Business continuity and contingency plans should describe the steps an organization would take to ensure the continuity of its core business processes in the event of a system failure. In a June 1998 report, we made a series of recommendations aimed at broadening IRS’ Year 2000 contingency planning approach to encompass a core business system focus as called for in our business continuity and contingency plan guide.IRS agreed with our recommendations and in July 1998 began to take action to develop a more comprehensive, business-based approach to contingency planning. IRS’ Century Date Change Project Office hired a contractor to provide business continuity and contingency planning expertise and training and assist the business areas in developing and testing their plans. IRS established a working group comprised of representatives from IRS’ business areas to identify IRS’ core processes and associated subprocesses. For each core business process, IRS established a working group to (1) identify possible failure scenarios for subprocesses; (2) determine the business impact of these failures; (3) determine which failure scenarios should be addressed by business contingency plans, based on a scoring system that included business impact and risk; and (4) develop plans for those scenarios. IRS determined that business continuity and contingency plans should be prepared for all of the failure scenarios for its five submission processing subprocesses (receive paper submissions; receive electronic submissions; control and track tax and submissions; process, correct, and forward payment data; and process, correct, and forward tax information return data), several of which involve issuing refunds. In November 1998, IRS’ Century Date Change Project Office issued its business continuity and contingency plan guidance that describes the (1) methodology to be used to develop business contingency plans (the term IRS uses for plans prepared in accordance with this guidance) and (2) types of information that should be included in the plans. IRS’ guidance states that IRS used our guide to help develop its methodology for preparing business contingency plans. IRS’ Chief Operations Officer designated a Year 2000 business executive to help coordinate the efforts of the working groups and oversee the development of the plans. According to IRS officials, the groups used IRS’ guidance to develop the plans. These groups also received technical guidance from the contractor. Each business contingency plan was assigned to an executive-level official who was responsible for approving the plan. In the event of a Year 2000 system-related failure, this executive is also to decide if and when the trigger conditions have been met for implementing the business contingency plan. The plans were to be tested to identify any needed changes. The two plans that we reviewed were tested on July 8 and 9, 1999, respectively. The refund plan and the paper submissions plan were inconsistent and incomplete in two key areas of IRS’ guidance. These areas were performance goals and mitigating actions. These weaknesses raise questions about whether these two plans provide sufficient assurance that IRS has taken all the necessary steps to reduce the impact of a potential Year 2000 failure. IRS officials agreed to make changes to these two plans to improve their consistency and completeness in these areas. In addition, IRS officials said they have taken steps to help ensure the consistency and completeness of other business contingency plans and make changes to those plans if necessary. IRS does not have viable, alternative backup systems for the various information systems used for processing tax returns. Further, IRS’ refund plan acknowledges that in the event that one or more of these systems fail, IRS may experience “a major work stoppage,” depending on how long the failure continues. Given the lack of automated alternatives, the refund plan calls for (1) notifying the public and (2) reverting to manual issuance of refunds—a process that IRS currently uses for certain types of taxpayers (e.g., those receiving a refund of more than $1 million or those with a specific hardship). Although this business contingency plan includes a specific performance goal as required by IRS’ guidance, that goal is inconsistent with the recommended contingency actions. Specifically, the plan’s performance goal calls for issuing 20 percent of the normal refund volume, using a $5,000 minimum as the threshold for manual issuance. However, the plan’s contingency procedures call for instituting a manual operation that would give priority to processing refunds for 1040EZ returns. These returns are filed by taxpayers with taxable incomes of less than $50,000. Consequently, these returns may not generate a significant number of $5,000 refunds. The inconsistency between the performance goal and the business contingency plan procedures raises questions about the goal that IRS is trying to achieve with its contingency plan. For example, if IRS is trying to reduce the potential for incurring increased interest costs on late refunds, high-dollar refunds should be targeted regardless of the type of return.However, if IRS is trying to expedite tax refunds for those taxpayers who may have the greatest financial need, a performance goal that focuses on issuing refunds of $5,000 or more may not be appropriate. In our June 1999 meeting with IRS officials, we pointed out this inconsistency, and they agreed that they needed to change the plan’s performance goal. In our meeting, the executive that was responsible for this plan said the plan’s performance goal should focus on issuing refunds to certain “hardship” taxpayers. According to IRS, hardship taxpayers would be those that filed a return with (1) a Form 911, Application for Taxpayer Assistance Order; (2) an earned income tax credit, which is a refundable tax credit available to low-income, working taxpayers; or (3) an adjusted gross income within a certain dollar range that is to be determined if a Year 2000 failure actually occurs. With respect to mitigating actions, this plan did not include dates for completing them before a potential Year 2000 failure. Examples of the plan’s mitigating actions include (1) preparing a letter to the Department of the Treasury’s