IRS' Year 2000 status reports do not provide a complete picture of the status of IRS' mission-critical systems because IRS does not monitor Year 2000 status for its mission-critical systems in their entirety. Instead, IRS monitors the Year 2000 status of the components of an information system, such as the application software, systems software, and hardware for each of its three types of computers--mainframes, minicomputers/file servers, and personal computers. IRS also monitors its telecommunications networks separately. As part of IRS' Year 2000 risk mitigation efforts, IRS has hired a contractor to conduct periodic risk assessments. The contractor's December 1998 report recommended exploring the feasibility of tracking status on a system-by-system basis to provide a clear view of IRS' ability to achieve Year 2000 compliance. The report stated that such a system view would permit IRS to, among other things, help assess the need to target resources to achieve Year 2000 compliance. IRS officials said that IRS' approach to monitoring Year 2000 compliance corresponds to how IRS' Information Systems organization is structured to carry out its work. Specifically, IRS officials said that separate organizational units are responsible for application software, systems software and hardware, and telecommunications networks. Therefore, IRS monitors its Year 2000 status by these areas. They do not believe the benefits of monitoring status on a system-by-system basis outweigh the costs, given the amount of time remaining to complete IRS' Year 2000 work. IRS' reports indicate that it met the January 1999 completion goal for some areas but not for others. The reports indicate that IRS met the January 1999 goal for correcting the application software for its existing systems and upgrading telecommunications networks. Since May 1998, when we last testified on this topic, IRS has also made progress in an area that we said was lagging--upgrading systems software and hardware. Despite this progress, however, IRS did not achieve its January 1999 completion goal for any of its three types of computer hardware. IRS fully implemented the Year 2000 aspects for one of its major system replacement projects. For the other system replacement project, 6 of the 10 service centers were using the full suite of Year 2000 changes. Since we testified in May 1998, IRS has continued to make progress in correcting the application software for its mission-critical systems. As of February 6, 1999, IRS reports indicate that IRS has corrected 88 percent of these applications, thereby exceeding its 85 percent goal. In addition to completing this work, IRS has hired a contractor to review all of the corrected application software to determine whether IRS made any errors. This effort began in August 1998 and is scheduled to continue through May 1999. In addition, IRS reports indicate that it met its goal for completing work on its telecommunications networks. In May 1998, we said that, according to IRS, telecommunications networks presented the most significant correction challenge and were likely the highest risk for not being completed by January 31, 1999. As of February 6, 1999, with the exception of three areas, IRS reported that it met its goal for these networks. IRS' reports indicate that IRS made significant progress in an area that in May 1998 we said was lagging--upgrading systems software and hardware for its three types of computers: mainframes, minicomputers/file servers, and personal computers. Despite this progress, IRS did not meet the January 31, 1999, completion goal for its three types of computers. For IRS' mainframe computers, IRS officials said IRS fell short in meeting its goal because of delays in receiving the Year 2000 upgrades for one of its system replacement projects. IRS officials said those upgrades are to be received and implemented by March 1, 1999. For minicomputers/file servers, IRS reports indicate that as of February 6, 1999, IRS' Information Systems organization had completed 60 percent of the work for upgrading systems software and hardware--a significant increase from 13 percent that was done in May 1998, when we last testified on the IRS' Year 2000 status. According to IRS, systems software and hardware for 13 of the 27 mission-critical systems that use minicomputers/file servers were not upgraded by January 31, 1999. The systems software and hardware for 7 of the 13 systems are not scheduled to be Year 2000 compliant until after March 1999. As a result of the delay, some changes are not to be tested until October 1999, when the second part of the Year 2000 end-to-end test is to begin. This delay reduces the time available to make any needed corrections before January 1, 2000. For personal computers, IRS officials said they plan to replace about 35,000 personal computers and the associated systems software between February 1999 and July 1999 to achieve Year 2000 compliance. As a part of this replacement effort, IRS plans to reduce the number of commercial software and hardware products in its inventory from about 4,000 to 60 core standard products. According to IRS officials, thus far, IRS has