Addressing the Year 2000 problem is a tremendous challenge for the federal government. To meet this challenge and monitor individual agency efforts, OMB directed the major departments and agencies to submit quarterly reports on their progress, beginning May 15, 1997. These reports contain information on where agencies stand with respect to the assessment, renovation, validation, and implementation of mission-critical systems, as well as other management information on items such as business continuity and contingency plans and costs. The federal government's most recent reports show improvement in addressing the Year 2000 problem. While much work remains, the federal government has significantly increased the percentage of mission-critical systems that are reported to be Year 2000 compliant, as figure 1 illustrates. In particular, while the federal government did not meet its goal of having all mission-critical systems compliant by March 1999, 92 percent of these systems were reported to have met this goal. While this progress is notable, 11 agencies did not meet OMB’s deadline for all of their mission-critical systems. Some of the systems that were not yet compliant support vital government functions. For example, many of the Federal Aviation Administration’s (FAA) systems were not compliant as of the March deadline. As we testified last month, several of these systems provide critical functions, ranging from communications to radar processing to weather surveillance. Among other systems that did not meet the March 1999 deadline are those operated by Health Care Financing Administration (HCFA) contractors. As we testified in February 1999, these systems are critical to processing Medicare claims. Additionally, not all systems have undergone an independent verification and validation process. For example, the Environmental Protection Agency and the Department of the Interior reported that 57 and 3 of their systems, respectively, deemed compliant were still undergoing independent verification and validation. In some cases, independent verification and validation of compliant systems have found serious problems. For example, as we testified before you this February, none of HCFA’s 54 external mission-critical systems reported by the Department of Health and Human Services as compliant as of December 31, 1998, was Year 2000 ready, based on serious qualifications identified by the independent verification and validation contractor. Other examples have been cited in agency quarterly reports. In February 1999, the Department of Commerce reclassified a system from compliant to noncompliant because an independent verification and validation contractor had concerns about some of the commercial- off-the-shelf software used in the system and wanted to review additional test data. In February 1999, the Environmental Protection Agency reported that its independent third-party review process found a Year 2000 error in a system that was later repaired, tested, and returned to production. In November 1998, the Department of Health and Human Services reported that it removed four Indian Health Service systems from compliant status because an independent verification and validation contractor found that their data exchanges were not compliant. Achieving individual system compliance, although important, does not necessarily ensure that a business function will continue to operate through the change of century--the ultimate goal of Year 2000 efforts. Key actions, such as end-to-end testing and business continuity and contingency planning, are vital to ensuring that this goal is met. Further, OMB has recently taken action on our April 1998 recommendation to set governmentwide priorities and has identified the government’s high-impact programs. This is an excellent step toward ensuring the continuing delivery of vital services. To ensure that their mission-critical systems can reliably exchange data with other systems and that they are protected from errors that can be introduced by external systems, agencies must perform end-to-end testing of their critical core business processes. The purpose of end-to-end testing is to verify that a defined set of interrelated systems, which collectively support an organizational core business area or function, will work as intended in an operational environment. In the case of the year 2000, many systems in the end-to-end chain will have been modified or replaced. As a result, the scope and complexity of testing--and its importance--are dramatically increased, as is the difficulty of isolating, identifying, and correcting problems. Consequently, agencies must work early and continually with their data exchange partners to plan and execute effective end-to-end tests (our Year 2000 testing guide sets forth a structured approach to testing, including end-to-end testing). In January 1999, we testified that with the time available for end-to-end testing diminishing, OMB should consider, for the government’s most critical functions, setting target dates, and having agencies report against them, for the development of end-to-end test plans, the establishment of test schedules, and the completion of the tests. On March 31, OMB and the Chair of the President’s Council on Year 2000 Conversion announced that one of the key priorities that federal agencies will be pursuing during the rest of 1999 will be cooperative efforts regarding end-to-end testing to demonstrate the Year 2000 readiness of