Madam Chairman and Members of the Subcommittee: We are pleased to be here today to discuss the results of our work to date on the Internal Revenue Service’s (IRS) efforts to have its information systems function correctly when processing dates beyond December 31, 1999. These efforts are necessary because IRS’ information systems, many of which are over 25 years old, were programmed to read two-digit date fields. Therefore, if unchanged, beginning January 1, 2000, these systems would interpret 2000 as 1900, and thus would seriously jeopardize critical tax processing and collection operations. According to IRS, the failure to change two-digit date fields before 2000 could result in generating millions of erroneous tax notices, refunds and bills. IRS has less than 9 months to complete the work that it believes is necessary to reach its goal of having all of its systems Year 2000 compliant by January 31, 1999. Meeting this goal is important to help ensure that IRS (1) can accurately process tax returns during the 1999 filing season and (2) has almost a full year to test the multitude of changes that are necessary and make additional corrections so that its systems operate properly in the next millennium. Our statement today is based on the work we did to prepare a draft report on the status of IRS’ Year 2000 efforts. Our draft report is currently at IRS for comment. In preparing that report, we interviewed officials from IRS’ National Office, computing centers, service centers, regions, and district offices. We analyzed and compared IRS’ planning, budget, and performance-monitoring documentation with our Year 2000 assessment guide as a part of a structured approach for reviewing IRS’ conversion efforts. telecommunications is at the highest risk for not being completed by January 31, 1999. In addition to converting systems, IRS is undertaking two major system replacement projects as part of its Year 2000 efforts. Both of these projects have encountered some schedule delays. In a briefing to this Subcommittee in January 1998, we identified two significant risk areas to IRS’ Year 2000 efforts. The first was the lack of a master conversion and replacement schedule. The second was a limited approach to contingency planning. IRS is taking actions to address our concerns regarding the lack of a master conversion and replacement schedule. However, we remain concerned that IRS’ current approach to contingency planning does not address the likelihood that system failures could occur once systems are implemented. To assist agencies in their Year 2000 conversion efforts, we developed an assessment guide that includes a structured, step-by-step approach that agencies may use for reviewing and assessing their readiness to handle the Year 2000 problem. The assessment guide states that the Year 2000 conversion efforts should be managed as a single, large information systems project. The assessment guide describes in detail the five phases of a Year 2000 conversion process (i.e., awareness, assessment, renovation, validation, and implementation). Each of these phases represents a major Year 2000 program activity or segment. To successfully address the Year 2000 problem, effective program and project management is required for all five phases. IRS’ Chief Information Officer (CIO) established several parallel efforts to help ensure that IRS achieves Year 2000 compliance by January 31, 1999. These efforts include creating the Century Date Change Project Office, which is responsible for coordinating the conversion of most existing information systems that can be made Year 2000 compliant as well as ensuring that all systems are converted in accordance with a 14-step conversion process. That process incorporates the five phases included in our assessment guide. Some of the steps involved in converting existing systems include (1) correcting millions of lines of application code; (2) upgrading thousands of hardware and systems software products for IRS’ three levels of computing operations—mainframes, minicomputers/file servers, and personal computers, (3) upgrading telecommunications networks; and (4) ensuring that external data exchanges are Year 2000 compliant. The other parallel Year 2000 efforts are two major system replacement projects—the replacement of the Distributed Input System (DIS) and the Remittance Processing System (RPS) with the Integrated Submission and Remittance Processing (ISRP) system and the consolidation of the mainframe computer processing operations at 10 service centers to 2 computing centers. IRS personnel use DIS to input taxpayer data and RPS to input remittance data. According to IRS, these two systems are old, and it is not cost-beneficial to make them Year 2000 compliant. Therefore, IRS decided to replace DIS and RPS with ISRP. ISRP will be piloted in two phases at the Austin Service Center. The first phase is underway and the second phase is scheduled to begin July 31, 1998. Nationwide implementation is scheduled for January 1999. As a part of its mainframe consolidation effort, IRS is to (1) replace and/or upgrade service center mainframe hardware, systems software, and the associated telecommunications infrastructure; (2) replace about 16,000 terminals that support frontline customer service and compliance operations; and (3) replace the Communication Replacement System (CRS) that provides security functions for on-line taxpayer account databases. Replacements of the terminals and CRS are critical to IRS’ achieving Year 2000 compliance. According to IRS, before January 1999, it needs to complete 12 steps of its 14-step process for converting (1) the applications for its existing systems; (2) telecommunications networks; and (3) systems software and/or hardware for mainframes, minicomputers/file servers, and personal computers. In addition, before January 31, 1999, IRS needs to (1) make its systems for external data exchanges Year 2000 compliant; (2) replace its data input and remittance processing systems and, at a minimum, the Year 2000 portions of its mainframe consolidation program; and (3) modify application software to