United States General Accounting Office

GAO Testimony

Before Congressional Requesters

For Release on Delivery

Expected at

1:30 p.m.

Friday,

October 2, 1998

YEAR 2000 COMPUTING

CRISIS

The District of Columbia

Faces Tremendous

Challenges in Ensuring Vital

Services Are Not Disrupted

Statement of Jack L. Brock, Jr.

Director, Governmentwide and Defense Information

Systems

Accounting and Information Management Division

GAO/T-AIMD-99-4

Mrs. Chairwoman, Mr. Chairmen, and Members of the Subcommittees:

Thank you for inviting me to participate in today’s hearing on the District

of Columbia’s Year 2000 problem. As you know, the District of Columbia,

like other local and state governments, is extremely vulnerable to Year

2000 problems due to its widespread dependence on computer systems to

deliver vital public services and carry out its operations. If the problems

are not addressed in time, systems supporting important functions such as

public safety, revenue collection, traffic control, payroll, and pensions may

be unable to operate. Today, I will discuss the Year 2000 risks facing the

District, its progress to date in fixing systems, and our concerns with the

District’s remediation strategy.

Until this past June, the District had made only limited progress in

addressing the Year 2000 problem. It lacked both the structure and the

resources necessary to address the issue. Since June, the pace of the

District’s Year 2000 effort has picked up considerably. The District hired a

contractor to assist in remediating systems, established a Year 2000

program management office, assigned more resources, and began a more

aggressive strategy to compensate for lost time. These actions will

substantially improve its ability to complete the difficult tasks that lay

ahead. But because the District is so far behind in addressing the problem,

the risk that critical processes could fail is greatly increased. As a result, it

is vital that the District promptly identify its most important operations,

determine which systems supporting these operations can be fixed before

the Year 2000 deadline, and ensure that business continuity and

contingency plans are developed for systems that will not be renovated on

time.

To prepare for this testimony, we evaluated the District’s efforts to

address risks associated with the Year 2000 date change and compared

these efforts to criteria detailed in our Year 2000 Assessment Guide,

1

1

Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14). Published as an exposure

draft in February 1997 and finalized in September 1997, the guide was issued to help federal agencies

prepare for the Year 2000 conversion.

Page 1 GAO/T-AIMD-99-4
Business Continuity and Contingency Planning Guide,

2

 and Testing Guide.

3

 We interviewed District officials responsible for overseeing the Year 2000

effort, including the Chief Management Officer and her deputy, the Acting

Chief Technology Officer, the Year 2000 Program Manager, the Chief

Procurement Officer, and Office of Inspector General officials. We

reviewed and analyzed the District’s request for contractor assistance in

assessing, renovating, and testing city systems. We also attended two

hearings held by the District of Columbia Council in May and July 1998 on

the status of the city’s Year 2000 efforts. Finally, we interviewed officials

from Public Technology, Inc., the International City/County Management

Association, the National Association of State Information Resources

Executives, the National Governors’ Association, and the Regional Council

of Governments to evaluate the progress of other state and local

governments. We performed our work in Washington, D.C., from March

through September 1998, in accordance with generally accepted

government auditing standards.

Year 2000 Risks

Facing the District of

Columbia

Addressing the Year 2000 problem in time will be a formidable challenge

for the District of Columbia. The District government is composed of

approximately 80 entities, responsible for carrying out a vast array of

services for a diverse group of stakeholders. These services include

municipal, state, and federal functions, such as street maintenance and

repairs, economic development and regulation, trash pick-up, water and

sewer services, educational institutions, hospital and health care, public

safety, and correctional institutions. Each of these services is susceptible

to the Year 2000 problem.

The Year 2000 problem is rooted in the way dates are recorded and

computed in automated information systems. For the past several

decades, systems have typically used two digits to represent the year, such

as “97” representing 1997, in order to conserve on electronic data storage

and reduce operating costs. With this two-digit format, however, the year

2000 is indistinguishable from 1900, or 2001 from 1901. As a result of this

2

Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD-10.1.19).

Published as an exposure draft in March 1998 and finalized in August 1998, this guide provides a

conceptual framework for helping organizations to manage the risk of potential Year 2000-induced

disruptions to their operations. It discusses the scope and challenge and offers a structured approach

for reviewing the adequacy of agency Year 2000 business continuity and contingency planning efforts.

