply with the questions that
have been asked, certainly from Mrs. Maloney and others today. Do
you feel like you’ve got a good handle and things are going to go
right?

Ms. CraiG. I do. I don’t want to minimize the complexity. It is
a big challenge. But I do think we have a handle on what needs
to happen. We work very closely with the Federal Reserve System
as well, and I believe they announced earlier this month that their
systems are already Y2K compliant. So we will be testing with

em, as well as with the Federal program agencies, to make sure
that all these payment systems work correctly.

Mr Flysike onoe ag h d any of the
ir. Flyzik, once again with great respect to you and any of
testimony that’s been given today, also with regard to your wantin;

to be very judicious among the conversations that you've had wi
Secretary Rubin, how do you characterize putting into context that
we on this committee, at least the majority side of the committee,
have attempted to stay up with the Government and we have
issued report cards that, by and large, have not been favorable?
How do on respond to the Secretary? Because I’ve heard you say
today: We're ready to go; we are on target; we are doing those
things that are necessary, and we're on t: t to do that.

How do you justify asking or Secretary Rubin saying, what are
those Congressman trying to do to us? In other words, said another
way, are we crazy?

Mr. FLyzik. No, sir, not at all.

Mr. SESSIONS. Do you think we're fair?

Mr. FLyzik. In characterizing my conversations with the Sec-
retary, I think we show appreciation for the work being done here
by the committee and the subcommittees because you have done a
remarkable job with the awareness issue and keeping the pressure
on us to keep the priorities up. You’ve made it easier for me to go
to Secretary Rubin and talk to him about the importance of this
project and have Secretary Rubin himself become deeply engaged
in the project.

In my last four or five meetings with him, I think we were sched-
uled to meet for about 15 minutes, and I believe they all ran well
over a half-hour, some even longer, as we've gotten into details.

Mr. SEssIons. He should be commended for that, by the way.

Mr. Fiyzik. Thank you, sir.

Mr. SESSIONS. I think that’s admirable of the Secretary.

Mr. FLyzIK. Thank you, sir.


131

work, we have been evaluating the Department’s compliance with
the year 2000 provisions of the Federal Financial Management Im-
provement Act, the Brown Bill. We found that the Department is
meeting OMB’s quarterly reporting requirements, and that those
quarterly reports show that the Department as a whole is meeting
on these milestones.

While encouraging, these results must be qualified in two re-
spects. First, our results are based primarily on the quarterly sta-
tus reports that have been provided to OMB. We have not per-
formed extensive tests to verify the accuracy and completeness of
those reports. Second, the milestone dates that have been met so
far, are not the real meat of the year 2K conversion process. They
cover what GAO defines in their Assessment Guide, as the aware-
ness and assessment phases. Completion of the next three phases—
renovation, validation, and implementation—will be crucial in mak-
ing a successful conversion.

In our phase of review we did identify two areas of concern that
the Department is already working to address. The first is the need
for a standard year 2000 certification process. The second is the
need for more complete and descriptive year 2000 contingency
plans to ensure the continuity of Treasury’s core business processes
in the event of a year 2000-induced failure.

In our phase II audit, which is starting this month, we will sub-
stantially increase our audit effort. We will look behind the infor-
mation in the  uarterly status reports to verify the progress being
reported to OMB. More importantly, we will examine the next two
phases in the process; renovation and validation.

Our audit work will focus in three main areas; management
oversight both at the Department and the Bureaus; the certifi-
cation process; and contingency planning. We plan to report defi-
ciencies as they are identified. Our goal is to alert the Department
to any significant vulnerabilities that they need to quickly address
to reduce the risk of a year 2K failure.

Based on the results of this work, we'll determine the scope of
additional audit work for the remainder of 1998, and well into
1999. We as well as the Department and the Bureaus have a great
deal of work ahead of us. One of our challenges will be to find a
way within our existing resources to give adequate coverage to this
area. We will have some help in this regard, especially at IRS.