implement tax law changes for the 1999 and 2000 filing seasons. assessments, as of March 31, 1998, IRS had identified 127 mission-critical systems, including 7 telecommunications systems. IRS has made more progress in converting its applications than in converting its information systems infrastructure. Specifically, as of March 31, 1998, IRS reported that it had completed the first 12 steps of its 14-step conversion process for applications for about 59 (46 percent) of its 127 mission-critical systems. IRS’ goal is to convert the applications for the remaining 68 mission-critical systems by January 31, 1999. IRS officials said they believe they are on track for meeting that goal. IRS has completed its assessment of the hardware and systems software for its mainframe computers. Conversion efforts for other infrastructure areas —hardware and systems software for minicomputers/file servers and personal computers, telecommunications networks, and external data exchanges—are, for the most part, either in the assessment phase or the early stages of conversion. According to IRS, of these areas, telecommunications networks will likely present the most significant conversion challenge and may be at the highest risk for not being completed by January 31, 1999. According to IRS, the capability to exchange information, both voice and data, among various computer systems is the backbone of IRS’ ability to perform all of its tax processing and customer service functions. IRS uses a telecommunications network that is supported through the Department of the Treasury and additional networks that are unique to IRS. As of March 10, 1998, IRS had an inventory of the components that are included in Treasury’s network and was verifying a preliminary inventory of the components in the networks unique to IRS. A contractor is currently doing a risk assessment to help develop a conversion schedule so that the most important work will be scheduled first to minimize adverse impacts if IRS is unable to complete all of its telecommunications work by January 31, 1999. The two major system replacement projects included in IRS’ Year 2000 efforts are experiencing some schedule slippages. For example, certain software development for ISRP that was to be completed in April 1998 is now scheduled to be done in June 1998. As a result, the time available for testing before the start of the second phase of the pilot has been reduced. ISRP officials do not believe this two-month delay will affect either the start of the second phase of the ISRP pilot or its nationwide implementation. According to IRS officials, IRS has revised its mainframe consolidation completion schedule because of field office concerns about the ambitious schedule and pending expanded business requirements. Under the revised schedule, IRS plans to delay the consolidation of data processing operations of five service centers from 1998 until after June 1999. IRS officials said they expect to complete the Year 2000 portions of mainframe consolidation (e.g., terminal replacement and CRS) by January 31, 1999. However, according to IRS’ weekly status reports on mainframe consolidation, CRS has been experiencing some difficulties and is somewhat behind its original schedule for system testing. In our January briefing to your office, we identified two major risk areas for IRS’ Year 2000 effort: (1) the lack of an integrated master conversion and replacement schedule and (2) a limited approach to contingency planning. IRS is taking action to have a contractor develop a master conversion and replacement schedule. A master conversion and replacement schedule, according to our Year 2000 assessment guide, should be a part of an agency’s Year 2000 Program Plan. This schedule could be used to track the progress of concurrent and interdependent projects that must be ready for integrated systems testing at the end of January 1999. This year, IRS has a host of activities that it must complete concurrently so that its systems will be able to function correctly in 2000. Managing the interdependencies of these activities is critical to help IRS ensure the timely completion of its Year 2000 effort. A master conversion and replacement schedule could (1) establish the sequential relationships between the tasks associated with the Year 2000 conversion and replacement activities, (2) identify how much a task can slip without affecting other tasks or the overall Year 2000 effort, (3) help determine whether programming and testing resources are likely to be available when needed, and (4) provide a tool for prioritizing and assigning programming and testing resources that are essential to the success of all Year 2000 efforts in the most efficient manner. Century Date Change Project Schedule for its Year 2000 activities. Although the project schedule identifies the tasks for major Year 2000 activities, their corresponding start and finish dates, and the primary organizations responsible for them, the schedule does not yet establish a link between related tasks or analyze how the timing of the various tasks may affect resource availability. Until these actions are complete, IRS cannot project whether resources will be available when needed for concurrent tasks. Thus, IRS faces the risk that resources may not be available when needed. IRS currently has a contractor working on the development of an integrated schedule of its Year 2000-related efforts, including making all of the necessary tax law changes for 1999. If properly developed, this schedule should meet the intent of the master conversion and replacement schedule called for in our assessment guide. But time is running out for completing such a schedule. Unless IRS obtains this schedule soon, its value as a management tool to help anticipate bottlenecks is diminished. Contingency planning was the second risk area we identified in our January 1998 briefing. In part, due to concerns that the same resources that are doing Year 2000 conversion work would be needed to do contingency planning, IRS officials decided to develop a contingency planning process that would minimize the number