Year 2000 Computing Crisis: Potential for Widespread Disruption Calls for Strong Leadership and Partnerships
Released: 1998-04-30T00:00:00

Letter

Background

Over the past 2 years, the term “Year 2000 Problem” has become increasingly familiar. This problem is rooted in the way in which automated information systems have, for the past several decades, typically represented the year—using two digits rather than four—in order to conserve electronic data storage space and reduce operating costs. Thus 1998 would be represented as simply 98. In this format, however, 2000 is indistinguishable from 1900 because both are represented only as 00. As a result, if not modified, computer systems or applications that use dates or perform date- or time-sensitive calculations may generate incorrect results beyond 1999, reading 00 as 1900 rather than 2000.

As we testified before the Congress a year ago, correcting this problem, in government as in the private sector, will be labor-intensive and time-consuming—and must be done while systems continue to operate.Many of the federal government’s computer systems were originally designed and developed 20 to 25 years ago; are poorly documented; and use a wide variety of computer languages—many of which are obsolete. Some applications include thousands, tens of thousands, or even millions of lines of code, each of which must be examined for date-format problems. Other system components—hardware, operating systems, communications interfaces, and database software—may also be affected by the date problem.

Many data exchanges and interdependencies also exist among federal, state, and local governments; the private sector; foreign countries; and international organizations. Therefore, systems are also vulnerable to failure caused by incorrectly formatted data provided by other systems, which are noncompliant. Examples of such data exchanges include the following situations.

Taxpayers can pay their taxes through data exchanges between the taxpayer, financial institutions, the Federal Reserve System, and the Department of the Treasury’s Financial Management Service and Internal Revenue Service.

State disability determination systems provide data on an individual’s medical eligibility for disability benefits to the Social Security Administration which uses this data to support payments to disabled persons.

Medical providers obtain payments for their medical services through data exchanges between the provider, Health Care Financing Administration (HCFA) and its contractors, the Social Security Administration, the Department of the Treasury, the Federal Reserve System, and financial institutions.

Commercial and military aircraft and ships within the United States and in foreign countries and organizations interface with the Global Positioning System, which consists of satellites, ground systems, and receivers, for navigation purposes as well as for precision targeting and smart bombs.

The Government and the Nation Face High Risk of Service Disruption Due to the Year 2000 Problem

The public faces a high risk that critical services provided by the government and the private sector could be severely disrupted by the Year 2000 computing crisis. Financial transactions could be delayed, flights grounded, power lost, and national defense affected. The many interdependencies that exist among governments and within key economic sectors could cause a single failure to have adverse repercussions. While managers in the government and the private sector are taking many actions to mitigate these risks, a significant amount of work remains, and time frames are unrelenting.

Risk of Disruption to Government Services Is High

The federal government is extremely vulnerable to the Year 2000 issue due to its widespread dependence on computer systems to process financial transactions, deliver vital public services, and carry out its operations. This challenge is made more difficult by the age and poor documentation of some of the government’s existing systems and its lackluster track record in modernizing systems to deliver expected improvements and meet promised deadlines.

Unless this issue is successfully addressed, serious consequences could ensue. For example:

Unless the Federal Aviation Administration (FAA) takes much more decisive action, there could be grounded or delayed flights, degraded safety, customer inconvenience, and increased airline costs.

Payments to veterans with service-connected disabilities could be severely delayed if the system that issues them either halts or produces checks so erroneous that it must be shut down and checks processed manually.

The military services could find it extremely difficult to efficiently and effectively equip and sustain their forces around the world.

Federal systems used to track student loans could produce erroneous information on loan status, such as indicating that a paid loan was in default. Internal Revenue Service tax systems could be unable to process returns, thereby jeopardizing revenue collection and delaying refunds.

The Social Security Administration process to provide benefits to disabled persons could be disrupted if interfaces with state systems fail.

In addition, the year 2000 could also cause problems for the many facilities used by the federal government that were built or renovated within the last 20 years and contain embedded computer systems to control, monitor, or assist in operations. Many of these systems could malfunction due to vulnerability to the Year 2000 problem. For example, heating and air conditioning units could stop functioning properly and card-entry security systems could cease to operate.

Year 2000-related problems have already been identified. For example, an automated Defense Logistics Agency system erroneously deactivated 90,000 inventoried items as the result of an incorrect date calculation. According to the agency, if the problem had not been corrected (which took 400 work hours), the impact would have been catastrophic and would have seriously hampered its mission to deliver materiel in a timely manner. In another case, the Department of Defense’s Global Command Control System, which is used to generate a common operating picture of the battlefield for planning, executing, and managing military operations, failed testing when the date was rolled over to the Year 2000.

In order to assist federal agencies in addressing their Year 2000 risks, we developed an enterprise readiness guide that offers a structured, step-by-step approach for reviewing the adequacy of agency planning and management of its Year 2000 program. The guide describes five phases of a Year 2000 program: awareness, assessment, renovation, validation, and implementation. Over 30,000 copies of the guide—which was released to the public as an exposure draft in February 1997 and issued in September 1997—have been requested.

We have also reviewed the Year 2000 programs of a number of federal agencies and have issued over two dozen reports and testimonies on this issue. (For a complete list of our reports and testimonies on the Year 2000 issue, see the “Related GAO Products” section at the end of this report.) In general, our reviews found that progress has been uneven. As discussed below, some agencies are significantly behind schedule and are at high risk that they will not fix their systems in time. Other agencies have made progress, although risks remain and a great deal more work is needed. Our reports have numerous recommendations which the agencies have almost universally agreed to implement.

Federal Aviation Administration (FAA). FAA has been severely behind schedule in completing basic awareness and assessment activities. In our January 1998 report, we concluded that at its current pace, FAA would not make it in time. Moreover, FAA had not (1) analyzed the impact of its systems’ not being Year 2000 compliant, (2) inventoried and assessed all of its systems for date dependencies, or (3) developed contingency plans to ensure continuity of operations. Accordingly, we made several recommendations including that FAA should (1) assess how its business lines and the aviation industry would be affected if the Year 2000 problem were not corrected in time and use this information to help rank the agency’s Year 2000 activities, (2) complete its inventory of all information systems and determine each one’s criticality and decide whether each system should be converted, replaced, or retired, and (3) craft Year 2000 contingency plans for all business lines. FAA has agreed to implement our recommendations.

Social Security Administration (SSA). A federal leader in addressing Year 2000 issues, SSA had made significant progress in assessing and renovating mission-critical mainframe software. However, we found that SSA remained at risk in that not all mission-critical systems necessary to prevent the disruption of benefit payments will be corrected before January 1, 2000. At particular risk are the 54 state disability determination systems that had not yet been assessed. In addition, SSA faced the risk that inaccurate data would be introduced into its databases by the hundreds of federal and state agencies and thousands of businesses with which it exchanges data files. Also, SSA had not developed contingency plans. We made several recommendations to the Commissioner of SSA to address these areas. SSA agreed with all of our recommendations and identified specific actions that it would take to ensure an adequate transition to the year 2000.

Department of Veterans Affairs (VA). We reported that at VA, the Veterans Benefits Administration is addressing the Year 2000 problem but needed to take additional action to correct its systems in time.Accordingly, we made 10 specific recommendations, such as (1) completing an analysis to determine whether the Veterans Benefits Administration’s internal applications, interfaces, and third-party products were Year 2000 compliant and (2) developing a Year 2000 contingency plan. VA agreed to implement these recommendations. In a later review, we found that VA had initiated a number of these actions but that substantial risks remained.