The IRS Chief Inspector’s Office has an extensive audit effort un-
derway at IRS. They recently issued a final report on IRS’ project
planning and project methodology and made several recommenda-
tions for improvement. They have nine additional audits that are
either ongoing or planned to cover the various pieces of the IRS
Y2K conversion effort. Also, the Department’s contractors are pro-
viding management support and year 2000 vulnerability assess-
ments.

Finally, we are aware that GAO will be conducting reviews of
Y2K conversion in the Department of the Treasury. We are coordi-
nating with both GAO and the IRS Chief Inspector’s Office to avoid
duplication and to leverage our resources.

ong the three audit groups, we hope to give audit coverage to
most, if not all, of the Treasury critical operations.


15

Mr. KucinicH. Thank you very much, Chairman Horn, and as
the ranking member of this subcommittee, it’s a pleasure to join
with you on this issue. I think that it’s obvious that we have a
practical problem here that needs to be fixed, and if any committee
and any subcommittee can help, it’s this one under the leadership
of the very able Chairman Horn. Certainly, the subtext of this de-
bate is the role of technology in society and government, and I also
wonder as I am reading the testimony and following the evolution
of this problem if it doesn’t raise questions about a crisis in linear

inking.

We have a challenge of a paradigm shift in the new millennium
and it’s certainly going to for new thinking as well as an eval-
uation of the role that technology has played in the evolution of our
information age. Meeting the challenges presented by the year
2000 conversion will require the commitment of significant _re-
sources from both the public and private sectors. The Federal Gov-
ernment, in Particular, must take a leadership role. It’s not enough
that the Federal Government fix its own systems, the Government
must also facilitate private sector conversion.

And I commend, once again, Chairman Horn’s leadership on the
year 2000 conversions. Oversight by this subcommittee has served
to increase public awareness of potential problems facing the Fed-
eral Government. Moreover, the GAO has provided invaluable as-
sistance on the Federal year 2000 conversion, and I want to thank
the GAO for its role in that regard.

The President’s recent decision to establish the Council on the
Year 2000 Conversion is a much needed step, and I agree with
Congresswoman Morella’s views on that. This council can provide
high level guidance for executive branch agencies. It will also be
able to develop national policies to assure coordination with other
governments and private sector entities. It will serve as the Fed-
eral liaison to the international community.

Converting all the Federal computer systems requires the atten-
tion and dedication of senior level management within each agency.
Federal agencies currently are addressing the technology changes
that must be made to their systems to minimize disruption by the
century change. However, it appears from the information I’ve re-
ceived, Mr. Chairman, that they’re not all working quickly enough
to complete their tasks by the year 2000. Many agencies have only
just begun to identify noninformation technology systems such as
building security, telecommunications, heating, transportation sys-
tems that present conversion problems. Now, computer chips em-
bedded in personal computers, printers, phones, vehicles, weapons
systems, laboratory equipment, or other machinery must be located
and modified if they’re noncompliant.

Some of the most significant issues involve the ability of the Gov-
ernment to prioritize its systems so that mission-critical systems
will not suffer undue disruptions. Agencies should consider the
need for independent verification and validation of their systems
and assure efficient time for end-to-end system testing. Coordinat-
ing data exchanges with other public and private entities, and as-
suring seamless transitions across agency jurisdictions will be a
Governmentwide challenge. Retaining qualified year 2000 staff ca-
pable of converting systems at each agency is going to be essential,


APPENDIX
Page 4 of 6

CAO Response to Year 2000 Audit
Page 4

September 9, 1997

CAO Response: Concur

The Year 2000 Plan recommends a disposition for the systems in use at the House. The CHO
has provided guidance on LIMS, payroll and OSM Asset Management systems. CHO is in the
process of reviewing the remaining recommendations and will advise HIR on how to proceed.
Final decisions on most of these applications should be made over the next 6-8 months with
guidance and coordination from the Technology Coordination Task Force. For replacements of
retired systems, the necessary analysis will be completed to determine the system that best meets
requirements. Subsequent verstons of the Year 2000 plan will document these decisions.

(g) Attend the CIO Council Subcommittee on Year 2000, 28 appropriate.

