IRS' Year 2000 Efforts: Business Continuity Planning Needed for Potential
Year 2000 System Failures (Letter Report, 06/15/98, GAO/GGD-98-138).

GAO reviewed the Internal Revenue Service's (IRS) efforts to have its
information systems function correctly when processing dates beyond
December 31, 1999, focusing on: (1) IRS' progress in converting its
systems according to the guidelines in GAO's year 2000 assessment guide;
(2) the risks IRS faces to completing the year 2000 effort on time; and
(3) risks to the continuity of IRS operations in the event of year
2000-induced system failures.

GAO noted that: (1) according to IRS, before January 1999, it needs to
complete 12 steps of its 14-step process for converting: (a) the
applications for its existing systems; (b) the telecommunications
networks; and (c) systems software and hardware for mainframes,
minicomputers/file servers, and personal computers; (2) in addition,
before January 1999, IRS needs to: (a) ensure that external data
exchanges will be year 2000 compliant; (b) implement the Integrated
Submission and Remittance Processing System and, at a minimum, the year
2000 portions of mainframe consolidation; and (c) modify application
software to implement tax law changes for the 1999 and 2000 filing
seasons; (3) if these efforts are not completed, IRS' tax processing and
collection systems may fail to operate or may generate millions of
erroneous tax notices, refunds, interest calculations, and account
adjustments; (4) for the conversion of its existing systems, IRS has
made more progress on its applications than on its information systems
infrastructure; (5) specifically, as of April 24, 1998, IRS reported
that it had completed the first 12 steps of its 14-step conversion
process for applications for about 46 percent of the 127 systems it has
deemed as mission-critical; (6) IRS expects to convert the applications
for the remaining 54 percent of the mission-critical systems by January
1999; (7) the two major systems replacement efforts, which are also
expected to follow IRS' 14-step conversion process, are experiencing
some schedule slippages; (8) IRS officials said they expect to complete
the year 2000 portions of the mainframe consolidation by the original
completion date of December 1998; (9) GAO identified two risk areas for
IRS' year 2000 effort: (a) the lack of an integrated master conversion
and replacement schedule; and (b) a limited approach to contingency
planning; (10) since GAO's briefing, IRS has decided to have a
contractor develop an integrated schedule of its year 2000-related
efforts, including making all of the necessary tax law changes for 1999;
(11) IRS officials said they hope to have a baseline, master integrated
schedule in June 1998; and (12) in part, due to IRS officials' concerns
that the same resources that are doing year 2000 conversion work would
be needed to do contingency planning, IRS officials decided to develop a
process that would minimize the number of contingency plans that would
have to be developed.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  GGD-98-138
     TITLE:  IRS' Year 2000 Efforts: Business Continuity Planning Needed 
             for Potential Year 2000 System Failures
      DATE:  06/15/98
   SUBJECT:  Data integrity
             Computer software verification and validation
             Computer software
             Information resources management
             Tax administration systems
             Strategic information systems planning
             Systems conversions
IDENTIFIER:  IRS Year 2000 Conversion Project
             IRS Integrated Submission and Remittance Processing System
             
******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************


Cover
================================================================ COVER


Report to the Chairman, Subcommittee on Oversight, Committee on Ways
and Means, House of Representatives

June 1998

IRS' YEAR 2000 EFFORTS - BUSINESS
CONTINUITY PLANNING NEEDED FOR
POTENTIAL YEAR 2000 SYSTEM
FAILURES

GAO/GGD-98-138

IRS' Year 2000 Efforts

(268755)


Abbreviations
=============================================================== ABBREV

  CIO - Chief Information Officer
  DIS - Distributed Input System
  FMS - Financial Management Service
  IRS - Internal Revenue Service
  ISRP - Integrated Submission and Remittance Processing System
  RPS - Remittance Processing System
  SAT - Systems Acceptance Testing
  SSA - Social Security Administration

Letter
=============================================================== LETTER


B-275431

June 15, 1998

The Honorable Nancy L.  Johnson
Chairman, Subcommittee on Oversight
Committee on Ways and Means
House of Representatives

Dear Chairman Johnson: 

This report summarizes the information we provided to your office on
the results of our work to date on the Internal Revenue Service's
(IRS) efforts to have its information systems function correctly when
processing dates beyond December 31, 1999.  These IRS efforts are
necessary because the IRS' information systems, many of which are
over 25 years old, were programmed to read two-digit date fields. 
Therefore, if unchanged, beginning January 1, 2000, these systems
would interpret 2000 as 1900 and thus would seriously jeopardize
critical tax processing and collection operations.  Although 2000 is
less than 2 years in the future, IRS has less than 1 year to complete
all of the work that it believes is necessary to reach its goal of
having all of its systems Year 2000 compliant by January 1999.  IRS
established this goal to help ensure that it can accurately process
tax returns and other tax data through multiple systems by the start
of the 1999 filing season. 

Our objectives were to (1) assess IRS' progress in converting its
systems according to the guidelines in our Year 2000 assessment
guide,\1 (2) identify the risks IRS faces to completing the Year 2000
effort on time, and (3) identify risks to the continuity of IRS
operations in the event of Year 2000-induced system failures. 


--------------------
\1 Year 2000 Computing Crisis:  An Assessment Guide
(GAO/AIMD-10.1.14, Sept.  1997). 


   BACKGROUND
------------------------------------------------------------ Letter :1

The enormous challenge involved in making information systems Year
2000 compliant is managerial as well as technical.  Agencies' success
or failure will largely be determined by the quality of their program
management and executive leadership.  The outcome of these efforts
will also depend on the extent to which agencies have
institutionalized key systems development and program management
practices, as well as on their ability to execute large-scale
software development or conversion projects. 