3

Year 2000 Computing Crisis: A Testing Guide (GAO/AIMD-10.1.21, Exposure Draft, June 1998). This

guide addresses the need to plan and conduct Year 2000 tests in a structured and disciplined fashion.

The guide describes a step-by-step framework for managing and a checklist for assessing all Year 2000

testing activities, including those activities associated with computer systems or system components

(such as embedded processors) that are vendor supported.

Page 2 GAO/T-AIMD-99-4
ambiguity, system or application programs that use dates to perform

calculations, comparisons, or sorting may generate incorrect results.

The District has a widespread and complex data processing environment,

including a myriad of organizations and functions. There are four major

data centers located throughout the city, each serving divergent groups of

users, running multiple applications, and using various types of computer

platforms and systems. Most of the District’s computer systems were not

designed to recognize dates beyond 1999 and will thus need to be

remediated, retired, or replaced before 2000.

To complicate matters, each District agency must also consider computer

systems belonging to other city agencies, other governments, and private

sector contractors that interface with their systems. For example, the

Social Security Administration exchanges data files with the District to

determine the eligibility of disabled persons for disability benefits. Even

more important, the District houses the most critical elements of the

federal government. The ability of the District to perform critical

government services after the century date change is not only essential to

District residents but also important to the continuity of operations of the

executive, congressional, and judicial offices housed here.

In addition, the Year 2000 could cause problems for the many facilities

used by the District of Columbia that were built or renovated within the

last 20 years and contain embedded computer systems to control, monitor,

or assist in operations. For example, water and sewer systems, building

security systems, elevators, telecommunications systems, and air

conditioning and heating equipment could malfunction or cease to

operate.

The District cannot afford to neglect any of these issues. If it does, the

impact of Year 2000 failures could potentially be disruptive to vital city

operations and harmful to the local economy. For example:

• Critical service agencies, such as the District’s fire and police departments,

may be unable to provide adequate and prompt responses to emergencies

due to malfunctions or failures of computer reliant equipment and

communications systems.

Page 3 GAO/T-AIMD-99-4
• The city’s unemployment insurance benefit system may be unable to

accurately process benefit checks as early as January 4, 1999.4

• The city’s tax and business systems may not be able to effectively process

tax bills, licenses, and building permits. Such problems could hamper local

businesses as well as revenue collection.

• Payroll and retirement systems may be unable to accurately calculate pay

and retirement checks.

• Security systems, including alarm systems, automatic door locking and

opening systems and identification systems, could operate erratically or

not all, putting people and goods at risk and disabling authorized access to

important functions.

To address these Year 2000 challenges, we issued our Year 2000

Assessment Guide to help federal agencies plan, manage, and evaluate

their efforts. This guide provides a structured approach to planning and

managing five delineated phases of an effective Year 2000 program. The

phases include (1) raising awareness of the problem, (2) assessing the

complexity and impact the problem can have on systems, (3) renovating,

or correcting, systems, (4) validating, or testing, corrections, and

(5) implementing corrected systems. We have also identified other

dimensions to solving the Year 2000 problem, such as identifying

interfaces with outside organizations specifying how data will be

exchanged in the year 2000 and beyond and developing business

continuity and contingency plans to ensure that core business functions

can continue to be performed even if systems have not been made Year

2000 compliant.

Like the District,

Other Local and State

Governments Are

Facing Formidable

Year 2000 Challenges

Based on the limited data available on the status of local and state

governments, we believe that the District’s Year 2000 status is not atypical.

For example, a survey conducted by Public Technology, Inc. and the

International City/County Management Association in the fall and winter

of 1997, found that of about 1,650 cities that acknowledged an impact from

Year 2000, nearly a quarter had not begun to address the problem.

4

Because of benefit year date calculations used in determining claimant eligibility, many state

unemployment systems are at risk of Year 2000 failures as early as January 1999. For example, if a

claim is filed January 4, 1999, it will have a benefit year ending date of January 3, 2000. If a state’s

benefits system has not been repaired, it may fail as early as January 1999 because it would not

properly recognize dates beyond 2000. Because the District had not yet procured a contractor to

remediate its unemployment system, GAO and the Department of Labor’s Inspector General recently

reported that the system was at a high risk of failing. (Year 2000 Computing Crisis: Progress Made at

Department of Labor, But Key Systems at Risk (GAO/T-AIMD-98-303, September 17, 1998)).

