Year 2000 Computing Challenge: Education Taking Needed Actions But Work Remains
Published: 1999-05-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Pursuant to a congressional request, GAO discussed the Department of Education's efforts to ensure that its computer systems supporting critical student financial aid activities will be able to process information reliably through the turn of the century, focusing on: (1) the progress Education has made to date in making its information systems year 2000 compliant; and (2) the future tasks facing the department.
section_title: What GAO Found
paragraphs: GAO noted that: (1) as of March 31, 1999, Education reported that all of its 14 mission-critical systems--including the 11 student financial aid delivery systems--were year 2000 compliant and in operation; (2) GAO's review of three of these systems found adequate test documentation; (3) however, the department has not yet closed out four of its systems as completing the year 2000 compliance process in accordance with Education-specific guidance; other systems issues also remain outstanding, although they are generally considered low-risk; (4) testing of data exchanges and end-to-end testing of key business processes are continuing according to the department's schedule, as is the refinement of business continuity and contingency plans; (5) while much of the work on renovating and validating mission-critical systems has been completed, and the risk of student financial aid delivery system failures has been significantly reduced, the department needs to continue making year 2000 a top priority; and (6) accordingly, it needs to focus particular attention on the following activities: (a) expeditiously resolving open issues delaying certification of the remaining four mission-critical systems still pending formal closeout; (b) continue resolving and tracking open issues, including environmental or functional changes made to existing systems; in doing so, ensure the involvement of independent verification and validation (IV&V) contractors; (c) ensuring that the new Recipient Financial Management System has been adequately tested for year 2000 compliance as each phase is implemented between now and August; (d) continue end-to-end testing of critical business processes involving Education's internal systems and its external data exchange partners; (e) ensure that results are monitored for completeness and any problems that may arise are addressed promptly--including concerns raised by the IV&V contractors; (f) continue outreach activities with schools, guaranty agencies, and other participants in the student financial aid community to share successes and lessons learned to help further reduce the likelihood of year 2000 failures; and (g) continue refining and testing the student financial aid business continuity and contingency plans, encouraging the involvement of post secondary institutions, guaranty agencies, and other external trading partners.

section_title: Letter
paragraphs: We are pleased to testify before you today on the Department of  Education's efforts to ensure that its computer systems supporting critical  student financial aid activities will be able to process information reliably  through the turn of the century.  Last year, we testified that significant risks  remained to the department's student financial aid delivery systems, risks  that involved systems testing, exchanging data with internal and external  partners, and developing business continuity and contingency plans.  We  also testified on the status of Education's mission-important and mission- supportive systems.  After providing some background information, my  statement today will briefly recap our prior findings and the actions that  were needed for reducing risk, progress by the department since then, and  future tasks facing Education.  We performed our work from March  through May 1999, in accordance with generally accepted government  auditing standards.
subsections: section_title: Background: Systems for Delivering Student Financial Aid
paragraphs: Student financial aid programs are administered by Education's Office of  Student Financial Aid Programs under title IV of the Higher Education Act  of 1965, as amended.  The four major programs providing student aid  currently in use are the Federal Family Education Loan Program (FFELP),  the Federal Direct Loan Program (FDLP), the Federal Pell Grant Program,  and campus-based programs.  These programs together will make  available over $50 billion to about 9 million students during the 1999-2000  academic year.
FFELP and FDLP are the two largest postsecondary student loan  programs, and Pell is the largest postsecondary grant program.  FFELP  provides student loans through private lending institutions; these loans are guaranteed against default by some 36 guaranty agencies and insured by  the federal government.  FDLP provides student loans directly from the  federal government, while Pell provides grants to economically  disadvantaged students.
In many ways, Education's student financial aid delivery system is similar  to functions performed in the banking industry, such as making loans,  reporting account status, and collecting payments.  The department  currently maintains 11 major systems for administering student financial  aid programs.  These systems were developed independently over time by  multiple contractors in response to new programs or mandates.  They have  resulted in a complex, highly heterogeneous systems environment.  The  systems range from legacy mainframes, several originally developed over  15 years ago, to recently developed client-server environments.
section_title: Last Year, Education Faced Major Challenges in Addressing Year 2000 Activities
paragraphs: Information systems are at the heart of the department's ability to carry out  its mission.  According to its own assessments, the student financial aid  delivery process could experience major problems if the systems upon  which it relies are not fully Year 2000 (Y2K) compliant in time.  Such risks  include delays in disbursements; reduction in Education's ability to  transfer payments, process applications, or monitor program operations;  and the potential inability of postsecondary education students to verify  the status of their loans or grants.
