Credit unions are nonprofit financial cooperatives organized to provide their members with low-cost financial services. According to NCUA, as of 1996, federally insured credit union assets totaled $326 billion. About one in four Americans belongs to a credit union, and credit unions accounted for about 2 percent of the total financial services in the United States. NCUA supervises and insures more than 7,200 federally chartered credit unions and insures member deposits in an additional 4,200 state-chartered credit unions through the National Credit Union Share Insurance Fund. As part of its goal of maintaining the safety and soundness of the credit unions, NCUA is responsible for ensuring credit unions are addressing the Year 2000 problem. The Year 2000 problem is rooted in the way dates are recorded and computed in automated information systems. For the past several decades, systems have typically used two digits to represent the year, such as "97" representing 1997, in order to conserve on electronic data storage and reduce operating costs. With this two-digit format, however, the year 2000 is indistinguishable from 1900, or 2001 from 1901. As a result of this ambiguity, system or application programs that use dates to perform calculations, comparisons, or sorting may generate incorrect results. According to NCUA, most credit unions rely on computers to provide for processing and updating of records and a variety of other functions. As such, the Year 2000 problem poses a serious dilemma for the industry. For example, the problem could lead to numerous problems when calculations requiring the use of dates are performed, such as calculating interest, calculating truth-in-lending or truth-in-savings disclosures, and determining amortization schedules. Moreover, automated teller machines may also assume that all bank cards are expired due to this problem. In addition, errors caused by Year 2000 miscalculations may expose institutions and data centers to financial liability and risk of damage to customer confidence. Other systems important to the day-to-day business of credit unions may be affected as well. For example, telephone systems could shut down as can vaults, security and alarm systems, elevators, and fax machines. In addressing the Year 2000 problem, credit unions must also consider the computer systems that interface with, or connect to, their own systems. These systems may belong to payment system partners, such as wire transfer systems, automated clearing houses, check clearing providers, credit card merchant and issuing systems, automated teller machine networks, electronic data interchange systems, and electronic benefits transfer systems. Because these systems are also vulnerable to the Year 2000 problem, they can introduce and/or propagate errors into credit unions systems. Accordingly, credit unions must develop comprehensive solutions to this problem and prevent unintentional consequences from affecting their systems and the systems of others. To address these Year 2000 challenges, GAO issued its Year 2000 Assessment Guide to help federal agencies plan, manage, and evaluate their efforts. The Office of Management and Budget (OMB), which is responsible for developing the Year 2000 strategy for federal agencies, also issued similar guidance. Both require a structured approach to planning and managing five delineated phases of an effective Year 2000 program. The phases include (1) raising awareness of the problem, (2) assessing the complexity and impact the problem can have on systems, (3) renovating, or correcting, systems, (4) validating, or testing, corrections, and (5) implementing corrected systems. GAO has also identified other dimensions to solving the Year 2000 problem, such as identifying interfaces with outside organizations and their systems and establishing agreements with these organizations specifying how data will be exchanged in the year 2000 and beyond. In addition, GAO and OMB have established a timeline for completing each of the five phases and believe agencies should have completed assessment phase activities last summer and should be well into renovation with the goal of completing this phase by mid to late 1998. Our work at other federal agencies indicates that because the cost of systems failures can be very high, contingency plans must be prepared so that core business functions will continue to be performed even if systems have not been made Year 2000 compliant. NCUA has developed a three-pronged approach for ensuring that credit unions are aggressively addressing the Year 2000 problem, which encompasses (1) incorporating the Year 2000 issue into its examination and supervision program, (2) disseminating information about the problem to credit unions, and (3) assessing Year 2000 compliance on the part of credit union data processing vendors. The first aspect of NCUA's strategy, the examination and supervision program, involves assessing credit union Year 2000 efforts through regular annual examinations at the 7,200 federally chartered credit unions and 30 to 40 percent of the 4,200 federally insured, state chartered credit unions for which NCUA conducts an insurance review. These examinations seek to identify credit unions that are in danger of not renovating their systems on time and to reach "formal agreements" that specify corrective measures. In conducting these reviews, examiners are to follow NCUA guidelines, which provide step-by-step procedures for identifying problem areas. Once a formal agreement is reached, the examiner is expected to monitor the credit union's implementation of the agreed-upon corrective measures. Also as part of its examination effort, NCUA has contracted a consulting firm to train selected examiners in Year 2000 efforts. Through this training, NCUA expects to have one in-house Year 2000 specialist available as a resource for every eight examiners. In addition, NCUA's board recently authorized the hiring of an electronic data processing (EDP) auditor to provide more in-depth technical assistance and education on Year 2000 problems. Another part of NCUA's examination and supervision strategy includes working with state regulators to ensure that federally insured, state chartered credit unions are also Year 2000 compliant. Officials from NCUA and the National Association of State Credit Union Supervisors told us that all but two state regulators are following the same Year 2000 