Every institution should know this answer by now. Note that a full inventory will include software systems, hardware, networking devices, and operating systems. Some buildings have systems or facilities within that cause them to be high risk, and sometimes the question is more simply related to building security or other infrastructure. A simple punch list of base infrastructure tests should suffice for most buildings. Remember that this question applies to embedded chips as well.
Triage is a critical next step.
Few institutions, if any, will fix every problem. Technical solutions are important, but in comparison to management processes, technical solutions may prove to be the less difficult part of the problem. The question here is whether all management agrees on the critical list, not just the technical personnel. Asking for examples to get a sense of current thinking would be a good idea. The basis for systems being deemed Y2K ready should not be that someone says they are, but that they were tested and found to work.