To function properly, the U.S. securities industry and capital markets require timely and accurate flows of electronic information. This information is transmitted through and processed within a vast network of computerized systems managed by stock, options, and futures exchanges; broker-dealers; banks; mutual funds; and various other organizations. These systems handle such tasks as displaying price quotations, routing orders to buy or sell, executing trades, and transferring securities and payments (clearance and settlement). In addition, SEC has internal systems that help it perform its regulatory responsibilities. All of these systems are potentially vulnerable to errors or malfunction as a result of the impending date changeover. The Year 2000 problem is rooted in the way dates are recorded and computed in many computer systems. For the past several decades, systems have typically used two digits to represent the year, such as “97” to represent 1997, in order to conserve on electronic data storage and reduce operating costs. With this two-digit format, however, the year 2000 is indistinguishable from 1900, 2001 from 1901, and so on. As a result of this ambiguity, system or application programs that use dates to perform calculations, comparisons, or sorting may generate incorrect results when working with years after 1999. For example, a broker-dealer with a system that is not compliant may be unable to receive payment information in January 2000 for securities that it sold in December 1999 if its computer systems fail to accept incoming data with a Year 2000 date. In a speech to international bankers, the president of the New York Federal Reserve Bank indicated that the Year 2000 software date change poses a major risk for world financial markets and that the world economy could be damaged if efforts to address the Year 2000 problem are not carried out correctly. SEC is the primary federal agency responsible for overseeing the securities markets in the United States. It promulgates regulations, reviews market operations, conducts inspections of market participants, and takes enforcement actions in response to violations of the securities laws and accompanying regulations. The securities laws allow SEC to delegate some of its responsibilities to the entities that operate the various stock and options markets as SROs. SROs develop and enforce rules for their members. They include the New York Stock Exchange, the National Association of Securities Dealers, and other regional securities exchanges that maintain the physical securities or their electronic equivalent. The SROs directly oversee their member broker-dealers, which buy and sell securities on behalf of customers. SEC oversees the SROs as well as investment companies that sell mutual funds, investment advisers who dispense investment advice or manage customer funds, and transfer agents who maintain records on behalf of companies that issue securities. Consequently, SEC and the SROs have primary responsibility for ensuring that Year 2000 problems in the securities industry do not adversely affect individual investors or the securities markets. Various organizations provide guidance for assessing, planning, and managing Year 2000 readiness programs. For example, we and other organizations, such as information technology consulting firms, have issued guidance for agencies and firms seeking assistance in formulating their Year 2000 remediation efforts. Our guidance on addressing the Year 2000 problem, contained in Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14, Sept. 1997), incorporates guidance and practices identified by leading organizations in the information technology industry. Our assessment guide recommends that organizations proceed through a five-phased approach to resolving their Year 2000 computing issues. These phases are awareness, assessment, renovation, validation, and implementation. SEC appears to be using a similar approach but has organized its program into six phases by dividing the validation phase into internal testing and integrated testing. In May 1997, OMB issued a format for federal agencies to report on the progress of their Year 2000 efforts. Specifically, OMB has asked that each agency report its total number of mission-critical systems; the number that are currently Year 2000 compliant; and the progress made in replacing, repairing, or retiring those systems that are not yet compliant. Although the guidance applies to a large number of federal agencies, SEC was not one of the agencies required to report. The Securities Industry Association, an organization that represents a large segment of the securities industry, is playing an important role in coordinating the industry’s Year 2000 efforts. This association has established a steering committee—made up of representatives from various SROs, broker-dealers, investment companies, third party software vendors, and others—to develop a strategy for industry remediation and coordinated testing schedules. To evaluate how SEC’s report discussed the agency’s efforts to address the Year 2000 problem for its internal systems and identify any ways that future reports could be improved, we interviewed officials in SEC’s Office of Information Technology. We also reviewed internal reports, plans, and timetables concerning the agency’s efforts to repair its own systems. To evaluate how SEC’s report discussed the efforts of market participants to address the Year 2000 problem, we interviewed SEC officials in the various divisions and offices within the agency responsible for overseeing SROs, broker-dealers, investment companies, investment advisers, and other market participants. We also reviewed documents SEC had collected from market participants to assess