FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

FINAL REPORT 

AUDIT OF AGENCY

YEAR 2000 RENOVATIONS

As of 3/31/1999 

May 1999

AUDIT ASSIGNMENT 98-08
Table of Contents Final Audit Report No. 98-08 

Table of Contents 

Executive Summary ............................................................... i

Background ........................................................................ 1

Federal Milestone Dates ............................................. 1

Mission Critical Systems ............................................. 4

FEC Gains Momentum ............................................. 5

Audit Objective, Scope, Methodology ........................... 5

Statement on Management Controls .................................... 6

Audit Results ............................................................... 7

Assessing Project Risk ............................................. 8

Disclosure System Overview ............................................. 10

Presidential Funding Program ............................................. 11

FEC Needs Y2K Outreach Program .................................... 12

Financial System Overview ............................................. 13

Communications Network Not Fully Compliant .................. 14

Inconsistency in Reporting Mission Critical Systems.................. 16

FEC Needs Contingency Planning .................................... 17

FEC FAXLINE System Not Scheduled for Y2K Testing ......... 19

Independent Verification of Y2K Renovations Needed ......... 20

User Acceptance Testing Not Meeting Expectations ................... 21

Compliance with Laws and Regulations ............................ 22

Appendix A 

User Acceptance Testing Survey ............................ 24

Appendix B 

Management’s Response to Draft Report ................... 27

Appendix C 

OIG Comments on Agency Response to Draft Report ........ 33

Appendix D 

Audit Letter to Management ...................................... 35
Executive Summary Final Audit Report No. 98-08 

Executive Summary 

The Office of Inspector General initiated and completed a limited-scope audit of the

Year 2000 (Y2K) renovation project at the Federal Election Commission (FEC). We

conducted our audit to assess the reported progress of the FEC to convert and implement

Y2K repairs on its computer systems. Throughout our audit, we regularly updated the

Y2K team on project risk that we had identified during our audit fieldwork, and provided

specific recommendations to reduce the exposure to the FEC from those risks.

Milestone dates published by the U.S. Office of Management and Budget (OMB)

establish progress goals for all Federal agencies. The General Accounting Office (GAO)

developed guidelines for use by Federal agencies as a framework for achieving the OMB

progress goal of becoming Y2K compliant. We evaluated agency progress using OMB’s

milestone dates and GAO’s methodology. Based on our audit work, we conclude that the

Y2K project status as reported by the FEC is consistent with the actual progress achieved.

As explained within our audit report, for its internally developed software the FEC has

funded for independent verification of Y2K renovations through an outside vendor. We

did not validate those renovations. However, our audit does show that there are still

major issues to be resolved to fully prepare computer operations at the FEC for the new

millennium. Those issues are addressed in the Audit Results section of this report.

The FEC Shows Progress 

The FEC has been required by OMB to report twice thus far on the progress of its Y2K 

renovation project. From information contained in the first FEC Y2K report issued in 

April 1998, OMB assessed the FEC’s Y2K project this way: “Progress behind schedule. 

No contingency plan; no IV&V.” By February 1999, the FEC was reporting 100 percent 

of its mission critical software renovated and tested. However, in its 8th Quarterly 

Report released in March 1999, OMB expressed concerns similar to those it had earlier: 

“Making progress on IT systems. The agency is 100% complete in its 

mission critical software conversion. Anticipated compliance in 

October. FEC needs a business continuity and contingency plan. The 

verification and validation plan is weak. FECs payroll and personnel 

systems will be converted to National Finance Center in October 

1999.” 

Unresolved Y2K Issues 

The Y2K project team has reported repairing over 3,000 software programs consisting of 

over one million lines of programming code, bringing internally developed computer 

programs into alignment with government-wide milestone dates. Although the FEC is 

making progress, the agency’s February 1999 Y2K report to OMB indicates that neither 

contingency planning or independent verification and validation (IV&V) has yet begun. 

The report goes on to state that the agency’s computer hardware, 3rd party software, and 

i 
Executive Summary Final Audit Report No. 98-08 

supporting communications network are not yet Y2K compliant. In addition, while 

system renovation work and program testing has been completed on the agency’s most 

important computer system, other testing has yet to be conducted. 

Also, our audit work shows that the FEC has not fully achieved progress required from 

published OMB directives. For example, a documented inventory of data exchanges with 

outside parties had not been completed and communications have not been established 

with each data exchange partner on how to fix the Y2K problem. In addition, the FEC 

needs to develop a listing of all computer services contracts with outside vendors, and 

determine whether those contracts comply with Federal regulations requiring Y2K 

provisions. Furthermore, our audit results show the need for an agency-wide team effort 

to ensure that the FEC will be able to achieve total Y2K compliance in a timely manner. 

Audit Recommendations 

Our audit recommendations addressing the issues discussed above are listed individually 

beginning on the first page of the Audit Results section in this report. They are also 

contained within the body of the audit report after the detailed discussion of each 

corresponding issue. Following our audit recommendations, we have incorporated 

pertinent written comments provided by agency management. Management’s response to 

the draft audit report is included in its entirety as Appendix B. Our subsequent response 

to management’s comments is provided in Appendix C. Finally, our suggestions for 

improvement to management controls for project planning and reporting metrics has 

been forwarded to the appropriate agency officials, and included as Appendix D of this 

report. 

ii 
Background Final Audit Report No. 98-08 

Background 

Computer systems provide mission critical services for the Federal Election Commission 

(FEC). These systems enable the news media, research institutions, and the public easy 

access to information regarding funds raised and spent to influence Federal elections. In 

addition, mission critical computer systems at the FEC warehouse information necessary 

to enforce limitations and prohibitions on contributions, process data for the Presidential 

public funding program, account for government held assets, and maintain personnel and 

payroll data on employees. 

Computer systems that cannot accurately store or properly process the century field are at 

risk of failing when called upon to manipulate data with a date of January 1, 2000 or 

later. Computer systems that currently use a two digit date field (i.e. “99” for the year 

1999) will not be able to recognize “00” as the year 2000. This problem is largely the 

result of the high cost of computer memory in the 1960s and 1970s, when programmers 

adopted a space-saving two-digit programming convention to represent the year. The 

General Accounting Office (GAO) has identified the Year 2000 (Y2K) problem as a 

government-wide high risk issue because of the potential impact if Federal systems fail to 

operate properly. 

We conducted our audit to assess whether the reported project status at the FEC matched 

the agency’s actual progress in resolving its Y2K problem. By conducting our audit in 

accordance with generally accepted government auditing standards, we also evaluated 

agency compliance with applicable laws and regulations. Based on our audit work, we 

conclude that the progress reported by the FEC is consistent with actual Y2K project 

results achieved. As explained within the audit report, for its internally developed 

software the FEC has funded for independent verification of Y2K renovations through an 

outside vendor. We did not validate those renovations1. However, our audit does show 

that there are still major issues to be resolved to fully prepare computer operations at the 

FEC for the new millennium. Those issues are addressed in the Audit Results section of 

this report. Additionally, our suggestions for improvement of project management are 

being provided to the FEC in the form of a Management Letter, which is shown in this 

report as Appendix D. 

Federal Milestone Dates 

During February 1997, U.S. Office of Management and Budget (OMB) designed an 

overall Federal strategy and authorized the Chief Information Officer, or a similarly 

designated official within each of the larger Federal agencies, to direct work and follow 

industry best practices to resolve the Y2K problem. OMB required each large Federal 

1 As explained by OMB in its 8th Quarterly Report: “Validation involves multiple phases of testing, 

including a combination of testing of individual components (unit testing), testing of entire systems 

(integration or systems testing), and in some cases, testing of a string of interdependent systems (end-toend testing).” 

1
Background Final Audit Report No. 98-08 

agency to report on their progress, and also established government-wide milestone dates 

to resolve the Y2K problem, see Exhibit No. 1.2 These milestones dates provided targets 

for the completion of the majority of work in each phase of Y2K activities. In January 

1998, OMB subsequently revised and accelerated three of the milestone dates. 

