For the past several decades, automated information systems have typically used two digits to represent the year, such as “98” for 1998, in order to conserve electronic data storage space and reduce operating costs. In this format, however, the year 2000 is indistinguishable from the year 1900 because both are represented as “00.” As a result, if not modified, computer systems or applications that use dates or perform date-sensitive calculations could malfunction or generate incorrect results when working with years after 1999. To mitigate this risk, organizations— public and private—must repair or replace their mission-critical systems, test the systems for Year 2000 compliance, and develop plans to ensure continued operations in the event of Year 2000-induced system failures. To assist agencies in addressing the Year 2000 computing problem, we prepared guidance that presents structured approaches for assessing an agency’s Year 2000 conversion effort, testing systems and system components for Year 2000 compliance, and developing business continuity and contingency plans. Our guide on business continuity and contingency planning, which the Office of Management and Budget (OMB) has adopted as a standard for federal agencies, describes four phases of implementation, each representing a major Year 2000 business continuity planning activity. These four phases are described in the following paragraphs. Initiation: This critical first step involves establishing an overall strategy for ensuring the continuity of agency operations in the event of Year 2000- induced system failures. The agency convenes a planning team of agency officials to work with the agency’s Year 2000 program management in developing a master schedule and milestones, documenting the agency’s core business processes, establishing key reporting requirements, and obtaining executive-level support for the planning effort. Business impact analysis: In this phase, the agency assesses the risk and impact of systems failures on the viability and operations of the agency’s core business processes. By defining possible failure scenarios associated with the Year 2000 problem, the agency identifies threats to its core business processes. The agency then analyzes the risk and impact of these potential threats and develops strategies to mitigate the impact of these threats prior to potential system failure. Contingency planning: This phase entails developing and documenting contingency plans that specify the agency’s response to system failures in order to ensure the continued operation of the agency’s core business processes. These plans provide a description of the resources, staff roles, procedures, and timetables needed for implementation. Testing: In this phase, the agency develops and executes test plans to determine whether the contingency plans are capable of providing the desired level of support to the agency’s core business processes and whether the plans can be implemented within a specified period of time. The agency then updates its contingency plans based on lessons learned and retests if necessary. In planning for possible Year 2000-related problems, agencies need to consider not only the potential failures of their internal systems but also disruptions related to the agencies’ external dependencies. Many agencies depend on information and data from business partners, including other federal agencies, state and local agencies, and private sector entities. In addition, agencies need to consider the risks to public infrastructure services, such as power, water, and voice and data telecommunications. We conducted our review from November 1998 through April 1999 in accordance with generally accepted government auditing standards. Details of our objectives, scope, and methodology are presented in appendix I. We requested comments on a draft of this report from the Director of OPM or her designee. On April 2, 1999, we met with OPM officials to obtain and discuss the agency’s written comments, which are summarized in the Agency Comments section and reprinted in appendix IV. The first phase of business continuity planning—referred to herein as initiation—involves developing a planning strategy for ensuring the continuity of agency operations in the event of Year 2000-induced failures. As noted in our guidance on business continuity planning, during this initiation phase, agencies need to create an organizational structure for the planning project and establish a master schedule and key milestones for completing the planning effort. Our guide recommends creating a business continuity work group that reports to senior agency management and includes representatives from the agency’s major business units. Through the coordination of this work group, agencies would identify their core business processes, establish key reporting requirements, and obtain executive support for the planning effort. Our review showed that OPM developed a strong planning strategy for its Year 2000 business continuity efforts. In developing this planning strategy, OPM established a project structure and milestones for carrying out the planning effort, identified the agency’s core business processes, established key reporting requirements, and obtained the concerted support and involvement of senior managers in the agency. OPM’s Year 2000 business continuity planning efforts began in April of 1998. At that time, OPM’s Director designated the agency’s Chief of Staff to oversee the agency’s continuity planning process. The Chief of Staff formulated an executive committee to select an OPM official to serve as the project manager in directing the day-to-day activities of the agency’s Year 2000 continuity planning effort. As recommended in our business continuity planning guide, OPM assembled a business continuity work group to coordinate the agency’s planning efforts. The work group, which began meeting in June 1998, is led by the business continuity project manager and is composed of officials from each of OPM’s 17 major business units. (See app. II for a list of the units represented on the work group.) The designated role of the work group was to coordinate the agency’s planning efforts through their