SSA’s programs touch the lives of almost every individual in this country. Its Old Age, Survivors, and Disability Insurance (OASDI) programs—which comprise what is commonly called Social Security—provide benefits to retired and disabled workers and their dependents and survivors; its Supplemental Security Income (SSI) program provides assistance to aged, blind, and disabled individuals with limited income and resources. In addition to paying benefits, SSA issues Social Security numbers to eligible individuals and maintains and provides earnings records for individuals working under employment covered by the program. SSA also helps process claims for black lung benefits and provides support to other programs, such as Medicare, Medicaid, and Railroad Retirement. More than 50 million beneficiaries receive benefits and services under SSA’s programs, which in fiscal year 1996 accounted for $386 billion—nearly one-quarter of the nation’s $1.6 trillion in federal expenditures. SSA administers its programs through five core business processes—enumeration, earnings, claims, postentitlement, and informing the public. Through these processes, as shown in table 1, SSA processes claims for benefits, adjudicates appeals on disputed decisions, and handles the millions of actions required each year to keep beneficiary records current and accurate. SSA serves the public through its central office in Baltimore, Maryland, and a network of field offices that includes 10 regional offices, approximately 1,300 field offices, and a nationwide toll-free telephone number. Field offices are located in cities and rural communities across the nation and are the agency’s physical point of contact with beneficiaries and the public. SSA also depends on 54 state DDS offices, along with one federally administered DDS, to help process claims under its disability insurance programs. State DDSs provide crucial support to the initial disability claims process—one that accounts for a large proportion of SSA’s workload—through their role in determining an individual’s medical eligibility for disability benefits. DDSs make decisions regarding disability claims in accordance with federal regulations and policies; the federal government reimburses 100 percent of all DDS costs in making disability determination decisions. The DDSs, during fiscal year 1996, processed more than 2 million initial disability determination claims. The process begins when individuals apply for disability benefits at an SSA field office, where determinations are made on whether they meet nonmedical criteria for eligibility. The field office then forwards these applications to the appropriate state DDS, where a disability examiner collects the necessary medical evidence to make the initial determination of whether the applicant meets the definition of disability. Once the applicant’s medical eligibility is determined, the DDS forwards this decision to SSA for final processing. Both SSA and the DDSs rely on information systems to support the processing of benefits. SSA uses an information processing network that links its distributed (field level) operations with its centralized mainframe computers at headquarters. Each core process is supported by hundreds of software programs that enable field office staff to perform data collection and on-line editing of client information, using either terminals or recently installed personal computers that communicate with SSA’s centralized mainframe computers. These mainframe computers establish and update beneficiary claims, process applications for Social Security numbers, and establish and maintain individuals’ earnings histories. SSA’s Chief Information Officer (CIO) provides primary oversight of the agency’s information systems investments; the Office of the Deputy Commissioner for Systems (referred to as the Office of Systems) is responsible for managing all facets of information systems planning, development, acquisition, and operation. State DDSs rely primarily on their internal systems to process medical determinations. In general, DDS computers are comprised of unique state-owned hardware of various ages and stages of completion and with differing capacity and maintenance levels. Similarly, the types of systems and levels of software used vary according to individual state needs. The majority of the DDSs—42 of the 54—use software developed by two private contractors, while the remaining 12 DDSs—referred to as independent DDSs—either process disability claims manually or use software that they have developed. DDS systems are linked to SSA’s mainframe computers via the National Disability Determination Service System (NDDSS). Records are established on the NDDSS through direct input by DDS staff or by uploading data from local databases. Since 1992, SSA’s Office of Systems has been responsible for disability system development. The office serves as the focal point for all disability-related hardware and software initiatives for the DDSs and is responsible for ensuring the integration of these activities on an enterprise basis. Because of its heavy reliance on technology, the Year 2000 problem presents SSA with the enormous challenge of reviewing all of its computer software and making the conversions required to ensure that its systems can handle the first change to a new century since the computer age began. The CIO has overall responsibility for the Year 