Year 2000 Computing Crisis: Additional Work Remains to Ensure Delivery of Critical Services
Published: 1999-04-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Pursuant to a congressional request, GAO discussed federal agencies' progress in addressing the year 2000 computing challenge and outlined actions needed to ensure a smooth conversion to the next century, focusing on the: (1) status of the federal government's remediation of its mission-critical systems; (2) remaining challenges facing the government in ensuring the continuity of business operations, namely end-to-end testing and business continuity and contingency planning; (3) Office of Management and Budget's (OMB) efforts to identify the government's high-impact programs; and (4) readiness of state systems that are essential to the delivery of federal human services programs.
section_title: What GAO Found
paragraphs: GAO noted that: (1) addressing the year 2000 problem is a tremendous challenge for the federal government; (2) to meet this challenge and monitor individual agency efforts, OMB directed the major departments and agencies to submit quarterly reports on their progress, beginning on May 15, 1997; (3) these reports contain information on where agencies stand with respect to the assessment, renovation, validation, and implementation of mission-critical systems, as well as other management information; (4) the federal government's most recent reports show improvement in addressing the year 2000 problem; (5) while much work remains, the federal government has significantly increased the percentage of mission-critical systems that are reported to be year 2000 compliant; (6) in particular, while the federal government did not meet its goal of having all mission-critical systems compliant by March 1999, 92 percent of these systems were reported to have met this goal; (7) while this progress is notable, 11 agencies did not meet OMB's deadline for all of their mission-critical systems; (8) to ensure that their mission-critical systems can reliably exchange data with other systems and that they are protected from errors that can be introduced by external systems, agencies must perform end-to-end testing of their critical core business processess; (9) OMB and the President's Council on Year 2000 Conversion announced that one of the key priorities that federal agencies will be pursuing during the rest of 1999 will be cooperative efforts regarding end-to-end testing to demonstrate the year 2000 readiness of federal programs with states and other partners critical to the administration of those programs; (10) OMB called on federal agencies to identify and report on the high-level core business functions that are to be addressed in their business continuity and contingency plans in their February 1999 quarterly reports; (11) accordingly, in their February 1999 reports, almost all agencies listed their high-level core business functions; (12) OMB issued a memorandum to federal agencies designating lead agencies for the government's 42 high-impact programs; (13) OMB directed the lead agencies to provide a schedule and milestones of key activities in their year 2000 plans by April 15; (14) in January 1999, OMB implemented a requirement that federal oversight agencies include the status of selected state human services systems in their quarterly reports; and (15) specifically, OMB requested that the agencies describe actions to help ensure that federally supported, state-run programs will be able to provide services and benefits.

section_title: Letter
paragraphs: I am pleased to appear today to discuss progress being made in addressing  the Year 2000 computing challenge and to outline actions needed to ensure  a smooth conversion to the next century.  The federal government--with its  widespread dependence on large-scale, complex computer systems to  deliver vital public services and carry out its massive operations--faces an  especially enormous and difficult task.  Unless adequately confronted, Year  2000 computing problems could lead to serious disruptions in key federal  operations, ranging from national defense to benefits payments to air  traffic management.
Consequently, in February 1997, we designated the Year 2000 computing  problem as a high-risk area.  Our purpose was to stimulate greater attention  to assessing the government's exposure to Year 2000 risks and to  strengthen planning for achieving Year 2000 compliance for mission-critical  systems.  Fortunately, the past 2 years have witnessed marked  improvement in preparedness as the government has revised and  intensified its approach to this problem.
Today, I will discuss the status of the federal government’s remediation of  its mission-critical systems.  In addition, I will lay out some of the  remaining challenges facing the government in ensuring the continuity of  business operations, namely end-to-end testing and business continuity and  contingency planning, and the Office of Management and Budget’s (OMB)  efforts to identify the government’s high-impact programs.  Finally, I will  discuss the readiness of state systems that are essential to the delivery of  federal human services programs.
subsections: section_title: Improvements Made But Much Work Remains
paragraphs: Addressing the Year 2000 problem is a tremendous challenge for the federal  government. To meet this challenge and monitor individual agency efforts,  OMB directed the major departments and agencies to submit quarterly  reports on their progress, beginning May 15, 1997.  These reports contain  information on where agencies stand with respect to the assessment,  renovation, validation, and implementation of mission-critical systems, as  well as other management information on items such as business  continuity and contingency plans and costs.