respective OPM units and report to the continuity project manager on the status of units’ planning activities. Our business continuity planning guide states that agencies should also develop a master schedule and milestones for the continuity planning effort. OPM developed a master schedule that called for the preparation of all the agency’s draft contingency plans by December 1998. To determine whether the plans would be effective if implemented, OPM established milestones to develop and test the contingency plans by May 1999. The schedule called for OPM to prepare its final contingency plans by June 1999. In the early phase of the business continuity planning effort, each agency also needs to identify those processes or functions that are critical to the agency’s ability to deliver important services to its customers. These core business processes are to serve as the foundation of the agency’s Year 2000 continuity planning efforts. OPM identified the following five core business processes for the agency: Provide retirement and survivor annuity payments. Process retirement and survivor claims. Administer health benefit and life insurance programs and payments. Provide examining services to agencies. Provide communications to agencies and employees on critical human resources issues. In addition, OPM identified two key support functions that the continuity work group would consider in its planning process: (1) provide administrative and management information systems and (2) provide information technology infrastructure. When identifying core business processes, it is important that agencies consider the critical agency systems that support these core processes. Because the agency’s mission-critical systems support its core processes, these critical systems should receive priority in the agency’s Year 2000 program. At the time of our review, OPM had designated 109 of its information systems as mission-critical. Included in OPM’s inventory of mission-critical systems are complex retirement and insurance support systems that process monthly annuity payments and collect funds withheld by federal employees for retirement, health benefits, and life insurance premiums. OPM officials told us that when they assessed their systems to determine which ones to designate as mission critical, they decided to take the broad approach of including more rather than fewer systems. OPM officials said that this approach would help to ensure that important systems received agencywide attention. In developing a sound continuity planning approach, agencies also need to establish key reporting requirements. Within OPM, business continuity and contingency planning is one of 14 components in the agency’s overall Year 2000 program. Under OPM’s Year 2000 program management approach, agency officials responsible for each of these 14 components are to report monthly on their progress in meeting Year 2000-related goals. (See app. III for a list of the 14 components and the responsible OPM units.) OPM initiated this program management approach in August 1998 in response to our earlier review of OPM’s initial Year 2000 system conversion efforts. In a July 1998 briefing with OPM officials, we raised concerns that OPM had not developed a comprehensive Year 2000 plan with scheduled tasks as specified in our Year 2000 assessment guide and that the lack of such a plan could affect OPM’s ability to achieve Year 2000 compliance. OPM agreed with these observations and developed a Year 2000 plan with scheduled tasks and a more structured reporting and control mechanism. OPM also established a reporting format for its business units to use when preparing their Year 2000 contingency plans. In June 1998, OPM’s continuity work group adopted the contingency plan reporting format that the Social Security Administration (SSA) had used for its contingency planning efforts. We had reported earlier that SSA was generally regarded as a federal leader in addressing the century date change. Additionally, in its May 1998 quarterly report on the status of the federal government’s Year 2000 progress, OMB reported that SSA’s business continuity and contingency plan had been circulated as a model to other federal agencies. Our business continuity planning guide stresses the importance of promoting executive ownership of the Year 2000 continuity planning effort. Since the commencement of OPM’s contingency planning activities, OPM has made a concerted effort to obtain the support and involvement of the agency’s senior managers. For example, OPM’s Chief of Staff oversaw the business continuity work group’s initial efforts to coordinate the agency’s Year 2000 continuity planning activities. OPM’s Deputy Director, newly appointed in November 1998, has also taken an active role in the agency’s efforts to address the Year 2000 problem. In December 1998, the Deputy Director assumed responsibility for overseeing the business continuity work group’s efforts to coordinate the agency’s Year 2000 continuity planning activities. After developing a business continuity strategy for the Year 2000 problem, agencies need to determine the risk and impact of internal and external system failures on the viability and operations of the agency’s core business processes. During this phase—referred to herein as business impact analysis—the agency identifies Year 2000-related threats to the agency’s core processes. The agency then assesses the risk and impact of these threats and identifies strategies to eliminate or reduce the impact of the threats prior to potential system failures. Our review of OPM’s business impact analysis found that OPM identified potential threats to the agency’s critical functions and identified strategies to mitigate these threats. We found during our review, however, that when OPM analyzed the impact of system failures on its core business processes, it had not estimated and assigned risk to its mission-critical systems. After reviewing a draft of this report, OPM provided us with documentation that showed that the agency had taken additional action to develop a Year 2000 risk assessment for each of its 109 mission-critical systems. This assessment should assist in providing OPM