Veterans Benefits Computer Systems: Risks of VBA's Year-2000 Efforts
(Letter Report, 05/30/97, GAO/AIMD-97-79).
Pursuant to a congressional request, GAO reviewed the Veterans Benefits
Administration's (VBA) actions to address management and technical
weaknesses reported in a June 1996 hearing on VBA's modernization
efforts, focusing on GAO's assessment of VBA's actions to ensure that
the year-2000 computing problem will be adequately addressed.
GAO noted that: (1) correcting the year-2000 problem is critical to
VBA's mission of providing benefits and services to veterans and their
dependents; (2) if not corrected, calculations based on incorrect dates
could result in inaccurate and late payment of benefits to veterans,
prompting financial stress to millions across the country; (3) VBA has
acted to address the problem, but can do more; (4) the year-2000
management office structure and technical capabilities are insufficient;
(5) key year-2000 readiness assessment processes--determining the
potential severity of the year-2000 impact on VBA's operations,
inventorying its information systems and their components, and
developing contingency plans--have not been completed; (6) both VBA's
initial and revised strategies are risky in that without sufficient
information on the costs or potential problems associated with its
approach to making systems year-2000 compliant, it cannot make informed
choices as to which systems must be funded to avoid disruptions in
service, versus which can be deferred; (7) deficiencies in these three
areas add risk to an already difficult challenge; (8) addressing these
problems will require close and continual top management attention and
leadership; (9) contributing to the challenge facing VBA are the loss of
key computer personnel, difficulties in obtaining necessary information
from external sources on whether interfaces and third-party products are
year-2000 compliant, and delays in upgrading systems at VBA data
centers; (10) the issue of whether third-party products are year-2000
compliant is being faced by other federal agencies as well; (11) the
Department of Veterans Affairs' (VA) chief information officer told GAO
that VBA will: (a) revise its year-2000 strategy to focus on converting
the existing noncompliant benefits payment systems rather than replacing
them; and (b) acquire contractual support to assist in managing the
year-2000 effort and in making necessary changes; (12) these are
positive developments, and GAO looks forward to seeing VBA's plans to
implement these steps; and (13) the implementation of these
recommendations will put VBA in a better position to avoid these types
of problems in the future.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-97-79
TITLE: Veterans Benefits Computer Systems: Risks of VBA's
Year-2000 Efforts
DATE: 05/30/97
SUBJECT: Veterans benefits
Information resources management
Strategic information systems planning
Systems development life cycle
Information systems
Federal agency reorganization
Computer security
Requirements definition
Computer software
Human resources utilization
IDENTIFIER: Software Capability Maturity Model
**************************************************************************
* This file contains an ASCII representation of the text of a GAO *
* report. Delineations within the text indicating chapter titles, *
* headings, and bullets are preserved. Major divisions and subdivisions *
* of the text, such as Chapters, Sections, and Appendixes, are *
* identified by double and single lines. The numbers on the right end *
* of these lines indicate the position of each of the subsections in the *
* document outline. These numbers do NOT correspond with the page *
* numbers of the printed product. *
* *
* No attempt has been made to display graphic images, although figure *
* captions are reproduced. Tables are included, but may not resemble *
* those in the printed version. *
* *
* A printed copy of this report may be obtained from the GAO Document *
* Distribution Facility by calling (202) 512-6000, by faxing your *
* request to (301) 258-4066, or by writing to P.O. Box 6015, *
* Gaithersburg, MD 20884-6015. We are unable to accept electronic orders *
* for printed documents at this time. *
**************************************************************************
Cover
================================================================ COVER
Report to the Chairman, Subcommittee on Oversight and Investigations,
Committee on Veterans' Affairs,
House of Representatives
May 1997
VETERANS BENEFITS COMPUTER SYSTEMS
- RISKS OF VBA'S YEAR-2000 EFFORTS
GAO/AIMD-97-79
Veterans Benefits Computer Systems
(511208)
Abbreviations
=============================================================== ABBREV
OMB - Office of Management and Budget
VA - Department of Veterans Affairs
VBA - Veterans Benefits Administration
Letter
=============================================================== LETTER
B-275674
May 30, 1997
The Honorable Terry Everett
Chairman, Subcommittee on Oversight
and Investigations
Committee on Veterans' Affairs
House of Representatives
Dear Mr. Chairman:
Unless timely corrective action is taken, the Veterans Benefits
Administration (VBA), like other federal agencies, could face
widespread computer systems failures at the turn of the century due
to incorrect information processing relating to dates. In many
systems, the year 2000 will be indistinguishable from 1900; this
could make veterans who are due to receive benefits appear
ineligible. If this happened, issuance of benefits checks that
veterans rely on could be delayed or interrupted.
In response to your September 10, 1996, letter, we conducted a
follow-up review to determine VBA's actions to address management and
technical weaknesses reported in a June 19, 1996, hearing on VBA's
modernization effort. This report discusses our assessment of VBA's
actions to ensure that the year-2000 computing problem will be
adequately addressed. Our review of VBA's actions to address other
management and technical weaknesses will be discussed in a separate
report.
RESULTS IN BRIEF
------------------------------------------------------------ Letter :1
Correcting the year-2000 problem is critical to VBA's mission of
providing benefits and services to veterans and their dependents. If
not corrected, calculations based on incorrect dates could result in
inaccurate and late payment of benefits to veterans, prompting
financial stress to millions across the country. VBA has acted to
address the problem, but can do more. First, the year-2000
management office structure and technical capabilities are
insufficient. Second, key year-2000 readiness assessment
processes--determining the potential severity of the year-2000 impact
on VBA's operations, inventorying its information systems and their
components, and developing contingency plans--have not been
completed. Third, both VBA's initial and revised strategies are
risky in that without sufficient information on the costs or
potential problems associated with its approach to making systems
year-2000 compliant, it cannot make informed choices as to which
systems must be funded to avoid disruptions in service, versus which
can be deferred. Deficiencies in these three areas add risk to an
already difficult challenge.
Addressing these problems will require close and continual top
management attention and leadership. Contributing to the challenge
facing VBA are the loss of key computer personnel, difficulties in
obtaining necessary information from external sources on whether
interfaces and third-party products are year-2000 compliant, and
delays in upgrading systems at VBA data centers. The issue of
whether third-party products are year-2000 compliant is being faced
by other federal agencies as well.
On April 11, 1997, at the conclusion of our review, the Department of
Veterans Affairs' (VA) chief information officer told us that VBA
will (1) revise its year-2000 strategy to focus on converting the
existing noncompliant benefits payment systems rather than replacing
them and (2) acquire contractual support to assist in managing the
year-2000 effort and in making necessary changes. We commend VBA for
these initial steps and also the steps outlined in its May 16, 1997,
comments to us. These are positive developments, and we look forward
to seeing VBA's plans to implement these steps.