completed testing on 5 of the 60 core products. IRS plans to complete the testing for the remaining 55 products by April 1999. IRS' goal is to eliminate all nonstandard products by July 1999. For one of IRS' two major system replacement projects, IRS implemented the Year 2000 changes at all 10 service centers by January 31, 1999; for the other system replacement project, 6 of the 10 service centers were using the full suite of Year 2000 changes for the system by January 31, 1999. IRS' two major system replacement projects are Service Center Mainframe Consolidation (SCMC) and the Integrated Submission and Remittance Processing (ISRP) System. SCMC is to consolidate the mainframe computer tax processing activities from the 10 service centers to 2 computing centers--thereby reducing the total number of tax processing mainframe computers from 67 to 12. Specifically, SCMC is to (1) replace and/or upgrade mainframe hardware, systems software, and telecommunications networks; (2) replace about 16,000 terminals that support frontline customer service and compliance activities; and (3) replace the system that provides security functions for on-line taxpayer account databases with a new system known as the Security and Communications System (SACS). Replacement of the terminals and the implementation of SACS are critical to IRS' achieving Year 2000 compliance. The other replacement project is ISRP. ISRP is a single, integrated system that is to perform the functions of two systems that are not Year 2000 compliant--the Distributed Input System that IRS uses to process tax returns and the Remittance Processing System that IRS uses to process tax payments. IRS completed the Year 2000 critical portions of SCMC by January 31, 1999. Specifically, in early October 1998, IRS completed its implementation of the 16,000 terminals that are needed for frontline customer service and compliance activities. Also, as of January 31, 1999, all 10 service centers were using SACS. Originally, IRS had planned to have the other aspects of SCMC besides SACS--that is, the tax processing activities of the 10 service centers-- moved to the 2 computing centers by December 1998. As of January 31, 1999, the tax processing activities for three service centers had been moved to the computing centers. IRS is determining the number of additional service centers that are to be moved in 1999. SCMC officials have developed several different schedule options for moving the tax processing activities of the remaining seven service centers. At the time we prepared this statement, IRS officials had not yet selected a schedule option. According to IRS officials, the tax processing activities of all 10 service centers do not need to be moved before 2000 because the existing mainframes in each of the 10 service centers have been made Year 2000 compliant. Thus, in all likelihood, at the start of the 2000 filing season, some service centers will be processing their data locally, whereas others will have their data processed at the computing centers. IRS' Year 2000 end-to-end test is designed to include both processing scenarios. Both functions of ISRP--tax return processing and remittance processing--were to be implemented in November 1998. However, as a result of problems that occurred during the pilot test of ISRP and the contingency option IRS implemented for the 1999 filing season to address those problems, 4 of the 10 service centers are not to begin using the remittance processing portion of ISRP until August 1999. For the 1999 filing season, the contingency option for ISRP is to retain enough of the old tax processing and remittance processing equipment in the service centers so that IRS could revert to the old systems if ISRP experiences problems. However, four of the service centers did not have enough floor space to accommodate both the old tax processing and remittance processing systems and the ISRP equipment. As a result, these four service centers are to continue using the old remittance processing equipment during the 1999 filing season and convert to ISRP in August 1999. These four service centers were among the top five remittance processing centers during the peak of the 1998 filing season. We recognize that this contingency option may have been the only feasible one for IRS. However, as we reported in December 1998, these four service centers are to receive their equipment so late in 1999 that their staffs will have no experience with the new equipment before the 2000 filing season in processing the large volume of remittances that occur in the peak of the filing season. In addition to fixing its existing systems, IRS still needs to complete two critical activities for its Year 2000 efforts, and one of these activities is behind schedule. The two critical activities are the completion of (1) an unprecedented Year 2000 end-to-end test of 97 of IRS' 133 mission-critical systems and (2) 36 contingency plans for IRS' core business processes. Using thousands of test cases, IRS' Year 2000 end-to-end test is to assess the ability of IRS' mission-critical systems to function collectively in a Year 2000 compliant environment. These cases are intended