with vital information about the likelihood of system failures and the risk of such failures to the agency’s core business functions. In conducting a risk and impact assessment of core business processes, agencies first need to identify potential Year 2000-related threats, which represent circumstances or events that could harm critical agency functions. As noted in our business continuity planning guide, agencies identify these potential threats by considering various Year 2000 failure scenarios. These failure scenarios assume the loss of the agency’s internal mission-critical systems as well as potential failures related to exchanging electronic data with business partners. The failure scenarios should also address the potential disruption of essential infrastructure services, including power and telecommunications. OPM identified potential threats to its critical functions through its Year 2000 business continuity work group. Members of this work group coordinated with their respective units in considering possible Year 2000 failure scenarios and identified specific threats to the provision of uninterrupted critical services to OPM customers. For example, in identifying threats to its critical process of providing retirement and survivor annuity payments, OPM noted that some banks might not be able to receive electronic funds transfer (EFT) payments, thus preventing customers from receiving their retirement benefits. After identifying potential Year 2000-related threats, agencies need to assess the risk and impact of these threats on the agency’s core business processes. As noted in our business continuity planning guide, the risk management process for continuity planning calls for agencies to estimate and assign risk to each of their mission-critical systems. This risk could be related to the system’s environment, hardware, software interfaces, or other circumstances unique to the particular system. For example, factors could include the number of interfaces that the system has with external entities and the current status of repairing and testing the system for Year 2000 compliance. During our review, we found that when OPM assessed the risk of Year 2000-induced failures for its core business processes, it had not estimated and assigned risk to its mission-critical systems. Therefore, OPM units that were assessing the risk of Year 2000 failures on core business processes lacked critical information on the risk of failure associated with each of the mission-critical systems. This lack of information hindered OPM’s ability to develop a complete assessment of the risk to its core processes. Such an assessment is important to providing OPM with information on which processes are more likely to be affected by system failures and to allowing OPM to concentrate its resources on mitigating and managing those risks that are more likely to endanger agency operations. OPM systems at greater risk for failure may need increased management attention because these systems will likely require more detailed contingency plans and longer time frames for testing the plans. OPM has engaged a contractor to independently verify OPM’s Year 2000 compliance effort. As part of its quality review, the contractor was tasked with identifying risks in OPM’s Year 2000 methodologies and processes. Contractor representatives we interviewed said that they planned to provide OPM with information about the degree of risk associated with each of OPM’s critical systems; however, they did not plan to provide this information to OPM until October or November 1999, when all system testing is expected to be completed. The contractor representatives said that the scope of their work did not include verifying the appropriateness of OPM’s business continuity and contingency planning efforts. They said that OPM would have to determine on its own how contingency planning efforts should be prioritized, based on its knowledge of the importance of its systems for maintaining essential agency operations. If OPM waited to develop a complete risk assessment of its mission-critical systems and associated core processes until October or November 1999, it would likely not have sufficient time to reassess and implement appropriate risk mitigative actions prior to January 1, 2000. Although factors affecting risk and impact could change after the agency developed its risk assessment, OPM could update its assessment as it became aware of additional information that altered the risks associated with its systems and processes. If necessary, OPM could then develop additional mitigative strategies or revised contingency procedures on the basis of this new information. At our April 2, 1999, meeting with OPM to obtain and discuss the agency’s written comments to our draft report, OPM provided us with information that demonstrated that the agency had taken additional action to develop a Year 2000 risk assessment of its mission-critical systems. OPM stated that after we raised concerns about the timing of its verification efforts, it accelerated the schedule for the independent contractor to provide it with information about the risk associated with its mission-critical systems. OPM said that with this assistance from its verification contractor, the agency developed a Year 2000 risk assessment for each of its 109 mission- critical systems. OPM officials provided us with supplemental documentation that showed the criteria OPM used to assess the systems and the results of the risk assessment for each system. OPM officials told us that they are using this newly developed risk assessment in their planning efforts to focus on those risks that are more likely to endanger the agency’s core business functions. As part of the business continuity planning process, agencies also need to identify strategies to eliminate or reduce the impact of the Year 2000- related threats prior to potential system failures. With the identification and implementation of risk mitigation strategies, agencies can reduce the level of risk and lessen the potential need to implement the contingency plan. Our review of OPM’s planning documents found that 16 of OPM’s 17 business units identified clearly stated risk mitigation