Exhibit No. 1 

OMB Scheduled Milestone Dates 

Phase/Work Milestone Date Revised Date 

Awareness 12/96 Same 

Agency Strategy 

Assessment 

Inventory and Scope Completed. 3/97 Same 

System Plans and Schedules. 6/97 Same 

Renovation 12/98 9/98 

Coding Repairs to be Completed. 

Validation 1/99 1/99 

Management Sign-off. 

Implementation 11/99 3/99 

Integrated Testing Completed. 

Source: 

to be Completed. 

For Milestone Dates and Revised Dates - see Footnote No. 1. 

It was not until March 1998 that OMB established reporting requirements for smaller 

Federal agencies, like the FEC.3 OMB requested that the smaller agencies report their 

Y2K status in basically the same format as that published earlier for larger Federal 

agencies. While OMB did not require quarterly reporting from the smaller agencies, they 

were directed to report on their Y2K project once at the end of April 1998, and again on 

May 15, 1999. Subsequently, in its 7th Quarterly Report, OMB accelerated the May 1999 

reporting date to February 15, 1999. In its “8th Quarterly Report - Progress on Year 2000 

2 “Getting Federal Computers Ready for 2000,” published by OMB, dated February 6, 1997. Subsequently 

revised in OMB M-98-02, dated January 20, 1998. 

3

 “Progress Reports on Fixing Year 2000 Difficulties for Small Agencies,” OMB M-98-07, dated March 9, 

1998. 

2
Background Final Audit Report No. 98-08 

Conversion” issued on March 18, 1999, OMB established new reporting requirements 

affecting each small Federal agency not fully completed in their Y2K renovations. These 

agencies will now be required to report quarterly to OMB until their work is finished. 

Accordingly, this means that the FEC will need to submit its next Y2K progress report to 

OMB on May 15, 1999. 

Therefore, the FEC was initially required to only report twice on its Y2K renovation 

project. However, recognizing the criticality of the Y2K issue, senior management at the 

FEC choose instead to expand upon the mandatory OMB reporting requirement electing 

to publish regular Y2K quarterly reports starting with the first report issued on April 30, 

1998. Based on the information provided by the FEC in the April 1998 report, OMB 

assessed the FEC’s Y2K project as follows: “Progress behind schedule. No contingency 

plan; no IV&V.”4 Immediately following the release of each OMB quarterly report, it has 

been the practice of the U.S. House of Representative Subcommittee on Government 

Management, Information and Technology to announce its own assessment on the 

progress reported by each agency and assign grades between ‘A’ and ‘F’ based on their 

progress. After OMB’s 5th and 8th Quarterly Reports, the only reports thus far to include 

the efforts for both small and large Federal agencies, the Congressional Subcommittee 

chose not to assign grades to smaller agencies, continuing to grade only the large Federal 

agencies. 

In the March 1998 Y2K directive, OMB required small agencies to achieve progress 

corresponding to the milestone dates which had been established for the large Federal 

agencies. As can be seen in Exhibit No. 1, three of the milestone dates had already past 

prior to OMB publishing the March 1998 guidance. In that directive, OMB listed the last 

three revised milestone dates and then summarily stated, “The assessment phase should be 

complete.” Furthermore, two other milestone dates cited in OMB’s March 1998 

memorandum had already come and gone. One for an inventory of data exchanges with 

external parties; and the other, to notify each external data provider of the ramifications 

regarding the Y2K problem. 

OMB attached the February 1997 Y2K policy that it had issued earlier for the large 

Federal agencies as an appendix to the March 1998 directive for small agencies. As part 

of that policy, OMB stated that its overall strategy is predicated on three basic 

considerations, the third of which sets forth the following: 

“Given the limited amount of time, emphasis will be on mission critical 

systems. In many agencies such systems are large and complex, which means 

they will require the most time and be the most challenging to fix.” 

4

 “Progress on Year 2000 Conversion, 5th Quarterly Report, issued by OMB, as of May 15, 1998. 

3
Background Final Audit Report No. 98-08 

Mission Critical Systems 

As shown in Exhibit No. 2, the FEC is reporting sixteen computer systems as critical to 

accomplishing the agency’s mission. A mission critical system is defined as any system 

that, should it fail due to the lack of Y2K readiness, the agency will not be able to perform 

its stated mission. In addition to identifying the mission critical systems, Exhibit No. 2 

also shows the status for each system. 

In its strategic plan, the FEC describes its mission this way: “The ultimate mission of the 

FEC is to assure that the campaign finance process is open, fully disclosed and fairly 

enforced, fostering the electorate’s faith in the ultimate fairness of the nation’s political 

process.” Maintaining current and accurate data in its computerized reporting systems is 

central to the FEC achieving its mission. 

Exhibit No. 2 

Status of Mission Critical Systems 

As Reported by the Federal Election Commission 

System Renovated Tested Current Status 

Accounting Yes Yes Implemented 

Disclosure Yes Yes Implemented 

3rd Party Software No No In-Process 

Hardware(3rd Party & FEC Owned) No No In-Process 

Imaging Micro Updating Yes Yes Implemented 

Information Yes Yes Implemented 

Mailroom Yes Yes Implemented 

Matching Funds Processing Yes Yes Implemented 

OGC Tracking Yes Yes Implemented 

Open/Closed Minutes Comm. Sec. Yes Yes Implemented 

Payroll Yes Yes Implemented 

Personnel Yes Yes Implemented 

Planning & Management Yes Yes Implemented 

Press Yes Yes Implemented 

RAD Yes Yes Implemented 

Teamlinks /Lotus Notes Yes Yes Implemented 

Source: “Report on Year 2K Remediation” The Federal Election Commission, dated February 12, 

1999. 

4
Background Final Audit Report No. 98-08 

The Y2K Project at the FEC Gains Momentum 

Documentation shows that the FEC began to recognize the potential impact of the Y2K

problem on future operations, in early 1997. For instance, On March 6, 1997 in a

transmittal to the Honorable Bob Livingston, Chairman of the House Committee on

Appropriations, the FEC provided Chairman Livingston with its Automated Data

Processing Strategic Plan for Fiscal Years 1997-2002. In that same transmittal, a cover

letter signed by the Chairman of the FEC listed specific agency computerization

initiatives requiring future funding considerations. One of these initiatives was the Y2K

issue.

Additionally, during 1997 numerous electronic mail messages issued from the Staff

Director, continued to alert agency staff at the FEC of the pending Y2K problem. The

Staff Director subsequently left the FEC at the end of July 1998. Agency awareness of

the problem culminated in the formation of a Y2K project team within the Data Systems

Development Division. The team’s first initiative was to complete an agency-wide

inventory of computer software for “in-house” developed programs. This inventory was

documented in November 1997, prior to OMB’s directive to small agencies.

In December 1998, the Y2K team reported that all in-house developed programming

code for systems scheduled to be in operation after January 1, 2000, had been repaired to

recognize a four digit century structure. Many of the renovated programs had also been

partially or completely tested, and some implemented. During January 1999, the Y2K

project team began discussions with outside vendors to obtain independent verification

and validation (IV&V) of Y2K renovations.

On February 12, 1999, the FEC issued the second of two mandatory Y2K reports required

by OMB, detailing the current status of the agency’s Y2K renovation efforts. As

previously stated, the FEC is reporting 100% of its mission critical software converted

and tested. Based on the information provided by the FEC in its February 1999 report,

OMB’s 8th Quarterly Report issued during March 1999 summarized the agency’s

progress as follows:

“Making progress on IT systems. The agency is 100% complete in its 

mission critical software conversion. Anticipated compliance in October. 

FEC needs a business continuity and contingency plan. The verification 

and validation plan is weak. FECs payroll and personnel systems will be 

converted to National Finance Center in October 1999.” 

Audit Objective, Scope and Methodology 

We conducted our audit to verify the reported progress of the Y2K renovation project at 

the FEC, and to evaluate compliance with applicable laws and regulations. To 

accomplish our objectives, we used various methods of data collection including 

5
Background Final Audit Report No. 98-08 

interviews, surveys, and review of documents. Our audit was not limited solely to 

evaluating the agency’s progress for preparing its mission critical systems, we also 

performed a cursory review of the agency’s overall state of readiness. To obtain a 

perspective on the adequacy of the FEC’s Y2K project we used OMB directives, as well 

as guidance issued by GAO. 