examination strategy established by NCUA; the other two state regulators are planning on performing added steps in addition to performing those included in NCUA's strategy. The second aspect of NCUA's strategy--information dissemination--seeks to heighten credit union awareness of the Year 2000 problem. In August 1996 and June 1997 letters to federally insured credit unions, NCUA formally alerted credit unions to the potential dangers of the Year 2000 problem, identified the specific impacts the problem could have on the industry, provided detailed explanations of the problem, and identified steps needed to correct the problem. It also related its plans to include Year 2000 evaluations in regular examinations and provided credit unions with copies of its examination guidance. In addition, NCUA has appointed a Year 2000 executive responsible for achieving Year 2000 compliance industrywide and assigned Year 2000 compliance officers to its central office and six regional offices. These staff will be responsible for serving as Year 2000 focal points to coordinate efforts across the agency. Finally, NCUA is working with credit union trade groups, such as the Credit Union National Association, in raising awareness of Year 2000 issues. The third component of NCUA's program--vendor compliance--targets organizations that provide electronic data processing services to credit unions. According to NCUA, approximately 40 vendors provide data processing services to 76 percent of all federally insured credit unions, which account for 79 percent of federally insured credit union assets. Consequently, it is vital that these vendors correct their own systems and help ensure that information can be easily transferred after the Year 2000 deadline. NCUA has begun identifying and contacting major EDP vendors, and it plans to assess their efforts through questionnaires. Specifically, in May 1997 and again in August 1997, NCUA mailed a questionnaire to the 87 vendors, including the 40 vendors that support the bulk of credit unions, requesting information on Year 2000 readiness and, as of September 1997, had received 29 responses. While NCUA has initiated actions to build the Year 2000 issue into examinations and to raise awareness about the issue among credit unions and their vendors, our work to date has identified four issues that must be addressed to provide greater assurance that NCUA efforts will be successful. First and foremost of our concerns is that NCUA still does not have a complete picture of where credit unions and their vendors stand in resolving the Year 2000 problem, and current efforts to determine credit union compliance are behind the schedule established by OMB and GAO. To collect information from the credit unions on their Year 2000 status, NCUA examiners used a high-level questionnaire that inquired whether (1) credit union systems were capable and ready to handle Year 2000 processing, (2) plans were in place to resolve the problem, (3) enough funds were budgeted to correct systems, and (4) responsibility and reporting mechanisms were appropriately established to support the Year 2000 effort. NCUA issued a separate high-level questionnaire to credit union vendors. However, as of the time of our work, NCUA had not yet queried 20 percent of the credit unions and had only received 29 of the 87 vendor responses. In addition, of the credit union and vendor responses received, NCUA has not yet analyzed the information to determine which credit unions and vendors are at high risk of not correcting their systems on time. This problem is compounded by the fact that the NCUA questionnaires did not inquire about the status of efforts in completing each important phase of correction: (1) raising awareness of the problem, (2) assessing the complexity and impact the problem can have on systems, (3) renovating, or correcting, systems, (4) validating, or testing, corrections, and (5) implementing corrected systems. The questionnaires also did not include system interface issues. For example, they did not inquire about (1) identifying interfaces with outside organizations and their systems, such as payment, check clearing, credit card, and benefit transfer systems, and (2) establishing agreements with these organizations specifying how data will be exchanged in the year 2000 and beyond. As a result, even when NCUA assesses the results, it still will not have a complete understanding of how far along the industry is in addressing the problem. In addition, NCUA examinations are conducted only on an annual basis. This means that each credit union will be examined only two more times between the end of 1997 and the year 2000. Further, NCUA has not yet established a formal mechanism for credit unions to submit interim progress reports to provide an up-to-date picture of individual correction efforts between examinations. NCUA officials told us that examiners perform off-site supervision in between exams by tracking performance via credit union financial reports and by contacting credit union officials should a problem arise. However, this may not be enough given the seriousness of the problem and the fact that the Year 2000 deadline is just 2 years away. Further complicating NCUA's situation is the fact that it is still involved in assessment phase activities. According to OMB and GAO guidance, these activities should have been completed back in the summer. As it stands, NCUA does not plan to complete them until the end of this calendar year. Accordingly, we believe NCUA should accelerate agency efforts to complete the assessment of the state of the industry by no later than November 15, 1997, rather than waiting until the end of the year. NCUA should also collect the necessary information to determine the exact phase of each credit union and vendor in addressing the Year 2000 problem. Because NCUA currently does not have a process in place for interim reporting of this information between examinations, NCUA should require credit unions to report the precise status (phase) of their efforts on at least a quarterly basis. One option would be to use the financial reports, commonly referred to as call reports, that credit unions provide to NCUA quarterly. As part of this report, NCUA should also require credit unions to report on the status of identifying their interfaces to determine whether this issue is being adequately addressed and, if not, require credit unions to