strategies for the threats that OPM had identified. For example, in the case of ensuring the provision of EFT payments to federal retirees, one of the risk mitigation strategies included developing a computer program that would immediately recognize EFT payments that were not accepted by banks and reauthorize a hard-copy check to be sent to the retiree’s current correspondence address. With the recent development of its Year 2000 risk assessment, OPM can focus its efforts on ensuring that its inventory of risk mitigation strategies is sufficient. Given the time constraints as the century date change approaches, OPM—like other government agencies and private organizations—will need to focus its resources on developing and implementing risk mitigative actions for those systems and processes that are at greater risk for failure. Agencies need contingency plans for responding to the loss or degradation of essential services as the result of a Year 2000 problem in an automated system. In this contingency planning phase of the business continuity planning process, agencies are to prepare plans that describe the fallback procedures the agency would employ—including the activation of manual or contract processes—to ensure the continuity of core business processes in the event of Year 2000-induced system failures. As noted in our business continuity planning guide, contingency plans should also include a description of the resources, staff roles, and timetables needed for implementation. To prepare for possible disruptions to its core business processes, OPM developed its Year 2000 contingency plans by organizational unit. We reviewed the 27 contingency plans that OPM’s 17 units prepared in response to possible Year 2000-induced failures. Our review of these contingency plans initially showed that they did not fully address three areas of key information that are essential for ensuring the continuity of agency operations in the event of critical system failures. Specifically, OPM’s plans (1) did not demonstrate that the agency considered all its mission-critical systems in the planning process, (2) lacked clear procedures and assignment of responsibilities for activating and implementing the plans, and (3) did not include a risk-reduction strategy and procedures for the critical days before and after the century date change. When it provided written comments on our draft report, OPM gave us supplemental documentation that demonstrated that the agency had taken additional actions to address our concerns. With this additional attention to its contingency plans, OPM will be better positioned to have timely and well-defined responses in the event that system failures occur. When developing Year 2000 contingency plans, agencies should determine the effect of mission-critical system failures on agency operations by documenting which systems affect the agency’s core business processes. Moreover, because the agency’s mission-critical systems support its core business processes, all the critical systems should be considered in the contingency planning process. Our review found that 23 of OPM’s 27 contingency plans did not identify the mission-critical systems associated with the threats that had been identified. Because most of OPM’s plans did not link identified threats to mission-critical systems, OPM would not be able to readily determine whether its inventory of critical systems was considered or included in the planning process. OPM officials initially told us that they could not confirm whether all of OPM’s 109 mission-critical information systems were considered or included in the agency’s contingency plans. They told us, however, that OPM would work to ensure that all critical systems are linked to core processes in the plans and that this linkage would verify that OPM’s entire inventory of 109 critical systems was considered. In its written comments on a draft of our report, OPM said that it had considered all the automated systems supporting its core business functions in its continuity planning process. In response to our concerns about this issue, OPM created and provided to us a crosswalk that linked each of its critical systems to the relevant sections of its contingency plans. By linking its critical systems to its contingency plans, OPM was able to ensure that it had considered all its critical systems in the planning process. As noted in our business continuity planning guide, each Year 2000 contingency plan should provide a description of the resources, staff roles, procedures, and timetables needed for its implementation. As part of this description, agencies need to define and document the triggers for activating contingency plans as well as the actions to be taken if and when the plans are activated. Each of the agency’s contingency plans should also identify the individuals responsible for managing the plan’s activation and implementation. Our review found that 26 of OPM’s 27 contingency plans were missing one or more of these important elements. Only 1 of the 27 plans we reviewed identified the OPM official responsible for managing the activation and implementation of each contingency plan. Seven of the plans did not specify the trigger for plan activation, and nine did not clearly state the procedures needed for operating in contingency mode. This lack of accountability could generate confusion over who is responsible for notifying agency personnel when a contingency plan is activated and for carrying out contingency mode procedures until the agency’s normal operating mode can be resumed. Similarly, for those plans that did not specify requirements for activation and implementation, agency officials will not know in advance when contingency procedures should be invoked and what actions should be taken if and when the plan is activated. Specification of triggers and implementation actions in contingency plans allows the agency to have predetermined criteria and thus avoid the time- consuming process of reaching agreements if a system failure occurs. At our April 2, 1999, meeting with OPM officials to discuss OPM’s comments on our draft report, agency officials provided us with documentation that showed the agency