Last September, the department had reported to the Office of Management  and Budget (OMB) that of its 14 mission-critical systems (11 involving  student financial aid), 4 had been implemented and were operating as Y2K  compliant.  Education, along with other executive branch agencies, faced a  March 31, 1999, OMB deadline for implementation of Y2K-compliant  mission-critical systems.  Given the situation at the time, we saw three key  issues that threatened the department's ability to carry out its mission:   systems testing, data exchanges, and business continuity and contingency  planning.
Thorough Y2K testing is essential to providing reasonable assurance that  systems process dates correctly and will not jeopardize an organization's  ability to perform core business operations.  Agencies must test not only  the Y2K compliance of individual applications, but also the complex  interactions among numerous converted or replaced computer platforms,  operating systems, utilities, applications, databases, and interfaces.   Because of Education's late start and the compression of its schedule to  meet the March 31 deadline, the time available for key testing activities of  mission-critical systems was limited.
We pointed out that Education needed to mitigate critical risks that  affected its ability to award and track billions of dollars in student financial  aid by ensuring adequate testing of its systems.  We said that maintaining  testing and implementation schedules while ensuring testing adequacy  would be essential.  Effectively addressing testing reduces the risk that the  department's ability to deliver financial aid to students could be  compromised.
Data exchange—the transfer of information across systems—is the second  area of risk we identified at Education last September.  Conflicting formats  or data processed on noncompliant systems could spread errors from  system to system, compromising not only data but also the systems  themselves.  To mitigate this risk, organizations need to inventory and  assess their data exchanges, reach agreements with exchange partners on  formats and protocols, and develop contingency plans in the event of  failure.
Education's student financial aid environment is very large and complex; it  includes over 7,000 schools, 6,500 lenders, and 36 loan guaranty agencies— not to mention other federal agencies.  Figure 1 is a simplified graphic  representation of that environment.  As we reported in September, to  address its data exchanges with schools, lenders, and guaranty agencies,  Education dictated how the data that these institutions provide to the  department should be formatted.  The department handles this in one of  two ways:  it either provides software to institutions, such as EDExpress,  or it provides the technical specifications for the institution to use in  developing the necessary interface.
As of last fall, the department had been active in coordinating with its data  exchange partners.  Beyond this, however, we pointed out that Education  needed to engage in end-to-end testing of its mission-critical business  processes, including data exchanges.  Further complicating data exchange  compliance is the need to ensure that data are not only formatted  consistently but are accurate.  As we have previously reported, Education  has experienced serious data integrity problems in the past.
As Education reported last September, its own surveys showed that many  of its data exchange partners had a long way to go.  For example, in the  summer of 1998, the department and the American Association of  Community Colleges conducted surveys of the Y2K readiness of  postsecondary schools.  They found that up to one-third of the schools did  not have a compliance plan in place.
The third area we discussed last September as critical for Education was  business continuity and contingency planning.  Some problems are  inevitable as any organization enters the next century.  It is vital, then, that  realistic contingency plans be developed to ensure the continuity of core  business operations in the event of Y2K-induced failures.  And as our  testimony pointed out, continuity and contingency plans must focus on  more than agency systems alone; they must likewise address data provided  by their business partners and the public infrastructure.  One weak link  anywhere in the chain of critical dependencies can cause major disruption.
The department has been committed to developing business continuity and  contingency plans for each mission-critical business process and its  supporting systems.  It initiated contingency planning in February 1998,  and appointed a senior executive to manage the development and testing of  continuity and contingency plans for all student financial aid operations.   Completion of such plans was targeted for March 31, 1999.
section_title: Progress Has Been Made
paragraphs: As of March 31, 1999, the Department of Education reported that all of its  14 mission-critical systems—including the 11 student financial aid delivery  systems—were Y2K compliant and in operation.  Our review of three of  these systems found adequate test documentation.  However, the  department has not yet closed out four of its systems as completing the  Y2K compliance process in accordance with Education-specific guidance;  other systems issues also remain outstanding, although they are generally  considered low-risk.  Testing of data exchanges and end-to-end testing of  key business processes are continuing according to the department's  schedule, as is the refinement of business continuity and contingency  plans.
subsections: section_title: Systems Tests Were Adequately Supported But Open Issues Remain
paragraphs: As part of our work, we selected three student financial aid systems and  reviewed the contractor's change control/quality control process, test  plans, and test results.  We found adequate documentation supporting  baseline, regression, and future date testing at the unit and system levels,  as summarized in table 1.