In addition, in its comments to us on May 16, 1997, VA concurred with
all 10 recommendations. The implementation of these recommendations
will put VBA in a better position to avoid these types of problems in
the future.
BACKGROUND
------------------------------------------------------------ Letter :2
VA comprises three major components: the Veterans Health
Administration, which provides services through the nation's largest
health care system; the National Cemetery System, which provides
burial services in 113 national cemeteries; and VBA, which provides
nonmedical benefits to veterans and their dependents.
In fiscal year 1996, VBA paid $20 billion in benefits to 10 million
veterans and their dependents. These benefits are grouped into five
major business areas--compensation and pension (the largest),
educational assistance, housing loan guaranty, vocational
rehabilitation and counseling, and insurance. VBA administers its
benefits programs through 58 regional offices. These offices are
supported by three software development centers located at Hines,
Illinois; Austin, Texas; and Philadelphia.
As early as 1985, VBA realized that its computer systems at these
centers were nearing the end of their useful lives and were becoming
difficult and expensive to maintain. To replace its aging computer
systems, VBA developed a three-stage procurement plan to modernize
its hardware and software and better support its business areas and
regional offices. For stage I, VBA awarded a contract in December
1992 to acquire a number of personal computers, local area networks,
minicomputers, and commercial off-the-shelf software for the 58
regional offices. For stage II, VBA awarded a contract in July 1995
to acquire imaging equipment and associated software for its
educational assistance processing sites in Atlanta and St. Louis.
This equipment would scan all documents in the chapter 30\1 education
claims folders. Stage III, which was canceled in 1996, was for
procuring mainframe computers for the Hines and Philadelphia data
centers.
VBA's modernization effort was intended to replace the functions of
the existing network through which benefits are delivered with new
software applications and relational databases\2 to provide enhanced
functionality for users in all of VBA's major businesses. The
original plan was to modernize the compensation and pension area
first, and then the other major business areas. In September 1995,
however, VBA decided to redirect its modernization as a result of a
study prepared by a private contractor, which concluded that VBA's
modernization approach was risky and too large in scope. The current
modernization is limited to replacing and improving existing benefits
payment systems. As one component of this, VBA expects to have an
on-line compensation and pension payment system in place by December
31, 1998. This system is expected to provide the same claims
processing capability as the current benefits delivery network, match
or exceed the current system's responsiveness, be easy to use, and
resolve the year-2000 problem.
Over the years, we have identified many weaknesses in VBA's efforts
to modernize its operations and manage its information technology
resources. For example, as we reported in November 1992, VBA
procurements of hardware were not supported by a defined information
architecture, thereby increasing the risk that it would develop a
system that would not work as intended.\3 Further, in June 1996\4 we
reported and testified, that on the basis of our analysis of VBA's
software development processes, the agency is operating at a level-1
maturity capability,\5 defined as ad hoc and chaotic.
--------------------
\1 Chapter 30 relates to the Montgomery GI bill, which provides
education benefits for veterans on active duty after July 1, 1985.
\2 A relational database is a computer file that stores information
in tables (rows and columns) and conducts searches by using data in
specified columns of a table to find additional data in another
table.
\3 Veterans Benefits: Acquisition of Information Resources for
Modernization Is Premature (GAO/IMTEC-93-6, Nov. 4, 1992).
\4 Software Capability Evaluation: VA's Software Development Process
Is Immature (GAO/AIMD-96-90, June 19, 1996) and Veterans Benefits
Modernization: Management and Technical Weaknesses Must Be Overcome
If Modernization Is To Succeed (GAO/T-AIMD-96-103, June 19, 1996).
\5 A capability maturity model was developed in 1991 by the Software
Engineering Institute (Carnegie Mellon University, Pittsburgh) for
use by organizations wishing to evaluate their capability to
consistently and predictably produce high-quality software. The
Institute's mission is to provide leadership in advancing the state
of the practice of software engineering to improve the quality of
systems that depend on software.
SCOPE AND METHODOLOGY
------------------------------------------------------------ Letter :3
In assessing actions taken by VBA to address the year-2000 problem,
we reviewed and analyzed numerous documents, including VBA's December
13, 1996, Year-2000 Plan; its January 28, 1997, Year-2000 Risk
Assessment; and the Department of Veterans Affairs' January 13, 1997,
Year-2000 Readiness Review. To determine progress made in solving
the year-2000 problem we reviewed and analyzed VBA project plans,
project schedules, and progress reports for the replacement
initiatives identified by agency officials as crucial to solving the
year-2000 problem, as well as project plans and schedules for the
contingency and conversion initiatives. To determine the costs,
benefits, and risks associated with the year-2000 problem, we
reviewed VA's fiscal 1998 budget submission and VBA's January 31,
1997, information resources management support plan. We used our
draft year-2000 assessment guide\6 to assess VBA's readiness to
achieve year-2000 compliance.
In addition, we visited and/or interviewed project teams, including
contractor support, in St. Petersburg, Florida, and Washington,
D.C.; computer personnel at VBA's data centers at Hines and
Philadelphia, and its Austin Systems Development Center to discuss
progress and problems involved with their year-2000 activities. We
also discussed VBA's year-2000 efforts with VBA headquarters
officials in Washington, D.C., plus representatives from VA's Office
of Information Resources Management. We performed our work from
October 1996 through April 1997, in accordance with generally
accepted government auditing standards. The Department of Veterans
Affairs provided detailed comments on a draft of this report. These
comments are an expansion of the Department's initial comments dated
April 22, 1997. They have been incorporated into the report where
appropriate and are included as appendix I.
--------------------
\6 Year 2000 Computing Crisis: An Assessment Guide [exposure draft]
(GAO/AIMD-10.1.14, February 1997).
HIGH RISK OF YEAR-2000 PROBLEMS
CAN BE REDUCED USING STRUCTURED
APPROACH AND RIGOROUS PROGRAM
MANAGEMENT
------------------------------------------------------------ Letter :4
At 12:01 a.m. on January 1, 2000, many computer systems worldwide
could malfunction or produce inaccurate information simply because
the date has changed. Unless corrected, such failures could have a
costly, widespread impact. Within VBA, compensation and pension
systems that relate dates--such as birth or military service--to
benefits could be vulnerable.
The problem is rooted in how dates are recorded and computed. For
the past several decades, systems have typically used two digits to
represent the year--such as "97" for 1997--to save electronic storage
space and reduce operating costs. In such a format, however, 2000 is
indistinguishable from 1900. As an example of the potential impact
of this ambiguity, a veteran born in 1925 and therefore turning 75 in
2000 could be seen as being negative 25 years old (if "now" is
1900)--not even born yet--and hence ineligible for benefits that the
veteran had been receiving.