had taken additional actions to address these concerns. Specifically, OPM’s documents showed that it had (1) identified the officials responsible for activating and implementing the contingency plans, (2) specified the triggers for plan activation, and (3) articulated the procedures needed for operating in contingency mode. As part of the contingency planning process, agencies also should develop and document a risk-reduction strategy for the critical days before and after the century date change. This strategy—called the “zero day” or “day one” strategy—articulates the procedures and resources that the agency will need for the period from late December 1999 to early January. Such a strategy may include, for example, an agencywide shutdown of all agency information systems on Friday, December 31, 1999, and a phased power-up on Saturday, January 1, 2000. OPM’s initial plans did not include a risk-reduction strategy and procedures for these critical days before and after the century date change. During our review, OPM officials told us that they recognized that they needed to develop a zero day strategy and procedures for the agency’s critical operations. OPM’s business continuity project manager initially said, however, that he did not know when the agency would develop its zero day plans. At our April 2, 1999, meeting to obtain and discuss OPM’s written comments on a draft of this report, the agency gave us documentation that showed that it had taken additional action to develop zero day plans for its business units. In its written comments, OPM said that from the outset of its business continuity planning process, the agency had intended for OPM units to submit their zero day plans in April 1999. Prior to receiving OPM’s written comments, however, we had not been provided with any information that specified when the agency’s zero day strategy and procedures would be completed. The zero day plans that OPM provided to us showed that the agency’s units had detailed their planned procedures and activities for the 6-day period from Wednesday, December 29, 1999, to Tuesday, January 4, 2000. OPM’s plans included the designation of agency employees who would serve on business resumption teams. These teams would be responsible for assisting in carrying out the contingency plans and dealing with a wide range of operational problems that could occur. Now that OPM has developed zero day plans, the agency can periodically review these plans to determine what changes, if any, should be made to reduce risk and ensure a smooth transition during the critical days before and after the century date change. OPM officials said that they expect that their zero day plans may change between April and the fall of 1999, as OPM’s units review their plans and respond to any changes in risks associated with the agency’s core business processes or mission-critical systems. The fourth phase of business continuity planning involves developing and executing tests of the contingency plans to determine whether the plans are likely to be effective if implemented. As noted in our business continuity planning guide, these tests allow the agency to evaluate whether the contingency plans are capable of providing the desired level of support to the agency’s core business processes and whether the plans can be implemented within a specified period of time. The contingency test plans developed by agencies are to include elements that will allow the agency to test the basic assumptions under which the contingency plans were developed. Our review of the contingency test plans that OPM made available to us showed that important elements were often lacking, including clearly defined test objectives, necessary personnel and their roles, the duration and location of tests, and expected test results. Along with its written comments on a draft of our report, OPM provided documentation that showed that the agency had taken additional action to incorporate these elements into its test plans. With these elements now added, OPM’s tests of its contingency plans can provide greater assurance that the contingency plans would be effective in the event of Year 2000-induced business failures. According to OPM’s monthly Year 2000 management reports, OPM began developing its contingency plan testing strategy in August 1998. Members of the continuity work group were to coordinate the development of the test plans through their respective units. As with the preparation of OPM’s Year 2000 contingency plans, the business continuity project manager instructed the OPM units to refer to our business continuity planning guide when developing their contingency test plans. OPM initially made available five of its contingency test plans for us to review. At the time we reviewed these five test plans, OPM had not completed development of all its test plans. The five test plans that we reviewed were prepared and submitted by three OPM offices: the Employment Service, the Office of Communication, and the Retirement and Insurance Service. OPM’s business continuity project manager said that these offices included the most critical of the agency’s core processes. We used our business continuity planning guide as a framework to review the five contingency test plans. Our review of these test plans showed that important elements were often not addressed. Elements missing from the test plans included clearly defined test objectives, necessary personnel and their roles, the duration and location of tests, and expected test results. These elements are important because they allow the agency to evaluate whether individual contingency plans are capable of providing the desired level of support to the agency’s core business processes and whether the plans can be implemented within a specified period of time. At our April 2, 1999, meeting with OPM to discuss its written comments on our draft report, agency officials provided us with documentation that demonstrated that the agency had taken additional action to incorporate these missing elements into its test plans. This additional information showed that its test plans included the important elements needed for testing, such as test objectives, necessary personnel, the