The GAO publication, “Year 2000 Computing Crisis: An Assessment Guide” which was 

finalized in September 1997, had been released in draft in February 1997, and made 

available as an added resource for Federal agencies to use in evaluating progress on their 

Y2K system renovation projects. The GAO guide draws on the work of the CIO Council 

Subcommittee on Y2K, and incorporates guidance and practices identified by leading 

organizations in the information technology industry. The GAO guidelines contain five 

primary phases, each listing key processes that should be accomplished in order to fully 

complete the phase. The five phases are: Awareness, Assessment, Renovation, 

Validation, and Implementation. In their Y2K quarterly reports to OMB, the FEC 

accepted the five phases listed in the GAO guidelines as, the solution framework the 

agency will use to resolve the Y2K issue. Exhibit No. 1, presents OMB milestone dates 

for each of the five phases. All Federal agencies should have completed the majority of 

the work for the last OMB milestone date, by March 1999. 

We conducted our survey and fieldwork from December 1998 through March 1999, in 

accordance with generally accepted government auditing standards. The scope of our 

audit was agency-wide. 

Statement on Management Controls 

As part of our audit, we assessed the system of management controls, policies, 

procedures, and practices applicable to the FEC’s management of the Y2K project. Our 

assessment was performed to determine the level of control risk for determining the 

nature, extent, and timing of our substantive tests to accomplish our objective. 

Due to inherent limitations, a study and evaluation made for the limited scope purposes 

described above, would not necessarily disclose every material weaknesses or reportable 

condition. However, we identified reportable conditions and recommended 

improvements for the on-going management of the Y2K compliance effort. These 

conditions and their effects are fully described in the Audit Results section of this report, 

and in the management letter shown as Appendix D. 

6
Audit Results Final Audit Report No. 98-08 

Audit Results 

In February 1998, President Clinton issued an Executive Order which directs the head of 

each Federal agency to “assure that efforts to address the Y2K problem receive the 

highest priority attention in each agency5.” Efforts at the FEC in recent months indicate 

progress in preparing agency computer systems for the new millennium; however, the 

Y2K project still has not evolved into an agency-wide team effort. During the course of 

our audit, we regularly briefed FEC officials on audit results and offered suggestions for 

improvement. Because issues remain to be resolved, we recommend that the FEC: 

1. For the inventory of its data exchanges, ensure that the internal and external 

dependency links between enterprise core business areas, processes, and information 

systems are documented in detail. 

2. Communicate with each external data exchange partner regarding the Y2K issue, and 

use the agency’s WEB site as a means of keeping its public informed on the current 

status of the Y2K problem. 

3. Update and issue the statement of work requiring Y2K compliant technology for the 

product and services covered under the ADP contract, complete work on the agency’s 

internal network, and perform end-to-end testing using FEC data to ensure that the 

communications network is fully Y2K compliant. 

4. In future Y2K reports issued to OMB, the FEC should include the computerized 

communications network as a mission critical system and ensure that the total number 

of mission critical systems reported conforms with OMB instructions. 

5. Develop adequate contingency plans for the communications network. In addition, we 

suggest that the FEC instruct each of its program offices with a high level core 

business function to submit contingency plans, so that the plans can be evaluated and 

tested prior to January 1, 2000. 

6. The FEC FAXLINE System provides an important public service; therefore, we 

recommend that the FEC perform end-to-end Y2K testing of that system to ensure an 

uninterrupted continuation of service. 

7. Develop and issue the statement of work to obtain services for independent 

verification of Y2K renovations. 

8. Conduct meetings with each division/office to reassess the number of mission critical 

systems, as well as the level of verification obtained through user acceptance testing. 

If user acceptance testing is to be relied upon as reported by the FEC, develop a 

5

 “Executive Order on Year 2000 Conversion” dated February 4, 1998. 

7
Audit Results Final Audit Report No. 98-08 

testing environment so system users can properly verify Y2K renovations and system 

performance. 

9. Prepare a listing of all agency computer technology contracts, and review those 

contracts to ensure that the appropriate Y2K language has been included in order to 

comply with existing Federal regulations. 

Assessing Project Risk 

In order to keep abreast of events relating to the Y2K renovation effort at the FEC, in 

early 1998 the Office of Inspector General (OIG) began requesting information on the 

status of the agency’s Y2K project. By the fall of 1998, the OIG changed from being a 

passive observer to taking a more active role through monitoring reported progress in the 

Y2K renovation project. Our monitoring efforts included assessing by comparison, the 

Y2K quarterly reports submitted by the FEC to OMB, and providing management with 

the results of our analysis. To assist the FEC further in preparing computer systems for 

the new millennium, the OIG subsequently became one part of a two prong approach for 

independent verification and validation (IV&V) of agency-wide Y2K renovations. 

Initially, we had offered our services to assist with independent validation of system 

testing; however, in December 1998 the FEC granted the Y2K project manager funding 

authority to obtain IV&V services from an outside vendor. Consequently, the agreed 

upon role of the OIG would be to determine whether the progress reported by the FEC 

matched its overall state of readiness. We placed special emphasis on two priority areas: 

1) systems that provide and receive electronic data from outside parties, and 2) core 

business functions that rely on computer processed data. 

As reported by OMB, the Clinton Administration is committed to ensuring that the Y2K 

problem does not interfere with the services that the American people rely on. Therefore, 

during our audit we identified systems, assigning the highest priority to those systems 

which transfer data to the public and systems that receive electronic data from outside 

sources. Although most of the core business functions within the agency rely heavily on 

computer processed data, we specifically identified six internal processes that either 

transfer and/or receive electronic data from sources outside the FEC. These six processes 

are: 1) the electronic filing process used by external parties for campaign finance 

reporting, 2) public access through the Direct Access and State Access Programs, 3) 

electronic data received by the Audit Division, including the Presidential public funding 

program, 4) the communications network which transfers the data and also provides for 

Internet access, 5) electronic transfer of accounting and payroll data, and 6) forms, 

schedules, and other documentation provided to the public through electronic data 

transfer. Our audit assessed the risk associated with the Y2K renovation of the computer 

systems within these critical areas, and we offer recommendations which we feel will 

reduce the agency’s exposure to the Y2K problem. 

8
Audit Results Final Audit Report No. 98-08 

Risk is inherent in any renovation project. One common technique used to assess risk in a 

system development or renovation project is to analyze diagrams that chart the flow of 

electronic data through the system. OMB previously asked each Federal agency, having 

any data exchange with outside sources, to inventory those exchanges. In its directive to 

small Federal agencies issued in March 1998, OMB established a goal of February 1, 1998 

for completing that data exchange inventory, and March 1, 1998 to communicate with 

each exchange partner regarding the Y2K problem.6 While the Y2K project team had 

completed an inventory of the agency’s internally developed software programs; upon our 

request they were unable to provide a documented inventory of external data exchanges or 

any corresponding data flow diagrams. To address interface and data exchange issues in 

its “Year 2000 Computing Crisis: An Assessment Guide” published in September 1997, 

the GAO recommends “developing a model showing the internal and external 

dependency links between enterprise core business areas, processes, and information 

systems.” Similar to OMB’s directives, the GAO guidelines also recommend “notification 

of all outside data exchange entities” as well as “the need for data bridges and filters.”

7 

Even when all internal computer systems at the FEC are Y2K renovated, without effective 

prevention efforts there is always a risk that data received from external providers which 

has been processed, summarized, and transferred from a system not Y2K compliant might 

populate internal systems with corrupt data. In order to block transfer of non-compliant 

data, an industry practice is to develop and install front-end filters and system edit checks. 

Where to install filters and edit checks capable of protecting agency computer systems 

without unnecessarily restricting the transfer of data, can be determined from locating and 

identifying date fields. In addition, the proper placement of sender notification 

procedures, such as electronic error messaging with standby instructions can be 

determined by analyzing data flow. 

Audit Recommendation No. 1: We recommend that for the inventory of its data 

exchanges, the FEC ensure that the internal and external dependency links between 

enterprise core business areas, processes, and information systems are documented in 

detail. 

