The enormous challenge involved in making information systems Year 2000 compliant is managerial as well as technical. Agencies’ success or failure will largely be determined by the quality of their program management and executive leadership. The outcome of these efforts will also depend on the extent to which agencies have institutionalized key systems development and program management practices, as well as on their ability to execute large-scale software development or conversion projects. To assist agencies with these tasks, our Year 2000 assessment guide discusses the scope of these challenges and offers a structured, step-by-step approach for reviewing and assessing an agency’s readiness to handle the Year 2000 problem. The assessment guide states that the Year 2000 program should be managed as a single, large information systems project. The assessment guide describes in detail the five phases of a Year 2000 conversion process (i.e., awareness, assessment, renovation, validation, and implementation). Each of these phases represents a major Year 2000 program activity or segment. To successfully address the Year 2000 problem, effective program and project management is required for all five phases. Appendix I contains a description of these phases. To make its information systems Year 2000 compliant, IRS must (1) convert existing systems by modifying application software and data and upgrading hardware and systems software, if needed; (2) replace systems if correcting them is not cost-beneficial or technically feasible; or (3) retire systems if they will not be needed by 2000. IRS’ Chief Information Officer (CIO) established several parallel efforts to help ensure that IRS achieves Year 2000 compliance by January 1999. These efforts include creating the Century Date Change Project Office, which is responsible for coordinating the conversion of most existing information systems that can be made Year 2000 compliant as well as ensuring that all systems are converted in accordance with the same standards. The Century Date Change Project Office adapted our Year 2000 conversion model phases and established a 14-step process to track the progress of its Year 2000 conversion efforts. Some of the steps involved in converting existing systems include (1) converting applications; (2) upgrading hardware and/or systems software for mainframes, minicomputers/file servers, and personal computers; (3) upgrading telecommunications networks; and (4) ensuring that external data exchanges are Year 2000 compliant. The other parallel Year 2000 efforts are 2 major replacement efforts: (1) the replacement of the Distributed Input System (DIS) and the Remittance Processing System (RPS) with the Integrated Submission and Remittance Processing (ISRP) system and (2) the consolidation of the mainframe computer processing operations at 10 service centers to 2 computing centers. IRS personnel use DIS to input taxpayer data and RPS to input remittance data. According to IRS, these systems are old, and it is not cost-beneficial to make them Year 2000 compliant. Therefore, IRS decided to replace DIS and RPS with ISRP. A two-phase pilot of ISRP is under way during 1998 at IRS’ Austin Service Center. Nationwide implementation is scheduled for January 1999. As a part of its mainframe consolidation effort, IRS is to (1) replace and/or upgrade service center mainframe hardware, systems software, and telecommunications infrastructure; (2) replace about 16,000 terminals that support frontline customer service and compliance operations; and (3) replace the communication replacement system that provides security functions for on-line taxpayer account databases. Replacements of the terminals and the communication replacement system are critical to IRS’ achieving Year 2000 compliance. IRS is undertaking the non-Year 2000 aspects of mainframe consolidation because it concluded that consolidation would satisfy the Office of Management and Budget’s Bulletin 96-02, which directs agencies to consolidate information processing centers; be consistent with IRS’ planned modernization architecture; and save an estimated $356 to $500 million from fiscal years 1997 through 2003. IRS’ original mainframe consolidation schedule called for moving mainframe computer processing operations and the communication replacement system from 10 service centers to 2 computing centers between December 1997 and December 1998. The mainframe consolidation project is to provide the hardware, systems software, and telecommunications infrastructure for 40 mission-critical systems whose application software is being converted under the direction of the Century Date Change Project Office. IRS is experiencing delays in completing conversion efforts for its existing systems and major systems replacement efforts. IRS has made the most progress in converting its applications for the systems it has deemed mission-critical. Conversion efforts for systems software and hardware, telecommunications networks, and external data exchanges are still in the initial steps of IRS’ 14-step conversion process. The completion schedule for mainframe consolidation, with the exception of the Year 2000 critical aspects, has been extended beyond December 1998. Table 1 shows how IRS has allocated each of the 14 steps in its conversion process to our Year 2000 assessment, renovation, validation, and implementation phases. Much of IRS’ early Year 2000 efforts in 1996 focused on the awareness and assessment phases of the applications for existing information systems controlled by the CIO. In May 1997, IRS began assessing the date dependencies of applications for information systems that were controlled by either field offices or business functional areas (hereafter referred to as field/customer systems). As a result of the CIO and field/customer system assessments that were completed as of March 