Uniformly, every institution that has engaged in internal testing also has indicated that this process indeed located further Year 2000 problems that needed repair. Thus, in spite of extensive repair efforts, some problems were not isolated until internal future date tests were performed. This underscores why every organization must build in a program of rigorous internal testing as a part of its Year 2000 project schedule, even for applications designed to be Year 2000 compliant. Moreover, the internal testing process cannot wait until the last minute. Experience has shown that testing programs overall typically consume over 50% of the resources allocated to Year 2000 projects. External tests are conducted by an institution to assess the risks in repaired and internally tested systems where they interface with systems of other institutions. External tests are particularly important where the interface is proprietary or specific to the particular business activity and the dependency on the external interface is critical. For the most critical systems, in particular payment and settlement systems, external testing must be done, and should be done carefully. External tests can take a variety of forms. Point-to-point tests verify the ability of an institution to transmit and receive data with another entity. End-to-end tests take this one step further and verify the ability of an institution originating a transaction to transmit test data to a recipient through an intermediary which correctly performs business functions using that data. End-to-end tests are particularly appropriate for real-time, interactive applications.

Some information can in fact be downright misleading. For example, a firm may engage in internal testing and locate a number of Year 2000-related problems in its systems. Of course, it is the process of this testing that will enable the firm to locate and overcome these problems. Thus, disclosing its internal test results in isolation could give a false impression of its readiness. In general, comprehensive self-disclosure in written form, supplemented by a willingness to answer specific questions, is proving to be the most effective way of sharing information. Another issue that often comes up in this context is the question of certification. External parties, whether auditors or examiners, cannot realistically certify Year 2000 compliance. The best that they can do is focus on the effectiveness of the process that the organization has established. Oversight by these third parties should not be seen as a substitute for an organization’s own due diligence, an area in which internal audit departments have traditionally played a leading role. Internal auditors also could be useful in helping firms develop their Year 2000 disclosures. Another concern is the existence of possible legal obstacles that may stand in the way of Year 2000 information sharing. In the United States, several efforts have been made to limit or remove these obstacles, and such efforts may be needed in other countries as well. For example, a ruling was issued by our Justice Department limiting the extent to which Year 2000 information sharing could be viewed as a violation of antitrust laws.