Education reported that its 14 mission-critical systems were compliant as  of March 31, but it still has remaining tasks to complete for several of these  systems before certifying them as completing the Y2K compliance process.   The final step of the department's close out process includes a Year 2000  System Closeout form that is signed by the system manager, principal  office coordinator, Year 2000 project management team liaison, and either  the independent verification and validation (IV&V) contractor or a  representative of the Year 2000 Program Office support contractor.  The  signatures certify that the system has completed the Y2K compliance  process, consisting of successfully passing appropriate Y2K validation tests  (including IV&V), and identifying and testing data exchanges.  As of May 9,  the department had not closed out 4 of its 14 mission-critical systems,  including 2 student financial aid systems.  Education expects to close out  three of the remaining four systems by the end of this month but has not yet  received final concurrence from IV&V contractors, who are waiting to  review documentation pending from the department.  According to  Education officials, the fourth system Education’s Local Area Network  (EDNET) requires additional funding for Y2K interoperability.  Education  has requested these funds as part of a supplemental budget request to OMB  for Y2K emergency funding.
In addition to closing out the remaining 4 systems, 7 of the other 10  mission-critical systems have remaining tasks (excluding data exchange  testing) that still need to be completed.  For example, the Campus Based  System's computing environment was converted in February 1999 to  another operating system; however, the contractor for the data center has  not provided the IV&V contractor with an updated inventory of its  hardware and system-related software (e.g., operating system, system  utilities, compilers, etc.).  The inventory is due to the IV&V contractor in  mid-May for review.  Another example of an open item is a noncompliant  software product used by the Direct Loan Origination System.  The  software product was upgraded in April, but the IV&V contractor is still  waiting for documentation.
According to Education officials and the IV&V contractors, these open  issues are considered low-risk items and are in the process of being  resolved.  With the exception of data exchange testing (discussed below),  Education expects to resolve these issues over the next few months.  The  department needs to be diligent in making sure that these issues are indeed  resolved expeditiously.
The department is also currently in the process of developing a new  mission-critical system—the Recipient Financial Management System—to  replace the current Pell Grant Recipient Financial Management System.   The first two phases of the Recipient Financial Management System are  expected to be implemented on May 26, 1999, with the third phase  following on June 25, 1999, and the final phase scheduled for  implementation on August 13, 1999.  According to department officials, the  new system was developed to be Y2K compliant and is scheduled to begin  compliance testing this month.
section_title: Testing of Data Exchanges Is Ongoing
paragraphs: Beyond the testing of individual mission-critical systems, we reported last  fall that Education needed to devote a significant amount of time to testing  its data exchanges as part of its end-to-end testing approach.  In  recognition of the importance of data exchanges, the Higher Education  Amendments of 1998 specifically required that Education "fully test all data  exchange routes for Year 2000 compliance via end-to-end testing, and  submit a report describing the parameters and results of such tests to the  Comptroller General no later than by March 31, 1999."  In response to this  mandate, the department submitted a report describing various aspects of  its end-to-end testing approach and results to date.  OMB has also identified  student aid as one of 42 high-impact federal programs and has assigned the  Department of Education as the lead agency.  Education's approach  includes the following:
Testing and validating the data exchange software that the department  develops and provides to postsecondary institutions to support the  administration and application of federal student financial aid, which  includes EDExpress, Free Application for Federal Student Aid (FAFSA)  Express, and FAFSA on the Web.
Testing all of its data exchanges during the renovation and validation  process by simulating the trading partner's role (i.e., sending and  receiving data to and from the systems).
Testing the data exchange with the actual trading partner.  A series of  test dates has been scheduled for this purpose—as listed in table 2—to  confirm that the transmission performs correctly for a particular entity.