31, 1998, IRS had identified 127 mission-critical systems, including 7 telecommunications systems. As of April 24, 1998, IRS reported that it had completed the first 12 steps of its 14-step conversion process on applications for about 46 percent (59 systems) of its 127 mission-critical systems. In doing so, IRS fell short of its goal of having the applications for 66 systems converted by January 31, 1998. IRS’ schedule calls for completing the first 12 steps for the remaining 54 percent (68 systems) of the mission-critical systems by January 1999. IRS officials said that they believe they are on track for meeting that goal. IRS is still in the initial steps of its 14-step conversion process for most of its systems software, hardware, and telecommunications network components. IRS is also still in the initial stages of converting its external data exchanges. Appendix II provides additional information on the status of the conversion process for each of these areas. Of these infrastructure areas, according to IRS, telecommunications networks present the most significant conversion challenge and may be at the highest risk for not being done by January 1999. According to IRS, the capability to exchange information, both voice and data, between various computer systems is the backbone of IRS’ ability to perform all of its tax processing and customer service functions. IRS uses a telecommunications network that is supported through the Department of the Treasury and additional networks that are unique to IRS. As of March 10, 1998, IRS had an inventory of the components that are included in Treasury’s network and was verifying a preliminary inventory of the components in the networks unique to IRS. At the time of our review, a contractor was doing a risk assessment to help develop a conversion schedule so that the most important work would be scheduled first to minimize adverse impacts if IRS is not able to complete all of its telecommunications work by January 1999. IRS’ systems replacement efforts (i.e., ISRP and mainframe consolidation) are experiencing some delays. For example, certain ISRP software development that was to be completed in April 1998 is now scheduled to be done by June 16, 1998. As a result, the time available for testing before the start of the second phase of the pilot has been reduced. ISRP project office officials still anticipate that ISRP will be implemented nationwide by December 1998. The completion schedule for consolidating the data processing portion of service center operations has been extended from December 1998 until after June 1999. According to IRS officials, the need for this extension stems from numerous factors, including field office concerns about the ambitious schedule and expanded business requirements for security, disaster recovery, and testing. At the time we were finalizing this report, IRS officials said they were assessing various technical alternatives for meeting the expanded business requirements. They said they expect a revised business case and budget estimates that reflect the impact of both the schedule and requirements changes to be completed in June 1998. IRS officials said they expect to complete the Year 2000 portions of mainframe consolidation (i.e., terminal replacement and the communication replacement system) by the original completion date of December 1998. However, the communication replacement system has been experiencing some difficulties and is somewhat behind its original schedule for system testing. In our briefing to your office, we said that IRS’ ability to meet future milestones was at increased risk because IRS lacked a master schedule showing the relationships and interdependencies among the many Year 2000 efforts that must be completed in 1998. According to our assessment guide, a master conversion and replacement schedule should be a part of an agency’s Year 2000 program plan. This schedule could be used to (1) establish the sequential relationships among all of the tasks associated with all Year 2000 activities; (2) identify how much a task’s milestone completion date could slip without affecting other tasks; (3) help determine whether programming and testing resources will be available when needed, given the concurrent milestone completion dates for various tasks; and (4) provide a tool for assigning programming and testing resources that are essential to the success of all efforts in the most efficient manner. Understanding the schedule and resource interdependencies of all the key activities that are needed to make its systems Year 2000 compliant is imperative if IRS is to make its mission-critical systems Year 2000 compliant on time. For example, IRS’ mainframe consolidation project is behind schedule because of start-up delays and problems with implementing the systems software that is being used to consolidate one of the mainframe platforms. As a result of the problems with the commercial off-the-shelf software, additional testing is being done that was not initially expected. This testing requires staff from IRS’ Information Systems Office of Technical Support, which is also supporting the Century Date Change Project Office in other efforts. A master schedule showing both task and resource requirements should help identify whether any of the individual Year 2000 efforts will require the same staff for the same time period. Recognizing that several major and complex projects, including application software changes that are needed to implement recent tax legislation, must be completed before the 1999 filing season, in November 1997, the Commissioner of Internal Revenue announced the establishment of an executive steering committee. This committee is to identify risks to the 1999 filing season and the entire Year 2000 effort and take actions to mitigate those risks. As a part of this effort, IRS developed a Century