Addressing the Year 2000 problem in time will be a formidable challenge for the District of Columbia. The District government is composed of approximately 80 entities, responsible for carrying out a vast array of services for a diverse group of stakeholders. These services include municipal, state, and federal functions, such as street maintenance and repairs, economic development and regulation, trash pick-up, water and sewer services, educational institutions, hospital and health care, public safety, and correctional institutions. Each of these services is susceptible to the Year 2000 problem. The Year 2000 problem is rooted in the way dates are recorded and computed in automated information systems. For the past several decades, systems have typically used two digits to represent the year, such as “97” representing 1997, in order to conserve on electronic data storage and reduce operating costs. With this two-digit format, however, the year 2000 is indistinguishable from 1900, or 2001 from 1901. As a result of this ambiguity, system or application programs that use dates to perform calculations, comparisons, or sorting may generate incorrect results. The District has a widespread and complex data processing environment, including a myriad of organizations and functions. There are four major data centers located throughout the city, each serving divergent groups of users, running multiple applications, and using various types of computer platforms and systems. Most of the District’s computer systems were not designed to recognize dates beyond 1999 and will thus need to be remediated, retired, or replaced before 2000. To complicate matters, each District agency must also consider computer systems belonging to other city agencies, other governments, and private sector contractors that interface with their systems. For example, the Social Security Administration exchanges data files with the District to determine the eligibility of disabled persons for disability benefits. Even more important, the District houses the most critical elements of the federal government. The ability of the District to perform critical government services after the century date change is not only essential to District residents but also important to the continuity of operations of the executive, congressional, and judicial offices housed here. In addition, the Year 2000 could cause problems for the many facilities used by the District of Columbia that were built or renovated within the last 20 years and contain embedded computer systems to control, monitor, or assist in operations. For example, water and sewer systems, building security systems, elevators, telecommunications systems, and air conditioning and heating equipment could malfunction or cease to operate. The District cannot afford to neglect any of these issues. If it does, the impact of Year 2000 failures could potentially be disruptive to vital city operations and harmful to the local economy. For example: Critical service agencies, such as the District’s fire and police departments, may be unable to provide adequate and prompt responses to emergencies due to malfunctions or failures of computer reliant equipment and communications systems. The city’s unemployment insurance benefit system may be unable to accurately process benefit checks as early as January 4, 1999. The city’s tax and business systems may not be able to effectively process tax bills, licenses, and building permits. Such problems could hamper local businesses as well as revenue collection. Payroll and retirement systems may be unable to accurately calculate pay and retirement checks. Security systems, including alarm systems, automatic door locking and opening systems and identification systems, could operate erratically or not all, putting people and goods at risk and disabling authorized access to important functions. To address these Year 2000 challenges, we issued our Year 2000 Assessment Guide to help federal agencies plan, manage, and evaluate their efforts. This guide provides a structured approach to planning and managing five delineated phases of an effective Year 2000 program. The phases include (1) raising awareness of the problem, (2) assessing the complexity and impact the problem can have on systems, (3) renovating, or correcting, systems, (4) validating, or testing, corrections, and (5) implementing corrected systems. We have also identified other dimensions to solving the Year 2000 problem, such as identifying interfaces with outside organizations specifying how data will be exchanged in the year 2000 and beyond and developing business continuity and contingency plans to ensure that core business functions can continue to be performed even if systems have not been made Year 2000 compliant. Based on the limited data available on the status of local and state governments, we believe that the District’s Year 2000 status is not atypical. For example, a survey conducted by Public Technology, Inc. and the International City/County Management Association in the fall and winter of 1997, found that of about 1,650 cities that acknowledged an impact from Year 2000, nearly a quarter had not begun to address the problem. In addition, state governments are also reporting areas where they are behind in fixing Year 2000 problems. For example, as we recently testified before the Subcommittee on Government Management, Information and Technology, House Committee on Government Reform and Oversight, a June 1998 survey conducted by the Department of Agriculture’s Food and Nutrition Service, found that only 3 states reported that their Food Stamp Program systems were Year 2000 compliant and only 14 states reported that their Women, Infants, and Children program were