Year 2000 Computing Crisis: Federal Reserve Is Acting to Ensure Financial Institutions Are Fixing Systems, But Challenges Remain
Released: 1998-09-17T00:00:00

Letter

Objective, Scope, and Methodology

Our objective was to evaluate FRS’ efforts to date to ensure that the institutions it oversees have adequately mitigated the risks associated with the Year 2000 date change. We compared these efforts to criteria detailed in our Year 2000 Assessment Guide. This guide advocates a structured approach to planning and managing an effective Year 2000 program through five phases: (1) raising awareness of the problem, (2) assessing the extent and severity of the problem, and identifying and prioritizing remediation efforts, (3) renovating or correcting systems, (4) validating, or testing, corrections, and (5) implementing corrected systems. The guide also identifies other facets involved in solving the Year 2000 problem, such as identifying interfaces with outside organizations; specifying how data will be exchanged in the Year 2000 and beyond; remediating, validating, and implementing the interfaces; and developing contingency plans to ensure that core business functions can continue to be performed even if systems have not been made Year 2000 compliant. The Office of Management and Budget (OMB) established a schedule for completing each of the five phases, including requiring agencies to complete the assessment phase in the summer of 1997 and the renovation phase by mid-to late 1998.

We also compared FRS’ efforts against Year 2000 guidance and procedures set forth by the Federal Financial Institutions Examination Council (FFIEC). FRS and the federal bank, credit union, and thrift institution regulators have been coordinating their efforts through FFIEC to ensure consistent and uniform supervision on Year 2000 issues.

In addition, we reviewed correspondence FRS sent to its examiners and to the institutions it supervises. In conjunction with the Federal Reserve’s Office of Inspector General (IG), we interviewed examiners and reviewed examination work papers at the Federal Reserve Banks of New York, Atlanta, Kansas City, Chicago, Cleveland, and San Francisco. In addition, we obtained and reviewed the IG’s March 31, 1998, and July 1, 1998, reports on its interim assessment of FRS’ progress on Year 2000 activities. We also interviewed Federal Reserve Board officials in Washington, D.C., responsible for developing and overseeing the implementation of FRS’ Year 2000 supervision program, policies, and procedures.

Our audit work was performed between December 1997 and July 1998 in accordance with generally accepted government auditing standards. On August 4, 1998, we provided the Chairman of the Board of Governors of the Federal Reserve System with a draft of this report for review and comment. On August 7, 1998, and August 26, 1998, we met with the Federal Reserve Board Assistant Director who is the Year 2000 Program Officer to discuss the Board’s comments, which are discussed in the “Agency Comments” section of this report.

Background

Established by the Federal Reserve Act of 1913, FRS is responsible for conducting monetary policy, maintaining the stability of financial markets, providing services to financial institutions and government agencies, and supervising and regulating banks and bank-holding companies. FRS is headed by a seven-member Board of Governors and is comprised of 12 federally chartered corporations, located throughout the United States, which are known as federal reserve banks. FRS is responsible for overseeing the Year 2000 activities of 1,618 institutions, including 990 state member banks, 349 bank holding companies, 221 foreign bank offices, and 9 Edge Act corporations. According to FRS, these organizations held assets totaling over $7.7 trillion and deposits of about $3.6 trillion as of June 30, 1998. FRS also oversees 49 service providers and software vendors.

As part of its goal of maintaining the safety and soundness of financial institutions, FRS is responsible for examining and monitoring these institutions’ efforts to address the Year 2000 problem. Addressing the Year 2000 problem in time will be a tremendous challenge for financial institutions and FRS. Nearly all of FRS-regulated financial institutions rely on computers—either their own or those of a third-party contractor—to process and update records and for a variety of other functions. To complicate matters, most institutions have computer systems that interface with systems belonging to payment system partners, such as wire transfer systems, automated clearinghouses, check clearing providers, credit card merchant and issuing systems, automated teller machine networks, electronic data interchange systems, and electronic benefits transfer systems. Because of these interdependencies, bank systems are also vulnerable to failure caused by incorrectly formatted data provided by other systems that are not Year 2000 compliant.

Financial institutions and their regulators cannot afford to neglect any of these issues. If they do, the impact of Year 2000 failures could be potentially disruptive to vital bank operations and harmful to customers, as the following examples illustrate.