duration and location of tests, and expected test results. With these elements now included in its test plans, OPM’s testing of its related contingency plans can provide greater assurance that OPM’s proposed contingency responses would be effective in the event of Year 2000-induced failures. At the time of our review, OPM was planning to complete its evaluation of the results of its contingency plan testing by May 1999 and prepare the final contingency plans by June 1999. Because OPM had newly begun the process of testing its individual Year 2000 contingency plans at the time of our review, we focused our review on OPM’s development of these test plans and did not address the execution or results of the tests. OPM has made progress in its business continuity and contingency planning efforts for the Year 2000 computing problem. OPM developed a strong planning strategy for its business continuity planning efforts by creating a project structure and milestones for the planning effort, identifying core business processes, establishing key reporting requirements, and obtaining solid support for the planning effort from the agency’s senior managers. Once a Year 2000 continuity strategy is developed, successful implementation becomes crucial to providing reasonable assurances that the agency has reduced the risk and potential impact of Year 2000-induced information system failures. In response to concerns we raised during our review, OPM undertook actions to improve the implementation of its Year 2000 business continuity planning strategy. OPM’s Year 2000 risk and impact assessment now includes the assignment of risk to each of its mission-critical information systems. OPM’s Year 2000 contingency plans now address key information that is essential for ensuring the continuity of agency operations. Finally, OPM’s contingency test plans now include important elements for determining the effectiveness of its contingency plans. By taking measures to improve these components of its overall business continuity planning effort, OPM will be better positioned to deal with unexpected problems and delays that may be caused by the Year 2000 computing problem. We provided a draft of this report to the Director of OPM for comment. On April 2, 1999, we met with OPM officials to obtain and discuss the agency’s written comments on our draft report. At this meeting, OPM provided us with its written comments as well as supplemental documentation that showed that the agency had taken additional actions to respond to our concerns. Descriptions of the additional actions that OPM undertook were incorporated throughout this report. OPM’s written comments, which were provided by OPM’s Deputy Director, are reprinted in appendix IV and summarized and evaluated here. In its written comments, OPM stated that during our review we made a number of good suggestions that were helpful to the agency in its ongoing Year 2000 business continuity planning efforts. Although OPM commended our effort, the agency said that it disagreed with various statements in our draft report. OPM’s overall disagreement with the conclusions and recommendations in our draft report focused primarily on the timing of our review. OPM stated that our review occurred in the middle of the agency’s Year 2000 business continuity planning efforts, and as a result, the material we reviewed was preliminary and incomplete. Although we recognized that OPM’s preparation for the Year 2000 computing problem was an ongoing effort, we based the timing of our review on the schedule that OPM had established for completing various milestones in its business continuity planning process. For example, OPM’s schedule called for the completion of its initial Year 2000 contingency plans by December 2, 1998; we began our review of these plans later in that month. Additionally, in response to OPM’s request, we delayed completion of our scheduled audit work so that the agency could provide us with contingency test plans from various OPM units. In commenting on a recommendation in our draft report that OPM complete a Year 2000 risk assessment for the agency’s mission-critical systems, OPM stated that after we raised concerns about the timing of its verification efforts, it accelerated the schedule for the independent verification contractor to provide it with information about the risk associated with its mission-critical systems. OPM stated that with assistance from its verification contractor, the agency developed a risk assessment for each of its 109 mission-critical systems. At the April 2, 1999, meeting with OPM to discuss the agency’s written comments on our draft report, OPM officials provided us with documentation that showed the criteria OPM used to assess the systems and the results of the risk assessment for each system. OPM officials told us that they would use this assessment to prioritize the agency’s Year 2000 business continuity planning efforts. To recognize the additional action that OPM undertook in developing the risk assessment, we made changes to the relevant sections of our report, including the removal of our recommendation that OPM develop a Year 2000 risk assessment of its mission-critical systems. In commenting on the conclusion in our draft report that OPM’s plans did not demonstrate that the agency considered all its mission-critical systems in the planning process, OPM stated that all the automated systems that support its core business functions had been considered in the business continuity planning process. OPM stated that during our review, it had provided us with a crosswalk that linked each core business process to all mission-critical systems supporting it. Although this process of linking core business processes to mission-critical systems is important to document for planning purposes, this process alone did not demonstrate that OPM considered or included all the agency’s mission-critical systems in its Year 2000 contingency plans. After it had given us its written comments on our draft report, OPM provided us with a crosswalk that linked each of its critical systems to the relevant sections of its contingency plans. By creating this crosswalk of its critical systems to its