compliant. Moreover, four states reported that their Food Stamp Program systems would not be compliant until the last quarter of calendar year 1999, and five states reported a similar compliance time frame for the Women, Infants, and Children program. Until June 1998, the District had made very little progress in addressing the Year 2000 problem. It had not identified all of its mission-critical systems, established reporting mechanisms to evaluate the progress of remediation efforts, or developed detailed plans for remediation and testing. In addition, it lacked the basic tools necessary to move its program forward. For example, it had not assigned a full-time executive to lead its Year 2000 effort, established an executive council or committee to help set priorities and mobilize its agencies, or identified management points-of-contact in business areas. Since this past June, the District has recognized the severity of its situation and taken a number of actions to strengthen program management and to develop a strategy that is designed to help the city compensate for its late start. For example, to improve program management, the District has hired a new chief technology officer, appointed a full-time Year 2000 program manager, established a Year 2000 program office, and continued to use its chief technology officer council to help coordinate and prioritize efforts. The District also contracted with an information technology firm to assist in completing the remediation effort. To accomplish this in the short time remaining, the District and the contractor plan to concurrently (1) remediate and test system applications, (2) assess and fix the information technology (IT) infrastructure, including the data centers, hardware, operating systems, and telecommunications equipment, (3) assess and correct noninformation technology assets, and (4) develop contingency plans. So far, the District has done the following. Developed an inventory of information technology applications. Of the 336 applications identified, the District and its contractor determined that 84 are deemed Year 2000 compliant, 135 have already been remediated but still need to be tested, and 117 need to be remediated and tested. According to the District, over 9 million lines of code still need to be remediated. Initiated pilot remediation and test efforts with the pension and payroll system. The system has been converted and the conversion results are being readied for system users to review. The District expects to complete the pilot by December 31, 1998. Adopted a contingency planning methodology that it is now piloting on the 911 system, the water and sewer system, and the lottery board system. It expects to complete the first two pilots by October 31, 1998, and the remaining one during the first quarter of fiscal year 1999. Developed a strategy for remediating non-IT assets that is now being tested on the water and sewer system. This is also expected to be done by October 31, 1998. After this effort is completed, the District and the contractor will begin to assess and remediate non-IT equipment at agencies providing critical safety, health, and environmental services. The District’s recent actions reflect a commitment on the part of the city to address the Year 2000 problem and to make up for the lack of progress. However, the District is still significantly behind in addressing the problem. As illustrated in the following figure, our Assessment Guide recommends that organizations should now be testing their systems in order to have enough time to implement them. They should also have business continuity and contingency plans in place for mission-critical systems to ensure the continuity of core business operations if critical systems are not corrected in time. By contrast, the District is still in the assessment process—more than 1 year behind our recommended timetable. For example, it has not identified all of its essential business functions that must continue to operate, finished assessing its IT infrastructure and its non-IT assets, provided guidance to its agencies on testing, and identified resources that will be needed to complete remediation and testing. Until the District completes the assessment phase, it will not have reliable estimates of how long it will take to renovate and test mission-critical systems and processes and to develop business continuity and contingency plans. The District will also be unable to provide a reliable estimate of the costs to implement an effective Year 2000 program. Further, the District has had some problems in completing the assessment phase. For example, according to program office officials, three agencies—the Court System, Superior Court, and Housing Authority—have refused to participate in the program office’s assessment activities. Agencies also do not consistently attend program office meetings and do not always follow though on their assessment commitments, such as ensuring that program office and contractor teams have access to agency personnel and data. Program office officials attributed these problems to the office’s limited authority and the lack of mandatory requirements to participate in the Year 2000 program. Failure to fully engage in the Year 2000 program can only increase the risks the District faces in trying to ensure continuity of service in key business process areas. District officials acknowledge that the city is not able to provide assurance that all critical systems will be remediated on time. We agree. Therefore, to minimize disruptions to vital city services, it will be essential for the District to effectively manage risks over the next 15 months. First, because it is likely that there will not be enough time to remediate all systems, the