Credit unions are nonprofit financial cooperatives organized to provide their members with low-cost financial services. According to NCUA, as of 1996, federally insured credit union assets totaled $326 billion. About one in four Americans belongs to a credit union, and credit unions accounted for about 2 percent of the total financial services in the United States. NCUA supervises and insures more than 7,200 federally chartered credit unions and insures member deposits in an additional 4,200 state-chartered credit unions through the National Credit Union Share Insurance Fund. As part of its goal of maintaining the safety and soundness of the credit unions, NCUA is responsible for ensuring credit unions are addressing the Year 2000 problem. The Year 2000 problem is rooted in the way dates are recorded and computed in automated information systems. For the past several decades, systems have typically used two digits to represent the year, such as “97” representing 1997, in order to conserve on electronic data storage and reduce operating costs. With this two-digit format, however, the year 2000 is indistinguishable from 1900, or 2001 from 1901. As a result of this ambiguity, system or application programs that use dates to perform calculations, comparisons, or sorting may generate incorrect results. According to NCUA, most credit unions rely on computers to provide for processing and updating of records and a variety of other functions. As such, the Year 2000 problem poses a serious dilemma for the industry. For example, the problem could lead to numerous problems when calculations requiring the use of dates are performed, such as calculating interest, calculating truth-in-lending or truth-in-savings disclosures, and determining amortization schedules. Moreover, automated teller machines may also assume that all bank cards are expired due to this problem. In addition, errors caused by Year 2000 miscalculations may expose institutions and data centers to financial liability and risk of damage to customer confidence. Other systems important to the day-to-day business of credit unions may be affected as well. For example, telephone systems could shut down as can vaults, security and alarm systems, elevators, and fax machines. In addressing the Year 2000 problem, credit unions must also consider the computer systems that interface with, or connect to, their own systems. These systems may belong to payment system partners, such as wire transfer systems, automated clearing houses, check clearing providers, credit card merchant and issuing systems, automated teller machine networks, electronic data interchange systems, and electronic benefits transfer systems. Because these systems are also vulnerable to the Year 2000 problem, they can introduce and/or propagate errors into credit unions systems. Accordingly, credit unions must develop comprehensive solutions to this problem and prevent unintentional consequences from affecting their systems and the systems of others. To address these Year 2000 challenges, GAO issued its Year 2000 Assessment Guide to help federal agencies plan, manage, and evaluate their efforts. The Office of Management and Budget (OMB), which is responsible for developing the Year 2000 strategy for federal agencies, also issued similar guidance. Both require a structured approach to planning and managing five delineated phases of an effective Year 2000 program. The phases include (1) raising awareness of the problem, (2) assessing the complexity and impact the problem can have on systems, (3) renovating, or correcting, systems, (4) validating, or testing, corrections, and (5) implementing corrected systems. GAO has also identified other dimensions to solving the Year 2000 problem, such as identifying interfaces with outside organizations and their systems and establishing agreements with these organizations specifying how data will be exchanged in the year 2000 and beyond. In addition, GAO and OMB have established a timeline for completing each of the five phases and believe agencies should have completed assessment phase activities last summer and should be well into renovation with the goal of completing this phase by mid to late 1998. Our work at other federal agencies indicates that because the cost of systems failures can be very high, contingency plans must be prepared so that core business functions will continue to be performed even if systems have not been made Year 2000 compliant. NCUA has developed a three-pronged approach for ensuring that credit unions are aggressively addressing the Year 2000 problem, which encompasses (1) incorporating the Year 2000 issue into its examination and supervision program, (2) disseminating information about the problem to credit unions, and (3) assessing Year 2000 compliance on the part of credit union data processing vendors. The first aspect of NCUA’s strategy, the examination and supervision program, involves assessing credit union Year 2000 efforts through regular annual examinations at the 7,200 federally chartered credit unions and 30 to 40 percent of the 4,200 federally insured, state chartered credit unions for which NCUA conducts an insurance review. These examinations seek to identify credit unions that are in danger of not renovating their systems on time and to reach “formal agreements” that specify corrective measures. In conducting these