Correcting this problem will not be easy or inexpensive, and must be
done while such systems continue to operate. Many of the
government's computer systems were developed 20 to 25 years ago, use
a wide array of computer languages, and lack full documentation.
Systems may contain up to several million lines of software code that
must be examined for potential date-format problems.
The enormous challenge involved in correcting these systems is not
primarily technical, however: it is managerial. Agencies' success
or failure will largely be determined by the quality of their program
management and executive leadership. Top agency officials must
understand the importance and urgency of this undertaking, and
communicate this to all employees. The outcome of these efforts will
also depend on the extent to which agencies have institutionalized
key systems-development and program-management practices, and on
their experience with such large-scale software development or
conversion projects. Accordingly, agencies must first assess their
information resources management capabilities and, where necessary,
upgrade them. In so doing, they should consider soliciting the
assistance of other organizations experienced in these endeavors.
To assist agencies with these tasks, we have prepared a draft guide
that discusses the scope of the challenge and offers a structured,
step-by-step approach for reviewing and assessing an agency's
readiness to handle the year-2000 problem.\7 The guide describes in
detail five phases, each of which represents a major year-2000
program activity or segment. These are:
Awareness. This is a critical first step. Although many people
may have heard about a year-2000 problem, they may not know what
it entails or why it matters. For agency personnel, awareness
is imperative. This is also the phase in which the agency team
that will take the lead in correcting the problem is identified.
The team then examines the problem's potential impact, gauges
the adequacy of agency resources, develops a strategy, and
secures strong, visible executive support.
Assessment. The main thrust of this phase is separating
mission-critical systems--which must be converted or
replaced--from important ones that should be converted or
replaced and marginal ones that may be addressed now or
deferred. Since the year-2000 problem is primarily a business
problem, it is essential to assess its likely impact on the
agency's major business functions. Following this, information
systems in each business area should be inventoried and
prioritized; project teams are then established and program
plans devised. Testing strategies must be identified, and
contingency plans developed as well.
Renovation. This phase deals with actual changes--converting,
replacing, or eliminating selected systems and applications. In
so doing, it is important to consider the complex
interdependencies among these. Changes must be consistent
agencywide, and information about them clearly disseminated to
users.
Validation. Here, agencies test, verify, and validate all
converted or replaced systems and applications, ensuring that
they perform as expected. This critical phase may take over a
year and consume up to half of the year-2000 program's budget
and resources. It is essential that agencies satisfy themselves
that their testing procedures are up to the challenge and that
their results can, indeed, be trusted.
Implementation. Deploying and implementing year-2000-compliant
systems and components requires extensive integration and
acceptance testing. And since not all agency systems will be
converted or replaced simultaneously, it may be wise to operate
in a parallel-processing environment for a time, using old and
new systems side-by-side. Such redundancy can act as a
fail-safe mechanism until it is clear that all changed systems
are operating correctly.
--------------------
\7 GAO/AIMD-10.1.14, February 1997.
AWARENESS ACTIONS INITIATED,
BUT MORE CAN BE DONE
------------------------------------------------------------ Letter :5
VBA has initiated actions to address the year-2000 awareness phase,
including an agencywide plan, a year-2000 strategy, and a program
management organization. However, executive management can further
improve upon these actions by addressing deficiencies in the
year-2000 program management office structure and technical and
program management capabilities. It is critical that these
deficiencies be corrected if VBA is to succeed in correcting the
year-2000 problem.
YEAR-2000 ACTIONS HAVE BEEN
INITIATED
---------------------------------------------------------- Letter :5.1
VBA recognizes that the upcoming change of century poses significant
challenges to the agency. In 1991, it conducted an initial analysis
of the year-2000 problem. According to VBA's January 31, 1997,
information resources management support plan, correcting the
year-2000 problem is the agency's number-one priority. A year-2000
charter has been developed, defining the project management
organization. VBA's chief information officer has overall
responsibility for ensuring year-2000 compliance. In addition, a VBA
year-2000 project manager has been assigned, along with site project
coordinators at each of VBA's systems development centers--Hines,
Philadelphia, and Austin. A consultant has also been obtained to
assist in managing the day-to-day responsibilities.
VBA also has developed an agencywide plan for achieving year-2000
compliance, using a multifaceted strategy. The primary focus of this
strategy has been to replace noncompliant systems with newly
developed, compliant systems. In the event the replacement projects
are not implemented in time, VBA has developed and has begun to
implement a contingency plan for the compensation and pension and
educational assistance payment systems to ensure their continued
operation past the year 2000. Another aspect of VBA's strategy is to
convert the existing insurance and debt management systems.
VBA's goal is to have all operating systems, applications and
third-party products (hardware, software, mainframes, minicomputers,
operating systems, and utilities) compliant by November 30, 1998.
This will allow it over 1 full year to test and correct problems, and
to monitor the applications' execution.
VBA'S YEAR-2000 PROGRAM
MANAGEMENT OFFICE STRUCTURE
IS INADEQUATE
---------------------------------------------------------- Letter :5.2
It is essential that agencies appoint a year-2000 program manager and
establish an agency-level program office to manage and coordinate
year-2000 program activities. The problem and solutions involve a
wide range of dependencies among information systems: the need to
(1) centrally develop or acquire conversion and validation standards,
inspection, conversion, and testing tools, (2) coordinate the
conversion of crosscutting information systems and their components,
(3) establish priorities, and (4) reallocate resources as needed.
Although VBA has appointed a year-2000 project manager and has
established a program management office, the functions of this office
do not adequately cover all of VBA's year-2000 activities. According
to the project manager, her management functions are limited to
conversion projects for the compensation and pension and educational
assistance payment systems, and replacement projects for educational
assistance payment systems. She is not overseeing or coordinating
year-2000 activities for any other conversion or replacement project.
As a result, the program management office is not necessarily aware
of year-2000 problems in these other areas, such as the housing loan
guaranty area, which may require the office's attention because they
can adversely affect the agency's ability to provide benefits and
services to veterans.
In addition, no one in VBA's program management office is overseeing
the year-2000 work in the 58 regional offices. For example, VBA's
chief information officer issued a September 16, 1996, memorandum to
area, service and regional office directors requesting that all
regional office and program sponsors develop an inventory of all
locally developed applications and locally acquired third-party
products to determine whether they are year-2000 compliant. These
sponsors do not, however, have to report this information to the
program management office. In contrast to VBA's three systems
development centers, there is no year-2000 site project coordinator
in VBA's regional offices.