to replicate the many different kinds of transactions that IRS' information systems process on any given day to help assess whether IRS' systems can perform all date computations using data and systems date clocks with January 1, 2000, or later. The test will involve 97 of IRS' 133 mission-critical systems. Most of IRS' mission-critical system application software has been tested individually; however, the ability of the application software to operate collectively, using Year 2000 compliant systems software and hardware, with all systems date clocks set forward to simulate the Year 2000, has not been fully tested. In July 1998, IRS began the preliminary activities associated with conducting the end-to-end test. These activities included, but were not limited to, establishing a dedicated test environment to replicate IRS' tax processing environment, developing test plans and procedures, and doing some preliminary testing of some systems with the systems date clock set forward to 2000. Currently, IRS is developing baseline data from the 1999 filing season that will be ultimately used for the Year 2000 end-to-end test. The end-to-end test is to have two parts. The first part is scheduled to begin in April and end in July 1999. The second part is to begin in October and end in December 1999. The April test is to include the application software that is currently being used for the 1999 filing season. The October test is to include the application software changes that are needed for the tax law changes that are to be implemented for the 2000 filing season. The need to conduct this test has in turn created an additional challenge in completing the work necessary for the 2000 filing season. As shown in table 1, to accommodate the Year 2000 end-to-end test, IRS revised its traditional milestones for implementing tax law changes for the 2000 filing season, thereby compressing the amount of time available to develop and test these changes. Under this compressed schedule, instead of having until January 2000, IRS must program and test all tax law changes that are to take effect in the 2000 filing season before September 30, 1999. Under the compressed schedule, business requirements are to be delivered to IRS' Information Systems organization by February 28, 1999; the Information Systems organization is scheduled to complete the application software changes by June 15, 1999; and testing of these application software changes is be completed by September 30, 1999. In 1999, IRS is to complete the development of 36 contingency plans that IRS determined are needed to address various Year 2000 failure scenarios for its core business processes. IRS' initial goal was to have these plans completed by December 1998; however, IRS' revised goal is to complete 18 submissions processing contingency plans, 2 customer service contingency plans, and 3 key support services plans by no later than March 31, 1999. One key support services contingency plan and 12 compliance contingency plans are to be completed by May 31, 1999. In June 1998, we reported that IRS' Year 2000 contingency planning efforts fell short of meeting the guidelines included in our Year 2000 Business Continuity and Contingency planning guide. Accordingly, we recommended that the Commissioner of Internal Revenue take a series of steps to broaden IRS' contingency planning effort to help ensure that IRS adequately assesses the vulnerabilities of its core business processes to potential Year 2000 induced system failures. Specifically, we recommended that the Commissioner take the following steps: (1) solicit the input of business functional areas to identify core business processes and identify those processes that must continue in the event of a Year 2000 failure; (2) map IRS' mission-critical systems to those core business processes; (3) determine the impact of information systems failures on each core business process; (4) assess existing contingency plans for their applicability to potential Year 2000 failures; and (5) develop and test contingency plans for core business processes if existing plans are not appropriate. Since we issued our report, IRS has been taking actions to address our recommendations. IRS has solicited the input of its business officials and established working groups to identify failure scenarios and to develop the contingency plans. The working groups determined IRS should develop 36 contingency plans that cover various aspects of its core business areas of submissions processing, customer service, compliance, and key support services. One factor influencing the staggered schedule for completing contingency plans was that the staff assigned to develop plans have competing responsibilities, such as the development of business requirements to implement tax law changes as well as other business improvement initiatives. Under the staggered schedule, with the exception of the key support services area, earlier completion milestones were established for those aspects of three other core business areas that, according to IRS officials, were likely to experience a Year 2000 before the other areas. To the extent that the plans require