Page 4 GAO/T-AIMD-99-4
In addition, state governments are also reporting areas where they are

behind in fixing Year 2000 problems. For example, as we recently testified

before the Subcommittee on Government Management, Information and

Technology, House Committee on Government Reform and Oversight,5

 a

June 1998 survey conducted by the Department of Agriculture’s Food and

Nutrition Service, found that only 3 states reported that their Food Stamp

Program systems were Year 2000 compliant and only 14 states reported

that their Women, Infants, and Children program were compliant.

Moreover, four states reported that their Food Stamp Program systems

would not be compliant until the last quarter of calendar year 1999, and

five states reported a similar compliance time frame for the Women,

Infants, and Children program.

Despite Slow Start,

the District Is Acting

to Address the Year

2000 Problem

Until June 1998, the District had made very little progress in addressing

the Year 2000 problem. It had not identified all of its mission-critical

systems, established reporting mechanisms to evaluate the progress of

remediation efforts, or developed detailed plans for remediation and

testing. In addition, it lacked the basic tools necessary to move its program

forward. For example, it had not assigned a full-time executive to lead its

Year 2000 effort, established an executive council or committee to help set

priorities and mobilize its agencies, or identified management

points-of-contact in business areas.

Since this past June, the District has recognized the severity of its situation

and taken a number of actions to strengthen program management and to

develop a strategy that is designed to help the city compensate for its late

start. For example, to improve program management, the District has

hired a new chief technology officer, appointed a full-time Year 2000

program manager, established a Year 2000 program office, and continued

to use its chief technology officer council to help coordinate and prioritize

efforts.

The District also contracted with an information technology firm to assist

in completing the remediation effort. To accomplish this in the short time

remaining, the District and the contractor plan to concurrently

(1) remediate and test system applications, (2) assess and fix the

information technology (IT) infrastructure, including the data centers,

hardware, operating systems, and telecommunications equipment,

5

Year 2000 Computing Crisis: Severity of Problem Calls for Strong Leadership and Effective

Partnerships (GAO/T-AIMD-98-278, September 3, 1998).

Page 5 GAO/T-AIMD-99-4
(3) assess and correct noninformation technology assets, and (4) develop

contingency plans. So far, the District has done the following.

• Developed an inventory of information technology applications. Of the 336

applications identified, the District and its contractor determined that 84

are deemed Year 2000 compliant, 135 have already been remediated but

still need to be tested, and 117 need to be remediated and tested.

According to the District, over 9 million lines of code still need to be

remediated.

• Initiated pilot remediation and test efforts with the pension and payroll

system. The system has been converted and the conversion results are

being readied for system users to review. The District expects to complete

the pilot by December 31, 1998.

• Adopted a contingency planning methodology that it is now piloting on the

911 system, the water and sewer system, and the lottery board system. It

expects to complete the first two pilots by October 31, 1998, and the

remaining one during the first quarter of fiscal year 1999.

• Developed a strategy for remediating non-IT assets that is now being tested

on the water and sewer system. This is also expected to be done by

October 31, 1998. After this effort is completed, the District and the

contractor will begin to assess and remediate non-IT equipment at agencies

providing critical safety, health, and environmental services.

The District Is Still

Significantly Behind

in Addressing the Year

2000 Problem

The District’s recent actions reflect a commitment on the part of the city

to address the Year 2000 problem and to make up for the lack of progress.

However, the District is still significantly behind in addressing the

problem. As illustrated in the following figure, our Assessment Guide

recommends that organizations should now be testing their systems in

order to have enough time to implement them. They should also have

business continuity and contingency plans in place for mission-critical

systems to ensure the continuity of core business operations if critical

systems are not corrected in time.

By contrast, the District is still in the assessment process—more than 1

year behind our recommended timetable. For example, it has not

• identified all of its essential business functions that must continue to

operate,

• finished assessing its IT infrastructure and its non-IT assets,

• provided guidance to its agencies on testing, and

Page 6 GAO/T-AIMD-99-4
• identified resources that will be needed to complete remediation and

testing.