Financial Management Service outlining the process for transferring refund documents and files, (2) planning for one additional week of training on the manual refund issuance process, (3) identifying additional secure storage space in each service center, and (4) coordinating press release information with IRS’ Office of Public Affairs. Moreover, the plan did not specify which individuals were to be responsible for completing the mitigating actions. Although IRS’ guidance does not require that the plan identify specific individuals, without identifying responsible individuals and dates for completing the mitigating actions, IRS has little assurance that these actions will be completed before a potential Year 2000 failure. In our June 1999 meeting, the executive responsible for this plan acknowledged this omission and agreed that the mitigating actions should identify responsible individuals and completion dates. IRS receives paper submissions, including tax returns, at each service center loading dock. From the loading dock, the returns are taken to the mailroom for sorting. IRS’ Service Center Automated Mail Processing System (SCAMPS) is a new automated system that IRS uses to sort the mail. SCAMPS is to (1) open the envelopes to expedite the extraction process, in which employees remove the tax return information from the envelopes; (2) identify those tax returns with checks; (3) read the bar- coded tax return envelopes and sort them into one of 40 different categories; and (4) sort outgoing mail. The paper submissions plan focuses on the contingency actions to be implemented in the event that SCAMPS experiences a Year 2000 system failure. Although IRS’ guidance calls for plans to contain a performance goal, the paper submissions plan did not include one. According to the plan, “specific performance measures for manual mail handling operations are not yet available.” However, without a performance goal, it is unclear how IRS determined that it would be sufficient to “use available service center personnel to handle incoming mail” as specified in the plan. While we recognize that IRS is developing new performance measures that may not yet be available for this business function, in our June 1999 meeting with IRS officials, we identified information that could be used to develop a performance goal for the plan. For example, the SCAMPS processing rate could be used as a guide for developing an acceptable (albeit reduced) level of service for a manual mail sorting process. IRS could also use its productivity data on employees that manually extract tax return information from envelopes as a basis for developing a performance goal. The IRS executive that was responsible for this plan agreed that a goal should be included and that these two data sources could be used to develop that goal. The plan’s mitigating actions were also incomplete. Like the refund plan, this plan did not include the dates and the responsible individuals for completing the plan’s two mitigating actions. Also, we told IRS officials that we had questions about the viability of one of the plan’s mitigating actions. That action calls for reverting back to a mail sorting system that is currently not Year 2000 compliant. Even if IRS could develop a workaround solution to make the older mail sorting system Year 2000 compliant, IRS officials said that they had planned to remove the equipment for the older system by the 2000 filing season. IRS officials told us that as a result of testing this plan, this mitigating action would be deleted in the revised plan. The executive responsible for this plan also agreed to add responsible individuals and the dates for completing the other mitigating action, which pertains to sorting outgoing mail. In addition to agreeing to make changes to the two plans, IRS officials said that actions are under way to help ensure that other business contingency plans are consistent and complete. According to officials in IRS’ Business Systems Requirements Office (BSRO), a staff member has been designated to review all of the business contingency plans for consistency and completeness and for crosscutting issues among the plans. Heretofore, BSRO did not view this as its function, in part because according to BSRO officials, it had a limited number of staff. IRS also has issued a work request for one of its Year 2000 contractors to develop a database that BSRO staff could use to track the implementation of key elements of the business contingency plan (e.g., triggers, mitigating actions, contingency team actions). According to IRS, information from the business contingency plans is to be added to the database by late September 1999, and reports are to be generated shortly thereafter. If properly implemented in a timely fashion, these actions should provide IRS with a higher level of assurance that its business contingency plans will help reduce the impact in the event of a Year 2000–related system failure. Accordingly, we are not making any recommendations at this time. To achieve our objective of evaluating the consistency and completeness of two of IRS’ Year 2000 business contingency plans according to IRS’ guidance, we reviewed the following business continuity and contingency plan guidance: (1) Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD-10.1.19, Aug. 1998); (2) Internal Revenue Service Century Date Change Contingency Management Plan, (Version 5.0, Mar. 1, 1999); and (3) Internal Revenue Service Century Date Change Business Continuity and Contingency Plan, (Version 1.0, Nov. 24, 1998); interviewed officials from the Century Date Change Project Office; interviewed members of the submission processing contingency plan working group, the executive that was responsible for the two plans we reviewed, the Business Year 2000 Executive, and other BSRO staff; toured the Atlanta Service Center to learn more about how tax returns are processed through IRS’ information systems; and reviewed 6 of the 10 sections of the two business contingency plans to determine whether they were consistent with IRS’ guidance. We did not analyze four sections of the plans (training and testing, post- event wrap-up, contingency actions log sheet, and information recovery) for several reasons. In lieu of including the testing procedures in the plan, IRS