reviews, examiners are to follow NCUA guidelines, which provide step-by-step procedures for identifying problem areas. Once a formal agreement is reached, the examiner is expected to monitor the credit union’s implementation of the agreed-upon corrective measures. Also as part of its examination effort, NCUA has contracted a consulting firm to train selected examiners in Year 2000 efforts. Through this training, NCUA expects to have one in-house Year 2000 specialist available as a resource for every eight examiners. In addition, NCUA’s board recently authorized the hiring of an electronic data processing (EDP) auditor to provide more in-depth technical assistance and education on Year 2000 problems. Another part of NCUA’s examination and supervision strategy includes working with state regulators to ensure that federally insured, state chartered credit unions are also Year 2000 compliant. Officials from NCUA and the National Association of State Credit Union Supervisors told us that all but two state regulators are following the same Year 2000 examination strategy established by NCUA; the other two state regulators are planning on performing added steps in addition to performing those included in NCUA’s strategy. The second aspect of NCUA’s strategy—information dissemination—seeks to heighten credit union awareness of the Year 2000 problem. In August 1996 and June 1997 letters to federally insured credit unions, NCUA formally alerted credit unions to the potential dangers of the Year 2000 problem, identified the specific impacts the problem could have on the industry, provided detailed explanations of the problem, and identified steps needed to correct the problem. It also related its plans to include Year 2000 evaluations in regular examinations and provided credit unions with copies of its examination guidance. In addition, NCUA has appointed a Year 2000 executive responsible for achieving Year 2000 compliance industrywide and assigned Year 2000 compliance officers to its central office and six regional offices. These staff will be responsible for serving as Year 2000 focal points to coordinate efforts across the agency. Finally, NCUA is working with credit union trade groups, such as the Credit Union National Association, in raising awareness of Year 2000 issues. The third component of NCUA’s program—vendor compliance—targets organizations that provide electronic data processing services to credit unions. According to NCUA, approximately 40 vendors provide data processing services to 76 percent of all federally insured credit unions, which account for 79 percent of federally insured credit union assets. Consequently, it is vital that these vendors correct their own systems and help ensure that information can be easily transferred after the Year 2000 deadline. NCUA has begun identifying and contacting major EDP vendors, and it plans to assess their efforts through questionnaires. Specifically, in May 1997 and again in August 1997, NCUA mailed a questionnaire to the 87 vendors, including the 40 vendors that support the bulk of credit unions, requesting information on Year 2000 readiness and, as of September 1997, had received 29 responses. While NCUA has initiated actions to build the Year 2000 issue into examinations and to raise awareness about the issue among credit unions and their vendors, our work to date has identified four issues that must be addressed to provide greater assurance that NCUA efforts will be successful. First and foremost of our concerns is that NCUA still does not have a complete picture of where credit unions and their vendors stand in resolving the Year 2000 problem, and current efforts to determine credit union compliance are behind the schedule established by OMB and GAO. To collect information from the credit unions on their Year 2000 status, NCUA examiners used a high-level questionnaire that inquired whether (1) credit union systems were capable and ready to handle Year 2000 processing, (2) plans were in place to resolve the problem, (3) enough funds were budgeted to correct systems, and (4) responsibility and reporting mechanisms were appropriately established to support the Year 2000 effort. NCUA issued a separate high-level questionnaire to credit union vendors. However, as of the time of our work, NCUA had not yet queried 20 percent of the credit unions and had only received 29 of the 87 vendor responses. In addition, of the credit union and vendor responses received, NCUA has not yet analyzed the information to determine which credit unions and vendors are at high risk of not correcting their systems on time. This problem is compounded by the fact that the NCUA questionnaires did not inquire about the status of efforts in completing each important phase of correction: (1) raising awareness of the problem, (2) assessing the complexity and impact the problem can have on systems, (3) renovating, or correcting, systems, (4) validating, or testing, corrections, and (5) implementing corrected systems. The questionnaires also did not include system interface issues. For example, they did not inquire about (1) identifying interfaces with outside organizations and their systems, such as payment, check clearing, credit card, and benefit transfer systems, and (2) establishing agreements with these organizations specifying how data will be exchanged in the year 2000 and beyond.