Management’s Comments to Audit Recommendation No. 1: “All data exchanges, 

both inside and outside have been inventoried and mapped.” 

OIG Response to Management’s Comments for Audit Recommendation No. 1: The 

OIG considers management in agreement with the recommendation and have taken steps 

to implement corrective action. 

6

 “Progress Reports on Fixing Year 2000 Difficulties for Small Agencies,” OMB Memorandum for the 

Heads of Selected Agencies, dated March 9, 1998. 

7

 A data bridge is essentially software code that will transform electronic source data into a compatible 

format acceptable to the receiving program or system. 

9
Audit Results Final Audit Report No. 98-08 

Campaign Finance Disclosure System Overview 

The Disclosure System, appropriately named since it discloses campaign finance reports to 

the public, receives electronic data from outside sources. Developed in-house by agency 

programming staff, the Disclosure System is a complex mix of hardware platforms and 

software programs comprised of many different computer languages. It is the primary 

repository for millions of campaign finance records received each year from candidates, 

political committees, and political parties participating in Federal elections. The 

Disclosure System is capable of both receiving and transmitting electronic data through 

either a dedicated modem using the telecommunications medium (X.25), or via Internet 

protocol (TCP/IP). 

Exhibit No. 3 

Candidates, 

Committees, and 

Political Parties 

Electronic Filing Data Input 

WEB Site 

www.fec.gov Disclosure Data Base 

Direct Access 

State Access 

Programs 

Public Records 

Facility 

Washington D.C. 

The Public 

Electronic Exchange of Federal Campaign Finance Information 

TCP/IP 

TCP/IP Data 

Diskette 

Hard Copy, or 

or X.25 

Source: The Federal Election Commission 

X.25 

& 

Candidates and committees submit campaign finance information either through an 

electronic filing process, by data diskette, or in document form. As part of our audit 

program, we conducted interviews with agency staff and constructed a data flow diagram 

10
Audit Results Final Audit Report No. 98-08 

for disclosure of campaign finance information (see Exhibit No. 3). The FEC provides 

campaign finance information free of charge on the WEB. In addition, the public has free 

access to this information at the Public Records Facility at offices located in Washington, 

DC. Users requiring more detailed information about candidates, parties, and political 

action committees either subscribe on-line to the Direct Access Program, or in the case of 

State election offices obtain free access through the State Access Program. 

Data from the electronic filing process is submitted directly into either the agency’s WEB 

site or the Disclosure Data Base. The electronic filing software available from the FEC 

was built Y2K complaint. According to the FEC, during January 1999 the Y2K renovated 

version of the Disclosure Data Base scheduled to be in operation in the year 2000, has 

been fully implemented along with both the Direct Access and State Access Programs. 

Fully Y2K compliant is defined by the Federal Acquisition Regulations as information 

technology that, “accurately processes date/time data (including, but not limited to, 

calculating, comparing, and sequencing) from, into, and between the twentieth and 

twenty-first centuries, and the years 1999 and 2000 and leap year calculations, to the 

extent that other information technology, used in combination with the information 

technology being acquired, properly exchanges date/time with it8

.” 

Although the FEC is currently reporting the Disclosure System as completely converted, 

tested, and implemented; it does not operate independently. For example, without a Y2K 

compliant communications system, the FEC will not be able to conduct “end-to-end” 

system testing to ensure full Y2K compliance, as defined by Federal regulations. The 

communications network in conjunction with end-to-end testing are discussed later in this 

report. In addition, data filters and bridges will need to be tested to ensure that only Y2K 

compliant data is permitted to integrate with the Disclosure System and the agency’s 

WEB site. 

The Presidential Public Funding Program 

The Audit Division evaluates the matching fund submissions of Presidential candidates and 

determines the amount of contributions that may be matched with Federal funds. Federal 

regulations require that for any data submitted for the Presidential public funding program 

which is generated directly or indirectly from computerized files or records, the candidate 

shall submit a copy of the contributor list on magnetic media.9 The FEC has established 

and published filing format specifications for the data sent via magnetic tape.10 The date 

fields in the current version of the specifications are shown in a six digit format 

(YY/MM/DD). According to staff within the Audit Division, the documentation is 

scheduled to be updated prior to the 2000 Presidential election cycle. Data received by 

the Audit Division for the Presidential public funding program is first reviewed by agency 

8

 “Federal Acquisition Regulation; Year 2000 Compliance”, dated August 22, 1997. 9

 Title 11, of the Code of Federal Regulations (CFR), section 9036.1(b)(2). 

10 “Financial Control and Compliance Manual, For Presidential Primary Candidates Receiving Public 

Financing.” Federal Election Commission, dated January 1996. 

11
Audit Results Final Audit Report No. 98-08 

staff before it is ever integrated into an internal computer system. This substantially 

reduces the risk that non-compliant Y2K data will inadvertently be input into an agency 

database. 

However, the Audit Division also gathers information from candidates, committees, and 

political parties selected for an examination of their campaign finance activities. This 

information may be received on magnetic tape, or on data diskette, or as a flat file sent 

through the Internet. Audit staff we interviewed were unaware of any established 

communications to notify data exchange partners of the potential problems to either 

themselves or the FEC, if non-compliant Y2K date fields are transferred. 

The FEC Needs Y2K Outreach Program 

As previously stated, in March 1998 OMB established milestone dates for every small 

Federal agency to communicate with each of their external data exchange partners 

regarding the Y2K problem. During calendar year 2000, thousands of candidates, 

committees, and political parties will be eligible to exchange electronic data with the FEC. 

The Office of Election Administration (OEA) at the FEC does assist state and local 

election officials by responding to inquiries, publishing research and conducting 

workshops on all matters related to election administration. In addition, the OEA briefs 

foreign delegations on the U.S. election process, including voter registration. In this 

capacity, OEA has designed into their outreach program notification to all 50 State 

election officials of the potential risk involved in running unverified automated elections 

systems in the year 2000. 

However, agency outreach efforts to date have not included notification to all eligible 

external data providers of the potential consequences of sending non-compliant electronic 

data to the FEC. In its April 1998 Y2K quarterly report to OMB, the FEC stated that it 

originally intended “to begin alerting its customer base starting in June 1998, of the 

format changes and the implementation schedule.” The report also stated that the FEC 

would use the mail to contact all subscribers using the Direct Access Program, after that 

program was fully implemented on January 1, 1999. In discussions with the Y2K project 

team during January 1999, the project manager stated that the FEC no longer intends to 

contact its customer base regarding issues specific to the Y2K problem. According to the 

Y2K project manager, this change of policy is due partly to the fact that the FEC 

electronic filing software was developed Y2K compliant and is made available free of 

charge. In addition, although electronic filers do not have to use the FEC developed 

software, those that acquire custom designed programs must first be individually validated 

before they can send electronic data to the FEC. Electronic filers are provided with filing 

formats as well as a password. Therefore the FEC concludes, it is not necessary to notify 

each eligible electronic filer of issues relating specifically to the Y2K problem, and the 

issue was dropped from the February 1999 Y2K report to OMB. 

12
Audit Results Final Audit Report No. 98-08 

We believe that this logic runs contrary to the Y2K directive issued by OMB requiring all 

Federal agencies to establish communications with each external data partner regarding 

the Y2K issue, no later than March 1, 1998. First of all, electronic filers are not the 

agency’s only data exchange partners. Also, in order to successfully exchange electronic 

data between two computer systems, there must be a similar file format; or if not, at least 

a software bridge to accommodate dissimilar formats. Second, no system administrator is 

going to allow an outside entity to exchange data without obtaining proper access rights. 

Therefore, for the electronic filing process, the FEC is simply following standard 

procedures required under normal operating conditions, and not communicating with each 

data exchange partner on how to fix the Y2K problem, as requested by OMB. 

As shown previously in Exhibit No. 3, the FEC maintains an Internet WEB site. In 

addition to providing public access to Federal campaign information, this site provides a 

host of general information relating to the FEC. This information includes instructions on 

electronic filing in order to assist software developers and programmers when converting 

existing programs to conform to the electronic filing system. Early in our audit, we 

suggested to the Y2K project team that the WEB site could be used to keep the agency’s 

public current regarding the Y2K problem. 