2000 program; however, day-to-day responsibility for ensuring that changes are made to all systems used by SSA and the DDSs to support core business processes resides with the Office of Systems. In assessing the actions taken by SSA to address the Year 2000 problem, we reviewed numerous documents, including its Year 2000 tactical plan, systems inventories, test plans, and implementation schedules. We also analyzed internal tracking reports developed by the agency to monitor the progress of its Year 2000 activities, as well as its Year 2000 quarterly reports submitted to the Office of Management and Budget (OMB). We discussed SSA’s Year 2000 program activities with officials in various headquarters offices, including the Offices of the Deputy Commissioners for Systems; Operations; Finance, Assessment, and Management; and Programs and Policy. We also met with management and staff at SSA’s program service centers in Birmingham, Alabama, and Philadelphia, Pennsylvania, and at its regional office in Atlanta, Georgia. In addition, we examined Year 2000 program activities at DDS offices in Albany, New York; Birmingham, Alabama; and Decatur, Georgia. We also interviewed representatives of the two private contractors responsible for performing Year 2000 work at most of the DDSs. We used our Year 2000 assessment guide in evaluating SSA’s and the DDSs’ readiness to achieve Year 2000 compliance. We conducted our review from January 1997 through September 1997, in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Commissioner of Social Security or his designee. The Commissioner provided written comments, which are discussed in the “Agency Comments” section and are reprinted in appendix I. At 12:01 a.m. on January 1, 2000, many computer systems worldwide could malfunction or produce inaccurate information simply because the date has changed. Unless corrected, such failures could affect SSA benefits payments received by millions of Americans. The problem is rooted in how dates are recorded and computed. For the past several decades, systems have typically used two digits to represent the year—such as “97” for 1997—to save electronic storage space and reduce operating costs. In such a format, however, 2000 is indistinguishable from 1900. As an example of the potential impact of this ambiguity, a beneficiary born in 1925 and therefore turning 75 in 2000 could be seen as being negative 25 years old (if “now” is 1900)—not even born yet—and therefore ineligible for benefits that the individual had been receiving. Correcting this problem will not be easy or inexpensive and must be done while such systems continue to operate. Many of the government’s computer systems were developed 20 to 25 years ago, use a wide array of computer languages, and lack full documentation. Systems may contain up to several million lines of software code that must be examined for potential date-format problems. The enormous challenge involved in correcting these systems is primarily managerial. Agencies’ success or failure will be determined largely by the quality of their program management and executive leadership. Top agency officials must understand the importance and urgency of this undertaking and communicate this to all employees. The outcome of these efforts will also depend on the extent to which agencies have institutionalized key systems-development and program-management practices, and on their experience with such large-scale software development or conversion projects. Accordingly, agencies must assess their information resources management capabilities and, where necessary, upgrade them. In so doing, they should consider soliciting the assistance of other organizations experienced in these endeavors. To assist agencies with these tasks, our assessment guide discusses the scope of the challenge and offers a structured, step-by-step approach for reviewing and assessing an agency’s readiness to handle the Year 2000 problem. The guide describes in detail five phases, each of which represents a major Year 2000 program activity or segment. These are the following: Awareness. This is a critical first step. Although many people may have heard about a Year 2000 problem, they may not know what it entails or why it matters. For agency personnel, this knowledge is imperative. This is also the phase in which the team within the agency that will take the lead in correcting the problem is identified. The team then examines the problem’s potential impact, gauges the adequacy of agency resources, develops a strategy, and secures strong, visible executive support. Assessment. The main thrust of this phase is separating mission-critical systems—which must be converted or replaced—from important ones that should be converted or replaced and marginal ones that may be addressed now or deferred. Since the Year 2000 problem is primarily a business problem, it is essential to assess its likely impact on the agency’s major business functions. Following this, information systems in each business area should be inventoried and prioritized; project teams are then established and program plans devised. Testing strategies must be identified, and contingency planning must be initiated as well. Renovation. This phase deals with actual changes—converting, replacing, or eliminating selected systems and applications. In so doing, it is important to consider the complex interdependencies among them.