Department of Defense. We recently reported that the Department of Defense, which is responsible for about a third of the federal government’s reported mission critical systems, has taken positive actions to increase awareness, promote sharing of information, and encourage components to make Year 2000 remediation efforts a priority, but that its progress in fixing systems has been slow. However, Defense lacked key management and oversight controls to enforce good management practices, to direct resources, and to establish a complete picture of its progress in fixing systems. Accordingly, we recommended that the Secretary of Defense (1) establish a strong department-level program office, (2) expedite efforts to establish a comprehensive, accurate departmentwide inventory of systems, interfaces, and other equipment needing repair, (3) clearly define criteria and an objective process for prioritizing systems for repair based on their mission-criticality, (4) ensure that system interfaces are adequately addressed, (5) develop an overall, departmentwide testing strategy and a plan for ensuring that adequate resources are available to perform necessary testing, (6) require components to develop contingency plans, and (7) prepare complete and accurate Year 2000 cost estimates. The Department of Defense concurred with our recommendations. We have also recommended improvements in the Year 2000 programs of the Air Force, Logistics Systems Support Center, the Defense Finance and Accounting Service, and the Defense Logistics Agency, including the need to develop contingency plans.

Health Care Financing Administration (HCFA). HCFA administers the Medicare program, the nation’s largest health insurer. HCFA expects to process over 1 billion claims and pay $288 billion in benefits per year by 2000. In May 1997, we reported that the Heath Care Financing Administration had not taken enough initial steps, such as developing an assessment of the potential severity of the century change, to ensure that it can avoid the systems-related service disruptions that may occur as the year 2000 approaches. HCFA agreed to implement our recommendations that it identify responsibilities for managing and monitoring Year 2000 actions, prepare an assessment of the severity and timing of potential Year 2000 impact, and develop contingency plans for critical systems.

Federal Deposit Insurance Corporation. The Federal Deposit Insurance Corporation is the deposit insurer of approximately 11,000 banks and savings institutions which are responsible for over $6 trillion in assets and have insured deposits totaling upwards of $2.7 trillion. We found that while the Federal Deposit Insurance Corporation has taken aggressive efforts to ensure that the banks it oversees mitigate Year 2000 risks, it still faces significant challenges in providing a high level of assurance that individual banks will be ready. We recommended that the Federal Deposit Insurance Corporation work with other federal bank, credit union, and thrift institution regulators to, for example, revise their Year 2000 work program, complete guidance to institutions to mitigate risks associated with corporate customers and reliance on vendors, and establish a working group to develop contingency planning guidance. The Federal Deposit Insurance Corporation also agreed to our recommendations to (1) develop a tactical plan and explicit road map of the actions it plans to take based on the results of its June 1998 bank assessments and (2) ensure that adequate resources are allocated to complete its internal systems’ Year 2000 assessment and develop contingency plans for each of its mission critical systems and core business processes.

National Credit Union Administration. The National Credit Union Administration supervises and insures more than 7,200 federally chartered credit unions and insures member deposits in an additional 4,200 state-chartered credit unions. In October 1997, we reported that the National Credit Union Administration had recognized the severity of the Year 2000 problem, developed a plan, and initiated action, such as issuing several letters to credit unions alerting them of Year 2000 risks. At the same time, however, in response to our recommendations, the National Credit Union Administration agreed to take several actions to strengthen their Year 2000 efforts, including requiring credit unions to (1) report on the precise status of their Year 2000 efforts at least quarterly, including the status of addressing their interfaces and (2) implement the necessary management controls to ensure that these financial institutions have adequately mitigated the risks associated with the Year 2000 problem.

Audit offices of some states, including Arizona, Florida, Michigan, New York, and Virginia, and the District of Columbia have also identified significant Year 2000 concerns. Some of these risks include the potential that systems supporting benefit programs, motor vehicle records, and criminal records (i.e., prisoner release or parole eligibility determinations) may be adversely affected by the Year 2000 problem. These audit offices have made recommendations including the need for increased oversight, Year 2000 project plans, contingency plans, and personnel recruitment and retention strategies.

Key Economic Sectors at Risk of Year 2000 Failures

America’s infrastructures are a complex array of public and private enterprises with many interdependencies at all levels. Key economic sectors that could be seriously affected if their systems are not Year 2000 compliant are: information and telecommunications; banking and finance; health, safety, and emergency services; transportation; utilities; and manufacturing and small business. The information and telecommunications sector is especially important because it (1) enables the electronic transfer of funds, the distribution of electrical power, and the control of gas and oil pipeline systems, (2) is essential to the service economy, manufacturing, and efficient delivery of raw materials and finished goods, and (3) is basic to responsive emergency services. Illustrations of Year 2000 risks follow.

According to the Basle Committee on Banking Supervision—an international committee of banking supervisory authorities—failure to address the Year 2000 issue would cause banking institutions to experience operational problems or even bankruptcy. Moreover, the Chair of the Federal Financial Institutions Examination Council, a U.S. interagency council composed of federal bank, credit union, and thrift institution regulators, who is also the Comptroller of the Currency, stated that banking is one of America’s most information-intensive businesses and that any malfunctions caused by the century date change could affect a bank’s ability to meet its obligations. He also stated that of equal concern are problems that customers may experience that could prevent them from meeting their obligations to banks and that these problems, if not addressed, could have repercussions throughout the nation’s economy.

According to the International Organization of Securities Commissions, the year 2000 presents a serious challenge to the world’s financial markets. Because they are highly interconnected, a disruption in one segment can spread quickly to others.

FAA recently met with representatives of airlines, aircraft manufacturers, airports, fuel suppliers, telecommunications providers, and industry associations to discuss the Year 2000 issue. Participants raised the concern that their own Year 2000 compliance would be irrelevant if FAA were not compliant because of the many system interdependencies. Representatives went on to say that unless FAA was substantially Year 2000 compliant on January 1, 2000, flights would not get off the ground and that extended delays would be an economic disaster.

Another risk associated with the transportation sector was described by the Federal Highway Administration which stated that highway safety could be severely compromised because of potential Year 2000 problems in operational transportation systems. For example, date dependent signal timing patterns could be incorrectly implemented at highway intersections if traffic signal systems run by state and local governments do not process four-digit years correctly.

One risk associated with the utility sector is the potential loss of electrical power. For example, Nuclear Regulatory Commission staff believe that safety-related safe shutdown systems will function but that a worst-case scenario could occur in which Year 2000 failures in several nonsafety-related systems could cause a plant to shut down, resulting in the loss of off-site power and complications in tracking post-shutdown plant status and recovery.

With respect to the health, safety, and emergency services sector, according to the Department of Health and Human Services, the Year 2000 issue holds serious implications for patient care and scientific research activities of the federal government, and for the nation’s health care providers and researchers in general. Medical devices and scientific laboratory equipment may experience problems beginning January 1, 2000, if the computer systems, software applications, or embedded chips used in these devices contain two-digit fields for year representation. In addition, according to the Gartner Group, health care is substantially behind other industries in Year 2000 compliance and it predicts that at least 10 percent of mission-critical systems in this industry will fail because of noncompliance.

In addition to the risks associated with the nation’s key economic sectors, one of the largest, and largely unknown, risks relates to the global nature of the problem. With the advent of electronic communication and international commerce, the United States and the rest of the world have become critically dependent on computers. However, there are indications of Year 2000 readiness problems in the international arena. In September 1997, the Gartner Group, a private research firm acknowledged for its expertise in Year 2000 issues, surveyed 2,400 companies in 17 countries and concluded that “hirty percent of all companies have not started dealing with the year 2000 problem. Small companies, health care organizations, educational institutions, and many companies in 30 percent of the world’s countries are at a high risk of seeing year 2000 mission-critical failures due to a lack of readiness.”

In this survey of companies in 17 countries, the Gartner Group also ranked certain countries and areas of the world. According to it, countries/areas at level I on its scale of compliance—just getting started—include Eastern Europe, many African countries, many South American countries, and several Asian countries, including China. Those at level II—completed the inventory process and have begun the assessment process—include Japan, Brazil, South Africa, Taiwan, and Western Europe. Finally, some companies in the United States, the United Kingdom, Canada, and Australia are at levels II while others are at level III. Level III indicates that a program plan has been completed and dedicated resources are committed and in place.