developed separate test plans for each contingency plan. To provide timely feedback to IRS so that they could begin corrective actions promptly, we focused our efforts on the business contingency plans themselves rather than the test plans. We did not analyze the post-event wrap-up information or the contingency actions log sheet because these sections are to be completed after the business contingency plan has been implemented. Both plans included little information about information recovery (i.e., regaining or retrieving data that may be lost or damaged as a result of a system failure). We also did not review any existing business resumption plans that IRS developed for other than Year 2000-induced failures, and we did not examine the relationship between individual Year 2000 business contingency plans and IRS’ “End Game” activities, which IRS is currently developing. We conducted our review from May 1999 to July 1999 in accordance with generally accepted government auditing standards. On August 27, 1999, we obtained written comments on a draft of this report from the Commissioner of Internal Revenue. (See app. I for a copy of IRS’ letter.) IRS said that it generally agreed with the issues raised in our report and is taking the necessary steps to correct them. IRS also amplified on its business contingency plan testing process and clarified some facts and provided updated information, which we included in the report where appropriate. IRS said that it had envisioned that the business contingency plans were “living documents” that would be revised over time to reflect changes in technology, business processes, and legislation. Furthermore, IRS said that the plans were to be tested by subject matter experts, including field staff, to ensure their viability, which would result in modifications to the plans. We agree that the plans were to be living documents and designed our methodology accordingly. Recognizing that the plans were subject to change based on the results of business contingency plan testing (as stated on p. 1 of our draft report), we met with IRS in June 1999 to discuss our initial findings. We scheduled this meeting, in part, so that IRS would have the benefit of our feedback while the plans were still subject to change, and possibly before they were to be tested. IRS said that as a result of our findings on the weaknesses in the plans and the results of testing two plans, it has begun work to address our concerns. We are sending copies of this letter to Representative Amo Houghton, Chairman, and Representative William J. Coyne, Ranking Minority Member, Subcommittee on Oversight, House Committee on Ways and Means; Senator Robert F. Bennett, Chairman, and Senator Christopher J. Dodd, Vice-Chairman, Senate Special Committee on the Year 2000 Technology Problem; and Representative Stephen Horn, Chairman, and Representative Jim Turner, Ranking Minority Member, Subcommittee on Government Management, Information and Technology, House Committee on Government Reform. We are also sending copies to the Honorable Lawrence H. Summers, Secretary of the Treasury, and the Honorable Jacob J. Lew, Director of the Office of Management and Budget. Copies will be made available to others on request. If you have any questions about the information contained in this report, please contact me or Sherrie Russ at (202) 512-9110. Key contributors to this assignment were Jackie Nowicki, Joanna Stamatiades, and Linda Standau. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch-tone phone. A recorded menu will provide information on how to obtain these lists.

Summary: GAO reviewed two Internal Revenue Service (IRS) year 2000 business continuity and contingency plans for their consistency and completeness on the basis of IRS' guidance for such plans. GAO noted that: (1) two IRS business continuity and contingency plans--one for processing paper tax returns that result in a refund (refund plan) and the other for receiving paper submissions (paper submissions plan)--were inconsistent and incomplete in two key areas included in IRS' guidance: (a) performance goals; and (b) mitigating actions; (2) these weaknesses raise questions about whether these two plans provide sufficient assurance that IRS has taken all the necessary steps to reduce the impact of a potential year 2000 failure; (3) IRS' guidance requires that plans specify a desirable performance goal; (4) the performance goal for the refund plan was inconsistent with the plan's contingency actions; (5) this inconsistency raises questions about the goal that IRS is trying to achieve with the refund plan; (6) the paper submissions plan did not include a performance goal; (7) without appropriate performance goals, IRS has little assurance that the contingency actions specified in the plan are appropriate for reducing the impact of a potential year 2000 failure; (8) in addition, neither plan specified the completion dates for the mitigating actions, which IRS' guidance defines as the steps that are to be completed in advance of a potential year 2000-related failure, to help reduce its impact; (9) moreover, neither plan specified which individuals were to be responsible for completing the mitigating actions; (10) IRS' guidance requires that the plans include mitigating actions and completion dates, but does not require that responsible individuals be identified for completing mitigating actions; (11) however, without assigning actions to specific individuals and identifying completion dates, IRS has little assurance that these actions will be completed before a potential year 2000 failure; (12) in June 1999, GAO informed IRS officials of its concerns regarding these two plans; (13) GAO also told them that its concerns raise questions about the extent to which other plans may have similar weaknesses; (14) in response to GAO's concerns, IRS officials agreed to make changes to improve the completeness and consistency of these two plans; (15) they also said they have designated an individual that is to determine the extent to which other plans may have similar weaknesses and revise the plans as needed; and (16) in addition, IRS assigned one of its year 2000 contractors to set up a mechanism by which IRS could track the implementation of business continuity and contingency plan actions.