The federal government's most recent reports show improvement in  addressing the Year 2000 problem. While much work remains, the federal  government has significantly increased the percentage of mission-critical  systems that are reported to be Year 2000 compliant, as figure 1 illustrates.   In particular, while the federal government did not meet its goal of having  all mission-critical systems compliant by March 1999, 92 percent of these  systems were reported to have met this goal.
While this progress is notable, 11 agencies did not meet OMB’s deadline for  all of their mission-critical systems.  Some of the systems that were not yet  compliant support vital government functions.  For example, many of the  Federal Aviation Administration’s (FAA) systems were not compliant as of  the March deadline.  As we testified last month, several of these systems  provide critical functions, ranging from communications to radar processing to weather surveillance.  Among other systems that did not  meet the March 1999 deadline are those operated by Health Care Financing  Administration (HCFA) contractors.  As we testified in February 1999,  these systems are critical to processing Medicare claims.
Additionally, not all systems have undergone an independent verification  and validation process.  For example, the Environmental Protection  Agency and the Department of the Interior reported that 57 and 3 of their  systems, respectively, deemed compliant were still undergoing  independent verification and validation.
In some cases, independent verification and validation of compliant  systems have found serious problems.  For example, as we testified before  you this February, none of HCFA’s 54 external mission-critical systems  reported by the Department of Health and Human Services as compliant as  of December 31, 1998, was Year 2000 ready, based on serious qualifications  identified by the independent verification and validation contractor.  Other  examples have been cited in agency quarterly reports.
In February 1999, the Department of Commerce reclassified a system  from compliant to noncompliant because an independent verification  and validation contractor had concerns about some of the commercial- off-the-shelf software used in the system and wanted to review  additional test data.
In February 1999, the Environmental Protection Agency reported that its  independent third-party review process found a Year 2000 error in a  system that was later repaired, tested, and returned to production.
In November 1998, the Department of Health and Human Services  reported that it removed four Indian Health Service systems from  compliant status because an independent verification and validation  contractor found that their data exchanges were not compliant.
section_title: Much Work Remains to Ensure Continuity of Federal Operations
paragraphs: Achieving individual system compliance, although important, does not  necessarily ensure that a business function will continue to operate  through the change of century--the ultimate goal of Year 2000 efforts.  Key  actions, such as end-to-end testing and business continuity and  contingency planning, are vital to ensuring that this goal is met.  Further,  OMB has recently taken action on our April 1998 recommendation to set  governmentwide priorities and has identified the government’s high-impact  programs.  This is an excellent step toward ensuring the continuing  delivery of vital services.
subsections: section_title: End-to-End Testing
paragraphs: To ensure that their mission-critical systems can reliably exchange data  with other systems and that they are protected from errors that can be  introduced by external systems, agencies must perform end-to-end testing  of their critical core business processes.  The purpose of end-to-end testing  is to verify that a defined set of interrelated systems, which collectively  support an organizational core business area or function, will work as  intended in an operational environment.  In the case of the year 2000, many  systems in the end-to-end chain will have been modified or replaced.  As a  result, the scope and complexity of testing--and its importance--are  dramatically increased, as is the difficulty of isolating, identifying, and  correcting problems.  Consequently, agencies must work early and  continually with their data exchange partners to plan and execute effective  end-to-end tests (our Year 2000 testing guide sets forth a structured  approach to testing, including end-to-end testing).
In January 1999, we testified that with the time available for end-to-end  testing diminishing, OMB should consider, for the government’s most  critical functions, setting target dates, and having agencies report against  them, for the development of end-to-end test plans, the establishment of  test schedules, and the completion of the tests.  On March 31, OMB and  the Chair of the President’s Council on Year 2000 Conversion announced  that one of the key priorities that federal agencies will be pursuing during  the rest of 1999 will be cooperative efforts regarding end-to-end testing to  demonstrate the Year 2000 readiness of federal programs with states and  other partners critical to the administration of those programs.