federal programs with states and other partners critical to the administration of those programs. We are also encouraged by some agencies’ recent actions. For example, we testified this March, that the Department of Defense’s Principal Staff Assistants are planning to conduct end-to-end tests to ensure that systems that collectively support core business areas can interoperate as intended in a Year 2000 environment. Further, our March 1999 testimony found that FAA had addressed our prior concerns with the lack of detail in its draft end-to-end test program plan and had developed a detailed end-to-end testing strategy and plans. Business continuity and contingency plans are essential. Without such plans, when unpredicted failures occur, agencies will not have well-defined responses and may not have enough time to develop and test alternatives. Federal agencies depend on data provided by their business partners as well as on services provided by the public infrastructure (e.g., power, water, transportation, and voice and data telecommunications). One weak link anywhere in the chain of critical dependencies can cause major disruptions to business operations. Given these interdependencies, it is imperative that contingency plans be developed for all critical core business processes and supporting systems, regardless of whether these systems are owned by the agency. Accordingly, in April 1998, we recommended that the Council require agencies to develop contingency plans for all critical core business processes. OMB has clarified its contingency plan instructions and, along with the Chief Information Officers Council, has adopted our business continuity and contingency planning guide. In particular, on January 26, 1999, OMB called on federal agencies to identify and report on the high-level core business functions that are to be addressed in their business continuity and contingency plans as well as to provide key milestones for development and testing of business continuity and contingency plans in their February 1999 quarterly reports. Accordingly, in their February 1999 reports, almost all agencies listed their high-level core business functions. Indeed, major departments and agencies listed over 400 core business functions. For example, the Department of Veterans Affairs classified its core business functions into two critical areas: benefits delivery (six business lines supported this area) and health care. Our review of the 24 major departments’ and agencies’ February 1999 quarterly reports found that business continuity and contingency planning was generally well underway. However, we also found cases in which agencies (1) were in the early stages of business continuity and contingency planning, (2) did not indicate when they planned to complete and/or test their plan, (3) did not intend to complete their plans until after April 1999, or (4) did not intend to finish testing the plans until after September 1999. In January 1999, we testified before you that OMB could consider setting a target date, such as April 30, 1999, for the completion of business continuity and contingency plans, and require agencies to report on their progress against this milestone. This would encourage agencies to expeditiously develop and finalize their plans and would provide the President’s Council on Year 2000 Conversion and OMB with more complete information on agencies’ status on this critical issue. To provide assurance that agencies’ business continuity and contingency plans will work if they are needed, we also suggested that OMB may want to consider requiring agencies to test their business continuity strategy and set a target date, such as September 30, 1999, for the completion of this validation. On March 31, OMB and the Chair of the President’s Council on Year 2000 Conversion announced that completing and testing business continuity and contingency plans as insurance against disruptions to federal service delivery and operations from Year 2000-related failures will be one of the key priorities that federal agencies will be pursuing through the rest of 1999. OMB also announced that it planned to ask agencies to submit their business continuity and contingency plans in June. In addition to this action, we would encourage OMB to implement the suggestion that we made in our January 20 testimony and establish a target date for the validation of these business continuity and contingency plans. While individual agencies have been identifying and remediating mission- critical systems, the government’s future actions need to be focused on its high-priority programs and ensuring the continuity of these programs, including the continuity of federal programs that are administered by states. Accordingly, governmentwide priorities need to be based on such criteria as the potential for adverse health and safety effects, adverse financial effects on American citizens, detrimental effects on national security, and adverse economic consequences. In April 1998, we recommended that the President’s Council on Year 2000 Conversion establish governmentwide priorities and ensure that agencies set agencywide priorities. On March 26, 1999, OMB implemented our recommendation by issuing a memorandum to federal agencies designating lead agencies for the government’s 42 high-impact programs (e.g., food stamps, Medicare, and federal electric power generation and delivery); the attachment contains a list of these programs and lead agencies.