Our objectives were to assess (1) the status of Navy’s effort to identify and correct its Year 2000 problem and (2) the appropriateness of the Navy’s strategy and actions for remediating Year 2000 problems. In conducting our review, we used our Year 2000 Assessment Guide to assess the Navy’s Year 2000 efforts. This guide addresses common issues affecting most federal agencies and presents a structured approach and provides a checklist to aid in planning, managing, and evaluating Year 2000 programs. The guidance, which is consistent with Defense’s Year 2000 Management Plan and the Navy’s own Year 2000 management approach, describes five phases—supported by program and project management activities—with each phase representing a major Year 2000 program activity or segment. The phases and a description of each follows. Awareness - Define the Year 2000 problem and gain executive-level support and sponsorship. Establish a Year 2000 program team and develop an overall strategy. Ensure that everyone in the organization is fully aware of the issue. Assessment - Assess the Year 2000 impact on the enterprise. Identify core business areas and processes, inventory and analyze systems supporting the core business areas, and prioritize their conversion or replacement. Develop contingency plans to handle data exchange issues, lack of data, and bad data. Identify and secure the necessary resources. Renovation - Convert, replace, or eliminate selected platforms, applications, databases, and utilities. Modify interfaces. Validation - Test, verify, and validate converted or replaced platforms, applications, databases, and utilities. Test the performance, functionality, and integration of converted or replaced platforms, applications, databases, utilities, and interfaces in an environment that faithfully represents the operational environment. Implementation - Implement converted or replaced platforms, applications, databases, utilities, and interfaces. Implement data exchange contingency plans, if necessary. During our review, we concentrated on the Navy’s efforts to oversee its Year 2000 program during the awareness and assessment phases—the first two phases of its overall five-phased approach. We focused our review on Year 2000 work being carried out by (1) DOD’s Office of the Assistant Secretary of Defense for Command, Control, Communications and Intelligence (ASD/C3I), which is responsible for promulgating DOD guidance on Year 2000 matters and providing assistance to Defense components, (2) Navy Headquarters, including the Offices of the Chief Information Officer (CIO), who is responsible for overall coordination and management and for issuing Navy Year 2000 policy and guidance, and (3) the Navy’s two largest systems commands, the Naval Air Systems Command (NAVAIR) and the Naval Sea Systems Command (NAVSEA), which are the central activities responsible for developing, acquiring, and supporting aeronautical systems and ships and related weapons and combat systems. Specifically, we met with the Acting Assistant Secretary of Defense for Command, Control, and Communications and Intelligence, the Principal Director for Information Management, the Director for Information Technology, and other senior staff responsible for Year 2000 issues. We reviewed Defense’s Year 2000 guidance and other documentation on Year 2000 funding, reporting, and date format requirements. We met with the Acting Deputy Chief Information Officer, the Team Leader and Coordinator from the Year 2000 Coordination Office, and the NAVSEA Coordinator and the NAVAIR Deputy CIO. We obtained and analyzed documents issued by these offices that describe organizational structure and responsibilities for carrying out the Navy Year 2000 program. We reviewed the Navy’s Year 2000 Action Plan to assess the level of guidance, roles, and responsibilities, and target milestone dates for the Year 2000 effort. We also reviewed other pertinent Year 2000 program documentation such as Defense and Navy guidance and management directives, working group minutes, status reports, and cost and schedule data. Further, we reviewed available inventory information on the Navy’s mission-critical systems contained in the Defense Integration Support Tools (DIST) database, which the Navy uses to help manage its Year 2000 efforts. In doing so, we determined (1) the number of systems reported to be owned and operated by Navy organizations and (2) the reported status of Navy systems in their Year 2000 efforts. We also assessed the reliability and completeness of the Navy’s Year 2000 information. We relied on work previously conducted at the Naval Supply Systems Command (NAVSUP), which is the Navy’s primary supply manager. In our report on NAVSUP’s Year 2000 efforts, we found that NAVSUP had made considerable progress in meeting its Year 2000 challenges as a result of implementing a centralized management and control approach. We performed our work primarily at the Navy’s Year 2000 Coordination Office and the Office of the Assistant Secretary of Defense for Command, Control, Communications and Intelligence in Arlington, Virginia. We conducted our work from August 1997 through April 1998 in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Secretary of the Navy. Comments from the department are discussed in the “Agency Comments and Our Evaluation” section and are reprinted in appendix II. Most