Audit Recommendation No. 2: We recommend that the FEC communicate with each 

external data exchange partner regarding the Y2K issue, and use the agency’s WEB site as 

a means of keeping its public informed on the current status of the Y2K problem. 

Management’s Comments to Audit Recommendation No. 2: “...we have 

communicated guidance on the Website and in the Direct Access Program login header. 

Additionally, we will contact those known entities who are involved in providing software 

to the electronic filing community and alert them to this requirement.” 

OIG Response to Management’s Comments for Audit Recommendation No. 2: The 

OIG considers management in agreement with the recommendation and have taken steps 

to implement corrective action. 

Financial System Overview 

Computer systems at the FEC maintain and process personnel and accounting data for an 

agency staff of over 300 full-time employees, and a budget of more than $30 million. The 

financial system is essentially composed of three integrated computerized systems: 

personnel, payroll, and accounting. 

The flow of electronic information within the financial system starts with the personnel 

system which transfers data to the payroll system. From the payroll system, data is then 

sent to the accounting system. Both accounting and payroll data is subsequently 

transferred to the U.S. Department of Treasury (Treasury). This simple flow of 

information is shown in Exhibit No. 4. 

13
Audit Results Final Audit Report No. 98-08 

Exhibit No. 4 

FEC Personnel System 

FEC Payroll System 

FEC Accounting System U.S. Department of Treasury 

Electronic Data Exchange for the Financial System 

Source: The Federal Election Commission 

Currently, the financial system receives no electronic data from sources outside of the 

FEC. The data exchange with Treasury is accomplished through system software supplied 

to the FEC by the Treasury. The data exchange process to Treasury begins with FEC 

staff downloading accounting and payroll data onto a data diskette; manually transferring 

the diskette to a desktop computer; uploading the data into the Treasury supplied 

software; and completing the transfer. 

The FEC intends to outsource both the personnel and payroll systems to the National 

Finance Center (NFC). In its August 1998 quarterly report to OMB, the FEC stated that 

the transfer of the two systems would not be completed until at least October of 1999. 

The FEC had hoped to migrate these two systems to the NFC much earlier, but the 

transfer was delayed due to the NFC dealing with its own Y2K problems. Because of the 

risk associated with the late transfer of these two systems, the FEC decided to go ahead 

and renovate both systems. Consequently, each individual component of the financial 

system has now been Y2K renovated. However, these integrated systems also use the 

communication network, and as discussed below that system is not fully Y2K compliant. 

Communications Network Not Fully Compliant 

As reported by the FEC, its telecommunications fall into two major categories: 1) 

communications associated with the telephone system, and 2) communications associated 

with computer data. This latter grouping is further sub-divided into communications 

provided through an ADP contractor, communication services provided by an electronic 

filing contractor, and the internal communications network operated and maintained by the 

agency’s information technology staff. While the electronic filing contractor is reporting 

their services as Y2K compliant, the current ADP contract has no provisions requiring the 

vendor to be compliant; furthermore, the contract is scheduled to expire during June 1999. 

14
Audit Results Final Audit Report No. 98-08 

In addition, while the Y2K project team is in the process of renovating the internal data 

communications environment, work remains to be done. 

As part of our audit fieldwork, we reviewed the ADP services contract. Products and 

services provided through the ADP contractor include Internet services, as well as 

communication software and computer hardware. The statement of work for the current 

contract was issued on November 9, 1992, with vendor proposals due by February 1, 

1993. After detailed evaluation of each vendor response, the contract was subsequently 

awarded on June 3, 1993. It took approximately eight months to award the 1993 

contract, which did not include the time required to develop the statement of work prior 

to its issuance. The contract was awarded for services to cover a 72 month period, with 

the agency having an automatic “right of extension” of vendor supplied products and 

services to the 78th month. This could extend the contract on a month-to-month basis at 

the option of the FEC through December 1999. While the Y2K project manager 

anticipates awarding a contract proposal during 1999 for communication services similar 

to those provided under the 1993 contract including provisions for the vendor to 

demonstrate the product and services, to date there has been no statement of work issued 

for a new contract. 

In its February 1999 Y2K report to OMB, the FEC states: “Although the ADP contractor 

is responsible for a major application, whether or not they are Y2K compliant at this 

juncture is not relevant.” However, in its publication, “Year 2000 Crisis: A Testing 

Guide” issued in November 1998 the GAO takes a diametrically opposite position, as 

follows: 

“In order to execute end-to-end testing and ensure that all systems in the 

chain of support to core business areas function as intended, the 

telecommunications infrastructure that interconnects the systems must be 

compliant and ready for testing. Ensuring that the vendor-supported 

components of the telecommunications infrastructure are compliant is a 

process that should have begun as part of establishing the test 

infrastructure. By now this process should have been completed for all 

telecommunications systems.” 

In its March 1998 “Memorandum to the Heads of Small Agencies,” OMB stated: “All 

Federal agencies must be prepared to make a smooth transition through the year 2000.” 

Late delivery of a Y2K compliant communications network presents a substantial risk for 

resolving the agency’s Y2K problem. Not only may there not be enough time for the 

agency to adequately test vendor products and services, but also mandatory end-to-end 

testing of systems which exchange or transfer data through the network may not be 

completed in time. In its “Year 2000 Computing Crisis: An Assessment Guide,” GAO 

states: “The purpose of end-to-end testing is to verify that a defined set of interrelated 

systems, which collectively support an organizational core business area or function, 

interoperate as intended in an operational environment (either actual or simulated).” 

Late renovation of the FEC’s communication network could mean that end-to-end testing 

15
Audit Results Final Audit Report No. 98-08 

of Y2K renovations will be delayed; or worse, not done at all. Therefore, it is essential to 

formulate an immediate strategy to address this critical issue. 

Audit Recommendation No. 3: We recommend that the FEC update and issue the 

statement of work requiring Y2K compliant technology for the product and services 

covered under the ADP contract, complete work on the agency’s internal network, and 

perform end-to-end testing using FEC data to ensure that the communications network is 

fully Y2K compliant. 

Management’s Comments to Audit Recommendation No. 3: “The CBD Notice for 

RFP9902 (Information Technology) was issued on April 13, 1999. The RFP is expected 

to be available April 26, 1999 with an estimated award date of late August. Complete 

implementation, including 30 day minimum parallel and Y2K testing is expected to be 

accomplished by November 30, 1999.” 

OIG Response to Management’s Comments for Audit Recommendation No. 3: Of 

special concern in management’s response is the uncertainty surrounding the scheduled 

late implementation of the Information Technology contract (commonly referred to as the 

“ADP contract”), which provides computer services for / between the FEC and the central 

computer facility housing the Disclosure Database. As stated, agency officials only expect 

Y2K testing on that contract to be accomplished by November 30, 1999. This is much 

later than established government-wide milestone dates and presents a significant risk to 

the FEC. 

Inconsistency in Reporting Total Mission Critical Systems 

For OMB reporting purposes, the FEC does not currently include the communications 

network in the count for total mission critical systems. Yet, the FEC describes the 

communications system as a “major application” in its February 1999 Y2K report. OMB 

has published guidelines recommending that agency computer systems be classified as 

either mission critical or non-mission critical. OMB has consistently requested that 

agency’s provide a status on the total number of mission critical systems, so that the 

Administration can issue accurate progress reports on fixing the Y2K problem in Federal 

systems to the American people. 

In addition, OMB has requested that mission critical systems be reported as compliant; or 

if not compliant, classified as being replaced, repaired, or retired. In its February 1999 

Y2K report to OMB, the FEC is reporting the total number of mission critical systems as 

sixteen, yet the number of mission critical systems listed within the report as compliant, 

replaced, repaired, and retired actually adds up to a total of eighteen systems. This 

inconsistency, as depicted in the following table taken from the February 1999 FEC Y2K 

report, has caused some confusion. 

16
Audit Results Final Audit Report No. 98-08 

Total number of 

Mission-Critical 

Systems 

Number 

Compliant 

Number to be 

Replaced 

Number to be 

Repaired 

Number to be 

Retired 

16 14 3 1 0 

In its March 1998 directive entitled “Memorandum to the Heads of Small Agencies” OMB 

requests that, “For this table, the four right-hand columns (“Number Compliant,” 

“Number Being Replaced,” “Number Being Repaired,” “and Number Being Retired”) 

must add up to the left-hand column (“Total Number of Mission-Critical Systems”).” 