additional actions, such as those associated with testing or preparatory activities, these delays reduce the time available to complete these activities. According to IRS officials, the completion milestones of March and May 1999 reflect when the technical work for the plans is to be completed. Once that work is completed, the plans are to be approved by the official responsible for the core business process and tested. According to IRS officials, a contractor is still developing the testing approach. As a result, these officials could not provide us with the completion milestones and staff requirements for testing the contingency plans. In addition to Year 2000 efforts, IRS has other ongoing business initiatives that are placing competing demands on its information systems and business staff. The Commissioner's Executive Steering Committee (ESC) and IRS' risk mitigation efforts have provided a forum for addressing these issues. Concurrent with its Year 2000 efforts, IRS is continuing to make changes to its information systems to accommodate changes resulting from various business initiatives. These initiatives include the SCMC project that we discussed previously, implementation of the IRS Restructuring and Reform Act provisions, and of various taxpayer service initiatives. While we do not question the importance of these initiatives, as we have said before, the need to make a significant number of tax law changes for the 2000 filing season introduces an additional risk, albeit one that we could not quantify, to IRS' Year 2000 effort. In November 1997, the Commissioner established the ESC Steering Committee (ESC) to identify risks to the 1999 filing season and the entire Year 2000 effort and to take actions to mitigate those risks. In addition, IRS hired a contractor to conduct periodic risk assessments. The contractor's most recent report was issued in December 1998. Recent ESC documents, the contractor's December 1998 risk assessment report, and our interviews with SCMC officials have identified the following examples of competing demands on staff in IRS' Information Systems organization and business organizations: Documents prepared for the September 1998 ESC meeting stated that IRS' Information Systems organization that is responsible for systems software issues was "overextended" because of Year 2000 demands, SCMC, and support for the Year 2000 end-to-end test. The contractor's December 1998 risk assessment report indicated that some of IRS' core business area staff face competing demands from the need to (1) identify business requirements for the 2000 filing season and (2) complete Year 2000 contingency plans. As we said previously, IRS' goal is to have business requirements completed by the end of February. According to the minutes from the January 1999 ESC meeting, IRS' Internal Audit has also raised a concern about the availability of sufficient staff to support the Year 2000 end-to-end test given the other Year 2000 demands. According to IRS officials, Internal Audit has not released a formal report on this matter. IRS' draft paper on the SCMC schedule options states that one of the risks for each of the schedule options is the resource drain on IRS staff and contractors from the filing season, the Year 2000 end-to-end test, and critical staff being used to train any new SCMC staff. The draft option paper notes that the extent of the drain varies somewhat depending on how many service centers are to have their tax processing activities moved to the computing centers in 1999. Over the last several months, IRS has taken various actions to address these competing demands. For example: To address the "overextension" of the Information Systems organization that is responsible for systems software, the Chief of that organization said that he obtained contractor support and transferred staff from other areas. He said the additional staff, coupled with the delays in moving the tax processing activities of the service centers to the computing centers, helped alleviate this overextension. To address the competing demands on the business staff to develop Year 2000 contingency plans and finalize business requirements for the 2000 filing season, IRS officials decided to stagger the completion milestones for contingency plans. To help prioritize the work within the Information Systems organization IRS officials told us they have established another executive steering committee. In addition, the minutes from the January 1999 ESC meeting said that the Commissioner has asked the cognizant staff to identify the source of each of the 2000 filing season requirements--(i.e., IRS Restructuring and Reform Act, Taxpayer Service Improvement Initiative, etc.). This identification is the first step for providing the additional information that would be useful for establishing priorities for IRS' Information Systems staff. Since our testimony in May 1998, IRS has made considerable progress in completing its Year 2000 work. However, IRS did not complete all the work that it had planned to do by January 1999. This unfinished work and upcoming critical tasks are to be completed in the remainder of 1999. At the same