Although there are many national and international risks to key economic sectors related to the Year 2000, our limited review of these key sectors found a number of private-sector organizations that have raised awareness and provided advice through publications, conferences, and guidance. For example:

The Securities Industry Association established a Year 2000 committee in 1995 to promote industry awareness, and since then has established other committees and subcommittees to address key Year 2000 issues, such as testing, and has issued guidelines.

The Electric Power Research Institute sponsored a conference in 1997 with utility professionals to explore the Year 2000 issue in embedded systems.

Representatives of several oil and gas companies formed a Year 2000 energy industry group, which meets regularly to discuss the Year 2000 problem.

The International Air Transport Association formed an information management committee and organized Year 2000 seminars and briefings for many segments of the airline industry.

In addition, information technology industry associations, such as the Information Technology Association of America, have published newsletters, issued guidance, and held seminars to focus information technology users on the Year 2000 problem.

Growing Concern Led to Increased Federal Role

As the Year 2000 has grown nearer and the scope of the problem has become clearer, the federal government’s response to the crisis has grown as well. At the urging of congressional leaders and others, OMB and the federal agencies have dramatically increased the amount of attention and oversight given to this issue in the last year. Moreover, last month the President issued an executive order establishing a President’s Council on Year 2000 Conversion and recognizing the national and international aspects of the problem.

Congressional oversight has played a key role in focusing OMB and agency attention on the Year 2000 problem. In addition, Congressional hearings on the international, national, governmentwide, and agency-specific Year 2000 problems have exposed the threat that the Year 2000 poses to the public.

OMB’s Initial Response to the Year 2000 Problem

In the fall of 1995, OMB asked SSA to be champion for the Year 2000 issue for the federal government. In this role, SSA formed an informal interagency working group on the Year 2000, chaired by the Assistant Deputy Commissioner for Systems of the Social Security Administration, which met for the first time in November 1995. This interagency working group subsequently developed best practices for the Year 2000 conversion. The group later evolved into the Chief Information Officer (CIO) Council’s Year 2000 Committee. The committee has two objectives: (1) re-emphasize information technology management practices to ensure that mission critical systems work on, before, and after January 1, 2000, and (2) identify joint efforts to leverage resources for solving the Year 2000 problem.

In April 1996, OMB sent a memorandum to agency senior information resource management officials and CIOs requesting that agencies’ 5-year information resources management plans include their Year 2000 strategy. In addition, OMB stated that agencies should avoid acquiring commercial off-the-shelf products and application software that are not year 2000 compliant, except in emergency situations. In a follow-up to this memorandum, OMB sent a memorandum to the deputy heads of departments and agencies urging them to discuss the Year 2000 issue with their managers and computer professionals.

On February 6, 1997, OMB issued a broader Year 2000 strategy for the federal government. The strategy was predicated on three assumptions: (1) senior agency managers will take whatever action is necessary to address the problem, (2) a single solution to the problem does not exist, and (3) given the limited amount of time available, emphasis will be placed on mission-critical systems. At the department or agency level, OMB’s strategy relied on the CIOs to direct agency Year 2000 actions.

To monitor individual agency efforts, OMB required the major departments and agencies to submit quarterly reports on their progress. Specifically, OMB asked agencies to report where they stand with respect to completing the assessment, renovation, validation, and implementation phases. OMB’s first governmentwide progress report, based on 24 agencies’ May 1997 reports, was transmitted to selected congressional committees on June 23, 1997. While acknowledging that much work remained, OMB expressed its belief that agencies had made a good start in addressing the problem and reported that agencies had identified no mission-critical systems that were behind schedule.

In July 1997 testimony, we disagreed with OMB’s position, stating that we believed that there was ample evidence that OMB and key federal agencies needed to heighten their levels of concern and move with more urgency. First, most agencies’ reported schedules left little time to resolve unanticipated problems. Second, OMB’s perspective was based on agency self-reporting which had not been independently validated. Third, entities may have interpreted the term “mission critical” in various ways. Fourth, OMB, in its governmentwide schedule, established only 1 month for the validation phase which is critical for thorough testing and, according to the Gartner Group, testing could consume over 40 percent of the time and resources of the entire Year 2000 program. In this testimony, we also identified other major areas—data exchanges, systems prioritization, and contingency planning—that we considered essential for OMB to emphasize.

OMB Takes Additional Actions

In response to information provided by agencies in their August quarterly report and the issues raised at the July hearing, OMB began taking more aggressive action on Year 2000 matters. For example, in the next governmentwide report, dated August 15, 1997, and released in September, OMB noted increasing concern with agencies’ progress and announced additional initiatives to address the Year 2000 problem. The report stated that while progress had been made overall, it was not uniform across the agencies. Accordingly, OMB placed agencies in three tiers based on their progress in addressing the Year 2000 problem: (1) 4 agencies showed insufficient evidence of progress, (2) 12 agencies showed evidence of progress but OMB also had concerns, and (3) 8 agencies appeared to be making sufficient progress. OMB established a rebuttable presumption for agencies in the first tier that it would not fund requests for information technology investments in the fiscal year 1999 budget formulation process unless they were directly related to fixing the Year 2000 problem.

OMB also announced other initiatives in its August 15, 1997, governmentwide report. First, OMB emphasized that validation activities were critical to success and stated that it planned to meet with agencies in the following months to discuss the adequacy of scheduled timetables for completing validation. Second, OMB said that it would address interfaces with systems external to the federal government, including those of state and local governments and the private sector. Third, OMB asked agencies for a summary of the contingency plan for any mission-critical system that was reported behind schedule in two consecutive quarterly reports and planned to summarize such plans in future reports to the Congress.

OMB’s report issued in December 1997 and dated as of November 15, 1997, stated that while all agencies had shown progress, the extent of that progress was mixed. OMB expressed its concern about whether agencies will have enough time to adequately test mission-critical systems in production settings. Writing that “the sense of urgency should be clear to both our private-sector suppliers and to those with whom we exchange data,” OMB accelerated two of its governmentwide target milestones. It moved up the date for completion of renovation by 3 months (from December to September 1998), and for implementation by 8 months (from November 1999 to March 1999).

Along with accelerated target completion dates, OMB acknowledged its expectation that some systems will not meet the [March 1999 implementation] target. Because of this, in January 1998, OMB asked agencies—for their February 15, 1998 reports—to identify steps they are taking to develop contingency plans for systems that may not meet the deadline. Further, following the lead of several private companies, OMB also asked agencies to report on independent verification activities, in which independent entities determine whether agency systems have in fact been made Year 2000 compliant.

OMB’s last report, issued on March 10, 1998, stated that while good progress has been made, it is not rapid enough overall. Only 9 of the 24 departments and agencies summarized in OMB’s governmentwide report were determined to be making satisfactory progress. (The Departments of the Interior and Veteran Affairs, the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, National Science Foundation, Nuclear Regulatory Commission, Small Business Administration, and the Social Security Administration).

State/Federal Year 2000 Initiatives Are Underway

Data exchanges between the federal government and the states are also critical to ensuring that billions of dollars of benefits payments are made to millions of recipients. Consequently, in October 1997 the Commonwealth of Pennsylvania hosted the first State/Federal CIO Summit. Participants resolved to (1) use a four-digit contiguous computer standard for data exchanges between states and federal agencies, (2) establish a national policy group, cochaired by the administrator of OMB’s Office of Information and Regulatory Affairs and the president of the National Association of State Information Resource Executives (who is also California’s CIO), and (3) create a joint state/federal technical group, cochaired by the chair of the federal CIO Council Year 2000 Committee and the chair of the National Association of State Information Resource Executives’ Subcommittee on Year 2000. We participated in this summit and have also initiated a governmentwide review of actions to address the Year 2000 problems associated with electronic data exchanges.