District must identify and prioritize its most critical operations. This decision must collectively reside with the key stakeholders involved in providing District services and must represent a consensus of the key processes and their relative priority. The results of this decision should drive remediation, testing, and business continuity and contingency planning and should provide increased focus to the efforts of the Year 2000 office and its contractor. To this end, we recommend that the District, along with its current Year 2000 efforts, identify and rank the most critical business operations and systems by October 31, 1998. The District should use this ranking to determine by November 30, 1998, the priority in which supporting systems will be renovated and tested. Continuity of operations and contingency plans for these processes and systems should also be initiated at this time if such action is not already underway. Second, for systems that may not complete remediation but that are still important to city operations, managers will need to develop contingency plans for continued operations. It is essential that such plans be developed early to provide stakeholders as much time as possible to provide resources, develop “workarounds,” or secure legislative or administrative approvals as necessary to execute the plans. Third, because of the dependencies between the District and the surrounding local and federal government entities, the District will need to work closely with those bodies to both identify and prepare appropriate remedial steps and contingency plans to accommodate those dependencies. We recommend that the District immediately develop an outreach program to first identify its dependencies and then determine the remediation required to minimize the risk of Year 2000 failure. Finally, efforts to address this problem must have continued top-level commitment from the Chief Management Officer and the department and agency heads, the Mayor’s office, and the control board. Establishing a program office and hiring a contractor with significant expertise is a good first step. However, the key stakeholders need to “own” the process, i.e., participate in critical decision-making on program direction, provide resources and support for the program, and ensure that all District agencies and offices fully participate in the process. To conclude, we believe the District’s Year 2000 program needs an absolute commitment from its leadership to make the most of the short time remaining. By addressing the steps outlined above, the District can better ensure a shared understanding of the key business processes that must be remediated, a shared understanding of the risks being assumed in establishing priorities for remediation, testing, and business continuity and contingency planning, and a shared commitment to provide the resources required to address those priorities. Mrs. Chairwoman and Mr. Chairmen, this concludes my statement. I will be happy to answer any questions you or Members of the Subcommittees may have. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: GAO discussed the year 2000 risks facing the District of Columbia, focusing on: (1) its progress to date in fixing its systems; and (2) the District's remediation strategy. GAO noted that: (1) until June 1998, the District had made very little progress in addressing the year 2000 problem; (2) to compensate for its late start, the District has hired a new chief technology officer, appointed a full-time year 2000 program manager, established a year 2000 program office, and continued to use its chief technology officer council to help coordinate and prioritize efforts; (3) the District also contracted with an information technology firm to assist in completing the remediation effort; (4) to accomplish this in the short time remaining, the District and the contractor plan to concurrently: (a) remediate and test system applications; (b) assess and fix the information technology (IT) infrastructure, including the data centers, hardware, operating systems, and telecommunications equipment; (c) assess and correct noninformation technology assets; and (d) develop contingency plans; (5) the District has done the following: (a) developed an inventory of information technology applications; (b) initiated pilot remediation and test efforts with the pension and payroll system; (c) adopted a contingency planning methodology which it is now piloting on the 911 system, the water and sewer system, and the lottery board system; and (d) developed a strategy for remediating non-IT assets which is now being tested on the water and sewer system; (6) the District's recent actions reflect a commitment on the part of the city to address the year 2000 problem and to make up for the lack of progress; (7) however, the District is still significantly behind in addressing the problem; (8) the District has not: (a) identified all of its essential business functions that must continue to operate; (b) finished assessing its IT infrastructure and its non-information technology assets; (c) provided guidance to its agencies on testing; and (d) identified resources that will be needed to complete remediation and testing; (9) until the District completes the assessment phase, it will not have reliable estimates on how long it will take to renovate and test mission-critical systems and processes and to develop business continuity and contingency plans; (10) District officials acknowledge that the city is not able to provide assurance that all critical systems will be remediated on time; and (11) therefore, to minimize disruptions to vital city services, it will be essential for the District to effectively manage risks over the next 15 months.