Date Change Project Schedule for its Year 2000 activities. While the project schedule identifies the tasks for major Year 2000 activities, their corresponding start and finish dates, and the primary organizations responsible for them, the schedule does not yet establish a link between related tasks or analyze how the timing of the various tasks may affect resource availability. Until these actions are complete, IRS cannot project whether resources will be available when needed for concurrent tasks. Thus, IRS faces the risk that resources may not be available when needed. On February 12, 1998, IRS issued a statement of work for a contractor to provide program management support to the Commissioner’s newly established executive steering committee. One of the support activities that IRS identified in the statement of work was the development of an integrated schedule identifying (1) the interfaces and dependencies among Year 2000 projects and (2) efforts to implement legislative changes for the 1999 filing season. IRS expects this schedule, along with related tasks and dependencies, to be available in June 1998. If properly developed, this schedule should meet the intent of the master conversion and replacement schedule called for in our assessment guide. The contractor is to work closely with IRS staff who are responsible for the various Year 2000 efforts to assess resource needs for new requirements or resource shortages for existing requirements. The contractor also is to identify and recommend alternatives for allocating resources to help IRS meet all of its requirements. Contingency planning was the second risk area we identified during our briefing to your office. Under IRS’ contingency planning approach, IRS may be jeopardizing the continuity of operations for core business processes in the event that Year 2000-induced system failures occur. IRS’ Century Date Change Project Office has developed a “Century Date Change Contingency Management Plan.” This plan states that “developing contingency procedures for all of IRS’ numerous systems will require a significant amount of knowledgeable resources, in most cases the same resources assigned to perform the actual century date change conversion effort.” To minimize the number of contingency plans that IRS would have to develop, the contingency management plan calls for developing contingency plans only for those business functions or processes that are supported by application software projects that are at risk of not being made Year 2000 compliant on schedule. The Century Date Change Project Office has established criteria to identify such projects. For these projects, IRS is to initiate a business function impact analysis. Once that analysis is complete, technical and business owners evaluate available alternatives, including using any existing contingency procedures, such as manual procedures, or an alternative technological solution, such as commercial off-the-shelf software. IRS plans to use a similar approach for initiating contingency plans for business functions when the conversion of infrastructure areas, such as systems software, external data exchanges, and telecommunications network components, falls behind schedule. IRS’ “Century Date Change Contingency Management Plan” does not address the likelihood that information systems that are converted on schedule may experience system failures. As a result, IRS will be ill-prepared to effectively manage Year 2000-induced system failures that could affect core business processes. IRS’ contingency management plan does not address the possibility that (1) IRS may have overlooked a date dependency during its assessment phase of applications or infrastructure areas or (2) even if system conversion and replacement efforts are completed on time and fully tested, unexpected failures may occur. Aspects of contingency planning are under way for IRS’ replacement projects (i.e., ISRP and mainframe consolidation). For example, the ISRP project office has developed a contingency plan that identifies (1) various risks to the ISRP pilot and nationwide implementation, (2) the probability of those risks, and (3) contingency options for addressing those risks. IRS is also taking steps to make its existing service center mainframe computers Year 2000 compliant in the event that the consolidation of tax processing to the computing centers is not completed according to schedule. IRS expects to make its existing service center mainframe computers Year 2000 compliant by January 1999. Also, as part of a larger effort to enhance IRS’ disaster recovery capabilities, IRS officials said they have identified expanded disaster recovery requirements for service center data processing. At the time we were finalizing this report, IRS officials said they were assessing various technical alternatives for meeting those requirements so they can be incorporated in the mainframe consolidation project. Our exposure draft on business continuity and contingency planning states that agencies must start business continuity and contingency planning now to reduce the risk of Year 2000 business failures. Among other things, the exposure draft states that agencies need to do a business impact analysis to determine the effect of mission-critical system failures on the viability of agency operations. This analysis is to include examining business priorities; dependencies; service levels; and, most important, the business process dependency on mission-critical information systems. According to our exposure draft, the business impact analysis triggers the development of contingency plans for each core business process, including any information system components that support that process. Contingency plans would also address the actions IRS may take, for example, to notify taxpayers in the event that Year 2000 failures cause significant delays