Loan systems could make errors in calculating interest and amortization schedules. In turn, these miscalculations may expose institutions and data centers to financial liability and loss of customer confidence.

Automated teller machines may malfunction, performing erroneous transactions or refusing to process transactions.

Telephone systems, vaults, and security and alarm systems could malfunction.

FRS Is Taking Positive Actions to Assess Financial Institutions’ Year 2000 Readiness

FRS has taken important steps to alert financial institutions to the risks associated with the Year 2000 problem and to assess what these institutions are doing to mitigate the risks. In June 1996, FRS began its Year 2000 efforts by issuing, with the other FFIEC members, an awareness letter to financial institutions pointing out the potential dangers of the Year 2000 problem. The letter described the Year 2000 problem and highlighted concerns about the industry’s Year 2000 readiness. It also called on institutions to perform a risk assessment of how their systems are affected by the Year 2000 problem and develop a detailed action plan, delineating how to fix their systems.

In February 1997, FRS began devoting a full-time effort to the Year 2000 problem, and in May 1997, issued a second, more detailed awareness letter in conjunction with the other FFIEC members. This letter described the five-phase approach to planning and managing an effective Year 2000 program and highlighted external issues—reliance on vendors, risks posed by exchanging data with external parties, and the potential effect of Year 2000 noncompliance on corporate borrowers—requiring management attention. The letter also addressed FFIEC’s plans to facilitate Year 2000 evaluations by using uniform examination guidance and procedures. Additionally, it (1) directed banks to inventory core computer functions and set priorities for Year 2000 goals by September 30, 1997, and (2) strongly encouraged that programming changes be completed and testing of mission-critical systems be well underway by December 31, 1998.

After making its financial institutions aware of the Year 2000 problem, FRS began assessing whether these institutions were taking appropriate Year 2000 mitigation steps. This assessment—which consisted of administering FFIEC’s high-level Year 2000 questionnaire via telephone or on-site visit to about 1,000 organizations—covered all large banks in the U.S., both domestic and foreign, a sample of smaller organizations, and some third party providers of data processing services used by banks, including software vendors. FRS completed this initial assessment in mid-1997 and determined that about 40 percent of the organizations contacted had yet to complete awareness phase activities, although most had initiated some assessment phase work.

Following this initial assessment, FRS undertook more detailed Year 2000 examinations at the 1,618 institutions. These examinations were completed in June 1998. To its credit, FRS made the FFIEC Year 2000 examination procedures more specific to alleviate shortcomings reported in our previous testimonies. These shortcomings included using vague terms (such as well into, largely, and well underway) to describe Year 2000 progress and not collecting all the data needed to determine where banks are in the Year 2000 correction process.

According to FRS, the results of its on-site Year 2000 examinations show that, as of June 30, 1998, 96 percent of the 1,618 institutions examined are performing satisfactorily. This does not mean that these institutions are Year 2000 ready, but rather that they are proceeding on schedule in accordance with the five-phase Year 2000 approach described in FFIEC’s May 5, 1997, guidance. FRS also reported that 4 percent of the institutions examined needed to improve their Year 2000 programs, while less than 1 percent was performing unsatisfactorily. Banks needing improvement were generally behind schedule, not fully aware of the status of Year 2000 efforts, and insufficiently committed to the effort. Banks performing unsatisfactorily were seriously behind schedule, did not understand or recognize the impact of the Year 2000 problem, and were only minimally committed to the effort. FRS is taking actions to deal with institutions in these latter two categories. For example, as of June 30, 1998, FRS had issued notification letters to these institutions requiring that they take formal corrective actions to address Year 2000 deficiencies. FRS is also requiring these institutions to report monthly on how they are progressing in correcting identified deficiencies. FRS and the other FFIEC members are planning to conduct another round of examinations, which will end on March 31, 1999. To accomplish this, they recently developed detailed examination procedures that focus primarily on an institution’s plans and processes for achieving Year 2000 readiness, with particular emphasis placed on the final phases of the Year 2000 project—testing and implementation—and on the institution’s contingency plans. On June 23, 1998, FRS also issued guidance directing each reserve bank to develop a plan—referred to as a Year 2000 Supervisory Review Plan—by July 15, 1998, to ensure that these follow-on examinations are completed on time.