CAO Response: Concur

The CAO will involve both management and staff in Year 2000 groups. The CIO Council bas
been contacted, and we will begin participating in their activities.

2, Revise and prepare follow-on document(s) to the Year 2000 plan which inchde the
following activities.

(a) Prepare a schedule of Year 2000 tasks (e.g, PERT chart concept) showing milestones
and interdependencies of issues/organizations.

CAO Response: Concur

‘The Year 2000 plan will be expanded to include additional levels of detail. Milestones,
dependencies, and issues will be documented. Appropriate charts will be prepared to illustrate
project resources, milestones, dependencies, and overall sequence.

(b) As necessary, re-prioritize and accelerate out-year projects in the Year 2000 plan to
meet remaining government milestones.

CAO Response: Concur
The Task Force will continue to monitor the Year 2000 project and make any necessary
adjustments. Those applications that are mission critical to the entire House will continue to
receive the highest priority.

(©) Develop detailed implementation plans for each system to be converted.


128

An example might be the IRS. There might be other examples.
But do you think they’re looking inwardly and bringing those sug-
gestions forward through to you? And is that part of the informa-
tion process that the President and the Vice President would want
and expect from their agency heads?

Mr. KOSKINEN. Again, as I said, in my prior incarnation at OMB
one of the things we tried to get agencies to do as they addressed
this problem was to look at all of their systems, develop an inven-
tory, and figure out which systems they didn’t need anymore, and
which systems weren’t worth trying to fix, but should be replaced.
And I think a lot of that has gone on, and about 20 percent of the
systems will be——

Mr. SESSIONS. I’m talking about process.

Mr. KOSKINEN. But the reason you make a judgment that the

stem isn’t necessary is because either the process changed or
should change. You should consolidate operations. Instead of hav-
ing eight systems, you may only need one or two.

And some of that has gone on. That’s an ongoing management
process. At this stage, I think the critical issue the agencies are
dealing with is the one Mr. Dodaro and I talked about. That is
many of them are in the process of changing their processes and
modernizing. In the middle of all that, they're going to cross the
year 2000 goal line, and the complicated judgment they have to
make is whether they then have to defer otherwise important, or
even critical, modernization efforts to ensure they can in fact be op-
erating.

The agencies I’ve met with are focused on that issue. To the ex-
tent that it requires them to adjust timelines, I am_encouragin;
them to do that, they need to do that, and I think Congress wil
be supportive. If it means the system will not be implemented
when originally scheduled or may cost more because of the delay,
I think we need to be open to those presentations.

Mr. SESSIONS. Good. And I hope that the agencies really do look
inward to make sure that there’s something that they feel like they
need to change that would allow them to become compliant and op-
erate better, that they would know that they could come to Con-
gress, speak with us about it, and have us work together.

There was a lot of discussion today about the type of people that
we're hiring, and the marketplace, and some about these contracts.

Can you please talk with me about the liability factor of some of
these contractors; what is their liability in the performance of their
duties to ensure that the Government will be prepared to operate?

Mr. KOSKINEN. Actually I am not a practicing lawyer in that
area, so |——

Mr. SEssIons. That makes two of us.

Mr. KOSKINEN. That’s right. So I can’t give you a judgment about
their liabilities for past performance or their efforts now. I do know
that as we go forward, it’s important for us to get the best work
we can out of the private sector, without deterring them from being
able to provide that work. But as I say, I don’t have any knowledge
really about what the liability factors are.

Mr. SEssIONs. Well, I would like to have you look at that, be-
cause what they are doing is providing—just like if you ask some-
one to build an airplane and to deliver it, we are asking these peo-


112

which have either been lost, but the thing works, and so forth.
What’s your solution for all of that? Does it mean a lot of con-
tracted work rather than just bringing people back?

Mr. HARDEN. Well, I’m not sure that there is an adequate solu-
tion to a problem that’s that massive. Bringing COBOL program-
mers out of retirement is one thing. There’s a lot of effort underway
now to train newer programmers with crash courses in COBOL,
but I’m not sure how many Government agencies or how many pri-
vate sector companies would turn over their code to programmers
who had a 90-day course in COBOL. There is one good thing you
could say about the year 2000 problem and that is that it has de-
creased the rate of unemployment in India. We see a lot of that.
We're sending programming offshore to countries like that, but of
course that’s not an option for this Government, and it certainly is
not an option for a lot of other companies in the private sector to
send their code offshore.