in processing tax returns and issuing refunds. IRS has undertaken efforts in the past to identify its core business processes as a part of various reengineering efforts that could be the starting point for a business impact analysis. For example, in 1996, as part of an effort to redesign its work processes, IRS began an effort to identify and map core business processes. IRS is still assessing some of its infrastructure components and faces the risk of not completing all of its Year 2000 efforts by January 1999. Moreover, IRS, like other agencies, is likely to encounter Year 2000-induced failures in some systems that were fully assessed, tested, and implemented. IRS’ “Century Date Contingency Management Plan” focuses on developing contingency plans only for business functions that are supported by application software projects that are behind schedule. The possibility exists that existing contingency or disaster recovery plans that were developed for other than Year 2000 purposes may be applicable to Year 2000 failures. However, if these plans are not applicable, under IRS’ “Century Date Contingency Management Plan,” IRS has no assurance that its core business processes will be able to continue to function, albeit, possibly at some reduced level of service, in the event that Year 2000-induced failures occur in systems that were converted according to schedule. We recommend that the Commissioner of Internal Revenue take the following steps to better ensure that IRS has adequately assessed the vulnerabilities of its core business processes in the event of Year 2000-induced system failures: solicit the input of business functional area officials to identify IRS’ core business processes and prioritize those processes that must continue in the event of Year 2000-induced failures; map IRS’ mission-critical systems to those core business processes; determine the impact of information system failures on each core business assess any existing business continuity and contingency plans that may have been developed for non-Year 2000 reasons to determine whether these plans are applicable to Year 2000-induced failures, and develop and test contingency plans for core business processes if existing plans are not appropriate. We requested comments on a draft of this report from the Commissioner of Internal Revenue or his designated representative. IRS provided us with comments during a May 4, 1998, meeting with the Acting Chief Information Officer and his staff. Those comments were reiterated in a May 8, 1998, letter from the Commissioner of Internal Revenue, which is reproduced in appendix III. The Commissioner said that IRS agrees that it must develop contingency plans to manage any adverse impacts of a less-than-fully successful century date program, and that IRS will take the following actions to address our recommendations regarding contingency planning. He said that to leverage the limited resources on the remaining Year 2000 conversion and testing efforts, IRS will focus contingency planning on those areas that have the greatest risk and highest business impact. Specifically, the Commissioner said the Acting Chief Information Officer will be working with the other Chief Officers to document IRS’ current business processes, the systems that support them, the impact if these processes or systems fail, and the probability or potential for Year 2000 risk. The Commissioner said that contingency plans will be developed for those areas that meet all of the following criteria: (1) high business impact, (2) high risk associated with failure, and (3) high probability of systems failure/instability due to Year 2000 conversion. We believe that these actions, if implemented properly, address most of the steps we identified in our contingency planning recommendations and should put IRS in a better position to respond to unexpected failures as a result of the Year 2000 problem than was the case under its previous contingency planning approach. However, we remain concerned that IRS will be ill-prepared in the event a failure occurs in a high business impact area that is supported by a system that IRS assesses as having a low probability of failure, but subsequently fails unexpectedly. We recognize that IRS needs to leverage its resources, particularly its information systems resources, to ensure that it completes all of the required Year 2000 conversion work on schedule. However, we believe it would be prudent for IRS’ business officials who are responsible for high business impact areas, regardless of the perceived Year 2000 risks, to begin identifying alternative business procedures or processes that may need to be implemented in the event of unexpected systems failure. In addition to commenting on our recommendations, IRS provided us with updated information on the status of its Year 2000 efforts. We have incorporated that updated information in the report where appropriate. The updated information is also included in IRS’ “Status Update Summary,” which is also reproduced in appendix III. To determine IRS’ progress and identify the risks facing its Year 2000 conversion efforts, we interviewed officials from the National Office, computing centers, service centers, regions, and district offices. We analyzed and compared IRS’ planning, budget, and performance-monitoring documentation with our Year 2000 assessment guide as a part of a structured approach for reviewing IRS’ conversion efforts. We did not review existing business continuity or contingency plans that IRS may have been developing for other than Year 2000-induced failures. We conducted our work in accordance with generally accepted government auditing standards between October 1996 and May 1998. We are sending copies of this report to the Subcommittee’s Ranking Minority Member; the Chairmen and Ranking Minority Members of the House Committee on Ways and