In addition to assessing the status of financial institution Year 2000 readiness, FRS has issued guidance to assist in other critical Year 2000 tasks. For example, in May 1998, FRS issued guidance in conjunction with FFIEC on contingency planning. This guidance was modeled on our business continuity and contingency planning guide, which provides a conceptual framework for helping large agencies manage the risk of potential Year 2000-induced disruptions to their operations. The FRS guidance emphasized that management and directors should place a high priority on developing, validating, and implementing an institution’s Year 2000 contingency plan and take into account the impact of external systems belonging to other financial institutions, service providers, customers, and suppliers of power and telecommunications. In addition, in March 1998, FFIEC and FRS issued guidance on mitigating the Year 2000 risks associated with critical bank customers (e.g., large borrowers and capital providers) and the use of data processing servicers and software vendors that support bank operations.

Moreover, FRS initiated outreach efforts to further raise awareness of the Year 2000 problem. Specifically, FRS (1) established an internet site that provides information on its Year 2000 supervisory program, (2) developed and distributed a Year 2000 awareness video for bank executives, and (3) conducted about 230 Year 2000 seminars nationwide for banking industry personnel.

Challenges Confronting FRS’ Efforts to Ensure That Financial Institutions Are Year 2000 Ready

With less than 16 months remaining before the millennium, FRS must continue to vigorously oversee the Year 2000 correction efforts of more than 1,600 financial institutions, service providers, and vendors. This task will become increasingly challenging as many of these entities undertake the more difficult and complicated stages of the remediation efforts.

FRS was at least 6 months late in addressing the Year 2000 problem. As mentioned previously, FRS did not initiate its Year 2000 program until June 1996, when FFIEC issued its first Year 2000 awareness memorandum. However, our guidance indicates that Year 2000 efforts should have begun by January 1996. Further, FRS initially did not keep pace with generally accepted Year 2000 schedules. According to both GAO and OMB, organizations should have completed awareness and assessment phases and be midway through the renovation phase by December 1997. FRS began detailed on-site examinations in mid-1997, but did not complete them until June 1998, when organizations should have been nearly done with renovations.

FRS’ late start was further compounded by limited Year 2000 training for information systems and other examiners during the early phase of the detailed examinations. Prior to the examinations, FRS addressed the century date change as part of information systems examiner training on emerging bank technologies. Recognizing that more comprehensive training was needed, FRS developed a Year 2000 course for information systems and other examiners to raise their Year 2000 awareness, increase their knowledge of steps financial institutions should take to address the Year 2000 problem, teach them to review bank project planning efforts, and enable them to use the FFIEC’s standard Year 2000 examination procedures. The training, however, was not initiated until January 29, 1998—well after detailed examinations were underway. For the next round of examinations, FRS finished training examination staff by the end of July 1998 and did not schedule the vast majority of examinations until after that time.

Lastly, FRS and the other regulators were late in issuing key guidance on business continuity and contingency planning, corporate borrowers, and software and service vendors. For example, in our testimony on the Federal Deposit Insurance Corporation’s Year 2000 efforts, we pointed out that business continuity and contingency planning guidance should have been issued before banks began completing the assessment phase (around mid-1997). FFIEC’s contingency planning guidance, however, was not issued until mid-May 1998.

Because FRS and the other regulators started late and fell behind recommended schedules, they had less time to conduct follow-up reviews. In addition, the delay in providing timely guidance increased the risk that banks and other financial institutions would postpone taking action to mitigate important Year 2000 risks or would take actions that did not effectively mitigate the risks. One regulator found during its on-site examinations that some community banks had not prepared contingency plans because they were waiting for the regulators to issue their contingency planning guidance.

FRS is now working to mitigate the effects of these problems. Specifically, it directed the reserve banks to develop supervisory review plans to ensure that the next round of exams—referred to as Phase II exams—are completed on time. FRS also directed the reserve banks, in preparing the plans, to place a high priority on (1) the largest financial institutions that present the greatest degree of risk to the financial system, (2) those institutions that have been previously identified as less than satisfactory, and (3) the largest service providers and software vendors.