implement such agreements as soon as possible. A second concern we have with NCUA's efforts is that the agency does not yet have a formal contingency plan. Our Year 2000 Assessment Guidecalls on agencies to initiate realistic contingency plans during the assessment phase for critical systems to ensure the continuity of their core business processes. Contingency planning is important because it identifies alternative activities, which may include manual and contract procedures, to be employed should systems fail to meet the Year 2000 deadline. NCUA guidance directs credit unions to conduct contingency planning, and NCUA officials told us that they have developed numerous contingency options and have discussed among the staff what steps to take should a credit union not be compliant by January 1, 2000. However, officials stated that the precise actions have not been documented in a formal plan. Not having this plan increases the risk of unnecessary problems in an already uncertain situation. Consequently, we recommend that NCUA formally document its contingency plans. A third concern that we have is that credit union auditors may not be addressing the Year 2000 problem as part of their work. NCUA requires each credit union to perform supervisory committee audits. These audits are to determine whether management practices and procedures are sufficient to safeguard members' assets and whether effective internal controls are in place to guard against error, carelessness, and fraud. They are conducted by the credit union's supervisory committee staff or by an outside accountant. However, NCUA officials noted that such reviews typically focus on general controls (e.g., ensuring accurate data is entered into the system, securing data from unauthorized use) and would not specifically include controls to prevent malfunctions due to the Year 2000 problem. Audits are an integral management control and expanding their scope to include important and high-risk Year 2000 issues is critical since it would provide credit union management with greater assurance and understanding about where their institution stands in addressing the problem. Accordingly, we are recommending to NCUA that it require credit unions to implement the necessary management controls to ensure that these financial institutions have adequately mitigated the risks associated with the Year 2000 problem. Specifically, NCUA should require credit union auditors to include Year 2000 issues within the scope of their management and internal control work and report serious problems and corrective actions to NCUA immediately. To aid credit union auditors in this effort, NCUA should provide the auditors with the procedures developed by NCUA for its examiners to use in assessing Year 2000 compliance and any other guidance that would be instructive. We also believe NCUA should require credit unions to establish processes whereby credit union management would be responsible for certifying Year 2000 readiness by a deadline well before the millennium. Such a certification process should include credit union compliance testing by an independent third party and should allow sufficient time for NCUA to review the results. Our fourth concern is that NCUA does not have enough staff qualified to conduct examination work in complex technical areas. At present, NCUA is the process of hiring one EDP auditor to help examine thousands of credit unions. Recognizing this weakness, NCUA is considering hiring up to three EDP auditors. However, these personnel additions may still not suffice given the tremendous workload and the short time frame for getting it done. To mitigate this concern, we recommend that before the end of the year, NCUA determine the level of technical capability needed to allow for thorough review of credit unions' Year 2000 efforts and hire or contract for this capability.

Summary:
Pursuant to a congressional request, GAO reviewed the National Credit Union Administration's (NCUA) progress in making sure that the automated information systems belonging to the thousands of credit unions it oversees have adequately mitigated the risks associated with the year 2000 date change. GAO noted that: (1) NCUA has taken steps to address the Year 2000 problem; (2) these involve incorporating the Year 2000 issue into its examination and supervision program, disseminating information about the problem, and assessing Year 2000 compliance on the part of data processing vendors; (3) concerns exist that must be resolved if the NCUA is to achieve greater certainty that credit unions will meet their Year 2000 deadline; (4) NCUA still does not have a complete picture of where credit unions and their vendors stand in resolving the Year 2000 problem, and current efforts to determine credit union compliance are behind the schedule established by GAO and the Office of Management and Budget (OMB); (5) while NCUA sent questionnaires to credit unions and data processing vendors about the problem, it has not yet queried 20 percent of credit unions and has only received 29 of 87 vendor responses; (6) of the credit union and vendor responses received, NCUA has not yet analyzed this information to identify high-risk credit unions and vendors; (7) further, the surveys did not specifically ask about the status of corrective efforts and whether interface issues were appropriately being addressed; (8) NCUA has directed credit unions to conduct contingency planning and its staff have discussed what steps they should take should a credit union not be compliant by January 1, 2000; (9) however, the agency still lacks a formal contingency plan; (10) NCUA must take prompt action to ensure that these discussions are formally documented so that it will be well-positioned to handle unforeseen problems; (11) as potentially damaging as the Year 2000 problem is, NCUA has not yet ensured that the issue is addressed by credit union auditors; (12) doing so would provide credit union management with a greater assurance and understanding about where their institution stands in addressing the problem; (13) NCUA does not have enough staff qualified to conduct examination work in complex system areas; (14) at present, NCUA is in the process of hiring an electronic data processing (EDP) auditor and is requesting authority to hire 2 more; and (15) these personnel additions may not suffice given the tremendous workload and short time frame for getting it done.