Means and the Senate Committee on Finance, Subcommittee on Taxation and IRS Oversight; various other congressional committees; the Secretary of the Treasury; the Commissioner of Internal Revenue; the Director of the Office of Management and Budget; and other interested parties. We will also make copies available to others upon request. The major contributors to this report are listed in appendix IV. Please contact me at (202) 512-9110 if you have any questions about this report. Our Year 2000 assessment guide describes in detail the five phases that agencies need to complete when making their systems Year 2000 compliant. Each of the following phases represents a major Year 2000 program activity or segment: Awareness. This phase entails defining the Year 2000 problem, gaining executive level support and sponsorship, and ensuring that everyone in the organization is fully aware of the issue. It is also during this phase that the agency is to establish a Year 2000 program team and develop an overall strategy. Assessment. This phase entails assessing the Year 2000 impact on the agency, identifying core business areas, inventorying and analyzing the systems supporting the core business areas, and prioritizing the conversion or replacement of these systems. It is also during this phase that the agency is to initiate contingency planning and identify and secure the necessary resources. Renovation. This phase deals with converting, replacing, or eliminating selected systems and applications. In so doing, it is important that the agency consider the complex interdependencies among the systems and applications. Validation. This phase deals with testing, verifying, and validating all converted or replaced systems and applications and ensuring that they perform as expected. This entails the agency testing in an operational environment the performance, functionality, and integration of converted or replaced systems, applications, and databases. Implementation. This phase entails deploying and implementing Year 2000-compliant systems and components. It is also during this phase that the agency’s data exchange contingency plans are implemented, if necessary. This appendix contains additional information on the status of IRS’ infrastructure areas that were in the initial steps of IRS’ 14-step conversion process at the time of our review. These initial steps are comparable to either our assessment or renovation phase of our Year 2000 Conversion Model. According to the Office of Management and Budget’s guidelines, agencies were to have completed the assessment phase by June 1997. IRS placed a priority on assessing its mainframe computers first because these computers encompass most of IRS’ tax processing systems. IRS is still assessing its telecommunications networks, external data exchanges, and the systems software and hardware for minicomputers/file servers and personal computers. IRS has completed its assessment of its mainframe computers and has scheduled their conversion. All existing mainframe hardware and systems software are currently scheduled to be converted between January 1998 and January 1999. IRS’ mainframe computer systems constitute the core of IRS’ data processing activities, including the processing of tax return and remittance data and the storage of taxpayer account and collection activity data. These systems are currently located at IRS’ 10 service centers, the Martinsburg Computing Center, and the Detroit Computing Center. Most of IRS’ mainframe computers are being replaced as a part of IRS’ mainframe consolidation project. In the event that not all centers can be consolidated by 2000, IRS is proceeding with plans to make its existing mainframe hardware and systems software at the service centers Year 2000 compliant. Some mainframe computers, such as those supporting master-file processing at the Martinsburg Computing Center and others at the Detroit Computing Center, are not included in the mainframe consolidation project. These mainframe computers are to be upgraded to achieve Year 2000 compliance by January 1999. IRS is still in the assessment phase for its telecommunications networks. IRS relies extensively on telecommunications networks to accomplish its mission. According to the IRS’ Year 2000 Telecommunications Project Management Plan, the IRS’ telecommunications network is a critical component of IRS’ tax processing and customer service operations. The capability to exchange information, both voice and data, among its various computer systems is the backbone of IRS’ ability to perform all of its tax processing and customer service functions. According to the Commissioner’s Executive Steering Committee documents, the telecommunications networks conversion is significantly behind schedule for meeting the January 1999 milestone. Although IRS has established conversion schedules for the mission-critical areas of its telecommunications networks and is integrating these schedules into an overall plan, many of the individual components that make up these mission-critical areas have not been fully assessed. Generally, these components have not been fully assessed because IRS’ inventory of telecommunications resources has not been sufficiently detailed to allow IRS to (1) confirm the Year 2000-compliant status of all telecommunications components, (2) develop detailed conversion schedules, and (3) track conversion progress against those schedules. In part, the inventory has been difficult to compile because IRS’ telecommunications networks include both IRS-owned and multiple vendor-maintained networks and equipment, such as the Treasury-supported network, that cannot be easily combined to serve as a comprehensive source of information. IRS, Treasury, and contractors have formed integrated teams to address the Year 2000 telecommunications issues. IRS is currently validating the inventory of