TECHNICAL AND PROGRAM
MANAGEMENT DEFICIENCIES
EXIST
---------------------------------------------------------- Letter :5.3
The ability to successfully manage the year-2000 problem will depend
upon the degree to which an agency has institutionalized key systems
development and program management practices, and on its experience
in managing large-scale software conversion or system development
projects. A systems architecture\8 is essential to VBA's plans to
develop compliant payment systems to replace its existing systems.
Leading organizations both in the private sector and in government
use systems architectures to guide mission-critical systems
development and to ensure the appropriate integration of information
systems through common standards.\9 The Congress also recognized the
importance of systems architectures as a means to improve the
efficiency and effectiveness of federal information systems by
enacting the Clinger-Cohen Act of 1996. The act, among other
provisions, requires that department-level chief information officers
develop, maintain, and facilitate integrated systems architectures.
An integrated systems architecture is divided into two principal
components--a logical component and a technical component. The
logical component is essential to ensuring that an agency's
information systems support accomplishing its mission, while the
technical component provides the detailed guidance needed for
developing evolving information systems. The logical component
includes a high-level description of the organization's mission,
functional requirements, information requirements, systems,
information flows among systems, and interfaces between systems. It
defines the organization's current and future missions, concepts of
operations, and interdependencies, such as information flows and
systems interfaces. The purpose of the logical architecture is to
ensure that systems meet the business needs of the organization.
The technical component of the integrated systems architecture
details specific information technology and communications standards
and approaches that will be used to build the systems, including
those that address critical hardware, software, communications, data
management, security, and performance characteristics. The purpose
of the technical architecture is to ensure that systems are
interoperable,\10 function together efficiently, and will be
cost-effective over their life cycle.
VBA has not developed a complete, integrated systems architecture for
its new systems development activities. Specifically, at the logical
architecture level, VBA has not developed or documented a
comprehensive analysis of the information flows among the various
information systems, nor has it performed the systems engineering
analyses needed to define and document--at an acceptable level to
systems developers--the interfaces among the various systems that
must share needed data to perform benefits delivery functions. At
the technical architecture level, VBA lacks several key elements as
well. For example:
VBA has not performed the analysis necessary to define its security
architecture. Without first performing a comprehensive threat
and vulnerability assessment, VBA cannot develop security
controls to prevent the intentional or accidental disclosure,
modification, or destruction of sensitive
information--information that is being processed and transmitted
over communications lines or shared internally among those who
need the data to process benefits claims or produce management
reports.
VBA has not analyzed or developed performance characteristics or
standards. As a result, it does not know what system capacity
will be needed to run its new applications or how processing
must be handled in order to maintain adequate performance.
VBA's systems development teams are making changes to the database
and data elements prior to obtaining the database
administrator's review and approval. This disregard or lack of
knowledge of standard change management processes can result in
redundancy and integrity problems and can increase the risk of
system performance degradation.
VBA's systems development teams were not until recently using a
standard software development language when coding the
applications software. For example, the graphical user
interface software in the new compensation and pension payment
system was being developed in JAM7,\11 while the new educational
assistance payment systems will be developed in Visual Basic.\12
VBA recently decided to make Visual Basic its standard software
development language. As a result, systems previously coded in JAM7
will need to be recoded in Visual Basic.
Along with not institutionalizing key systems development and program
management practices, VBA cannot rely on its software-development
processes. We assessed these processes using the Software
Engineering Institute's software capability maturity model; the
result showed that VBA's software development capability is at an
"ad-hoc and chaotic" level--the lowest level of software development
capability.\13 At this level, VBA cannot reliably develop and
maintain high-quality software on any major project within existing
cost and schedule constraints, placing VBA modernization at
significant risk. In this context, VBA relies solely on the various
capabilities of individuals rather than on an institutional process
that can yield repeatable results. To improve upon its software
development capability, VBA has recently obtained the assistance of
the Software Engineering Institute.
--------------------
\8 An integrated information systems architecture is a blueprint to
guide and constrain the development and evolution of a collection of
related automated information systems.
\9 Executive Guide: Improving Mission Performance Through Strategic
Information Management and Technology--Learning From Leading
Organizations (GAO/AIMD-94-115, May 1994).
\10 Interoperability refers to the ability of a technical and/or
software platform to operate with, or exchange data with, other
technical and software platforms, regardless of vendor or
vendor-specific technical standards.
\11 JAM7 is a commercial, off-the-shelf, 4th-generation software
development tool, designed to be used with relational database
management and transaction processing systems.
\12 Visual Basic is a Windows programming language that is often used
to write user interfaces for client/server applications.
\13 GAO/AIMD-96-90, June 19, 1996.
YEAR-2000 ASSESSMENT NOT YET
COMPLETE
------------------------------------------------------------ Letter :6
In the assessment phase, VBA has made limited progress in determining
whether its information systems and their components are year-2000
compliant. It has begun to develop inventories of its centralized
internal applications, internal/external interfaces, and third-party
products. Also, according to VBA's year-2000 project manager, VBA
has recently developed an overall testing plan. However, key
assessment processes have not been completed. Specifically, VBA has
not (1) assessed the severity of its year-2000 problem, (2) completed
its inventory or assessment of its information systems, interfaces,
and third-party products, or (3) developed contingency plans for all
its payment systems. Failure to address these key processes
increases the risk that VBA will not achieve year-2000 compliance by
January 1 of that year.
VBA HAS NOT ASSESSED
SEVERITY OF YEAR-2000
PROBLEM
---------------------------------------------------------- Letter :6.1
Developing and publishing a high-level assessment of the year-2000
issue provides executive management and staff with a broad overview
of the potential impact the century change could have on the agency.
Such an assessment provides management with valuable information on
which to prioritize the agency's year-2000 activities, as well as a
means of obtaining and publicizing management commitment and support
for necessary year-2000 initiatives.
VBA has performed no assessment of how its major business areas would
be affected if the year-2000 problem is not corrected in time. On
the basis of our discussions with VBA personnel, it is clear that
VBA's ability to deliver benefits and services to veterans could be
compromised if systems are not changed. For example, veterans could
receive inaccurate and/or delayed compensation and pension benefits,
receive debt-collection letters when they do not actually owe money,
cease to receive vocational rehabilitation services, receive
inaccurate insurance benefits, or have foreclosure proceedings
initiated unnecessarily due to erroneous date calculations. These
problems could all arise from the fact that the payment systems for
these major business areas use two digits to represent the year,
rather than four, to denote dates that affect benefits eligibility,
such as date of birth and dates of military service.
INVENTORY AND ASSESSMENT OF
INFORMATION SYSTEMS,
INTERFACES, AND THIRD- PARTY
PRODUCTS ARE INCOMPLETE
---------------------------------------------------------- Letter :6.2
An agencywide inventory of information systems and their components
provides the necessary foundation for detailed year-2000 program
planning. A thorough inventory ensures that all systems are
identified and linked to a specific business area or process, and
that all agencywide, crosscutting systems are considered.