Consequently, in its most recent quarterly report, OMB has identified the FEC as having 

eighteen mission critical systems; when in fact, the FEC is only currently reporting sixteen 

mission critical systems. In that report, OMB issued new reporting requirements asking 

each small Federal agency that has not fully completed their Y2K renovation work, to 

begin reporting quarterly to OMB on their progress11. This means that the FEC will need 

to issue its next Y2K progress report to OMB on May 15, 1999. 

Audit Recommendation No. 4: We recommend that in future Y2K reports issued to 

OMB, the FEC include the computerized communications network as a mission critical 

system and ensure that the total number of mission critical systems reported conforms with 

OMB instructions. 

Management’s Comments to Audit Recommendation No. 4: “With regards to FEC 

owned internal communications equipment, the FEC will make every effort to ensure Y2K 

compliance.” 

OIG Response to Management’s Comments for Audit Recommendation No. 4: 

Management states that every effort will be made to ensure the FEC owned internal 

communications equipment is Y2K compliant. However, management’s comments are 

non-responsive to our recommendation to include the computerized communications 

network as a mission critical system and ensure that the total number of mission critical 

systems reported conforms with OMB instructions. 

The FEC Needs Contingency Planning 

Contingency plans ensure the continuity of core business processes. Theoretically with 

adequate contingency planning a mission critical system could fail, yet the FEC would still 

be able to accomplish its mission. On the other hand, without a well designed contingency 

plan the failure of the one major system, such as the agency’s communications network, 

could disrupt operations for the entire organization. During 1998, OMB asked each 

Federal agency to identify all mission critical systems not expected to be fully Y2K 

compliant by March 1999, and also report the date that a corresponding contingency plan 

11 “8th Quarterly Report: Progress on Year 2000 Conversion,” issued by OMB on March 18, 1999. 

17
Audit Results Final Audit Report No. 98-08 

would be in place. The FEC has reported that it is still in the process of both renovating 

its own data communications environment and ensuring that the ADP communications 

contract is compliant. Additionally, OMB has repeatedly requested that contingency plans 

for high-level core business functions be completed and tested.12 In its February 1999 

Y2K quarterly report to OMB, the FEC simply states, “During the remaining months of 

calendar year 1999, the FEC will develop a contingency plan for the remote possibility 

that the computer systems become inoperable.” In its 8th Quarterly Report issued during 

March 1999, OMB expressed the following concerns regarding the FEC’s Y2K project: 

“Making progress on IT systems. The agency is 100% complete in its 

mission critical software conversion. Anticipated compliance in 

October. FEC needs a business continuity and contingency plan. The 

verification and validation plan is weak. FECs payroll and personnel 

systems will be converted to National Finance Center in October 

1999.” 

Audit Recommendation No. 5: We recommend that the FEC develop adequate 

contingency plans for its communications network. In addition, we suggest that the FEC 

instruct each of its program offices with a high level core business function to submit 

contingency plans, so that the plans can be evaluated and tested prior to January 1, 2000. 

Management’s Comments to Audit Recommendation No. 5: “For the 

communications network, the FEC will review its current procedures for addressing a 

communications network failure. A contingency plan will be developed to address such a 

failure in the event it should occur. Preliminary discussions regarding this issue have 

been held. A formal plan is scheduled to be developed.” 

OIG Response to Management’s Comments for Audit Recommendation No. 5: In 

regards to management’s comments on contingency planning, it is noted that the FEC has 

held preliminary discussions regarding this issue and a formal plan is scheduled to be 

developed; however, recent OMB testimony before Congress indicates that all Federal 

agencies are expected to submit business continuity and contingency plans by June 15, 

1999. Therefore, we believe that the FEC should strongly consider the contributions and 

suggestions offered in Finding Number 1, of our Management Letter shown in Appendix 

D of this report. These suggestions include using an electronic supplied version of a 

benchmark comprehensive Y2K plan as the foundation for developing an FEC-wide team 

effort for contingency planning and staff involvement. 

12 “Revised Reporting Guidance on Year 2000 Efforts” OMB M-99-09, Memorandum for the Heads of 

Selected Agencies, dated January 26, 1999. 

18
Audit Results Final Audit Report No. 98-08 

FEC FAXLINE System Not Scheduled for Y2K Testing 

The Public Disclosure Division processes incoming campaign finance reports from 

political committees and candidates involved in Federal elections, and makes those reports 

available to the public in paper form, on microfilm, and through digital computer images. 

The division also manages the FEC FAXLINE System, an automated faxing service which 

transfers electronic information to the public. The FEC FAXLINE System has over 440 

documents and publications available for immediate transmission. Materials available 

through this service include the forms necessary to report Federal campaign finance 

activities. In each of its quarterly reports assessing the progress of Y2K renovations in the 

Federal sector, OMB has stated that the Clinton Administration is committed to ensuring 

that the American people will continue to receive the services they rely on and government 

services will not be disrupted by the transition to the year 2000. 

During February 1999, the Public Disclosure Division implemented a new FEC FAXLINE 

System that was developed Y2K compliant and is supported through a contract with an 

outside vendor. The system consists primarily of a host computer installed with 

supporting software, and a twelve hour back-up power unit. The FEC FAXLINE System 

is not connected directly to the FEC communications network, instead data is delivered 

through eight dedicated phone lines. The FEC FAXLINE System also maintains a 

dedicated diagnostic phone line used by the vendor to troubleshoot the system. According 

to the Y2K project team, no plan is being considered to have the FEC FAXLINE System 

tested from end-to-end specifically for Y2K compliance. When interviewed, the Y2K 

project manager maintains that the only risk to the public is to have an invalid time stamp 

placed on the document received. Without end-to-end testing to include the supporting 

telecommunications infrastructures, the full consequences will remain unknown. 

Audit Recommendation No 6: The FEC FAXLINE System provides an important 

public service; therefore, we recommend that the FEC perform end-to-end Y2K testing of 

that system to ensure an uninterrupted continuation of service. 

Management’s Comments to Audit Recommendation No. 6: “We agree that the 

FAXLine should be tested, and that the system should be communicated directly to the 

public records office.” 

OIG Response to Management’s Comments for Audit Recommendation No. 6: The 

OIG considers management in agreement with the recommendation and will take steps to 

implement corrective action. 

19
Audit Results Final Audit Report No. 98-08 

Independent Verification of Y2K Renovations Needed 

OMB has asked each Federal agency “to assure independent verification that systems are 

fixed and to assure that information reported is accurate.”

13 During December 1998, the 

Y2K project team and the OIG entered into a cooperative agreement for verification and 

validation of agency-wide Y2K renovations. The agency’s plan would consist of a two 

prong approach: 1) the agency would contract with an outside vendor for verification of 

Y2K renovations, and 2) the OIG would compare the agency’s reported progress to its 

actual state of readiness with particular emphasis placed on mission critical systems that 

exchange data electronically with the public. It was not until December 1998 that the FEC 

granted the Y2K project manager the funding authority to obtain IV&V services from an 

outside vendor. Although the Y2K project team continues in discussions with potential 

vendors, the FEC still has not awarded a contract for IV&V testing of agency-wide Y2K 

renovations. 

In the first paragraph of its February 1999 Y2K report to OMB, the FEC asserts that 

“100% of the FEC’s mission critical software has now been renovated and tested.” If the 

reader did not scrutinize the report further, we believe that this statement by itself might 

lead the reader to an invalid conclusion that progress in the renovation and testing effort 

has reached a level, which in fact has not been achieved. For instance, as explained later in 

the body of the February 1999 Y2K report, while system testing has been completed on 

the Disclosure System, other testing has yet to be concluded. In addition, testing of 

computer hardware and 3rd party software remain, both systems are listed as mission 

critical. It should be noted that additional software renovations along with system testing 

may be necessary as a result of feedback received from the proposed IV&V process. Also 

as described next, our audit results show that user acceptance testing has fallen far short of 

the expected outcome. Without immediate action, there is a risk that that the FEC will not 

be able to validate and verify Y2K renovations and testing in time. 