what type of information the agency had analyzed and thus could summarize in future reports. In addition, we assessed the extent to which SEC’s report contained information that related to the various criteria set out in our own guidance for addressing Year 2000 issues and in the OMB guidance for selected federal agencies reporting on their Year 2000 efforts. We requested comments on a draft of this report from the Chairman, SEC. SEC provided written comments, which are discussed at the end of this report and reprinted in appendix II. SEC also suggested technical changes, which we incorporated where appropriate. We conducted our review from August 1997 through January 1998 in accordance with generally accepted government auditing standards. SEC’s June 1997 report provided an overview of its own and industry participants’ efforts to prepare for the year 2000. To assemble the report, SEC formed a task force that included representatives of each of its major operating divisions. These divisional representatives contacted various market participants under the representatives’ jurisdiction by letter or telephone, requested and reviewed documents provided by these participants, and discussed Year 2000 issues as part of on-site examinations of some participants. They compiled the report from the information provided and structured it to address the specific questions you raised in your December 6, 1996, letter that requested annual SEC progress reports. SEC’s report provided a high-level description of the status of Year 2000 remediation efforts for SEC internal systems, including detailed information on the status of SEC mission-critical systems. For mission-critical systems, the report discussed the total number of systems, how many are currently Year 2000 compliant, and how many are not compliant and will be either replaced or renovated. The report also provided SEC’s schedule for completing some of the phases of the remediation process for mission-critical systems. SEC did not report the status of its critical internal systems in relation to its six-phased approach for achieving Year 2000 readiness. Indicating the status of its critical systems in relation to the six phases would provide a more structured means to assess the progress SEC has made in addressing the Year 2000 problem for its internal systems. The report also described SEC’s efforts to promote awareness of the Year 2000 problem throughout the securities industry. It included a listing of the major organizations that SEC contacted within the securities industry and a description of how it coordinated its efforts with these organizations to ensure that systems throughout the securities industry are being readied for the year 2000. The organizations contacted included associations that represented SROs, broker-dealers, transfer agents, investment companies, and investment advisers. The report also provided a discussion of issues relating to public company financial statements, including auditing, auditor independence, and other accounting considerations. Finally, the report discussed SEC’s guidance to public companies regarding the extent to which these companies should include information in their public disclosure filings if the costs or consequences of the Year 2000 problem would have a material effect on reported financial information. Although it provided an overview of the status of its own and securities industry participants’ efforts to address the Year 2000 problem, the report did not identify those systems that might be critical to the continued functioning of the U.S. securities markets. Furthermore, it did not provide sufficient information about the timing and status of efforts by SROs, broker-dealers, investment companies, and other market participants to address their systems. In addition, it did not discuss what efforts will be made to address systems or organizations that have fallen behind schedule or what contingency planning is occurring to address systems that will not be ready in time. Such information is being required by OMB from other federal agencies and provides a more complete picture of Year 2000 readiness. According to our assessment guide, identifying and assessing mission-critical systems are important because an enterprisewide inventory of information systems and their components provides the necessary foundation for Year 2000 program planning. Identifying and addressing Year 2000 problems in critical systems are essential to ensuring that securities market operations continue without disruption and could also help market participants focus on their most critical systems as part of their overall efforts. Since May 1997, OMB has required selected federal agencies to report on the total number of mission-critical systems each has; the number of such systems that are currently Year 2000 compliant; and whether remaining systems are being replaced, repaired, or retired. SEC’s report identified the number of internal systems SEC considered critical to its operations, but did not provide similar information on market participants’ systems considered critical to the continued functioning of the U.S. securities markets. SEC officials said that they had determined whether SROs had conducted detailed inventories and identified critical systems because of the importance of these entities to the securities markets. The officials said that they generally had not collected similar information from market participants such as broker-dealers or investment companies because they had concentrated on ensuring that these participants were aware of and beginning to focus on Year 2000 problems. In addition, the officials said they also had begun identifying the steps these participants had taken to address the problems.