the Treasury-supported network by conducting site-specific inventories at its service centers. In addition to needing quality inventory data, IRS’ conversion solutions and plans for some areas are largely dependent on the ability of vendors to provide Year 2000-compliant products in a timely manner. After these products are received, IRS must test them to ensure that they work within IRS’ own data processing environment. According to IRS officials, a test plan for the Treasury-supported network has been developed. Given the large extent to which IRS relies on telecommunications networks to accomplish its mission and the high degree of risk associated with not making IRS’ telecommunications networks Year 2000 compliant, IRS’ telecommunications project plan calls for steps to mitigate this risk. The plan calls for initiating efforts to ensure that the portions of IRS’ telecommunications networks that are most critical to IRS’ operations are scheduled first and receive the necessary resources in accordance with their priority to IRS’ operations. At the time of our review, a contractor was doing a risk assessment to help develop a conversion schedule so that the most important work is scheduled first to minimize adverse impacts if IRS is not able to complete all of its telecommunications work by January 1999. According to IRS documents, this risk assessment will also trigger the development of contingency plans for mission-critical systems that are found to be at risk for not being converted on time. As an additional contingency measure, according to IRS, it is building redundancy into telecommunications networks to provide limited access if a portion of the network fails due to Year 2000 compatibility issues. IRS hopes to complete its assessment of external data exchanges by June 30, 1998. IRS, like most organizations, exchanges data in an electronic format with other organizations for a variety of purposes. These data exchanges involve both other government agencies as well as private sector organizations. For example, IRS (1) transmits information electronically to the Treasury’s Financial Management Service (FMS) for the purposes of reporting revenue receipts and the issuance of refund checks and (2) receives wage information (W-2) from the Social Security Administration (SSA) to verify the accuracy of individuals’ reported income. IRS also receives interest income data from banks and provides information to many states to assist them with taxpayer compliance activities. In September 1997, IRS initiated a plan to identify (1) all of its external data exchange organizations and (2) the actions needed to ensure that data exchanges are not adversely impacted by the Year 2000 problem. IRS has notified these organizations that Treasury has adopted a four-digit date field. IRS reports that as part of its application conversion efforts it has already converted more than 50 percent of the more than 300 data files that it exchanges with more than 400 organizations. A key portion of the remaining work involves contacting each of the organizations and verifying that it is aware of the IRS’ plans for conversion and it has taken steps to ensure the continued receipt and transmission of data. IRS has also identified a group of organizations whose external data exchanges are most critical to IRS’ operations and plans to commit additional attention and resources to these organizations to ensure that Year 2000 data exchange issues are thoroughly addressed. These organizations include government agencies, such as FMS, SSA, and the Federal Reserve, as well as private firms that are involved in activities such as the Electronic Federal Tax Payment System for federal employment tax deposits and banks that provide “lockbox” processing of $170 billion in remittances annually. To ensure that these most critical areas are thoroughly addressed, IRS has hired a contractor to conduct site visits to validate that the systems that receive/provide these data are on track to be Year 2000 compliant. At the time of our review, IRS was validating its inventory of external data exchanges and obtaining agreements regarding the organizations’ plans for converting their systems so that data exchanges can be made Year 2000 compliant. For the most part, IRS has completed its assessment of its minicomputer/file-server hardware and systems software. In the last 10 to 15 years, IRS has developed a number of information systems that use minicomputer and file-server technologies, rather than the mainframe-based technology that it has used for the past 30 years. IRS has identified 39 mission-critical systems that use minicomputer and file-server technologies. These systems support a variety of programs, including electronic filing, customer service, returns processing, fraud detection, criminal investigation, and compliance research activities. Many of these systems input data to IRS’ mainframe-based systems and, as such, are key elements of IRS’ tax processing system. Because organizational control over these systems is scattered across various project offices within IRS’ information systems organization and business or functional units, IRS has taken longer to identify and assess these systems than it has taken for its mainframe-based systems. The lack of an accurate inventory has also hindered progress in completing the assessment of these systems. IRS is relying on vendors to provide the Year 2000 solution for 12 platforms (i.e., a combination of computer hardware and systems software). These platforms currently support 39 mission-critical systems and several other important applications. According to the Commissioner’s Executive Steering Committee documents, IRS established March 15, 1998, as the date by which IRS wanted some assurance by the vendors that a Year 2000 solution existed for these platforms. Of the 12 platforms, 2 will be