We are also encouraged by some agencies’ recent actions.  For example, we  testified this March, that the Department of Defense’s Principal Staff  Assistants are planning to conduct end-to-end tests to ensure that systems  that collectively support core business areas can interoperate as intended  in a Year 2000 environment.  Further, our March 1999 testimony found  that FAA had addressed our prior concerns with the lack of detail in its  draft end-to-end test program plan and had developed a detailed end-to-end  testing strategy and plans.
section_title: Business Continuity and Contingency Plans
paragraphs: Business continuity and contingency plans are essential.  Without such  plans, when unpredicted failures occur, agencies will not have well-defined  responses and may not have enough time to develop and test alternatives.   Federal agencies depend on data provided by their business partners as  well as on services provided by the public infrastructure (e.g., power,  water, transportation, and voice and data telecommunications).  One weak  link anywhere in the chain of critical dependencies can cause major  disruptions to business operations.  Given these interdependencies, it is  imperative that contingency plans be developed for all critical core  business processes and supporting systems, regardless of whether these  systems are owned by the agency.  Accordingly, in April 1998, we  recommended that the Council require agencies to develop contingency  plans for all critical core business processes.
OMB has clarified its contingency plan instructions and, along with the  Chief Information Officers Council, has adopted our business continuity  and contingency planning guide.  In particular, on January 26, 1999, OMB  called on federal agencies to identify and report on the high-level core  business functions that are to be addressed in their business continuity and  contingency plans as well as to provide key milestones for development  and testing of business continuity and contingency plans in their February  1999 quarterly reports.  Accordingly, in their February 1999 reports, almost  all agencies listed their high-level core business functions.  Indeed, major  departments and agencies listed over 400 core business functions.  For  example, the Department of Veterans Affairs classified its core business  functions into two critical areas:  benefits delivery (six business lines  supported this area) and health care.
Our review of the 24 major departments’ and agencies’ February 1999  quarterly reports found that business continuity and contingency planning  was generally well underway.  However, we also found cases in which  agencies (1) were in the early stages of business continuity and  contingency planning, (2) did not indicate when they planned to complete  and/or test their plan, (3) did not intend to complete their plans until after  April 1999, or (4) did not intend to finish testing the plans until after  September 1999.  In January 1999, we testified before you that OMB could  consider setting a target date, such as April 30, 1999, for the completion of  business continuity and contingency plans, and require agencies to report  on their progress against this milestone.  This would encourage agencies  to expeditiously develop and finalize their plans and would provide the  President’s Council on Year 2000 Conversion and OMB with more complete  information on agencies’ status on this critical issue.  To provide assurance  that agencies’ business continuity and contingency plans will work if they  are needed, we also suggested that OMB may want to consider requiring  agencies to test their business continuity strategy and set a target date,  such as September 30, 1999, for the completion of this validation.
On March 31, OMB and the Chair of the President’s Council on Year 2000  Conversion announced that completing and testing business continuity and  contingency plans as insurance against disruptions to federal service  delivery and operations from Year 2000-related failures will be one of the  key priorities that federal agencies will be pursuing through the rest of  1999.  OMB also announced that it planned to ask agencies to submit their  business continuity and contingency plans in June.  In addition to this  action, we would encourage OMB to implement the suggestion that we  made in our January 20 testimony and establish a target date for the  validation of these business continuity and contingency plans.
section_title: Recent OMB Action Could Help Ensure Business Continuity of High-Impact Programs
paragraphs: While individual agencies have been identifying and remediating mission- critical systems, the government’s future actions need to be focused on its  high-priority programs and ensuring the continuity of these programs,  including the continuity of federal programs that are administered by  states.  Accordingly, governmentwide priorities need to be based on such  criteria as the potential for adverse health and safety effects, adverse  financial effects on American citizens, detrimental effects on national  security, and adverse economic consequences.  In April 1998, we  recommended that the President’s Council on Year 2000 Conversion  establish governmentwide priorities and ensure that agencies set  agencywide priorities.
On March 26, 1999, OMB implemented our recommendation by issuing a  memorandum to federal agencies designating lead agencies for the  government’s 42 high-impact programs (e.g., food stamps, Medicare, and  federal electric power generation and delivery); the attachment contains a  list of these programs and lead agencies.  For each program, the lead  agency was charged with identifying to OMB the partners integral to  program delivery; taking a leadership role in convening those partners;  assuring that each partner has an adequate Year 2000 plan and, if not,  helping each partner without one; and developing a plan to ensure that the  program will operate effectively.  According to OMB, such a plan might  include testing data exchanges across partners, developing complementary  business continuity and contingency plans, sharing key information on  readiness with other partners and the public, and taking other steps  necessary to ensure that the program will work.  OMB directed the lead  agencies to provide a schedule and milestones of key activities in the plan  by April 15.  OMB also asked agencies to provide monthly progress reports.
section_title: States’ Systems’ Readiness Essential to the Delivery of Federal Human Services Programs
paragraphs: OMB’s March 1999 memorandum identifies several high-impact state- administered programs, such as Food Stamps, Medicaid, and Temporary  Assistance for Needy Families, in which both the federal government and  the states have a huge vested interest, both financial and social.  Reports by  us and the federal lead agencies have indicated the need for the lead federal  agency to work together with the states to ensure that programs vital to so  many individuals can continue through the change of century.