contingency plans, OPM was able to ensure that all critical systems were considered in the agency’s planning process. In response to this additional action, we made revisions to the relevant sections of our report, including the removal of our recommendation that OPM ensure its contingency plans demonstrate that all critical systems have been considered in the agency’s contingency plans. Regarding a recommendation in our draft report that OPM revise its Year 2000 contingency plans to provide clear procedures and responsibilities for activation and implementation, OPM stated that this lack of clear procedures and assignment of responsibilities was not an oversight but was the result of our review’s being done while OPM was still developing its plans. Our review of OPM’s contingency plans, however, occurred in mid-December 1998, after the date by which OPM had requested that its units submit their contingency plans. We based the timing of our review of OPM’s contingency plans on the agency’s internal schedule for completing its initial contingency plans. At the April 2, 1999, meeting with OPM to discuss the agency’s written comment on our draft report, agency officials provided us with documentation that showed that OPM had taken additional action to address our recommendation concerning clear procedures and responsibilities for plan activation and implementation. This new information showed that OPM had identified the officials responsible for activating and implementing the contingency plans, specified the triggers for plan activation, and articulated the procedures needed for operating in contingency mode. In response to the supplemental documentation that OPM provided to us, we amended our report to reflect OPM’s additional work on this issue and removed our recommendation from the report. As to a recommendation in our draft report concerning the development of a zero day or day one strategy and procedures, OPM stated that after we had completed our audit work, it developed zero day plans for the various OPM units. In its written comments, OPM stated that from the outset of its business continuity planning process, the agency had intended for OPM units to submit their zero day plans in April 1999. OPM stated that the absence of a zero day strategy was not due to an oversight but rather to the fact that these plans were not yet due. During our review, however, OPM’s business continuity project manager initially told us that he did not know when OPM would develop its zero day plans. Prior to OPM’s written comments on a draft of this report, the plans that OPM had provided to us did not specify when the agency’s zero day strategy and procedures would be completed. In response to the additional information that OPM provided to us, we amended our report to reflect that OPM was requiring its units to submit their respective zero day plans in April 1999. Our report now also states that OPM provided us with additional documentation showing that OPM units had developed zero day plans. In addition, we removed our recommendation calling for OPM to develop a zero day strategy and procedures. As to a recommendation in our draft report that OPM ensure that its Year 2000 contingency test plans include important elements needed to test their effectiveness, OPM stated that it had always intended for this information to be part of the completed test plans. The contingency test plans that OPM made available to us for review in February 1999, however, were often missing elements that our business continuity planning guide states are important. At our April 2, 1999, meeting with OPM, agency officials provided us with information that showed that the agency had taken additional action to document these important elements, including test objectives, necessary personnel, the duration and location of tests, and expected test results. In response to OPM’s additional actions on this issue, we revised our report to reflect that OPM had documented these important elements in its contingency test plans. In addition, we removed our recommendation that OPM ensure that its test plans include the important elements needed to test their effectiveness. We are sending copies of the report to the Honorable Janice R. Lachance, Director of OPM; the Honorable Jacob J. Lew, Director of OMB; appropriate congressional committees; and other interested parties. Copies will also be made available to others upon request. Please contact me at (202) 512-8676 if you or your staff have any questions concerning this report. Major contributors to this report are listed in appendix V. Our overall objective for this review was to evaluate OPM’s business continuity and contingency planning efforts for managing and mitigating the risks associated with Year 2000-related business failures. Specifically, we evaluated OPM’s efforts to (1) develop an overall planning strategy for ensuring the continuity of agency operations, (2) assess the risk and impact of system failures on the agency’s core business processes, (3) prepare contingency plans that include procedures and timetables for continuing agency operations in the event that critical systems fail, and (4) test the contingency plans to determine their effectiveness. To accomplish these objectives, we relied on our Year 2000 business continuity planning guide, which provides a structured approach for helping agencies manage the risk of potential Year 2000-induced disruptions to their operations. This structured approach helps to ensure that agencies have, at a minimum, addressed the important components of a well-developed business continuity plan for the Year 2000 computing problem. To assess OPM’s efforts in developing a Year 2000 business continuity planning strategy, we reviewed key OPM documents related to Year 2000 planning, including internal monthly status reports, minutes of business continuity work group meetings, and monthly and quarterly status reports to OMB. We also interviewed key officials at OPM headquarters in Washington, D.C, including the Deputy Chief of Staff, the Deputy Chief Information Officer, and the project manager for the agency’s Year 2000 business continuity planning efforts. To evaluate OPM’s efforts