Figure 1: The District’s Year 2000 Status Compared to Our Recommended Year 2000 Schedule

1996 1997 1998 1999

awareness renovation

validation & implementation

where the 

District 

should be

where the 

District is

assessment

Until the District completes the assessment phase, it will not have reliable

estimates of how long it will take to renovate and test mission-critical

systems and processes and to develop business continuity and

contingency plans. The District will also be unable to provide a reliable

estimate of the costs to implement an effective Year 2000 program.

Further, the District has had some problems in completing the assessment

phase. For example, according to program office officials, three

agencies—the Court System, Superior Court, and Housing

Authority—have refused to participate in the program office’s assessment

activities. Agencies also do not consistently attend program office

meetings and do not always follow though on their assessment

commitments, such as ensuring that program office and contractor teams

have access to agency personnel and data. Program office officials

Page 7 GAO/T-AIMD-99-4
attributed these problems to the office’s limited authority and the lack of

mandatory requirements to participate in the Year 2000 program. Failure

to fully engage in the Year 2000 program can only increase the risks the

District faces in trying to ensure continuity of service in key business

process areas.

Essential Steps

Needed to Mitigate

Increased Risks

District officials acknowledge that the city is not able to provide assurance

that all critical systems will be remediated on time. We agree. Therefore,

to minimize disruptions to vital city services, it will be essential for the

District to effectively manage risks over the next 15 months.

First, because it is likely that there will not be enough time to remediate all

systems, the District must identify and prioritize its most critical

operations. This decision must collectively reside with the key

stakeholders involved in providing District services and must represent a

consensus of the key processes and their relative priority. The results of

this decision should drive remediation, testing, and business continuity

and contingency planning and should provide increased focus to the

efforts of the Year 2000 office and its contractor. To this end, we

recommend that the District, along with its current Year 2000 efforts,

identify and rank the most critical business operations and systems by

October 31, 1998. The District should use this ranking to determine by

November 30, 1998, the priority in which supporting systems will be

renovated and tested. Continuity of operations and contingency plans for

these processes and systems should also be initiated at this time if such

action is not already underway.

Second, for systems that may not complete remediation but that are still

important to city operations, managers will need to develop contingency

plans for continued operations. It is essential that such plans be developed

early to provide stakeholders as much time as possible to provide

resources, develop “workarounds,” or secure legislative or administrative

approvals as necessary to execute the plans.

Third, because of the dependencies between the District and the

surrounding local and federal government entities, the District will need to

work closely with those bodies to both identify and prepare appropriate

remedial steps and contingency plans to accommodate those

dependencies. We recommend that the District immediately develop an

outreach program to first identify its dependencies and then determine the

remediation required to minimize the risk of Year 2000 failure.

Page 8 GAO/T-AIMD-99-4
Finally, efforts to address this problem must have continued top-level

commitment from the Chief Management Officer and the department and

agency heads, the Mayor’s office, and the control board.6

 Establishing a

program office and hiring a contractor with significant expertise is a good

first step. However, the key stakeholders need to “own” the process, i.e.,

participate in critical decision-making on program direction, provide

resources and support for the program, and ensure that all District

agencies and offices fully participate in the process.

To conclude, we believe the District’s Year 2000 program needs an

absolute commitment from its leadership to make the most of the short

time remaining. By addressing the steps outlined above, the District can

better ensure a shared understanding of the key business processes that

must be remediated, a shared understanding of the risks being assumed in

establishing priorities for remediation, testing, and business continuity and

contingency planning, and a shared commitment to provide the resources

required to address those priorities.

Mrs. Chairwoman and Mr. Chairmen, this concludes my statement. I will

be happy to answer any questions you or Members of the Subcommittees

may have.

(511130)

6

The District of Columbia Financial Responsibility and Management Assistance Authority, also known

as the District of Columbia Control Board, was established in April 1995 by Public Law 104-8. The

board’s responsibilities include improving the District’s financial planning, budgeting, and revenue

forecasting as well as ensuring the most efficient and effective delivery of city services. The board is

also responsible for conducting investigations to determine the fiscal status and operational efficiency

of the District government.

Page 9 GAO/T-AIMD-99-4
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100