Audit Recommendation No. 7: We recommend that the FEC develop and issue the 

statement of work to obtain services for independent verification of Y2K renovations. 

Management’s Comments to Audit Recommendation No. 7: “Your 

recommendation...was implemented April 19, 1999 via a contract with SEEC, Inc. In 

order to ensure independent verification, validation will be accomplished at the vendor 

site.” 

OIG Response to Management’s Comments for Audit Recommendation No. 7: The 

OIG considers management in agreement with the recommendation and is taking 

appropriate steps to implement the recommendation. While verification of code at the 

vendor’s site provides a degree of assurance that due diligence was performed by the 

13 “Revised Reporting Guidance on Year 2000 Efforts” OMB-M-98-12, Memorandum for the Heads of 

Selected Agencies, dated July 22, 1998. 

20
Audit Results Final Audit Report No. 98-08 

agency in repairing programming code; it should also be pointed out that the vendor 

usually will not attest to the level of compliance. Consequently, the method recommended 

by both OMB and the GAO to ensure code compliance, as well as the reliability of other 

Y2K renovations including computer hardware and communication software, is through 

end-to-end testing of each system. 

User Acceptance Testing Not Meeting Expectations 

During our early discussions with the Y2K project team, we were informed that the FEC 

was relying on user testing to verify Y2K renovations after the converted systems were 

implemented. The GAO guidelines define acceptance testing as the process, “to verify 

that the complete system (i.e., the full complement of application software running on the 

target hardware and systems software infrastructure) satisfies specified requirements 

(functional, performance, and security) and is acceptable to end users.”

14 In both the 

August 1998 and February 1999 Y2K reports and using almost identical wording, the 

FEC states: “By bringing each program on-line as it is repaired or converted we utilize 

the best testing environment available, the actual user of the programs.” While the 

normal operating environment may provide assurance that Y2K changes have not 

introduced errors to adversely affect the functionality of a particular computer program; 

without structured technical assistance there can be no guarantee that critical future dates 

will actually be tested by the users of the system. In addition, GAO guidelines recommend 

that initial acceptance testing be part of the validation phase, prior to implementation of 

the renovated system.15 To determine whether the user environment provided assurance 

that Y2K renovations were complete and adequate, we surveyed the users of each mission 

critical computer system reported by the FEC as implemented. 

During February 1999, we sent a user survey (see Appendix A) to each of the twelve 

divisions/offices responsible for the sixteen reported mission critical systems, so that we 

could determine the effectiveness of user acceptance testing. Except for computer 

hardware and 3rd party software applications, the FEC is currently reporting all other 

mission critical computer systems as fully Y2K renovated and in operation. Of the 

fourteen mission critical systems reported by the FEC as completely renovated and 

implemented, only a single system was reported as receiving a thorough user acceptance 

test. Nine divisions/offices reported either performing no user acceptance testing, or only 

incidental testing as a by-product of routine operations. One of the division/offices 

responded that their system was not yet Y2K compliant. One office did not respond to 

our survey. 

It was evident from the survey results, users have not received adequate technical 

assistance to perform acceptance testing. In addition, some divisions/offices listed by the 

FEC as having responsibility for a mission critical system were not sure whether they 

14 “Year 2000 Computing Crisis: A Testing Guide” GAO, dated November 1998. 15 “Year 2000 Computing Crisis: An Assessment Guide” GAO, dated September 1997. 

21
Audit Results Final Audit Report No. 98-08 

operated a mission critical system, or not. Furthermore, the responses from two 

divisions/offices indicated that they didn’t have a mission critical system. 

Audit Recommendation No. 8: We recommend that the Y2K project team conduct 

meetings with each division/office to reassess the number of mission critical systems, as 

well as the level of verification obtained through user acceptance testing. If user 

acceptance testing is to be relied upon as reported by the FEC, develop a testing 

environment so system users can properly verify Y2K renovations and system 

performance. 

Management’s Comments to Audit Recommendation No. 8: “In order to complete 

the remediation of computer programs at the FEC, the following steps occurred: 

1) Programs were copied 

2) Those copied programs were replaced, remediated or retired 

3) Updated programs were fully tested and put back into operation 

Based on the above, the FEC has completed 100% of all programs identified as mission 

critical per our most recent OMB report.” 

OIG Response to Management’s Comments for Audit Recommendation No. 8: 

Management’s comments do not address our recommendation. We recommend that the 

Y2K project team conduct meetings with each division/office to reassess the number of 

mission critical systems, as well as the level of verification obtained through user 

acceptance testing. In addition, if user acceptance testing is to be relied upon as reported 

by the FEC, management should develop a testing environment so system users can 

properly verify Y2K renovations and system performance. 

Compliance with Laws and Regulations 

As previously stated, according to Federal regulations all Federal agencies have been 

directed to notify each contractor providing essential computer services of policies 

established to ensure Y2K compliance. Those regulations require that all Federal 

contractors either provide Y2K compliant technology, or ensure that non-compliant 

technology is upgraded to become Y2K compliant in a timely manner.16 During our 

interviews with FEC staff, we determined that agency computer services contracts may 

not have been reviewed to ensure that the appropriate Y2K provisions were included. 

Early in our audit, we provided the agency’s Y2K project team with the recommended 

contract language developed by the Federal government. As part of our audit fieldwork, 

we scheduled a comprehensive review of computer technology contracts in order to 

determine the level of compliance with applicable Federal regulations. However, upon our 

request in March 1999, the FEC was still unable to provide a listing of the contracts with 

the vendors that supply computer services to the agency. Without being able to identify 

16Title 48 of the Code of Federal Regulations (CFR), part 39.106 “Year 2000 compliance,” dated August 

7, 1997. 

22
Audit Results Final Audit Report No. 98-08 

every computer services contract, the FEC cannot ensure that each of its vendors has been 

notified to provide only Y2K compliant technology. 

Audit Recommendation No. 9: We recommend that the FEC prepare a listing of all 

computer technology contracts, and evaluate those contracts to ensure that the 

appropriate Y2K language has been included to comply with Federal regulations. 

Management’s Comments to Audit Recommendation No. 9: “Data Systems has 

identified computer contracts to the Contracting Officer. We suggest that you 

communicate directly with the Contracting Officer regarding this particular issue. We 

will notify them (current contractors with contracts through 2001) however specifically of 

this requirement. In conclusion, current contracts are Y2K compliant.” 

OIG Response to Management’s Comments for Audit Recommendation No. 9: 

Management suggest that the OIG communicate directly with operational staff in order to 

resolve the audit recommendation. While we believe our recommendations and 

suggestions would enhance the agency’s Y2K renovation effort, the OIG is constrained by 

Federal law from directing FEC operations. Guidance on the scope of the OIG can be 

obtained from Public Law 95-452, as amended by Title 1 of the Inspector General Act 

Amendments, Public Law 100-504. Furthermore, management’s suggestion raises 

concerns whether the appointed project officials have the authority to coordinate agencywide Y2K renovation efforts. Centralized planning and direction is crucial for large and 

complex agency-wide projects i.e., resolving the FEC’s Y2K problem. 

Conclusion 

Clearly, the FEC has much to accomplish in the months ahead in order to prepare its 

computer systems for the new millennium. As previously stated, the FEC is reporting all 

internally developed mission critical software as converted and tested. Feedback from the 

agency’s proposed IV&V contract with an outside vendor should indicate the adequacy of 

this conversion effort. Yet, successful renovation of in-house developed software is only 

part of the total Y2K project, significant though it may be. The areas addressed within 

this audit report pose a substantial risk to the agency, if not properly resolved. 

Furthermore, in a letter to management we express additional concerns that the FEC has 

neither developed a comprehensive Y2K plan to support project management, nor has the 

Y2K project team documented their efforts converting the in-house developed software 

(see Appendix D). Without immediate resolution, we believe these two conditions will 

only increase the exposure of the FEC to the Y2K problem. 