in assessing the risk and impact of system failures on the agency’s core business processes, we reviewed OPM planning documents that showed the results of the agency’s risk and impact assessments. We also interviewed selected representatives from OPM’s business continuity work group to learn how OPM units assessed the risk and impact of system failures on the agency’s core business processes. These work group representatives were from the Retirement and Insurance Service and the Office of the Chief Financial Officer. In addition, we interviewed representatives of J.G. Van Dyke and Associates, Inc., a systems contractor that OPM retained to perform independent verification and validation of OPM’s Year 2000 activities, including identifying risks in OPM’s Year 2000 methodologies and processes. To assess OPM’s efforts in preparing Year 2000 contingency plans, we reviewed the 27 plans that were prepared and submitted by the 17 OPM units represented on the agency’s business continuity work group (listed in app. II). Fourteen of these 17 units submitted one contingency plan each. The remaining three units—the Retirement and Insurance Service, the Office of Contracting and Administrative Services, and the Office of Executive Resources—submitted a total of 13 plans for their respective subunits. In addition, we interviewed the selected representatives from OPM’s business continuity work group to learn how these units prepared their contingency plans. To assess OPM’s efforts in determining whether its contingency plans would be effective if implemented, we reviewed five contingency test plans that OPM made available to us. These test plans were prepared and submitted by the Employment Service; the Office of Communications; and three offices within the Retirement and Insurance Service—the Office of Retirement Programs, the Office of Insurance Programs, and the Office of the Actuaries. At the time of our review, OPM had begun some testing of its contingency plans. However, we did not evaluate the execution or results of these tests. Our review did not include an assessment of OPM’s efforts to renovate or test its systems or system components for Year 2000 compliance. We conducted our review from November 1998 through April 1999 in accordance with generally accepted government auditing standards. In August 1998, OPM established a structured program management approach for its Year 2000 compliance efforts. Under this approach, OPM’s Year 2000 program is separated into 14 components. OPM officials responsible for these 14 components are to manage their respective Year 2000-related tasks and report on their progress in meeting their goals. Table III.1 lists the 14 program components of OPM’s Year 2000 program and the OPM unit responsible for each component. The following is GAO’s comment on OPM’s letter dated April 2, 1999. 1. OPM raised concerns that the introductory section in our draft report could present a false impression to OPM’s customers that the agency’s essential services may not be available after the century change. In response to OPM’s concerns, we redrafted the introductory paragraph to continue to emphasize the importance of Year 2000 preparations while not conveying any conclusions about OPM’s efforts to renovate or test its systems for Year 2000 compliance. Steven J. Wozny, Assistant Director, Federal Management and Workforce Issues K. Scott Derrick, Evaluator-in-Charge Jeffrey W. Dawson, Evaluator The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch-tone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed the Office of Personnel Management's (OPM) year 2000 business continuity and contingency planning activities, focusing on OPM's efforts to: (1) develop an overall planning strategy for ensuring the continuity of agency operations; (2) assess the risk and impact of system failures on the agency's core business processes; (3) prepare contingency plans that include procedures and timetables for continuing agency operations in the event that critical systems fail; and (4) test the contingency plans to determine their effectiveness. GAO noted that: (1) OPM has made progress in its business continuity planning efforts in preparation for the year 2000 computing problem; (2) using GAO's guidance on year 2000 business continuity planning for federal agencies, OPM developed a strong planning strategy for ensuring the continuity of critical agency operations in the event of year 2000-induced system failures; (3) to develop its planning strategy, OPM created a project structure involving representatives from the agency's major business units; (4) through the coordination of this project work group, OPM developed a master schedule and milestones for continuity planning activities, identified business processes that are critical to agency operations, established key reporting requirements, and obtained the concerted support and involvement of the agency's senior management; (5) GAO's review raised concerns, however, about OPM's implementation of the business continuity planning strategy; (6) GAO identified these concerns after reviewing key planning documents that OPM had developed according to critical milestones established by the agency in its year 2000 business continuity planning process; (7) specifically, GAO's concerns involved the approach that OPM used for: (a) assessing the risk and impact of system failures on the agency's core business processes; (b) preparing contingency plans to be used in the event of critical system failures; and (c) developing plans to test the contingency plans to determine whether they would be effective if implemented; (8) when OPM presented GAO with its written comments on a draft of this report, it provided GAO with supplemental documentation that demonstrated that the agency had taken additional actions to address GAO's concerns; (9) by taking these additional actions, OPM has improved the implementation of its business continuity planning strategy and increased the likelihood that critical agency functions can be carried out even if year 2000-induced failures occur in key computer systems; and (10) thus, GAO is not making recommendations to address the concerns originally observed.