The only real way to lick this problem as it is today is to start
a massive effort now, because as each day goes by, and as I said
earlier, as that timeframe is compressed, it becomes harder and
harder to find the resources. That in turn drives up the price and
you have sort of a catch 22. What you pay today for an hour to fix
COBOL code, you may pay four times next year to fix that same
code. So the real solution is to start now and do as much as you
can before that contention really takes over.

Mr. Horn. I thank the gentleman. And now I’m going to yield
back my time and yield what’s left of that 5 minutes to give Mrs.
Morella a start and then she can get her own 5 minutes later.

Mrs. MorRELLA. Oh, that’s very good. Thank you, I appreciate it.

I very much valued hearing what all of you said. It was really
very much like Robert Frost said when he defined a poem: “It tells
me something I didn’t know I knew.” And of course, we’ve known.
what you’ve said since we've been working on it for 2 years, but
to hear it said in terms of the cost escalating. I always thought the
Gartner Report cost was inflated, but boy, when you say $1 trillion
beyond what Gartner had suggested worldwide, it is shocking. The
personnel problem, and you're right, and the offshore labor re-
sponse that we're getting.

I want to thank GAO. We do rely on re very heavily in terms
of the kinds of assessment you do, and I think that your sheet, in
terms of outlining how agencies can further put together their re-
port internally with regard to priorities and contingency plans, ade-
quate resources, et cetera, is great

Mr. Koskinen, in hearing all this, and you know it all, have you
been vested with enough authority to be able to handle labor, costs,
the reporting, and Chairman Horn mentioned whether or not you
thougt it that one would be more appropriate, you know, every
month, or even a weekly kind of report. I wonder about what kind
of authority you’ve been fixes. Can you issue an Executive order?
Can you hire and fire and can you do all of the things that are nec-
essary? Or do you have that sense of: I’m not sure I’ve got enough,
T'll wait and see, and report back?

Mr. KOSKINEN. I’m satisfied I have the necessary authority and
visibility because I think ultimately the question is not whether I’m
going to walk through the Government hiring and firing people, the


114

ful I am in increasing awareness around the world, the more ag-
gravated this scrambling for resources will be.

So we have focused the agencies on that issue, but at this point,
at this s' , no agency has said their problem is an inability to
find enough workers. There are some unique areas. The FAA code
in their Host system, the micro-code, is known only by a handful
of people. But beyond that, I think that we don’t have that issue
yet, ‘although it will not surprise me at all as we go forward that
that’s going to be one of the focal points for our activities.

Mrs. MORELLA. I mean, when you consider that from the begin-
ning, I think I remember, it was $2.3 billion it was going to cost,
and: then it was 3 point something, and then it was 3.8, and now,
I think, in the supplemental, you're ing for 4.7. So I mean,
where do we go from here? And is this—I think it was Mr. Harden
in his testimony—is this going to take away from some of those
other vital information technologies?

Mr. KOSKINEN. That’s a different and important point. Because
of the finite number of people within agencies doing this work, both
for budgetary but certainly for personnel issues, as you devote peo-
ple to—and companies have the same problem—as you devote your
resources to solving the Y2K problem, by definition, those resources
are not available for other advancements. So one of the costs to the
economy generally is that this is, in many ways, a nonproductive
exercise. You are trying to protect your ability to stay in business.

We had encouraged agencies 2 years ago to view this as an op-

rtunity first, not only to inventory their systems, but to make a
hard judgment about whether systems were needed at all, and if
they were needed, whether the existing system was better replaced
than fixed. The numbers show that about 20 percent of Federal
systems will either be retired or replaced. So in that case, we'll at
least have an improvement in productivity. But for the other 80
percent, and in the private sector as well, is money spent primarily
to stand still and not go backward. So that that will in fact, over
time, be a nonproductive exercise, but it is critical work.