time IRS is addressing its Year 2000 challenge, it is undertaking other important business initiatives, such as preparing for the 2000 filing season and implementing SCMC. These various initiatives place competing demands on IRS' business and Information Systems staff. To date, IRS has taken actions to address these competing demands, including delaying the completion milestones for some Year 2000 activities. In the next 5 months, IRS will pass several key milestones. As IRS passes each one, it will have more information on the status of its Year 2000 effort and the amount of remaining work. This information should help IRS and Congress assess the level of risk to IRS' core business processes in 2000. For example: By the end of February 1999, the business organizations are to submit their requirements to IRS' Information Systems organization for the 2000 filing season. In the event that business requirements for the 2000 filing season are not submitted on time, IRS increases the risk that some tax law changes may not be thoroughly tested before they are implemented. From April to July 1999, IRS is to conduct its Year 2000 end-to-end test. The results of this test will be an indicator of the extent to which, for the work completed thus far, IRS has been successful in making its systems Year 2000 compliant. The results of this test should also provide information on how many Information Systems staff will be needed for correcting any problems that are identified. By the end May 1999, IRS is to complete its contingency plans. These plans should provide information on any additional steps needed to implement the plans. We plan to continue to monitor IRS' progress in meeting these key milestones. Mr. Chairman, this concludes my prepared statement. I welcome any questions that you may have. (268840) The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch-tone phone. A recorded menu will provide information on how to obtain these lists.

Summary:
Pursuant to a congressional request, GAO discussed the Internal Revenue Service's (IRS) year 2000 efforts and the remaining challenges IRS faces in making its information systems year 2000 compliant, focusing on: (1) the extent to which IRS monitors the year 2000 status of its mission-critical systems in their entirety; (2) whether IRS met the January 31, 1999, completion goal for the areas that it monitors--application software, systems software, hardware, and telecommunications networks; (3) the status of two remaining, critical year 2000 tasks--conducting year 2000 testing and completing 36 contingency plans; and (4) the fact that other business initiatives are creating competing demands on staff needed for year 2000 efforts. GAO noted that: (1) a complete picture cannot be provided of the year 2000 status of IRS' 133 mission-critical systems because IRS does not report year 2000 status for these systems in their entirety; (2) instead, IRS monitors the year 2000 status of the components of an information system, such as the application software, systems software, and hardware, for each of its three types of computers--mainframes, minicomputers/file servers, and personal computers; (3) IRS reports that it met the January 31, 1999, completion goal for some of the areas that it monitors but not for others; (4) IRS reports that it met the January 1999 completion goal for: (a) correcting application software; (b) upgrading telecommunications networks; and (c) fully implementing one of its two major system replacement projects; (5) despite significant progress since GAO's testimony in May, IRS did not meet the goal for: (a) upgrading systems software and hardware for its three types of computers; and (b) fully implementing the other major system replacement project; (6) as a result of not meeting the goal for upgrading systems software and hardware, some changes will not be tested until late in 1999, reducing the time available to make corrections before January 2000; (7) for the replacement project, some service center staffs will have no experience before 2000 using the new system to process peak filing season volumes of remittances; (8) IRS must conduct the year 2000 end-to-end testing of its mission-critical systems; (9) testing is to begin in April 1999; (10) the second critical task is to develop 36 contingency plans that IRS has determined are needed to address various failure scenarios for its core business processes; (11) IRS is developing these plans in response to GAO's June 1998 report; (12) IRS has delayed the completion dates so that the first set of plans are to be completed by March 31, 1999, and the second set of plans by May 31, 1999; (13) as IRS continues its year 2000 efforts, it will face the challenge of how to address the competing demands on its staff; (14) these competing demands are created by IRS' other major business initiatives, such as implementing tax law changes and completing the non-year 2000 portions of one of IRS' major system replacement projects; and (15) to address these competing demands, in the past several months, IRS has: (a) transferred staff from other areas; (b) hired additional staff; and (c) delayed some activities.