of the Navy’s automated information systems and weapons systems are vulnerable to the Year 2000 problem, which is rooted in the way dates are recorded and computed in automated information systems. For the past several decades, systems have typically used two digits to represent the year, such as “97” representing 1997, in order to conserve electronic data storage and reduce operating costs. With this two-digit format, however, the Year 2000 is indistinguishable from 1900, or 2001 from 1901, etc. As a result of this ambiguity, computerized systems and/or application software that use dates to perform calculations, comparisons, or sorting may generate incorrect results when working with years after 1999. In addition, any electronic device that contains a microprocessor or is dependent on a timing sequence may be also vulnerable to Year 2000 problems. This includes computer hardware, telecommunications equipment, building and base security systems, street lights at military installations, elevators, and medical equipment. Should Navy computer systems fail, Navy operations at all levels could be impacted by the incorrect processing of data as well as corrupted databases or even massive system failures. In turn, this could result in such problems as delays in supply shipments, faulty inventory forecasts, unreliable budget estimates, and erroneous personnel-related information. Moreover, the problem could adversely impact critical maritime operations such as combat, communications, command and control, intelligence, surveillance, reconnaissance, strategic sealift, and fleet mobilization and readiness. Like the other military services, the Navy has adopted DOD’s Year 2000 management strategy, which charges components (that is, program managers and system owners) with responsibility for making sure that all of their systems correctly process dates and gives them the flexibility to implement solutions as they deem appropriate. In December 1995, the Navy designated the Navy Information Systems Management Center with responsibility for (1) coordinating Year 2000 efforts being carried out by its 9 operating forces, including the U.S. Marine Corps, and its 17 shore establishments which include 5 major systems commands, (2) facilitating the sharing of Year 2000 information and best practices departmentwide, and (3) monitoring the Navy’s Year 2000 progress. In August 1997, the Navy transferred this responsibility to its newly established Office of the Department of the Navy Chief Information Officer. Appendix I illustrates the Navy’s organizational structure and describes the complexity involved in carrying out Year 2000 efforts at the component level. To comply with DOD’s current Year 2000 funding mandate, the Navy is not providing program managers and system owners additional funds to manage and fix the Year 2000 problem. Rather, program managers and system owners have been directed to use previously budgeted funds (that is, primarily operational and maintenance (O&M) funds) or reprogram other programmatic funds to fix Year 2000 problems. As of February 1998, the Navy estimated that it will cost about $421 million to successfully complete its Year 2000 program, but as discussed later, this estimate is not reliable. To increase awareness of Year 2000 and to foster coordination among its components, the Navy has taken the following actions. In November 1995, it formally began the awareness phase of its Year 2000 program. In April 1996, it established a Navy Year 2000 homepage that serves as a clearinghouse for Year 2000 information. Since October 1996, it has participated in a number of Year 2000 interface assessment workshops sponsored by Defense. These workshops are designed to acquaint managers with the nature and extent of interface problems pertaining to 21 functional areas, such as finance, intelligence, logistics, communications, and weapons systems. From March 1997 through May 1998, it has conducted quarterly reviews to keep abreast of Year 2000 problems. These reviews are attended by representatives from the Secretary of the Navy, the CIO office, and the major Navy and Marine Corps commands and activities. Since May 1998, the Navy CIO office has been holding weekly briefings with the commands. In April 1997, it adopted and implemented DOD’s compliance checklist to assist system managers in ensuring that their systems are compliant for the Year 2000. The checklist focuses on (1) identification of systems and interfaces, (2) assessment of date usage by the systems, and (3) compliance testing, among other subjects. In August 1997, it identified Year 2000 as its highest priority behind life-threatening or mission failure repairs and instructed components to put a higher priority on funding remediation efforts than on other information technology initiatives. In December 1997, it tasked the Navy Inspector General to assess Year 2000 readiness at its commands. The IG plans to report on its assessment of 12 commands in April. At the time of our review, the IG had not issued any reports. In February 1998, the Navy requested the Naval Audit Service to review Year 2000 readiness at the commands not visited by the IG. In January 1998, it formally issued its Year 2000 Action Plan. The March 1998 revision of this plan sets milestones for the completion of major Year 2000 activities and provides exit criteria for each phase.