According to its December 1996 year-2000 plan, VBA expected to have
completed its inventories of systems applications, interfaces and
exchanges, and third-party products by September 30, 1996. However,
VBA had completed an inventory only of its software applications at
its three systems development centers by that date. It had not
completed inventories of the agency's internal/external interfaces
and data exchanges or third-party vendors and products. The status
of VBA's inventories and its assessment for year-2000 compliance is
summarized below.
According to VBA's February 17, 1997, inventory, it has 153
applications, consisting of 8,480 modules and 9.1 million lines
of software code. According to VBA, of these applications, 22
are compliant, 20 are to be replaced with new compliant
applications,\14 and 111 are noncompliant. As shown in figure
1, no action has yet been taken to fix, replace, or retire about
one-third of the noncompliant applications.
Figure 1: Status of
Noncompliant VBA Applications
(See figure in printed
edition.)
VBA's inventory of applications does not include local applications
developed by its regional offices. Despite the chief information
officer's request that regional offices and program sponsors develop
an inventory of all locally developed applications, he has said that
such regional applications need not be included in the inventory of
software applications because no mission-critical applications were
locally developed. In our view, however, until each regional office
has developed an inventory of locally developed applications and
provided the year-2000 program management office with a listing of
these applications in terms of their criticality, there is no
assurance that critical applications that require year-2000
compliance do not exist in the regions. According to VA's year-2000
readiness review, VBA cannot adequately predict or plan the impact of
the year-2000 change without a complete inventory of region-developed
applications.
VBA has not completed its inventory of internal/external
interfaces\15 and data exchanges for its information systems.
It has identified 410 interfaces to date, but acknowledges that
more could exist. According to VBA's year-2000 project manager,
VBA plans to complete its inventory of interfaces by June 30,
1997. VBA has begun to assess whether the interfaces and data
exchanges in its inventory contain date information, but it does
not know when this will be completed. VBA also does not know at
this time how it will validate incoming external data, address
invalid data, or handle situations in which no data are received
from the external source. The Office of Management and Budget
(OMB) recently issued guidance recommending a standard date
format for agencies to use when exchanging electronic data with
date information.
VBA has developed an inventory of its third-party products but has
not yet completed its review of these products for year-2000
compliance. The agency currently does not know when this will
be completed because, like other federal agencies, it has had
difficulty obtaining information on year-2000 compliance from
third-party vendors. For example, many vendors have not yet
decided whether they will be able to support their products
beyond 1999. As a result, the VBA year-2000 project manager is
concerned that the agency will not have sufficient time to
purchase and implement year-2000-compliant hardware and software
upgrades to its existing and new systems.
--------------------
\14 These applications currently do not exist. VBA's inventory
includes both existing applications and applications under
development and/or planned.
\15 An example of an external interface is the exchange of disability
compensation information between the Department of Defense and VBA.
Defense currently provides VBA with electronic information on the
amount of disability benefits paid to a veteran by Defense for offset
against the amount paid by VBA to this same veteran. This offset is
necessary because, by law, the veteran cannot be paid twice for the
same disability.
CONTINGENCY PLANS HAVE NOT
BEEN DEVELOPED FOR ALL
CRITICAL SYSTEMS
---------------------------------------------------------- Letter :6.3
Agencies should develop realistic contingency plans--including
development and activation of manual or contract procedures--to
ensure the continuity of its major business processes. Three of
VBA's major business areas--loan guaranty, vocational rehabilitation
and counseling, and insurance--do not have contingency plans. VBA
recognizes that it may have to return to manual processing if
critical systems in these major businesses are not year-2000
compliant. Also, VBA's year-2000 project manager recently informed
us that the agency is now developing a contingency plan for several
of its loan guaranty systems as a result of concerns we identified.
NONCOMPLIANT SYSTEMS:
INADEQUATE ASSESSMENT OF COSTS
AND RISKS PRECLUDES INFORMED
PRIORITIZATION
------------------------------------------------------------ Letter :7
VBA lacks adequate information about the costs and risks associated
with its year-2000 efforts to make informed choices about information
technology priorities. Agencies should prioritize their information
technology projects to make effective use of two vital
resources--people and money. To make informed choices about
information technology priorities, agencies need to assess the costs,
benefits, and risks of competing projects. In some instances,
agencies may have to defer or cancel new systems developments and
allocate freed resources to achieve year-2000 compliance.
VBA has not prioritized its efforts to replace or convert existing
benefits payment systems. Its year-2000 strategy calls for it to
replace most existing systems while simultaneously converting its
existing compensation and pension and educational assistance systems
as a contingency. Since both actions depend upon limited financial
and personnel resources, VBA is at serious risk that it may not be
able to complete either in time.
Similarly, within its group of payment systems, VBA has not ranked
them on the basis of its need for particular functions within a
system, nor has it initiated work on the most important functions
first. And since each system has at least three distinct
parts--on-line, batch, and text--these parts need to be ranked in
order of importance.
Reliable assessments of costs and risks are important prerequisites
for effectively prioritizing projects. In VA's year-2000 readiness
assessment, it was estimated that year-2000 costs for VBA would be
about $20 million for fiscal years 1996 through 1999. However, this
amount only covers the conversion projects, such as the costs to
upgrade the mainframes and operating systems at the Hines and
Philadelphia data centers. It does not include costs to replace
VBA's aging systems with new, compliant payment systems.
VBA'S RISK ASSESSMENT
LIMITED TO CONVERSION
PROJECTS
---------------------------------------------------------- Letter :7.1
VBA has prepared a year-2000 risk assessment identifying six major
risk areas: the need for systems upgrades, lack of personnel
resources, insufficient information on third-party vendors and
products, insufficient time to fix all applications, lack of budget
resources, and insufficient information on interfaces. However,
VBA's January 28, 1997, risk assessment is generally limited to the
risks associated with the projects to convert the existing
compensation and pension and educational assistance payment systems.
It does not discuss specific risks associated with VBA's replacement
projects.
We have concerns about the risks associated with both the conversion
and replacement projects. These include schedule delays, loss of key
personnel, lack of sufficient funding for necessary upgrades, and
data center consolidation issues. These risks are discussed below.
REPLACEMENT PROJECTS MAY
MISS DEADLINE
-------------------------------------------------------- Letter :7.1.1
VBA is at risk of not completing its replacement payment systems--for
compensation and pension, educational assistance, and housing loan
guaranty--before January 1, 2000. One reason, as discussed earlier,
is VBA's lack of a complete, integrated systems architecture.