The President Broadens the Federal Year 2000 Role

Although the federal government’s Year 2000 efforts to date have primarily focused on government agencies, we and congressional leaders have urged the administration to expand the federal government’s Year 2000 outlook beyond federal agencies and their programs. On February 4, 1998, the President issued an executive order which could achieve this goal. The executive order states that agencies shall (1) assure that no critical federal program experiences disruption because of the Year 2000 problem, (2) assist and cooperate with state, local, and tribal governments where those governments depend on federal information or where the federal government is dependent on those governments to perform critical missions, (3) cooperate with private sector operators of critical national and local systems, and (4) communicate with their foreign counterparts to raise awareness of and generate cooperative international arrangements. To implement these policies, the order states that each agency head shall assure that efforts to address the Year 2000 problem receive the highest priority attention in his/her agency.

The executive order also established the President’s Council on Year 2000 Conversion led by an Assistant to the President and comprised of one representative from each of the executive departments and from other federal agencies as may be determined by the Chair. The Chair of the Council was tasked with the following Year 2000 roles: (1) overseeing the activities of agencies, (2) acting as chief spokesperson in national and international forums, (3) providing policy coordination of executive branch activities with state, local, and tribal governments, and (4) promoting appropriate federal roles with respect to private sector activities. In addition, the executive order requires the Chair and OMB to report to the President quarterly on the progress of agencies in addressing the Year 2000 problem.

Additional Actions Can Be Taken to Reduce Year 2000 Risks

The increased attention that the administration has given to solving the Year 2000 problem could help minimize the disruption to the nation as the millennium approaches. In particular, the new President’s Council on Year 2000 Conversion can initiate the additional actions needed to mitigate the many risks and uncertainties associated with the Year 2000. These actions could include fixing the government’s highest priority systems first and developing contingency plans.

Setting Priorities Is Critical

Agencies have taken longer to complete the awareness and assessment phases than is recommended. This leaves less time for the critical renovation, validation, and implementation phases. For example, the Air Force has used nearly 46 percent of its available time completing the awareness and assessment phases while the Gartner Group estimates that no more than 26 percent of an organizations’ year 2000 effort should be spent on these phases.

Consequently, priority-setting is absolutely essential. As illustrated in figure 1, according to the February 1998 agency quarterly reports, about 35 percent of federal agencies’ mission-critical systems were considered to be Year 2000 compliant. This leaves over 3,500 mission-critical systems (45 percent), as well as thousands of nonmission-critical systems, still to be repaired and over 1,100 systems (15 percent) to be replaced. It is unlikely that agencies can complete this vast amount of work in time. Accordingly, it is critical that the Executive Branch identify those systems that are of the highest priority. These include those that, if not corrected, could most seriously threaten health and safety, the financial well being of American citizens, national security, or the economy.

Despite the importance of making sure that the most critical systems are fixed and thoroughly tested, OMB has not set governmentwide priorities to help agencies determine which systems perform the most essential services and direct resources to correct these systems first. OMB’s most recent guidance sets the same deadline (March 1999) for agencies to implement Year 2000 fixes for both mission and nonmission-critical systems. While OMB made this change with the intention of fixing systems in time for them to be thoroughly tested and implemented well in advance of January 1, 2000, this change could have the unintended consequence of diverting agency attention from the most critical systems.

Agencies must also ensure that their mission critical systems can properly exchange data with other systems and are protected from errors that can be introduced by external systems. For example, agencies that administer key federal benefits payment programs, such as the Department of Veterans Affairs, must exchange data with the Department of the Treasury which, in turn, interfaces with financial institutions, to ensure that beneficiary checks are issued. It is important that the executive branch consider this issue because to complete end-to-end testing, agencies must secure the cooperation of other agencies and the private sector. In its February 1998 quarterly report, the Department of Transportation cited a concern about its inability to control end-to-end testing of system operations involving telephone companies and third-party operators of telecommunications links. Transportation stated that these private-sector entities must be committed to ensuring that mission-critical communications are not affected by the Year 2000. However, the executive branch has not directed that operational end-to-end testing be conducted of all steps in this process and that this testing be independently verified and validated. Without such testing and independent verification and validation, the agency authorizing the payments could find its Year 2000 efforts failing even if its own systems are Year 2000 compliant.

Monitoring of Agency Progress Needs to Be Improved

OMB’s reports on agency progress do not fully and accurately reflect the federal government’s true progress because not all agencies are required to report their progress and OMB’s reporting requirements are incomplete. For example,

OMB had not until recently required independent agencies to submit quarterly reports. Accordingly, the status of these agencies’ Year 2000 programs has not been monitored centrally. On March 9, 1998, OMB asked an additional 31 agencies, including the Securities and Exchange Commission and the Pension Benefit Guaranty Corporation, to report on their progress in fixing the Year 2000 problem by April 30, 1998. OMB plans to include a summary of those responses in its next quarterly report to the Congress. However, unlike its reporting requirements for the major departments and agencies which requires them to report quarterly, the March 9th memorandum stated that OMB did not plan to request that the independent agencies report again until next year. Since the independent agencies will not be reporting again until 1999, it will be difficult for OMB to be in a position to address any major problems. In providing comments on this report, the Chairman of the President’s Council on Year 2000 Conversion stated that he and OMB will ask these agencies to report more frequently if, based on their April 1998 reports, it is apparent that there are problems.

Agencies are required to report their progress in repairing noncompliant systems but are not required to report on their progress in implementing systems to replace noncompliant systems, unless the replacement effort is behind schedule by 2 months or more. Because federal agencies have a poor history of delivering new system capabilities on time, it is essential to know agencies’ progress in implementing replacement systems.

OMB’s guidance does not specify what steps must be taken to complete each phase of a Year 2000 program (i.e., assessment, renovation, validation, and implementation). Without such guidance, agencies may report that they have completed a phase when they have not. For example, while the Defense Logistics Agency told us that it had completed the assessment phase, we found that it had not addressed several critical steps associated with the assessment phase, such as prioritizing systems for correction. As previously noted, our enterprise readiness guide provides information on the key tasks that should be performed within each phase.

In a December 1997 letter to OMB, the Chairman, Subcommittee on Government Management, Information and Technology, House Committee on Government Reform and Oversight, expressed similar concerns, stating that “OMB needs to require agency plans and reports that are more comprehensive and more reliable.”

Contingency Plans Imperative

In January 1998, OMB asked agencies to describe their contingency planning activities in their February 1998 quarterly reports. These instructions stated that contingency plans should be established for mission-critical systems that are not expected to be implemented by March 1999, or for mission-critical systems which have been reported as 2 months or more behind schedule. Accordingly, in their February 1998 quarterly reports, several agencies reported that they planned to develop contingency plans only if they fall behind schedule in completing their Year 2000 fixes.

Agencies that develop contingency plans only for systems currently behind schedule, however, are not addressing the need to ensure the continuity of a minimal level of core business operations in the event of unforeseen failures. As a result, when unpredicted failures occur, agencies will not have well-defined responses and may not have enough time to develop and test effective contingency plans. Contingency plans should be formulated to respond to two types of failures: those that can be predicted (e.g., system renovations that are already far behind schedule) and those that are unforeseen (e.g., a system that fails despite having been certified as Year 2000 compliant or a system that cannot be corrected by January 1, 2000, despite appearing to be on schedule today).

Moreover, contingency plans that focus only on agency systems are inadequate. Federal agencies depend on data provided by their business partners as well as on services provided by the public infrastructure (e.g., power, water, transportation, and voice and data telecommunications). One weak link anywhere in the chain of critical dependencies can cause major disruptions to business operations. Given these interdependencies, it is imperative that contingency plans be developed for all critical core business processes and supporting systems, regardless of whether these systems are owned by the agency.

In its latest governmentwide Year 2000 progress report, issued March 10, 1998, OMB clarified its contingency plan instructions. OMB stated that while it requires agencies to report on their contingency plans under the circumstances described above, contingency plans should be developed for all core business functions. On March 18, we issued an exposure draft of a guide to help agencies ensure the continuity of operations through contingency planning. The CIO Council worked with us in developing this guide and intends to adopt the guide for federal agency use.