As of July 31, 1998, FRS had received and approved the reserve bank plans. However, because FRS had not directed the reserve banks to assess whether they had the technical examiners needed to execute their plans, the plans do not address this problem. As part of this planning effort, it is critical that FRS determine whether it has the number of technical examiners needed to evaluate the later stages of the Year 2000 conversion process. FRS currently has 73 information systems examiners—31 full time and 42 part time; it does not yet know whether this number is sufficient to complete technically complex examinations in 1,618 institutions by March 1999.

FRS is aware of this challenge and has begun to take steps to address it. First, FRS has begun to assess the number of technical and other examiners needed for the Phase II exams. In addition, FRS officials told us they have trained and are making available 106 examiners—32 full time and 74 part time—from other disciplines (e.g., safety and soundness) to assist in the exams. Finally, FRS officials told us they plan to defer approximately 300 regularly scheduled bank information technology exams to free up technical resources for Year 2000 work. While these steps may mitigate the problem, FRS will not know whether these steps will be sufficient until a comprehensive assessment is performed and completed. If resources are strained or insufficient, FRS could be forced to delay completing Year 2000 examinations, reduce their scope, or not perform some of them at all. In the first case, institutions would be left with less time to remediate any deficiencies. In the second, FRS might overlook issues that could lead to failures. In any case, the risk of noncompliance by banks—and the government’s exposure to losses—is increased as examination coverage is reduced.

Conclusions

FRS has a good appreciation for the Year 2000 problem, has made significant progress in assessing the readiness of member institutions, and is preparing itself for the work that needs to be done over the next 16 months to ensure that the institutions it supervises are ready for the Year 2000. Looking forward, the challenge for FRS, and the other regulators, is to make the best use of limited resources in the time remaining. The challenge is great, as a small number of examiners have limited time to assess the problems of thousands of financial institutions, service providers, and vendors. To their advantage, FRS and the other regulators have spent the last year developing a picture of how their industry stands, including which institutions are at high risk of not being ready for the millennium and require immediate attention, which service providers and vendors are likely to be problematic, and the extent of the problems remaining. For example, by carefully analyzing available data, the regulators should be able to identify common problems or issues generic to institutions that are of similar size and use specific service providers. This, in turn, will allow regulators to regroup, develop specific strategies, and have a more defined sense of the risks and the actions required to mitigate those risks.

Recommendations

We recommend that the Chairman of the Board of Governors of the Federal Reserve System direct the reserve banks to revise their supervisory review plans by October 1, 1998, to include (1) a determination of how many technical and other examiners they need to adequately oversee the Year 2000 efforts of member banks, data processing servicers, and software vendors and (2) a strategy for obtaining these resources and maintaining their availability.

Agency Comments

In commenting on a draft of this report, FRS agreed with our findings, conclusions, and recommendations. FRS also provided certain technical comments, which we incorporated as appropriate.

We are sending copies of this report to the Ranking Minority Members of the Subcommittee on Financial Services and Technology, Senate Committee on Banking, Housing, and Urban Affairs, and the House Committee on Banking and Financial Services and to the Chairman and Ranking Minority Members of the Senate Committee on Banking, Housing and Urban Affairs, Senate Special Committee on the Year 2000 Technology Problem, and the Subcommittee on Government Management, Information and Technology, House Committee on Government Reform and Oversight. We are also sending copies to the Chairman of the Board of Governors of the Federal Reserve System, the Comptroller of the Currency, the Chairman of the Federal Deposit Insurance Corporation, the Director of the Office of Thrift Supervision, the Chairman of the National Credit Union Administration, the Chair of the President’s Council on Year 2000 Conversion, the Director of the Office of Management and Budget, and the Federal Reserve Board’s Inspector General. Copies will also be made available to others upon request.

If you have any questions on matters discussed in this report, please call me or Gary Mountjoy, Assistant Director, at (202) 512-6240. Major contributors to this report are listed in appendix I.

Major Contributors to This Report

Accounting and Information Management Division, Washington, D.C.

Atlanta Field Office

Carl Higginbotham, Evaluator-in-Charge Tonia Brown, Senior Evaluator Teresa Tucker, Senior Information Systems Analyst John Ortiz, Evaluator The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent.

U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.