Mrs. MorELLA. You know, I want to correct what I said about
the supplemental, I think $4.7 billion is now the estimate.

Mr. KOSKINEN. Total estimate, yes.

Mrs. MORELLA. But it is not in the supplemental.

Mr. KosKINEN. It is not a supplemental. That is the agencies’ lat-
est estimate of their total costs. :

Mrs. MorELLa. So how are you going to handle that?

Mr. KOSKINEN. The $4.7 billion is presently included in their
budgets for 1998 and 1999. Those numbers have been reviewed by
the agencies in the 1999 budget process that is now moving
through the Congress. So there is not a need for additional money
beyond. The $4.7 billion is already in those budget numbers. The
question is: as we move forward, if those numbers increase——

Mrs. MoRELLA. It will go up, it will increase.

Mr. KosKINEN [continuing]. We will then have to look at where
we find the resources.

Mr. Horn. If the Congresswoman would yield back?

Mrs. MORELLA. I was 5 just going to—I yield back to——

Mr. Horn. Just to clarify the record. The administration was
asked by Mr. Kolbe’s Subcommittee on Appropriations to give us


2

what the storage capacity is; that wasn’t so then. So, somebody had
the bright idea, “Let’s use a two-digit year.” In other words, 67, not
1967, and that will add up over time, and we could put more infor-
mation in our data bank. So, we did that. They knew there would
be a problem in the year 2000, and they thought, “Well, technolo;
will solve that.” Well, technology isn’t going to solve it; hard wor!
is what’s going to solve it.

So, we've established that the problem is real and substantial.
We've raised awareness in the Federal Government and in the pri-
vate sector. We've initiated mcy quarterly pi ss reports and
the Office of Management and Budget followed that lead and has
been doing that on a quarterly basis since Dr. Raines took over as
Director. We’ve graded agency progress, thereby, stimulated in-
creased progress. We've induced the White House to act, and as I
note, that major step is forwarded today by Mr. Koskinen, former
Deputy Director for Management at OMB, and we're glad to see
him, and we're happy to welcome him here, because he is a highly
respected official of the Federal Government, and his 6-month re-
tirement was really all he needs. He’s still energized. (aughter.|

These accomplishments, however, of the subcommittee and OMB
are simply the prelude; they're necessary but not sufficient to finish
the year 2000 conversion. We begin, today, the next phase. We’ve
gone from questioning the reality of this problem to deploying thou-
sands of technical and managerial professionals. We've expanded
from looking only at mission-critical systems to considering possible
problems in data exchanges with other governments, both domesti
and foreign. We've recognized there are critical connections be-
tween public and private computer systems, and that vital infra-
structure such as the electric utilities’ power distribution could be
vulnerable to disruption.

It has been 701 days since our first 2000 hearing on April 16,
1996. There are 653 days remaining until the inevitable,
unmovable deadline. Over 50 percent of the available time has ex-
pired, but only 35 percent of the mission-critical systems are com-
pliant. We’re behind schedule in the executive branch.

It will require the cooperation of Congress, the White House, and
Federal departments and agencies to solve the problem on time.
And the key is managerial leadership. These are not just technical
problems. They are managerial leadership problems, and the ones
that have been successful have had first rate people, and we'll have
some of those here today who have been chief information officers
and really provided leadership in their agencies. We have no
choice, at this point, but to double our rate of progress. Then we
must double our rate of progress again.

As we look at the year 2000 conversion effort today, we must
constantly remind ourselves that the mission-critical systems we
talk about are but the tip of the iceberg; approximately one-eighth
of the installed base of systems. Roughly speaking, within the exec-
utive branch there are 8,000 mission-critical systems plus 60,000
second and third tier systems. In addition, there are ousands of
data exchanges with foreign, State, and local governments, as well
as businesses and citizens. There are telecommunications systems,
biomedical devices, millions of unaccounted embedded computer
chips. The Department of Defense, alone, has 600,000 embedded


91

. Federal systems used to track student loans could produce erroneous information
on loan status, such as indicating that a paid loan was in default.