Independent Verification of Progress Needed

OMB’s assessment of the current status of federal Year 2000 progress is predominantly based on agency reports that have not been consistently verified or independently reviewed. Without such independent reviews, OMB and others, such as the President’s Council on Year 2000 Conversion, have no assurance that they are receiving accurate information. For example, as previously discussed, we have found agencies reporting that they have completed the assessment phase when critical work in this phase remained. In another example, the Defense Finance and Accounting Service had not performed adequate testing to assert that certain systems it had reported as compliant were capable of transitioning into the year 2000. Specifically, managers of three systems reported as compliant indicated that they had performed some tests on the transfer and storage of dates, but had not completed all Year 2000 compliance tests.

We are also concerned about whether agencies have completed the assessment phase or are accurately reporting their status. Over two-thirds of the agencies stated that they had completed the assessment phase by November 1997, but in February 1998, several of these same agencies reported significant changes in the total number of mission-critical systems or increases in the number of systems being replaced, repaired or retired—decisions that should have been made during the assessment phase. For example, although the Department of Energy reported that it had completed the assessment phase in November, it reported in February 1998 that the number of mission-critical systems had decreased by 21 percent (468 systems to 370) with corresponding decreases in the number already compliant, being replaced, and being repaired. Most of these changes were attributed to reclassifying systems as nonmission critical. Classification of systems should have been completed in the assessment phase. In addition, from November 1997 to February 1998, the Department of Agriculture increased the number of systems being replaced by 350 percent (from 58 to 261) and increased the number being retired by 17 percent (126 to 147), even though it reported that its assessment was complete in November 1997. There was no explanation for these changes in Agriculture’s February report.

OMB has acknowledged the need for independent verification and has asked agencies to report on their independent verification activities in their February 1998 quarterly reports. Accordingly, the agencies described their current or planned verification activities in their February reports, which included internal management processes, reviews by the agencies’ inspectors general, and ongoing or planned contracts with vendors to perform independent verification and validation. While this has helped provide assurance that some verification is taking place through internal checks, reviews by inspectors general, or contractors, the full scope of verification activities required by OMB has not been articulated.

It is important that the executive branch set standards for the types of reviews needed to provide assurance regarding the agencies’ Year 2000 actions. Such standards could encompass independent assessments of (1) whether the agency has developed and is implementing a comprehensive and effective Year 2000 program, (2) the accuracy and completeness of the agency’s quarterly report to OMB, including verification of the status of systems reported as compliant, (3) whether the agency has a reasonable and comprehensive testing approach, and (4) the completeness and reasonableness of the agency’s business continuity and contingency planning.

Ability to Address Governmentwide Issues Could Be Strengthened

The CIO Council’s Year 2000 Committee has been useful in addressing governmentwide issues. For example, the Year 2000 Committee worked with the Federal Acquisition Regulation Council and industry to develop a rule that (1) establishes a single definition of Year 2000 compliance in executive branch procurement and (2) generally requires agencies to acquire only Year 2000-compliant products and services or products and services that can be made Year 2000 compliant. The Year 2000 Committee has also established subcommittees on (1) best practices, (2) state issues and data exchanges, (3) industry issues, (4) telecommunications, (5) buildings, (6) biomedical and laboratory equipment, (7) General Services Administration support and commercial off-the-shelf products, and (8) international issues.

The committee’s effectiveness could be further enhanced. For example, currently agencies are not required to participate in the Year 2000 Committee. Without such full participation, it is less likely that appropriate governmentwide solutions can be implemented. Further, while most of the committee’s subcommittees are currently working on plans, they have not published these with associated milestones. It is important that these plans and accompanying milestones be finalized and publicized quickly so that agencies can use this information in their Year 2000 programs. It is equally important that implementation of agency activities resulting from these plans be monitored closely and that the subcommittees’ decisions be enforced.

Another governmentwide issue that needs to be addressed is the availability of information technology personnel. According to the Information Technology Association of America, the United States has a shortage of 346,000 information technology personnel. In their February 1998 quarterly reports, the Departments of Agriculture, Health and Human Services, Justice, Labor, State, and Veterans Affairs as well as the Small Business Administration and Patent and Trademark Office reported that they or their contractors had problems obtaining and/or retaining information technology personnel. We also identified staffing concerns at the National Credit Union Administration, Army’s Logistics Systems Support Center, and VA’s Veterans Benefits Administration.The Internal Revenue Service has also stated that it needs to address critical recruitment and retention issues related to the Year 2000 problem as well as other information technology projects.

Currently, no governmentwide strategy exists to address recruiting and retaining information technology personnel with the appropriate skills for Year 2000-related work. Until recently, the CIO Council had not addressed this issue. We have not performed an analysis of the government’s information technology personnel needs to address the Year 2000 problem. However, before the personnel issue reaches a grave condition, it would be prudent for the CIO Council to identify and champion personnel strategies, such as obtaining waivers to rehire retired federal personnel and identifying incentives to retain needed staff, that could be implemented quickly by agencies with staffing problems.

While a draft of this report was out for comment, this issue was discussed at the March 18, 1998, meeting of the CIO Council. The Office of Personnel Management (OPM) provided the council with information on the tools that are currently available to help agencies obtain and retain staff. In addition, the council agreed that OPM and the Human Resources Technology Council would form a working group to look at any additional tools that could be made available to help agencies obtain and retain staff for the Year 2000 challenge. This working group is tasked with providing recommendations by May 1998. On March 30, 1998, OPM issued a memorandum stating that the Year 2000 problem was an “unusual circumstance” which would allow OPM to grant agencies waivers to allow them to rehire former federal personnel without financial penalty on a temporary basis to address the Year 2000 problem. This same memorandum advised the agencies of their ability to make exceptions to the biweekly limitation on premium pay when the head of an agency or designee determines that an emergency involving a direct threat to life or property exists.

Success of the New Presidential Council Is Critical

Given the sweeping ramifications of the Year 2000 issue, other countries have set up mechanisms to solve the Year 2000 problem on a nationwide basis. Several countries, such as the United Kingdom, Canada, the Netherlands, and Australia, have appointed central organizations to coordinate and oversee their governments’ responses to the Year 2000 crisis. In the case of the United Kingdom, a ministerial group is being established, under the leadership of the President of the Board of Trade, to tackle the Year 2000 problem across the public and private sectors. In addition, the British Prime Minister has stated that he will use his country’s European Union presidency to raise the profile of the Year 2000 crisis throughout Europe and the world.

These countries have also established public/private forums to address the Year 2000 problem. For example, in September 1997, Canada’s Minister of Industry established a government/industry Year 2000 task force of representatives from banking, insurance, transportation, manufacturing, telecommunications, information technology, small and medium-sized businesses, agriculture, and the retail and service sectors. The Canadian CIO is an ex-officio member of the task force. It has been charged with providing (1) an assessment of the nature and scope of the Year 2000 problem, (2) the state of industry preparedness, and (3) leadership and advice on how risks could reduced.

The Canadian task force issued a report in February 1998 with 18 recommendations to all levels of government and to private sector associations and businesses. These recommendations are intended to promote public/private sector cooperation as well as to prompt remedial actions. The task force published its report 4 months earlier than planned because of the seriousness of the Year 2000 situation. According to the task force it made this decision, “trusting that our recommendations, designed to focus business attention and bring about action on this critical issue, will be implemented with similar urgency.” Among these recommendations were that (1) formal action plans, if not already in place, be immediately implemented by every business leader, chief executive officer, president, and business owner and that these plans, along with progress reports, be shared with all trade partners in the Canadian national supply chain—with due consideration to commercial and legal circumstances, (2) all levels of government, before introducing legislation or regulatory changes, consider the impact that these changes may have in terms of reprogramming information systems and diverting resources from Year 2000 preparedness efforts, (3) all lending institutions as a prerequisite for loans and the insurance community for issuance/renewal of an insurance policy, should require the availability of a formal Year 2000 plan, and (4) regulators at all levels of government complete an assessment of the impacts that Year 2000 failures in their regulated industries would have on their regulatory objectives, and revise, where appropriate, their compliance assessment procedures, and exert, where possible, “moral suasion” on the importance of Year 2000 preparedness.