23
Appendix A Final Audit Report No. 98-08 

Audit Survey of Year 2000 Renovations

User Acceptance Testing For Critical Computer Systems

Department Name: 

Name of Responding Official: 

(Note: Please Respond No Later Than February 26, 1999) 

Name(s) of the Reported Mission Critical Computer Systems in Your Department: 

(Note: If you are unaware of a mission critical computer system within your area, please 

respond by indicating such, and return your reply c/o: Dorothy Maddox-Holland, Office of 

Inspector General. If you do not know the name of your system, use the name(s) as shown 

in the table presented at the end of this survey) 

Question No. 1: 

(a) Is the reported mission critical computer system(s) in your area of responsibility 

Y2K compliant? (Yes or No, or Don’t Know) 

(b) Has the Y2K compliant version been fully implemented (placed into operation)? 

(Yes or No, or Don’t Know) 

If Yes to both (a) and (b) for any system, please identify the system(s) as both compliant 

and implemented, and go to Question No. 2. 

If No or Don’t Know for either (a) or (b) for any system, you don’t need to respond 

further for that particular system. Please identify the system(s) and its current status, if 

known. If you have only one known mission critical system, and answered No or Don’t 

Know to either (a) or (b), after you identify that system you are finished with the survey. 

Please return your response c/o: Dorothy Maddox-Holland, Office of Inspector General. 

Thank you! 

24
Appendix A Final Audit Report No. 98-08 

Question No. 2: 

Did your department perform user acceptance testing of Y2K renovations for the 

mission critical computer system(s) in your area of responsibility after 

implementation? (Yes or No) 

If your answer to Question #2 is No for a system, identify each system and go to question 

No. 3. 

If your answer to Question No. 2 is Yes for a system, please list that system and answer 

the following three questions before going to Question No. 3: 

a) Were scripts prepared for users to follow to test the system’s Y2K renovations? (Yes 

or No) If Yes, please provide a copy of the test scripts along with your response to the 

survey. 

b) Were unexpected test results logged? (Yes or No) If Yes, please provide a copy of 

the exception report along with your response to the survey. 

c) From the list of four system components below, please indicate each that you tested in 

conjunction with the mission critical system software: 

1) application software, 

2) hardware, 

3) firmware, 

4) communications network. 

Question No. 3: 

Did user department management review and approve the system’s performance 

after conversion for Y2K renovations? (Yes or No) 

Please identify any system and indicate either Yes or No for that system. 

25
Appendix A Final Audit Report No. 98-08 

Mission Critical Computer Systems Reported by FEC 

Y2K Quarterly Report to OMB, August 1998 

System Program Office 

Accounting Administration Division 

Disclosure Data Systems Development 

External Source Programs Data Systems Development 

Hardware Data Systems Development 

Imaging Micro Updating Public Disclosure Division 

Information Information Division 

Mailroom Administration Division 

Matching Funds Processing Audit Division 

OGC Tracking Office of General Counsel 

Open/Closed Minutes Comm. Sec. Secretary of the Commission 

Payroll Administration Division 

Personnel Administration Division 

Planning & Management Planning and Management 

Press Press Office 

RAD Reports Analysis Division 

Teamlinks /Lotus Notes Data Systems Development 

- - - - - - - - - - - End of Survey - - - - - - - - - - -

26
Appendix B - Management Comments Final Audit Report No. 98-08 

27
Appendix B - Management Comments Final Audit Report No. 98-08 

28
Appendix B - Management Comments Final Audit Report No. 98-08 

29
Appendix B - Management Comments Final Audit Report No. 98-08 

30
Appendix B - Management Comments Final Audit Report No. 98-08 

31
Appendix B - Management Comments Final Audit Report No. 98-08 

32
Appendix C - OIG Response Final Audit Report No. 98-08 

OIG Response to Management’s Comments on Draft Report 

In its response to our draft audit report (see Appendix B), the FEC has expressed 

general concurrence with our audit recommendations. The FEC’s response also presents 

recent steps that have been taken to address some of the issues raised both by OMB in its 

quarterly reporting, as well as from our audit. However, in management’s response agency 

officials express the following: “Unlike larger Agencies, the FEC does not have the 

personnel resources to perform many of the recommendations outlined in the report.” We 

would like to point out that all of the recommendations in the audit report are supported by 

published OMB directives developed for small Federal agencies. Furthermore, both the 

Administration and Congress made additional funding available to Federal agencies 

requesting assistance in fixing Y2K problems. In its 8th Quarterly Report, under the 

section relating to small and independent agencies, OMB makes the following offer: “For 

those agencies that are behind schedule, OMB will work with senior management to 

ensure that they will be ready.” 

Although, the agency’s stated corrective actions taken and planned since the 

issuance of the draft audit report are encouraging, much needs to be accomplished within 

the allotted time remaining. Of special concern in management’s response is the 

uncertainty surrounding the scheduled late implementation of the Information Technology 

contract (commonly referred to as the “ADP contract,” see audit recommendation #3), 

which provides computer services for / between the FEC and the central computer facility 

housing the Disclosure Database. At this time, agency officials only expect Y2K testing on 

that contract to be accomplished by November 30, 1999. This is much later than 

established government-wide milestone dates and presents a significant risk to the FEC. 

In regards to management’s comments on contingency planning (refer to audit 

recommendation #5), it is noted that the FEC has held preliminary discussions regarding 

this issue and a formal plan is scheduled to be developed; however, recent OMB testimony 

before Congress indicates that all Federal agencies are expected to submit business 

continuity and contingency plans by June 15, 1999. Therefore, we believe that the FEC 

should strongly consider the contributions and suggestions offered in Finding Number 1, of 

our Management Letter shown in Appendix D of this report. These suggestions include 

using an electronic supplied version of a benchmark comprehensive Y2K plan as the 

foundation for developing an FEC-wide team effort for contingency planning and staff 

involvement. 

33
Appendix C - OIG Response Final Audit Report No. 98-08 

In audit recommendations numbers six and nine, management suggests that the 

OIG communicate directly with operational staff in order to resolve the respective audit 

recommendations. While we believe our recommendations and suggestions would enhance 

the agency’s Y2K renovation effort, the OIG is constrained by Federal law from directing 

FEC operations. Guidance on the scope of the OIG can be obtained from Public Law 95-

452, as amended by Title 1 of the Inspector General Act Amendments, Public Law 100-

504. Furthermore, management’s suggestion raises concerns whether the appointed 

project officials have the authority to coordinate agency-wide Y2K renovation efforts. 

Centralized planning and direction is crucial for large and complex agency-wide projects 

i.e., resolving the FEC’s Y2K problem. 

Addressing the verification efforts for agency renovations (refer to audit 

recommendation #7), management’s response reiterates “the importance of conducting an 

independent verification and validation of Y2K code compliance.” Management goes on 

to state: “In order to ensure independent verification, validation will be accomplished at 

the vendor site.” In our audit, we recommend conducting independent verification and 

validation. However, while verification of code at the vendors site provides a degree of 

assurance that due diligence was performed by the agency in repairing programming code; 

it should also be pointed out that the vendor usually will not attest to the level of 

compliance. Consequently, the method recommended by both OMB and the GAO to 

ensure code compliance, as well as the reliability of other Y2K renovations including 

computer hardware and communication software, is through end-to-end testing of each 

system. 

With the limited time remaining, and considering the amount of effort and 

coordination necessary to complete Y2K renovations at the FEC, there is a moderate 

degree of risk that the agency may not be ready on time. 

34
Appendix D - Management Letter Final Audit Report No. 98-08 

35
Appendix D - Management Letter Final Audit Report No. 98-08 

36
Appendix D - Management Letter Final Audit Report No. 98-08 

37
Distribution List

Primary Action Officials 

Richard L. Hooper, Director, DSDD 

Year 2000 Project Manager

Federal Election Commission

999 E Street, N.W.

Room 833

Washington, DC 20463

James A. Pehrkon ........................................................................ 

No. of Copies 

.................................................. 4 

2 

Staff Director

Federal Election Commission

999 E Street, N.W.

Room 933

Washington, DC 20463

Other FEC Offices 

The Commissioners .................................................................. 6 

Office of General Counsel ........................................................... 1 

Congressional Affairs Office ........................................................ 1 

38