Another factor contributing to the risk that these three systems will
not be completed on time is the loss of systems control and quality
assurance personnel due to resignations, retirements, and
reassignments. At the Hines systems development center, for example,
6 out of 16 systems control and quality assurance personnel were lost
as a result of resignations and retirements. Failure to replace
these individuals will result in schedule delays during the
validation and testing phase of systems development.
Specifically, for the compensation and pension system, VBA has
already experienced a schedule delay on its replacement project.
According to the project manager, the system will not be ready for
testing in July 1997, as initially scheduled. The project manager is
currently developing a revised schedule for completing the project.
The delay is due largely to the realization that what is being
developed is a stand-alone system rather than an integrated one. Our
analysis shows that additional delays to the project's schedule can
result from VBA's decision to change its software applications
programming language from JAM7 to Visual Basic. According to the
project manager, this change was necessary because most of the
agency's systems development projects are written in Visual Basic.
For educational assistance payments, VBA is also experiencing
schedule delays in developing four new, compliant systems. According
to its December 13, 1996, year-2000 plan, these systems were to be
completed by the summer of 1998. To date, VBA has only started
developing one educational system. This system, scheduled initially
for completion in June 1997, is now 5 months behind schedule because
of delays in contract award and problems in defining data elements.
VBA does not know when the remaining three educational assistance
systems will be implemented because each of these is contingent upon
completion of the previous educational system in the development
sequence. In addition, the system's project manager told us that
completion of the next system depends upon the availability of
funding for contractor support.
Finally, with respect to the housing loan guaranty systems, VBA is
also at risk. Its loan guaranty program uses a number of
interrelated systems to process loans, loan defaults, and property
management. Most of these systems are scheduled to be replaced.\16
However, one key loan system--loan services and claims--has
encountered many systems development problems and is currently about
6 months behind schedule. According to the system's project manager,
phase 1 of this system will now be deployed to one site in July 1997;
phase II of this system would then start. The project manager also
said that phase II was scheduled to be completed by mid-1998;
however, the application will have to be recoded from JAM7 to Visual
Basic, and will not be completed on schedule. Several other loan
systems development activities have either just started or have not
yet begun.
--------------------
\16 These systems are automated loan processing, construction and
valuation, loan service and claims, and expanded lender interface.
CONVERSION PROJECTS MAY
LIKEWISE BE DELAYED
-------------------------------------------------------- Letter :7.1.2
VBA is also at risk that its work to convert its existing
noncompliant payment systems may not be completed in time. This is
primarily because VBA has lost key computer specialists, including
programmers, software quality analysts, and hardware system
specialists, as a result of retirements and financial enticements
offered to employees eligible to retire. For example, the Hines
systems development center lost 20 computer specialists in December
1996 and January 1997, due to resignations and retirements. This
loss in experienced personnel will make it more difficult for VBA to
complete its conversion projects in time.
In addition, many of the remaining staff have been reassigned from
year-2000 work to special projects.\17 As a result, VBA personnel
have reviewed only 57 of 633 modules, or 9 percent, in the
compensation and pension system for compliance.\18
Since VBA's insurance system was essentially upgraded last year
rather than redesigned, its strategy for solving the year-2000
problem for the insurance program has been to convert the existing
system. According to the year-2000 project manager, this effort is
currently on schedule, but delays can occur if additional staff are
lost due to resignations and retirements. And because of
calculations using dates 1 year into the future, the insurance system
must not only be fixed but tested and ready to run by January 1,
1999.
VBA also needs to ensure that its information feeder systems and
crosscutting systems are made year-2000 compliant.\19 One example of
such a system is its beneficiary identification and records locator
system. VBA is in the process of developing a contract for the
year-2000 work on this system. VBA has also begun to recode its
centralized accounts receivable system.
--------------------
\17 According to VBA, these include legislative mandates, such as the
spina bifida benefit to children of Vietnam veterans exposed to Agent
Orange and other herbicides; minimum income for widows, which was
previously provided by the Department of Defense; and a reduction in
the clothing allowance for incarcerated veterans.
\18 The 633 modules relate to 4 compensation and pension
applications.
\19 Feeder systems provide data to one or more systems for
processing, but are not dependent on these systems for their own
operation. For example, a personnel system would provide employee
information needed to process payroll. A crosscutting system
processes, stores, or distributes common information or data across
all business functional areas of an organization. For example, a
decision support system can capture performance information covering
several major business areas.
DATA CENTER CONSOLIDATION
ISSUE
-------------------------------------------------------- Letter :7.1.3
A high-risk area associated with VBA's contingency and replacement
projects has been the issue of data-center consolidation. VBA is
aware that it needs to upgrade the mainframes and operating systems
at its Hines and Philadelphia data centers to run the existing
benefits payment systems. The current mainframes and operating
systems at these locations are not year-2000 compliant, and the
vendors of these systems have informed VBA that they will not support
the current systems. VBA also knows that upgrades are needed for the
minicomputers that will run its new systems. It has not formally
requested upgrades to the mainframes and operating systems at Hines
and Philadelphia, but has discussed this matter with VA's Office of
Information Resources Management.\20
Conversely, VBA has requested upgrades to the minicomputers, but VA
has yet to approve this request. A key factor affecting VA's
approval of both requests was its decision on which hardware
platforms would run the benefits payment systems--the existing and
new systems--and where these platforms would be located. VA and VBA
were to submit a strategy and implementation plan for data-center
consolidation to OMB in July 1996 and December 1996, respectively.
VA decided on March 28, 1997, to terminate consideration of
data-center consolidation, and focus its attention instead on
achieving year-2000 compliance. As a result, VA will approve
upgrades to the mainframes and operating systems at Hines and
Philadelphia. Until the upgraded systems are operational, however,
risks associated with noncompliance will remain.
--------------------
\20 VA's Office of Information Resources Management must approve all
VBA procurements over $250,000.
RECENT DEVELOPMENTS ARE
ENCOURAGING
------------------------------------------------------------ Letter :8
We met with VA's and VBA's chief information officers on March 27,
1997, to brief them on the results of our review. At that time we
expressed concern that VBA may not be able to complete its year-2000
efforts in time. In response to our concerns, VA's chief information
officer informed us on April 11, 1997, that VBA will redirect its
year-2000 strategy by focusing on converting the existing benefits
payment systems, rather than on replacing the noncompliant systems.
He also stated that VA has established an oversight committee
consisting of one VBA executive, a senior manager from VA's Office of
Information Resources Management, and an independent contractor, to
monitor and evaluate the progress of VBA's year-2000 effort. This
contractor will assess the status of code conversion and supplement
the recoding work currently done by VBA staff. The contractor is to
issue a report in August 1997, along with an action plan and a
proposal for the level of effort required to complete year-2000
recoding activities in December 1998.