In the United States, the President’s February 4, 1998, executive order could serve as the linchpin that bridges the nation’s and the federal government’s various Year 2000 initiatives. While the Year 2000 problem could have serious consequences, there is no comprehensive assessment of the nation’s readiness. As one of its first tasks, the President’s Council on Year 2000 Conversion could formulate such a comprehensive assessment in partnership with the private sector and state and local governments.

Many organizational and managerial models exist that the Conversion Council could use to build effective partnerships to solve the nation’s Year 2000 problem. Because of the need to move swiftly, one viable alternative would be to consider using the sector-based approach used recently by the President’s Commission on Critical Infrastructure Protection as a starting point. The Commission also called for a framework for implementing a national infrastructure protection policy, working in conjunction with state and local governments and the private sector.

One possible way to create a Year 2000 national coordination approach could involve federal agency focal points working with sector infrastructure coordinators. These coordinators would be created or selected from existing associations and would facilitate sharing information among providers and the government. Using this model, the President’s Council on Year 2000 Conversion could establish public/private partnership forums composed of representatives of each major sector that, in turn, could rely on task forces organized along economic sector lines, if necessary. Such groups would help (1) gauge the nation’s preparedness for the Year 2000, (2) periodically report on the status and remaining actions of each sector’s year 2000 remediation efforts, and (3) ensure the development of contingency plans to assure the continuing delivery of critical public and private services.

Conclusions

While the Year 2000 crisis has the potential to be catastrophic, the very real risks can be mitigated and disruptions minimized with proper attention and management. At the federal level, additional attention to the systems that serve the highest priorities, such as health and safety, would help ensure that the most essential government services continue without disruption beyond 1999. Moreover, the executive branch could improve oversight of federal agencies’ Year 2000 efforts by requiring business continuity and contingency plans for all mission-critical systems and instructing all key agencies to report regularly on the status of their Year 2000 efforts.

A coordinated, public/private effort, under the leadership of the executive branch, could provide a forum and bring together the key players in each key economic sector to effectively coordinate the nation’s Year 2000 efforts and assure that each sector, as well as sector interdependencies, are being adequately addressed. Further, public/private forums, in conjunction with the President’s new Year 2000 Conversion Council, could be instrumental in developing business continuity and contingency plans to safeguard the continued delivery of critical services for each key economic sector. While we do not foresee the federal government as dictating policy or requiring specific solutions, it is, however, uniquely positioned to publicize the Year 2000 computing crisis as a national priority, take a leadership role, and identify, assess, and report on the risks and necessary remediation efforts associated with the nation’s key economic sectors. Such plans would be most effective if they bring to bear the combined and considerable influence of the federal government, state and local governments, and the private sector.

Recommendations

To more effectively oversee the activities of federal agencies to address the Year 2000 crisis, we recommend that the Chairman of the President’s Council on Year 2000 Conversion establish governmentwide priorities, and ensure that agencies set agencywide priorities, for the most mission-critical business processes and supporting systems, using criteria such as the potential for adverse health and safety effects, adverse financial effects on American citizens, detrimental effects on national security, and adverse economic consequences; for the selected priorities, designate a lead agency to be responsible for ensuring that end-to-end operational testing of these processes and supporting systems occurs across organizational boundaries, and that independent verification and validation of such testing has been performed; identify all federal agencies beyond the departments and agencies currently reporting that are central to the success of Year 2000 readiness and require them to provide regular reports to OMB; require, as part of the quarterly reporting requirement, agencies to report to OMB on their progress in implementing systems intended to replace noncompliant systems; identify and publicize expectations on the key activities that should be accomplished for each of the assessment, renovation, validation, and implementation phases, and direct agencies to adhere to these expectations in reporting on the status of their programs; require agencies to develop contingency plans for all critical core business require agencies to develop an independent verification strategy to involve inspectors general or other independent organizations in reviewing agency Year 2000 progress, to include (1) assessing whether the agency has developed and is implementing a comprehensive and effective Year 2000 program, (2) providing an independent assessment of the agency’s quarterly report to OMB, (3) assessing whether the agency has a reasonable and comprehensive testing approach, and (4) assessing the completeness and reasonableness of the agency’s business continuity and contingency planning; ensure that agencies participate in the CIO Council’s Year 2000 Committee and that the CIO Council’s Year 2000 Committee subcommittees establish and publicize plans, milestones, and enforcement mechanisms; and develop a personnel strategy which includes (1) determining the need for various information specialists, (2) identifying any administrative or statutory changes that would be required to waive reemployment penalties for former federal employees, and (3) identifying ways to retain key Year 2000 staff in agencies through the turn of the century.

To steer the United States through the Year 2000 crisis, we recommend that the Chairman of the President’s Council on Year 2000 Conversion develop a comprehensive picture of the nation’s Year 2000 readiness, which would include identifying and assessing the risks of the nation’s key economic sectors, including those posed by international links and by the failure of critical infrastructure components; establish public/private partnership forums composed of representatives of each major economic sector to help (1) gauge the nation’s preparedness for the Year 2000, (2) periodically report on the status and remaining actions of each sector’s Year 2000 remediation efforts, and (3) ensure the development of contingency plans to assure the continuing delivery of critical public and private services.

Agency Comments and Our Evaluation

The Chairman of the President’s Council on Year 2000 Conversion provided comments on the recommendations contained in this report on March 23, 1998. A copy of these comments is reprinted in appendix II. We also met with the Chairman on March 30, 1998, to further discuss the need to implement our recommendations and to obtain clarification of his written comments.

Regarding our recommendation on setting priorities, the Chairman stated that agencies have established their priorities by identifying their mission-critical systems. Further, the Chairman stated that the council’s focus at this time should be to assist agencies as they work to ensure that all of their mission critical systems are ready for the year 2000. He added that it may be necessary at a later date for agencies to further prioritize these systems.

While priority setting is always an iterative process, it would be prudent to give this more concentrated attention now. Only a little over one-third of the 24 agencies analyzed by OMB in its governmentwide report were making satisfactory progress and many critical large departments and agencies were not. For example, we are reporting today that the Department of Defense, which is responsible for about one-third of the government’s mission-critical systems, has not yet determined, at the department level, which systems have the highest impact on its mission. Consequently, we are recommending that DOD clearly define criteria and an objective process for prioritizing systems for repair based on their mission criticality, and ensure that the most mission-critical systems will be repaired first. The department concurred with our recommendation and stated that “. . . the Secretary of Defense will define criteria and a process for prioritizing systems for repair based on the needs and mission of the Department of Defense. This process will be implemented no later than June 30, 1998.”

The time to reassess priorities and make difficult decisions is now, while agencies can concentrate attention on those systems that are essential to public health and safety, the financial well being of American citizens, national security, or the economy. If priorities are not clearly set, the government may find that its highest priority systems are not ready in time but that they could have been corrected had management attention and resources been properly focused earlier. To help identify the government’s most critical systems, (1) the Council on Year 2000 Conversion should set governmentwide priorities and (2) agencies must ensure that all component entities evaluate their systems using consistent priority-setting criteria that accurately reflect the agencies’ core mission.

Regarding our related recommendation on end-to-end operational testing and independent verification and validation of such testing, the Chairman stated that agencies are currently developing such plans and obtaining independent verification and validation for their systems. He added that the council and OMB will monitor these activities. In our March 30 meeting with the Chairman, he added that if any difficulty arises in getting agencies to cooperate with respect to end-to-end testing, he or OMB will intervene to resolve the matter.