of contingency plans that would have to be developed. Accordingly, IRS’ “Century Date Change Contingency Management Plan” calls for developing contingency plans only for those business functions or processes that are supported by application projects that are at risk of not being made Year 2000 compliant on schedule. The Century Date Change Project Office has established criteria to identify such projects. For these projects, IRS is to initiate a business function impact analysis. Once that analysis is complete, technical and business owners evaluate available alternatives, including using any existing contingency procedures, such as manual procedures, or using an alternative technological solution, such as commercial off-the-shelf software. IRS plans to use a similar approach for initiating contingency plans for business functions when the conversion of infrastructure areas such as systems software, external data exchanges, and telecommunications network components fall behind schedule. IRS’ “Century Date Change Contingency Management Plan” does not address the likelihood that information systems that are converted on schedule may experience system failures. As a result, IRS will be ill-prepared to effectively manage all Year 2000-induced system failures that could affect core business processes. IRS’ contingency management plan does not address the possibility that (1) IRS may have overlooked a date dependency during its assessment phase of applications or infrastructure areas or (2) even if system conversion and replacement efforts are completed on time and fully tested, unexpected system failures may occur. Aspects of contingency planning are under way for IRS’ replacement projects (i.e., ISRP and mainframe consolidation). For example, the ISRP project office has developed a contingency plan that identifies (1) various risks to the ISRP pilot and nationwide implementation, (2) the probability of those risks, and (3) contingency options for addressing those risks. Also, as part of a larger effort to enhance IRS’ disaster recovery capabilities, IRS officials said they hope to finalize expanded disaster recovery requirements for service center data processing in May 1998 so that those requirements can be included in the mainframe consolidation project. Our exposure draft on business continuity and contingency planning states that agencies must start business continuity and contingency planning now to reduce the risk of Year 2000 business failures. Among other things, the exposure draft states that agencies need to do a business impact analysis to determine the effect of mission-critical system failures on the viability of agency operations. This analysis is to include examining business priorities; dependencies; service levels; and, most importantly, the business process dependency on mission-critical information systems. According to our exposure draft, the business impact analysis triggers the development of contingency plans for each core business process, including any information system components that support that process. Contingency plans would also address the actions IRS may take, for example, to notify taxpayers in the event that Year 2000 failures cause significant delays in processing tax returns and issuing refunds. safety net into its schedule to allow time to work out problems with converted and replaced systems before January 1, 2000. However, given the conversion status of some of its infrastructure areas, IRS runs the risk of not completing all of its work by the January 31, 1999, milestone. Moreover, even if all of IRS’ work is completed according to schedule, the potential exists for failures in systems that were fully assessed, converted, tested and implemented according to schedule. We remain concerned about IRS’ narrow approach to contingency planning which focuses on developing contingency plans only for business functions that are supported by information systems projects that have a known risk of not being completed according to schedule. Under this approach, IRS has no assurance that its core business processes will be able to continue to function, albeit, possibly at some reduced level of service, in the event that Year 2000-induced system failures occur in systems that were converted according to schedule. That concludes my prepared statement. We welcome any questions that you may have. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: GAO discussed the results of its work to date on the Internal Revenue Service's (IRS) efforts to have its information systems function correctly when processing dates beyond December 31, 1999. GAO noted that: (1) for its existing systems, IRS has made more progress in converting application software than converting its information systems infrastructure, which includes hardware, systems software, and telecommunications; (2) despite its progress on converting applications, IRS fell short of its goal to have the applications for 66 of the 127 systems that it considers mission-critical converted by January 1998; (3) IRS is still assessing or in the early stages of converting its hardware and systems software for two of its three levels of computing operations--minicomputers/file servers and personal computers; (4) of all the infrastructure areas, according to IRS' tracking systems, telecommunications is at the highest risk for not being completed by January 31, 1999; (5) in addition to converting systems, IRS is undertaking two major system replacement projects as part of its year 2000 efforts; (6) both of these projects have encountered some schedule delays; (7) GAO identified two significant risk areas to IRS' year 2000 efforts; (8) the first was the lack of a master conversion and replacement schedule; (9) the second was a limited approach to contingency planning; (10) IRS is taking actions to address GAO's concerns regarding the lack of a master conversion and replacement schedule; and (11) however, GAO remains concerned that IRS' current approach to contingency planning does not address the likelihood that system failures could occur once systems are implemented.