We are encouraged by this recent development. These actions should
help VBA achieve year-2000 compliance. We will continue to evaluate
VBA's plans and strategies for how this will be accomplished.
CONCLUSIONS
------------------------------------------------------------ Letter :9
Correcting the year-2000 computing problem is crucial if VBA is to be
able to provide uninterrupted benefits and services to veterans.
This will not be easy, and will require a proactive strategy. VBA
will not be in a position to make informed decisions on the best use
of limited personnel and financial resources until it completes the
inventory and assessment of its information systems and their
components. Once this has been accomplished, a reallocation of VBA's
resources toward completing the conversion projects may be necessary,
and the development of contingency plans for all critical
noncompliant information systems will be essential. Making these
goals a reality will necessitate a stronger project management office
structure for VBA's year-2000 compliance activities, along with
improved technical and program management capabilities.
RECOMMENDATIONS TO THE
SECRETARY OF VETERANS AFFAIRS
----------------------------------------------------------- Letter :10
In light of the serious risks associated with VBA's year-2000
activities, we recommend that the Secretary of Veterans Affairs
direct and ensure that VBA's acting under secretary for benefits, in
conjunction with VBA's chief information officer,
strengthen VBA's year-2000 program management office by assigning
this office oversight and coordination responsibilities for all
year-2000 activities, including both system conversion and
replacement projects in the three systems development centers,
the central office, and the regional offices;
develop a complete, integrated systems architecture for its new
systems development activities, including a security
architecture, performance characteristics and standards, and
change management policy;
assess how its major business areas would be affected if the
year-2000 problem is not corrected in time and use the results
of this assessment to help prioritize the agency's year-2000
activities, as well as a means of obtaining and publicizing
management commitment and support for necessary year-2000
initiatives;
complete inventories of all information systems and their
components, including data interfaces and third-party products
by June 30, 1997;
complete an analysis to determine whether VBA's internal
applications, interfaces, and third-party products are
compliant, and develop a plan for addressing them, by July 31,
1997;
assess the cost, benefits, and risks of competing information
technology projects and prioritize them to make effective use of
limited staff and monetary resources, including deferring or
canceling new systems developments and reallocating the freed
resources to achieving year-2000 compliance;
assess the agency's personnel resource needs for achieving
year-2000 compliance, and then develop a plan for obtaining
these resources;
develop a risk assessment, by June 30, 1997, that discusses the
risks associated with each year-2000 project and its related
costs;
develop a schedule for replacing and/or converting all year-2000
projects by July 31, 1997; and
develop a year-2000 contingency plan for all critical information
systems, including development and activation of manual or
contract procedures.
AGENCY COMMENTS AND OUR
EVALUATION
----------------------------------------------------------- Letter :11
In commenting on a draft of this report, the Department of Veterans
Affairs concurred with all 10 of our recommendations. VA stated that
it considers successful resolution of VBA's year-2000 challenges to
be an overriding goal for VA and is redirecting all necessary
resources to anticipate and resolve any problems related to the
year-2000 issue.
In addition, VA stated that it had several serious concerns with our
draft report. It believed that we did not identify all its
accomplishments, and that our report contained inaccuracies. VA
stated that VBA has made substantial progress in resolving many of
the deficiencies mentioned in our draft report, including (1)
redirecting funds to support an independent and impartial contractor
to oversee the year-2000 program, (2) establishing an oversight
office, with contractor support, to monitor and evaluate VBA's
year-2000 effort, (3) relieving VBA's year-2000 project manager of
non-year-2000 duties to devote full attention to year-2000
activities, and (4) assessing the possible impact of deferring or
canceling new systems developments to free resources to achieve
year-2000 compliance. We are encouraged by these recently stated
actions by VBA and look forward to seeing VBA's plans to implement
them.
VA also stated that VBA completed (1) a review of its year-2000
status in 1991, (2) an inventory of information systems, and (3)
contingency plans for all payment applications. Our review showed
otherwise. We found that VBA's 1991 assessment of its year-2000
status contained no milestones or discussion of cost and risk
information for achieving year-2000 compliance. Also, as stated in
our report, VBA's inventory of information systems applications does
not include local applications developed by VBA's regional offices.
We also noted that, according to VA's year-2000 readiness review, VBA
cannot adequately predict or plan the impact of the year-2000 change
without a complete inventory of region-developed applications.
Similarly, while VA stated that VBA has contingency plans for all
payment systems, we found that three of VBA's major business
areas--loan guaranty, vocational rehabilitation and counseling, and
insurance--do not have contingency plans. VBA's year-2000 project
manager recently informed us that the agency is now developing a
contingency plan for several of its loan guaranty systems as a result
of concerns we identified.
Another major concern expressed by VA with our draft report is the
extensive reference to our draft year-2000 assessment guide. VA
indicated that we used this document as a rigid audit guide in
reviewing VBA's year-2000 effort. VA believes that VBA is meeting
the spirit of our assessment guide and the best practices developed
by the Governmentwide CIO Council Year 2000 Subcommittee. Our
year-2000 assessment guide provides agencies with a structured,
step-by-step approach for reviewing and assessing an agency's
readiness to handle the year-2000 problem. It draws on the work of
the Best Practices Subcommittee of the Interagency Year 2000
Committee, and incorporates guidance and practices identified by
leading organizations in the information technology industry. We
welcome any comments from VA on the content of our guide. Our guide
was released in February 1997 as an exposure draft and we plan to
finalize it this summer. While we used the guide to assess VBA's
readiness to achieve year-2000 compliance, our work in this area
preceded its February 1997 issuance, as evident in our June 19, 1996,
testimony on VBA modernization.
VA stated that our draft report mischaracterized the nature and
magnitude of VBA's year-2000 situation by inappropriately
interchanging the terms "systems" and "applications". We have
amended our report to reflect the use of the term "applications"
rather than "systems" when discussing VBA's inventory. However, we
have appropriately used the term "systems" in our report when
discussing current and planned mission-critical systems for each of
VBA's major business areas.
VA also stated that our report fails to balance the discussion of
deficiencies with recent developments in these areas. VA is
concerned that our report may unnecessarily alarm veterans without
the benefit of knowledge about VBA's year-2000 accomplishments.
Specifically, VA was concerned about our characterization of VBA's
ability to provide benefits and services to veterans if the year-2000
problem is not corrected. On the basis of our discussions with VBA's
chief information officer and project managers, as well as our review
of VBA year-2000 documents, we believe that VBA's ability to deliver
benefits and services to veterans could well be adversely affected if
the year-2000 problem is not solved. For example, in the vocational
rehabilitation and counseling area, benefits payments could be
inaccurate, delayed, or terminated due to incorrect processing of
date-sensitive information. In the housing loan guaranty area,
veterans who are delinquent in making payments on their guaranteed
loans could have foreclosure proceedings initiated by erroneous date
calculations. These are accurate and fair examples of what could
happen if the year-2000 problem is not corrected. We are not trying
to unnecessarily alarm veterans with these examples. Rather, we are
seeking to raise these issues early enough for VBA to ensure no
disruptions of services. Without early action, VBA will have to take
extraordinary efforts to avoid disruption of services. These efforts
will likely prove very costly, diverting resources from other
services, and some level of impact on service delivery may be
unavoidable.