. Internal Revenue Service tax systems could be unable to process returns, thereby
jeopardizing revenue collection and delaying refunds.

. The Social Security Administration process to provide benefits to disabled persons
could be disrupted if interfaces with state systems fail.

In addition, the year 2000 also could cause problems for the many facilities used by the
federal government that were built or renovated within the last 20 years that contain
embedded computer systems’ to control, monitor, or assist in operations. For example,
heating and air conditioning units could stop functioning properly and card-entry
security systems could cease to operate.

Year 2000-related problems have already been identified. For example, an automated
Defense Logistics Agency system erroneously deactivated 90,000 inventoried items as the
result of an incorrect date calculation. According to the agency, if the problem had not
been corrected (which took 400 work hours), the impact would have seriously hampered
its mission to deliver materiel in a timely manner.* In nother case the Department of
Defense's Global Command Control System, which is used to generate a common
operating picture of the battlefield for planning, executing, and managing military
operations, failed testing when the date was rolled over to the year 2000.

Our reviews of federal agency Year 2000 programs found uneven progress. Some
agencies are significantly behind schedule and are at high risk that they will not fix their
systems in time. Other agencies have made progress, although risks remain and a great
deal more work is needed. Our reports contained numerous recommendations, which
the agencies have almost universally agreed to implement. Among them were the need
to complete inventories of systems, document data exchange agreements, and develop
contingency plans.

Audit offices of some states also have identified significant Year 2000 concerns. Risks
include the potential that systems supporting benefit programs, motor vehicle records,
and criminal records (i.e., prisoner release or parole eligibility determinations) may be
adversely affected. These audit offices have made recommendations including the need
for increased oversight, Year 2000 project plans, contingency plans, and personnel
recruitment and retention strategies.

Data exchanges between the federal government and the states are also critical to
ensuring that billions of dollars of benefits payments are made to millions of recipients.

"Embedded systems are special-purpose computers built into other devices.

5 fronting DLA i i r

‘Defense Computers:
(GAO/AIMD-97-106, August 12, 197).
3


36

Ottice of the
Chief Administrative Sfficer
GSH. Bouse of Representatives
‘Washington, BE 20515-6860
MEMORANDUM
TO: John W. Lainhart, TV
Inspector General
FROM: Jay agen

Chief AdnMhistrtive Officer

DATE: wre
SUBJECT: Draft Audit Report - Inspector General Audit

‘Thank you for the opportunity to comment on your drait report, The draft audit report, "Despite CHO And
CAO Mandates. HIR Has Not Begun Development Of A Mainframe Migration Plan” has been reviewed with
consideration to the four recommendations contained therein. We appreciate the in-depth analysis provided in
the document, and are supportive of the recommendations.

Our specific cesponses to the recommendations are as follows:
Recommendations:

1. Assign a project leader with sufficient resources and appropriate authority to determine what has
been done and what still needs to be done with respect to the directive from the CHO regarding
development of a mainframe migration plan.

CAO Response: Concur.

Subsequent to the publication of this draft audit report, House Report 105-196 (Legislative Branch
Appropriations Bill for 1998) requested that the House Inspector General study this issue “to determine if the
House could be better served in the furure by either out-sourcing the operation of the mainframe computer to a
vendor or relocating the final mainframe systems to another legislative branch agency.”

We would like to collaborate with you on this study on behalf of the House community. In anticipation of our
collaboration, an HIR study group has been appointed to work with the OIG’s designated leader for the study.
The internal HIR group is made up of the following participants: Dianne Jordan (staff sponsor), Jerry Boho
CHIR project leader), Sander Zaben, Lea Fowlie, and Jim Daley.

The HIR study group will work with the designated OIG study leader to provide a comprehensive data center
inventory of all information systems hardware and software, The HIR study group will work closely with, and
assist the OIG study leader with study tasks involved in estimation of costs of viable technical alternatives for
each mainframe system. The systems under consideration in the audit are:


156

implement Y2K-compliant systems for both Social Security and
supplemental sect security income payments in August.

ased on the fact that our testing will be completed at least 15
months before the e year 2000 deadline, we believe we can be con-
fident that all Social Security payments will be issued correctly and
on time by FMS when the next century begins.