retired (1 of which will be replaced when ISRP is implemented nationwide.) IRS has determined that two platforms cannot be made Year 2000 compliant, and, at the time of our review, IRS was still evaluating its replacement options for them. As of April 10, 1998, IRS had either received or was about to receive the eight remaining platforms. IRS had identified a relational database as its greatest risk for its minicomputers and file servers because it supports 15 mission-critical systems, and IRS is the vendor’s only customer for this product. IRS officials told us that as of May 8, 1998, the vendor had provided a version of this database to IRS for testing. IRS officials said that once testing is completed, they will take the necessary steps to procure this database and make it available to the various users. Despite having identified the Year 2000 solutions for various minicomputer/file-server platforms, as of May 8, 1998, IRS had not yet completed a plan for migrating business or functional organizations from their current minicomputer/file-server platforms to the ones that are Year 2000 compliant. Specifically, as of May 8, 1998, IRS was beginning to develop for business and functional organizations (1) a schedule of critical tasks, (2) the associated milestones for completing the tasks, and (3) guidance on how to complete the tasks. IRS is in the assessment phase for personal computer hardware and commercial software (i.e., systems software and applications). IRS uses personal computers extensively for a wide range of functions, including (1) providing customer service staff with access to taxpayer account databases, (2) allowing compliance staff to collect detailed information and do complex calculations while working in the field, (3) entering information from tax returns and remittances, and (4) doing essential administrative functions. IRS has identified 134,000 personal computers that it must assess to determine if the hardware and/or the associated systems software is Year 2000 compliant or must be converted. IRS has estimated that approximately 60,000 of these computers support mission-critical functions. Of these 60,000 computers, IRS is currently replacing approximately 16,000 as part of IRS’ service center mainframe consolidation project. IRS’ goal is to convert all personal computers by January 1999. The Century Date Change Project Office is assigning Year 2000 conversion responsibility for personal computers to the organizations within IRS that currently share responsibility for purchasing and maintaining personal computers and their associated commercial software. According to the Century Date Change Project Office, as of March 1998, it had assigned responsibility for converting 75,000 of these personal computers. A. Carl Harris, Assistant Director Joanna Stamatiades, Evaluator-in-Charge Robert Arcenia, Senior Evaluator Linda Standau, Senior Evaluator Ronald Heisterkamp, Evaluator The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: GAO reviewed the Internal Revenue Service's (IRS) efforts to have its information systems function correctly when processing dates beyond December 31, 1999, focusing on: (1) IRS' progress in converting its systems according to the guidelines in GAO's year 2000 assessment guide; (2) the risks IRS faces to completing the year 2000 effort on time; and (3) risks to the continuity of IRS operations in the event of year 2000-induced system failures. GAO noted that: (1) according to IRS, before January 1999, it needs to complete 12 steps of its 14-step process for converting: (a) the applications for its existing systems; (b) the telecommunications networks; and (c) systems software and hardware for mainframes, minicomputers/file servers, and personal computers; (2) in addition, before January 1999, IRS needs to: (a) ensure that external data exchanges will be year 2000 compliant; (b) implement the Integrated Submission and Remittance Processing System and, at a minimum, the year 2000 portions of mainframe consolidation; and (c) modify application software to implement tax law changes for the 1999 and 2000 filing seasons; (3) if these efforts are not completed, IRS' tax processing and collection systems may fail to operate or may generate millions of erroneous tax notices, refunds, interest calculations, and account adjustments; (4) for the conversion of its existing systems, IRS has made more progress on its applications than on its information systems infrastructure; (5) specifically, as of April 24, 1998, IRS reported that it had completed the first 12 steps of its 14-step conversion process for applications for about 46 percent of the 127 systems it has deemed as mission-critical; (6) IRS expects to convert the applications for the remaining 54 percent of the mission-critical systems by January 1999; (7) the two major systems replacement efforts, which are also expected to follow IRS' 14-step conversion process, are experiencing some schedule slippages; (8) IRS officials said they expect to complete the year 2000 portions of the mainframe consolidation by the original completion date of December 1998; (9) GAO identified two risk areas for IRS' year 2000 effort: (a) the lack of an integrated master conversion and replacement schedule; and (b) a limited approach to contingency planning; (10) since GAO's briefing, IRS has decided to have a contractor develop an integrated schedule of its year 2000-related efforts, including making all of the necessary tax law changes for 1999; (11) IRS officials said they hope to have a baseline, master integrated schedule in June 1998; and (12) in part, due to IRS officials' concerns that the same resources that are doing year 2000 conversion work would be needed to do contingency planning, IRS officials decided to develop a process that would minimize the number of contingency plans that would have to be developed.