In addition to data exchange testing, as part of its continuing outreach  activities to data exchange partners, Education is in the process of sending  out another survey this month to over 7,000 postsecondary institutions to  be used in assessing how educational institutions are progressing with Y2K  compliance efforts.  The department expects to have results by June 1999.   Education also maintains an Internet web site that contains Y2K  information such as "Dear Colleague" letters about Y2K efforts, Education- developed software certification letters, and its publication entitled Year  2000 Readiness Kit: A Compilation of Y2K Resources for Schools, Colleges,  and Universities.  Also in development, according to Education, are plans  to demonstrate the readiness of its student aid application system by  having students at a local university apply for aid on systems (at the  university and at an Education data center) with the clock set forward to  February 29, 2000.
Education also reports that as of this month, 18 of the 36 student loan  guaranty agencies have Y2K-compliant systems.  Of the remaining 18  guaranty agencies still working on Y2K activities, 11 are expected to be  compliant by June 1999, with another 3 expected to be compliant by  September 1999.  Of the remaining 4, 1 guaranty agency reports it will not  be compliant until December 1999.  As part of its oversight function, the  department, which will include staff from the Office of the Inspector  General, is planning site visits to several guaranty agencies over the next  few months to review their Y2K efforts.
section_title: Business Continuity and Contingency Planning
paragraphs: In keeping with the department's commitment to engage in business  continuity and contingency planning, in November 1998 it posted an  invitation for comment on its Y2K contingency planning process for  student financial aid.  Since then, a draft plan dated February 5, 1999, has  been posted to its web site for review and comment by external trading  partners.  The draft document contains detailed plans for eight key  business processes and associated subprocesses, outlining the process  goal, description, and impact analysis.  For each subprocess, the business  impact analysis addresses failure scenarios, time horizon to failure, normal  performance levels, emergency performance levels, risk mitigation options,  and contingency options.  The mission-critical business processes are student aid application and eligibility determination; student aid origination and disbursement; student enrollment tracking and reporting; guarantor and lender payments; repayment and collection; institutional eligibility and monitoring; customer service and communication; and
Federal Family Education Loan Program origination, disbursement,  repayment, and collection.
Education also intends to test its business continuity and contingency  plans, and has requested additional funding in its supplemental budget  request to OMB to do so.  The department has conducted some preliminary  tests and anticipates doing more.  It currently expects to complete all of  these tests by June 15, 1999.
section_title: Future Tasks Facing Education
paragraphs: While much of the work on renovating and validating mission-critical  systems has been completed, and the risk of student financial aid delivery  system failures has been significantly reduced, the department needs to  continue making Y2K a top priority.  Accordingly, it needs to focus  particular attention on the following activities.
Expeditiously resolving open issues delaying certification of the  remaining four mission-critical systems still pending formal closeout.
Continue resolving and tracking open issues, including environmental or  functional changes made to existing systems; in doing so, ensure the  involvement of IV&V contractors.
Ensuring that the new Recipient Financial Management System has  been adequately tested for Y2K compliance as each phase is  implemented between now and August.
Continue end-to-end testing of critical business processes involving  Education's internal systems and its external data exchange partners.   Ensure that results are monitored for completeness and any problems  that may arise are addressed promptly—including concerns raised by  the IV&V contractors.
Continue outreach activities with schools, guaranty agencies, and other  participants in the student financial aid community to share successes  and lessons learned to help further reduce the likelihood of Y2K failures.
Continue refining and testing the student financial aid business  continuity and contingency plans, encouraging the involvement of  postsecondary institutions, guaranty agencies, and other external  trading partners.
In summary, Mr. Chairman, the Department of Education has made  progress toward making its programs and supporting systems Year 2000  compliant.  However, work remains to complete Education’s planned Y2K  program so as to ensure that the risk of disruption to student financial aid  delivery is minimized, and that the department is prepared to handle  emergencies that may arise.
This concludes my statement.  I would be pleased to respond to any  questions that you or other members of the Subcommittee may have at this  time.
The first copy of each GAO report and testimony is free. Additional copies are $2 each.  Orders should be sent to the  following address, accompanied by a check or money order made  out to the Superintendent of Documents, when necessary, VISA and  MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address are  discounted 25 percent.
U.S. General Accounting Office P.O. Box 37050 Washington, DC  20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.
Each day, GAO issues a list of newly available reports and  testimony.  To receive facsimile copies of the daily list or any list  from the past 30 days, please call (202) 512-6000 using a touchtone  phone.  A recorded menu will provide information on how to obtain  these lists.