Lastly, VA offered some specific comments directed to particular
language in the draft report. These comments have been incorporated
into the report where appropriate, and are included in appendix I.
--------------------------------------------------------- Letter :11.1
As agreed with your office, unless you publicly announce the contents
of this report earlier, we will not distribute it until 30 days from
its date. At that time, we will send copies to the Ranking Minority
Member of the Subcommittee on Oversight and Investigations, House
Committee on Veterans' Affairs, and the Chairman and Ranking Minority
Member of the Subcommittee on Benefits, House Committee on Veterans'
Affairs. We will also provide copies to the Chairmen and Ranking
Minority Members of the House and Senate Committees on Veterans'
Affairs, the House and Senate Committees on Appropriations, the
Secretary of Veterans Affairs, and the Director of the Office of
Management and Budget. Copies will also be made available to other
parties upon request. Please contact me at (202) 512-6253 or by
e-mail at willemssenj.aimd@gao.gov if you have any questions
concerning this report. Major contributors to this report are listed
in appendix II.
Sincerely yours,
Joel C. Willemssen
Director, Information Resources Management
(See figure in printed edition.)Appendix I
COMMENTS FROM THE DEPARTMENT OF
VETERANS AFFAIRS
============================================================== Letter
See comment 1.
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
See comment 2.
See comment 3.
See comment 4.
See comment 5.
See comment 1.
See comment 6.
See comment 7.
See comment 8.
See comment 1.
(See figure in printed edition.)
Now on p. 8.
See comment 9.
See comment 10.
See comment 11.
See comment 12.
See comment 11.
See comment 12.
See comment 13.
See comment 14.
(See figure in printed edition.)
See comment 15.
See comment 7.
See comment 2.
See comments 3 and 9.
See comment 16.
See comment 17.
See comment 18.
See comment 19.
The following are GAO's comments on the Department of Veterans
Affairs' letter dated May 16, 1997.
GAO COMMENTS
1. Discussed in agency comments section of report.
2. No change to report needed. As stated in our report, VBA has not
completed key year-2000 readiness assessment processes.
Specifically, VBA has not performed an assessment of how its major
business areas would be affected if the year-2000 problem is not
corrected in time. Similarly, Decision Systems Technology, Inc.'s
Office of Information Resources Management Readiness Review did not
assess how VBA's major business areas would be affected if the
year-2000 problem is not corrected. For example, veterans could
receive inaccurate and/or delayed compensation and pension benefits
or receive debt-collection letters when they do not actually owe
money. In addition, VBA's inventory of systems applications is
incomplete because it does not include locally developed
applications. Lastly, VBA has not developed contingency plans for
three of its major business areas--loan guaranty, vocational
rehabilitation and counseling, and insurance.
3. VBA's initial strategy of replacing and/or converting existing
noncompliant benefits payment systems was risky. As stated in our
report, VBA's strategy did not contain sufficient information on the
costs or potential problems associated with its approach to making
its systems year-2000 compliant. We have acknowledged in this report
that VBA recently redirected its year-2000 strategy by focusing on
converting the existing noncompliant benefits payment systems rather
than replacing them, and that this effort is expected to be completed
in December 1998. In light of these developments, VBA must
reevaluate the costs and risks associated with its new strategy. The
results of this evaluation are especially important since VBA has
decided only to exclude replacement of noncompliant benefits payment
systems from its year-2000 strategy rather than discontinue these
efforts. As a result, VBA's new year-2000 strategy and replacement
project effort continue to be dependent upon limited financial and
personnel resources.
4. Report changed to add "as with other federal agencies."
5. Report changed to include reference to VBA's 1991 year-2000
study.
6. Report changed to include "draft guide."
7. No change to report needed. See Recent Developments section of
report.
8. Report changed. See Recent Developments section of report.
9. No change to report needed. The report section relating to VBA's
"technical and program management deficiencies" was a critical part
of our analysis of VBA's initial strategy for correcting its
year-2000 problem. Although VBA recently decided to make year-2000
changes to existing systems its top priority and to no longer rely on
replacement of the noncompliant systems as a year-2000 solution, this
does not take away the fact that these deficiencies exist, and VBA
continues to devote limited financial and personnel resources to the
replacement projects.
10. Report changed to include VBA's 1991 year-2000 study. The
report already noted that VBA has begun to develop inventories of its
systems applications, internal/external interfaces, and third-party
products. However, these inventories were not completed by the end
of our audit work on April 11, 1997. Also, as stated in our report,
until each regional office has developed an inventory of regional
applications and provided the year-2000 program management office
with a listing of these applications in terms of their criticality,
there is no assurance that critical applications that require
year-2000 compliance do not exist in the regions.
11. Report changed to replace "systems" with "applications."
12. No change to report needed. According to the chart in our draft
and final report, the 32 noncompliant applications have not been
addressed (fixed, replaced, or retired) because 10 are awaiting
resources, 11 are awaiting completion of an analysis, and 11 have not
been scheduled for correction.
13. Report changed to delete the word "internal."
14. Report changed to reflect VBA's plans to complete its inventory
of interfaces by June 30, 1997, and that "VBA has begun to assess
whether its data exchange interfaces contain date information."
15. Report changed to reflect issuance of OMB's guidance
recommending a standard date format for agencies to use when
exchanging electronic data with date information. We encourage VBA
to make appropriate use of the OMB guidance, since VA did not
indicate in its comments whether VBA plans to use this guidance.
16. Report changed to replace the word "assessed" with "reviewed"
and to explain how the 633 modules in the compensation and pension
system relate to 4 of the 153 applications.
17. Report changed to explain why VBA did not perform year-2000
repairs to its insurance application.
18. Report changed to define "feeder" and "crosscutting" systems.
19. Report changed to add "support the current system."
MAJOR CONTRIBUTORS TO THIS REPORT
========================================================== Appendix II
ACCOUNTING AND INFORMATION
MANAGEMENT DIVISION, WASHINGTON,
D.C.
Helen Lew, Assistant Director
Leonard J. Latham, Technical Assistant Director
Mary J. Dorsey, Senior Information Systems Analyst
Tonia L. Johnson, Senior Information Systems Analyst
Michael P. Fruitman, Communications Analyst
*** End of document. ***