We do view systems preparation for the year 2000 as our abso-
lute highest priority, and we are assigning whatever resources are
negessary to ensure we do not fail.

u for allowing me the opportunity to discuss our plans
to hank e year 2000 challenge. We recognize the importance and
enormity of rt and are working to ensure that important Govern-
ment services are not disru;

I would be happy to answer any questions you may have regard-

this issue.
ma a prepared statement of Ms. Craig follows:]


123

some of us have just learned about it recently, is fairly well known
in the programming community, and that as people are going
through, as they're searching for dates, they are looking for this.

But when you get done with all that, it goes back to what Mr.
Dodaro said, it should not surprise any of us, as we go forward that
when we get to the year 2000 in some system, there turns out to
be a glitch related to that. But these issues are much smaller level
of magnitude. For example, the leap year problem in the year 2000
sounds exotic, but when you get at it, turns out to be a less severe
problem.

But again, people have known about it and I think we need to
continue to advise them to check for it.

Mr. SUNUNU. I think I just have a minute or so left.

Td like each of you to identify for me, or for the joint committee
here, what specific system, domestic or international, public or pri-
vate, concerns you the most in terms of the potential impact and
the risk of noncompliance, or a class of systems?

And obviously I’m asking for a guess. We're a year and a half
away from the problem date, but I think it’s helpful to us to have
a sense of where the real weaknesses lie; not just domestically, but
internationally as well.

Mr. KOSKINEN. I slump a little, only because there are a number,
a wide range of very critical systems, and I’m not sure it’s very
functional to say, well I’m really concerned only about that one, be-
cause if the IRS or Social Security doesn’t function, that’s a big
problem, even if we’ve got the FAA out——

Mr. SUNUNU. I didn’t use the word “only.”

Mr. KosKINEN. I’m satisfied that the OMB tier I process has
identified the agencies in which we have concerns about the level
of progress in those agencies. But not every critical system is in a
tier I agency.

The Treasury Department—for instance, we have a reasonable
level of confidence in terms of their state of progress, although they
have very high risk systems.

I think my concern is—and a concern you all have had for some
time—is that we are spending a lot of very appropriate time focus-
ing on internal agency systems. But if the Federal systems function
perfectly and there are major failures outside the Federal Govern-
ment, the public will still have a significant problem.

So I think the challenge for us in many ways is not a specific sys-
tem, the challenge for us is whether we have all of the appropriate
organizations and institutions around the world addressing this im-
portant issue, dealing with it.

Mr. Doparo. Basically, your question goes to one of the rec-
ommendations that we’ve advanced to the Council, which is to set
some governmentwide priorities for these systems. And we laid out
some criteria to use.

There are a certain set of issues associated with national defense
that are critical to so many systems. We've pointed out the prob-
lems of FAA and transportation in general. There are health and
safety issues that go to the heart of what the hospitals, health care
providers, and emergency services—I think the problem and dif-

culty in answering your question precisely is the very nature of
the problem as to the breadth and depth, and the fact that the


98

implemented. Further, while the subcommittee’s subgroups are currently working on
plans, they have not yet published these with associated milestones. It is important that
this be done and publicized quickly so that agencies can use this information in their
Year 2000 programs. It is equally important that implementation of agency activities
resulting from these plans be monitored closely and that the subgroups’ decisions be
enforced.

Another governmentwide issue that needs to be addressed is the availability of
information technology personnel. In their February 1998 quarterly reports, several
agencies reported that they or their contractors had problems obtaining and/or retaining
information technology personnel. Currently, no governmentwide strategy exists to
address recruiting and retaining information technology personnel with the appropriate
skills for Year 2000-related work. To date, the CIO Council has not addressed this issue
although it is considering asking the Office of Personnel Management to review the
possibility of obtaining waivers to rehire retired federal personnel.