As we reported in November 1998, many systems that support such human  services programs were at risk and much work remained to ensure  continued services.  In February 1999, we testified that while some  progress had been achieved, many states’ systems have been reported to be  at risk and were not scheduled to become compliant until the last half of  1999.  Further, progress reports had been based largely on state self- reporting, which, upon site visits, has occasionally been found to be overly  optimistic.  Accordingly, we concluded that given these risks, business  continuity and contingency planning was even more important in ensuring  continuity of program operations and benefits in the event of systems  failures.
In January 1999, OMB implemented a requirement that federal oversight  agencies include the status of selected state human services systems in  their quarterly reports.  Specifically, OMB requested that the agencies  describe actions to help ensure that federally supported, state-run  programs will be able to provide services and benefits.  OMB further asked  that agencies report the date when each state’s systems will be Year 2000  compliant.  Table 1 summarizes the information gathered by the  Departments of Agriculture, Health and Human Services, and Labor on how  many state-level organizations are compliant or when in 1999 they planned  to be compliant.
This table illustrates the need for federal/state partnerships to ensure the  continuity of these vital services, since a considerable number of state-level  organizations are not due to be compliant until the last half of 1999, and the  agencies have not received reports from many states.  Such partnerships  could include the coordination of federal and state business continuity and  contingency plans for human resources programs.
One agency that could serve as a model to other federal agencies in  working with state partners is the Social Security Administration, which  relies on states to help process claims under its disability insurance  program.  In October 1997, we made recommendations to the Social  Security Administration to improve its monitoring and oversight of state  disability determination services and to develop contingency plans that  consider the disability claims processing functions within state disability  determination services systems. The Social Security Administration  agreed with these recommendations and, as we testified this February, has  taken several actions.  For example, it established a full-time disability  determination services project team, designating project managers and  coordinators and requesting biweekly status reports.  The agency also  obtained from each state disability determination service (1) a plan  specifying the specific milestones, resources, and schedules for completing  Year 2000 conversion tasks and (2) contingency plans.  Such an approach  could be valuable to other federal agencies in helping ensure the continued  delivery of services.
In addition to the state systems that support federal programs, another  important aspect of the federal government’s Year 2000 efforts with the  states are data exchanges.  For example, the Social Security Administration  exchanges data files with the states to determine the eligibility of disabled  persons for disability payments and the National Highway Traffic Safety  Administration provides states with information needed for drivers  registration.  As part of addressing this issue, the General Services  Administration is collecting information from federal agencies and the  states on the status of their exchanges through a secured Internet World  Wide Web site.  According to an official at the General Services  Administration, 70 percent of federal/state data exchanges are Year 2000  compliant.  However, this official would not provide us with supporting  documentation for this statement nor would the General Services  Administration allow us access to its database.  Accordingly, we could not  verify the status of federal/state data exchanges.
In conclusion, it is clear that much progress has been made in addressing  the Year 2000 challenge.  It is equally clear, however, that much additional  work remains to ensure the continued delivery of vital services.  The  federal government and its partners must work diligently and cooperatively  so that such services are not disrupted.
Mr. Chairman, Ms. Chairwoman, this concludes my statement.  I will be  pleased to respond to any questions that you or other members of the  Subcommittees may have at this time.
section_title: Federal High-Impact Programs and Lead Agencies
paragraphs: Housing loans (Government National Mortgage Association)
Bureau of Indians Affairs programs (continued)
The first copy of each GAO report and testimony is free. Additional copies are $2 each.  Orders should be sent to the  following address, accompanied by a check or money order made  out to the Superintendent of Documents, when necessary, VISA and  MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address are  discounted 25 percent.
U.S. General Accounting Office P.O. Box 37050 Washington, DC  20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.
Each day, GAO issues a list of newly available reports and  testimony.  To receive facsimile copies of the daily list or any list  from the past 30 days, please call (202) 512-6000 using a touchtone  phone.  A recorded menu will provide information on how to obtain  these lists.