Because time is short and thorough end-to-end testing of critical systems and processes across organizational boundaries is essential, the council should ensure that a lead agency for each high priority business process is designated to develop and ensure the implementation of an end-to-end test plan, which includes independent verification and validation. Unless responsibility is clearly assigned, it will be difficult to ensure that all organizations participate constructively and expeditiously. Further, the President’s Council on Year 2000 Conversion will have to assume leadership and take whatever actions are warranted should difficulties arise in obtaining needed participation and cooperation from state and local governments and the private sector. We modified our recommendation to clarify our position.

With respect to our recommendation to require all critical agencies to report their progress quarterly, the Chairman’s written response pointed to the recent OMB memorandum that required an additional 31 agencies to report to OMB on their Year 2000 progress in April 1998 and again in a year’s time. However, this requirement does not currently pertain to all critical governmental and quasi-governmental agencies such as the U.S. Postal Service. The Chairman also stated that agencies considered central to the success of Year 2000 readiness should report their progress to OMB more frequently but did not state which agencies are considered central to the government’s Year 2000 readiness or how frequently these agencies will be required to report their progress. The Chairman later told us that OMB is considering expanding the list of reporting entities to include other organizations. In addition, he stated that he and OMB will ask the additional 31 agencies to report more frequently than annually if, based on their April 1998 reports, it is apparent that there are problems.

Since (1) all agencies which are critical to the nation’s Year 2000 readiness should be monitored and (2) problems could surface at any point in the Year 2000 remediation process, especially during the latter testing and implementation phases, it is imperative that all critical agencies be identified and be required to report to OMB regularly and be included in OMB’s governmentwide progress report. Moreover, just because an agency is not experiencing problems in April 1998 does not mean that it will not later encounter problems. Therefore, it is important to continue monitoring the progress of agencies which reported making adequate progress to ensure that such progress continues.

The Chairman disagreed with our recommendation to require agencies, as part of their quarterly reports, to cite their progress in implementing systems intended to replace noncompliant systems. He stated that the current requirement—under which agencies provide an exception report to OMB on replacement systems that have fallen 2 months or more behind schedule—is an appropriate level of reporting. The Chairman stated that OMB and the council will monitor this issue closely to determine if more reporting is required in the future. However, waiting until later is very risky, given the federal government’s poor record of delivering new systems capabilities when promised, and the immutability of the Year 2000 milestone. Over 1,100 mission-critical systems—22 percent of the government’s noncompliant mission-critical systems—are due to be replaced. To monitor their progress effectively, we believe that the President’s Council on Year 2000 Conversion, OMB, and the Congress need more thorough reports, including information on whether the replacement systems have been tested.

In reference to our recommendation related to consistent agency reporting, the Chairman stated that the council will encourage OMB to have agencies report on their progress consistent with the CIO Council’s best practice guide and our enterprise readiness guide. In our March meeting, the Chairman stated that agencies should use the criteria on the Year 2000 phases contained in our enterprise readiness guide when completing their quarterly reports. He added that OMB will likely encourage agencies to do so in its next quarterly report guidance. If OMB requires agencies to use the criteria set forth in our guide, this will satisfy our recommendation.

With respect to our recommendation to require agencies to develop contingency plans for core business processes and supporting systems, the Chairman agreed that it is important to develop contingency plans for all core business functions. He did not, however, believe that agencies would be making the most efficient use of the time remaining by developing contingency plans for every supporting system. We clarified that we are not advocating the development of contingency plans for individual mission-critical systems. Rather, contingency plans should be developed for each core business process. A core business process may rely on one or more mission-critical systems which the contingency plan would address as part of its identification and mitigation of potential system failures. Moreover, those program managers responsible for core business processes should take a leading role in developing business continuity and contingency plans because they best understand their business processes and how problems can be resolved. In this manner, the business continuity and contingency planning activity generally complements, rather than competes with, the agency’s Year 2000 remediation activities. We revised our recommendation to clarify our position.

In his written response, the Chairman did not specifically address whether the council would require agencies to develop an independent verification strategy. Instead, he agreed that independent assessments of agencies’ Year 2000 programs and their testing and planning approaches are important, stating that the council will examine how best to promote those assessments. The Chairman stated that he would work with the President’s Council on Integrity and Efficiency to encourage inspectors general to play a role in this area. In order to assure agencies, OMB, and the President’s Council on Year 2000 Conversion that their Year 2000 activities are effective, agencies must develop independent verification strategies which, in accordance with our recommendations, should be required by the President’s Council on Year 2000 Conversion. In a later meeting, the Chairman stated that he and OMB will consider issuing more explicit directions on independent verification to the agencies, especially with regard to establishing standards for the type of verification and evaluation desired.

To improve the effectiveness of the CIO Council’s Year 2000 Committee, we recommended that the Chairman ensure that (1) agencies participate in the committee and (2) the Committee’s subcommittees establish and publicize plans, milestones, and enforcement mechanisms. Regarding the first recommendation, the Chairman stated that in his meetings with agencies, he will continue to encourage their awareness of, and participation in, the activities of the Year 2000 Committee. With respect to the second recommendation, he said that he was satisfied that the committee is developing plans and milestones for its work and that OMB and the President’s Council on Year 2000 Conversion will continue to consult with the Committee on appropriate enforcement mechanisms. If the nation is to negotiate the millennium change successfully, the Chairman needs to ensure that the Year 2000 Committee and its subcommittees continue to play a central role in addressing the federal government’s Year 2000 problem. Without full participation of the agencies as well as publicity of the subcommittees’ plans, milestones, and enforcement mechanisms, it is less likely that appropriate solutions to governmentwide problems will be identified and effectively addressed.

Although the Chairman agreed that the President’s Council on Year 2000 Conversion should view the Year 2000 problem as more than a federal systems problem and should adopt a global perspective, he did not address our recommendation to develop a comprehensive picture of the nation’s Year 2000 readiness, and he did not fully agree with our recommendation to establish a national coordination structure using private/public partnerships in appropriate sector-based forums. The Chairman stated that he believed that the President’s Council on Year 2000 Conversion needed to be a catalyst, facilitator, and coordinator. He later told us that the council should only create and directly manage new national forums for specific sectors of the economy. He noted that to begin with, such partnerships would be appropriate in the energy and telecommunications sectors. In addition, the Chairman stated that the council can be effective by enlisting and supporting an agency, such as the Department of Health and Human Services, to coordinate an outreach approach to the health care industry. These agencies would be empowered to determine the appropriate measures the government should take to ensure progress in these industries. Senior executives of these coordinating agencies would be the agency’s representatives on the council, which would then monitor and coordinate the agency’s outreach activities and help ensure that there are not gaps in the coverage.

We believe that the President’s Council on Year 2000 Conversion must posture itself to be in an informed position to provide Year 2000 leadership for the nation as a whole. To provide such leadership, the council must develop an approach to receive the best guidance directly from the private sector and state and local government bodies, in addition to views and perspectives garnered by federal agency executives. Moreover, while the federal agencies should play an important role in any Year 2000 assessment of our nation’s key economic sectors, they may not always be in the best position to discharge responsibility for all outreach efforts in an economic sector. First, the problems that agencies face in ensuring their own Year 2000 compliance are daunting. Second, some sectors, such as telecommunications, health, safety, and emergency services, utilities, and manufacturing and small business have limited federal government involvement. As a result, in some sectors, the leadership role may be more appropriately placed in the private sector or state and local government. To clarify our position, we have modified our recommendation related to this issue.

In addition to the comments of the Chairman of the President’s Council on Year 2000 Conversion, OMB staff and the Chairwoman of the CIO Council’s Year 2000 Committee provided comments on the facts presented in the report, and generally agreed with these facts. OMB staff and the Chairwoman offered technical comments on selected sections of the report, and we have incorporated their suggested changes as appropriate.

We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate and House Committees on Appropriations and the House Committee on Government Reform and Oversight; Ranking Minority Member of the Subcommittee on Financial Services and Technology, Senate Committee on Banking, Housing and Urban Affairs; the Chairman of the President’s Council on Year 2000 Conversion; and Director of the Office of Management and Budget. Copies will also be made available to others upon request.