SUCCESS OF THE NEW PRESIDENTIAL COUNCIL IS CRITICAL

Given the sweeping ramifications of the Year 2000 issue, other countries have set up
mechanisms to solve the Year 2000 problem on a nationwide basis. Several countries,
such as the United Kingdom, Canada, and Australia, have appointed central
organizations to coordinate and oversee their governments’ responses to the Year 2000
crisis. In the case of the United Kingdom, for example, a ministerial group is being
established, under the leadership of the President of the Board of Trade, to tackle the
Year 2000 problem across the public and private sectors.

These countries have also established public/private forums to address the Year 2000
problem. For example, in September 1997, Canada's Minister of Industry established a
government/industry Year 2000 task force of representatives from banking, insurance,
transportation, manufacturing, telecommunications, information technology, small and
medium-sized businesses, agriculture, and the retai] and service sectors. The Canadian
Chief Information Officer is an ex-officio member of the task force. It has been charged
with providing (1) an assessment of the nature and scope of the Year 2000 problem, (2)
the state of industry preparedness, and (3) leadership and advice on how risks could be
reduced. This task force issued a report in February 1998 with 18 recommendations that
are intended to promote public/private-sector cooperation and prompt remedial action.

In the United States, the President's recent executive order could serve as the linchpin
that bridges the nation’s and the federal government's various Year 2000 initiatives.
While the Year 2000 problem could have serious consequences, there is no
comprehensive picture of the nation’s readiness. As one of its first tasks, the President's
Council on Year 2000 Conversion could formulate such a comprehensive picture in
partnership with the private sector and state and local governments.

10


39

HOUSE NEEDS TO REFOCUS ITS EFFORTS
TO MEET THE YEAR 2000 DEADLINE

I. INTRODUCTION

The Year 2000 date change is one of the most significant changes ever faced by the Information
Technology industry. It will have an enormous impact on business applications, package
solutions, and system software, potentially even putting some companies out of business. The
date change has the potential to cripple an organization's ability to execute its critical business
functions. It impacts everything from payroll and pension calculations to budgeting to electronic
data transfer. Failures can include programs ending abnormally, or worse, returning incorrect
results. Even applications that do not use dates are at risk, as they may depend on others that do.
Itis estimated that companies in the United States will spend billions of dollars addressing the
software changes required by the coming millennium. What makes this problem so daunting is its
magnitude, not its technical complexity. The biggest challenges to be faced by the House of
Representatives (House) are keeping tight project control of the effort and securing active House-
wide participation. The Year 2000 initiative has a deadline that cannot be extended.

House Information Resources’ (HIR) April 1997 Year 2000 plan represents the House's first,
formal attempt to present an organized response to a problem facing the rest of the Federal
government and private sector entities that depend on computers to sustain their operations. The
information presented in this report will show that, while the House is addressing this issue
head-on, itis ill-prepared to handle the problems that have been identified. The House is not
prepared to implement its Year 2000 initiative from the project management, planning, budgeting,
resources, and priorities perspective that would ensure success in this time-critical endeavor.

Background

‘The cause of the Year 2000 problem is relatively simple, Until very recently, computer storage
was at a premium, so programmers were encouraged to save space and eliminate redundant data
wherever possible. Date information was a prime candidate for space reduction because a date
such as January 31, 1997 could be represented by six numbers: 970131. However, the continued
use of the current two-digit year representation will cause many basic functions of computer
systems to fail in the Year 2000. For example, an automated pension program may calculate a
person's retirement by subtracting the birth year from the retirement year (i.e., 1997 minus 1942,
equals 55 years). However, the computer actually subtracts 42 from 97 to get $3. But in the year
2000, the same 2-digit computer calculated retirement age will be 00 minus 42 which equals a’
negative 42--the computer does not ‘know’ that “00” represents “2000.” Vast amounts of stored
data and program instructions are still in this old format. No one commissioning or writing code
in the 1970's and 1980's thought their systems would survive into the 21* century, yet they are
still in use in many organizations today, including the House.

If corrective actions are not taken before the Year 2000 arrives, most, if not all, of the House’s
systems, including the mission-critical ones (¢.g., Legislative Information Management System