Please contact me at (202) 512-2600 or Joel Willemssen, Director, Civil Agencies Information Systems, at (202) 512-6408, if you or your staff have any questions concerning this report. We can also be reached by e-mail at dodarog.aimd@gao.gov and willemssenj.aimd@gao.gov, respectively.

Scope and Methodology

To describe the Year 2000 risks facing the government and the nation, we relied on the work that we have performed in the Year 2000 area over the past 2 years that has encompassed evaluating and reporting on the progress of several individual agencies. (See Related GAO Products at the end of this report for a complete list of all our Year 2000 reports and testimonies.) In addition, we reviewed and assessed major departments and agencies’ quarterly reports as well as OMB’s governmentwide reports. We also researched information on private-sector and international activity related to the Year 2000 problem through the Internet and other sources. We did not independently assess the reliability of the information provided by these sources. We also discussed the Year 2000 issue with leading experts in certain key economic sectors and, where available, obtained and reviewed reports by state and foreign audit organizations.

To describe the evolution of the federal government’s Year 2000 strategy and identify additional actions that can be taken to prepare the nation for the Year 2000, we evaluated the Year 2000 efforts of OMB and of the CIO Council, including reviewing OMB’s quarterly reports and other documents. We also reviewed the February 4, 1998, executive order establishing the President’s Council on Year 2000 Conversion and met with the Chairman of this council. In addition, we interviewed officials from OMB and attended meetings of the CIO Council’s Year 2000 Committee and its subcommittees. We also reviewed the President’s Commission on Critical Infrastructure Protection’s October 1997 report.

We conducted our review from December 1997 through March 1998. We performed this review in accordance with generally accepted government auditing standards. We also provided a draft of this report for comment to the Chairman of the President’s Council on Year 2000 Conversion, OMB staff, and the Chairwoman of the CIO Council’s Year 2000 Committee, and incorporated their comments as appropriate. Their comments are discussed in the “Agency Comment and Our Evaluation” section.

Comments From the Chairman of the President’s Council on Year 2000 Conversion

The following are GAO’s supplemental comments on the Chairman of the President’s Council on Year 2000 Conversion’s letter of March 23, 1998. Additional comments are contained in the “Agency Comments and Our Evaluation” section.

GAO Comments

1. Report revised to reflect modified recommendation. 2. Report revised to reflect modified recommendation. 3. The report was revised to reflect that the CIO Council’s Subcommittee on the Year 2000 was renamed the Committee on Year 2000. The Committee on Year 2000 now has subcommittees rather than subgroups. 4. Report revised to reflect modified recommendations 5. The testimony of the Chairman of the President’s Council on Year 2000 was not reprinted. It is available upon request.

Related GAO Products

Defense Computers: Year 2000 Computer Problems Threaten DOD Operations (GAO/AIMD-98-72, April 30, 1998).

Year 2000 Computing Crisis: Federal Regulatory Efforts to Ensure Financial Institution Systems Are Year 2000 Compliant (GAO/T-AIMD-98-116, March 24, 1998).

Year 2000 Computing Crisis: Strong Leadership Needed to Avoid Disruption of Essential Services (GAO/T-AIMD-98-117, March 24, 1998).

Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD-10.1.19, Exposure Draft, March 1998).

Year 2000 Computing Crisis: Office of Thrift Supervision’s Efforts to Ensure Thrift Systems Are Year 2000 Compliant (GAO/T-AIMD-98-102, March 18, 1998).

Year 2000 Computing Crisis: Strong Leadership and Effective Public/Private Cooperation Needed to Avoid Major Disruptions (GAO/T-AIMD-98-101, March 18, 1998).

Post-Hearing Questions on the Federal Deposit Insurance Corporation’s Year 2000 (Y2K) Preparedness (GAO/AIMD-98-108R, March 18, 1998).

SEC Year 2000 Report: Future Reports Could Provide More Detailed Information (GAO/GGD/AIMD-98-51, March 6, 1998).

Year 2000 Readiness: NRC’s Proposed Approach Regarding Nuclear Powerplants (GAO/AIMD-98-90R, March 6, 1998).

Year 2000 Computing Crisis: Federal Deposit Insurance Corporation’s Efforts to Ensure Bank Systems Are Year 2000 Compliant (GAO/T-AIMD-98-73, February 10, 1998).

Year 2000 Computing Crisis: FAA Must Act Quickly to Prevent Systems Failures (GAO/T-AIMD-98-63, February 4, 1998).

FAA Computer Systems: Limited Progress on Year 2000 Issue Increases Risk Dramatically (GAO/AIMD-98-45, January 30, 1998).

Defense Computers: Air Force Needs to Strengthen Year 2000 Oversight (GAO/AIMD-98-35, January 16, 1998).

Year 2000 Computing Crisis: Actions Needed to Address Credit Union Systems’ Year 2000 Problem (GAO/AIMD-98-48, January 7, 1998).

Veterans Health Administration Facility Systems: Some Progress Made In Ensuring Year 2000 Compliance, But Challenges Remain (GAO/AIMD-98-31R, November 7, 1997).

Year 2000 Computing Crisis: National Credit Union Administration’s Efforts to Ensure Credit Union Systems Are Year 2000 Compliant (GAO/T-AIMD-98-20, October 22, 1997).

Social Security Administration: Significant Progress Made in Year 2000 Effort, But Key Risks Remain (GAO/AIMD-98-6, October 22, 1997).

Defense Computers: Technical Support Is Key to Naval Supply Year 2000 Success (GAO/AIMD-98-7R, October 21, 1997).

Defense Computers: LSSC Needs to Confront Significant Year 2000 Issues (GAO/AIMD-97-149, September 26, 1997).

Veterans Affairs Computer Systems: Action Underway Yet Much Work Remains To Resolve Year 2000 Crisis (GAO/T-AIMD-97-174, September 25, 1997).

Year 2000 Computing Crisis: Success Depends Upon Strong Management and Structured Approach, (GAO/T-AIMD-97-173, September 25, 1997).

Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14, September 1997).

Defense Computers: SSG Needs to Sustain Year 2000 Progress (GAO/AIMD-97-120R, August 19, 1997).

Defense Computers: Improvements to DOD Systems Inventory Needed for Year 2000 Effort (GAO/AIMD-97-112, August 13, 1997).

Defense Computers: Issues Confronting DLA in Addressing Year 2000 Problems (GAO/AIMD-97-106, August 12, 1997).

Defense Computers: DFAS Faces Challenges in Solving the Year 2000 Problem (GAO/AIMD-97-117, August 11, 1997).

Year 2000 Computing Crisis: Time is Running Out for Federal Agencies to Prepare for the New Millennium (GAO/T-AIMD-97-129, July 10, 1997).

Veterans Benefits Computer Systems: Uninterrupted Delivery of Benefits Depends on Timely Correction of Year-2000 Problems (GAO/T-AIMD-97-114, June 26, 1997).

Veterans Benefits Computers Systems: Risks of VBA’s Year-2000 Efforts (GAO/AIMD-97-79, May 30, 1997).

Medicare Transaction System: Success Depends Upon Correcting Critical Managerial and Technical Weaknesses (GAO/AIMD-97-78, May 16, 1997).

Medicare Transaction System: Serious Managerial and Technical Weaknesses Threaten Modernization (GAO/T-AIMD-97-91, May 16, 1997).

Year 2000 Computing Crisis: Risk of Serious Disruption to Essential Government Functions Calls for Agency Action Now (GAO/T-AIMD-97-52, February 27, 1997).

Year 2000 Computing Crisis: Strong Leadership Today Needed To Prevent Future Disruption of Government Services (GAO/T-AIMD-97-51, February 24, 1997).

High Risk Series: Information Management and Technology (GAO/HR-97-9, February 1997).

The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent.

U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.