To assist agencies with these tasks, our Year 2000 assessment guide
discusses the scope of these challenges and offers a structured,
step-by-step approach for reviewing and assessing an agency's
readiness to handle the Year 2000 problem.  The assessment guide
states that the Year 2000 program should be managed as a single,
large information systems project.  The assessment guide describes in
detail the five phases of a Year 2000 conversion process (i.e.,
awareness, assessment, renovation, validation, and implementation). 
Each of these phases represents a major Year 2000 program activity or
segment.  To successfully address the Year 2000 problem, effective
program and project management is required for all five phases. 
Appendix I contains a description of these phases. 

To make its information systems Year 2000 compliant, IRS must (1)
convert existing systems by modifying application software and data
and upgrading hardware and systems software, if needed; (2) replace
systems if correcting them is not cost-beneficial or technically
feasible; or (3) retire systems if they will not be needed by 2000. 

IRS' Chief Information Officer (CIO) established several parallel
efforts to help ensure that IRS achieves Year 2000 compliance by
January 1999.  These efforts include creating the Century Date Change
Project Office, which is responsible for coordinating the conversion
of most existing information systems that can be made Year 2000
compliant as well as ensuring that all systems are converted in
accordance with the same standards.  The Century Date Change Project
Office adapted our Year 2000 conversion model phases and established
a 14-step process to track the progress of its Year 2000 conversion
efforts.  Some of the steps involved in converting existing systems
include (1) converting applications; (2) upgrading hardware and/or
systems software for mainframes, minicomputers/file servers, and
personal computers; (3) upgrading telecommunications networks; and
(4) ensuring that external data exchanges are Year 2000 compliant. 

The other parallel Year 2000 efforts are 2 major replacement efforts: 
(1) the replacement of the Distributed Input System (DIS) and the
Remittance Processing System (RPS) with the Integrated Submission and
Remittance Processing (ISRP) system and (2) the consolidation of the
mainframe computer processing operations at 10 service centers to 2
computing centers.  IRS personnel use DIS to input taxpayer data and
RPS to input remittance data.  According to IRS, these systems are
old, and it is not cost-beneficial to make them Year 2000 compliant. 
Therefore, IRS decided to replace DIS and RPS with ISRP.  A two-phase
pilot of ISRP is under way during 1998 at IRS' Austin Service Center. 
Nationwide implementation is scheduled for January 1999. 

As a part of its mainframe consolidation effort, IRS is to (1)
replace and/or upgrade service center mainframe hardware, systems
software, and telecommunications infrastructure; (2) replace about
16,000 terminals that support frontline customer service and
compliance operations; and (3) replace the communication replacement
system that provides security functions for on-line taxpayer account
databases.  Replacements of the terminals and the communication
replacement system are critical to IRS' achieving Year 2000
compliance. 

IRS is undertaking the non-Year 2000 aspects of mainframe
consolidation because it concluded that consolidation would

  -- satisfy the Office of Management and Budget's Bulletin 96-02,
     which directs agencies to consolidate information processing
     centers;

  -- be consistent with IRS' planned modernization architecture; and

  -- save an estimated $356 to $500 million from fiscal years 1997
     through 2003. 

IRS' original mainframe consolidation schedule called for moving
mainframe computer processing operations and the communication
replacement system from 10 service centers to 2 computing centers
between December 1997 and December 1998.  The mainframe consolidation
project is to provide the hardware, systems software, and
telecommunications infrastructure for 40 mission-critical systems
whose application software is being converted under the direction of
the Century Date Change Project Office. 


   RESULTS IN BRIEF
------------------------------------------------------------ Letter :2

According to IRS, before January 1999, it needs to complete 12 steps
of its 14-step process for converting (1) the applications for its
existing systems; (2) telecommunications networks; and (3) systems
software and/or hardware for mainframes, minicomputers/file servers,
and personal computers.  In addition, before January 1999, IRS needs
to (1) ensure that external data exchanges will be Year 2000
compliant; (2) implement ISRP and, at a minimum, the Year 2000
portions of mainframe consolidation; and (3) modify application
software to implement tax law changes for the 1999 and 2000 filing
seasons.  If these efforts are not completed, IRS' tax processing and
collection systems may fail to operate or may generate millions of
erroneous tax notices, refunds, interest calculations, and account
adjustments. 

For the conversion of its existing systems, IRS has made more
progress on its applications than on its information systems
infrastructure.  Specifically, as of April 24, 1998, IRS reported
that it had completed the first 12 steps of its 14-step conversion
process for applications for about 46 percent (59 systems) of the 127
systems it has deemed as mission-critical.  IRS expects to convert
the applications for the remaining 54 percent (68 systems) of the
mission-critical systems by January 1999.  IRS has completed its
assessment of the hardware and systems software for its mainframe
computers.  Conversion efforts for other infrastructure
areas--hardware and systems software for minicomputers/file servers
and personal computers, telecommunications networks, and external
data exchanges--are, for the most part, in the assessment phase. 
According to IRS, of these areas, telecommunications networks will
likely present the most significant conversion challenge and may be
at the highest risk for not being completed by January 1999. 

The two major systems replacement efforts, which are also expected to
follow IRS' 14-step conversion process, are experiencing some
schedule slippages.  For example, the delivery of certain software
for ISRP has been delayed from April 1998 to June 1998, thereby
leaving less time for testing.  Despite this delay, IRS officials
believe ISRP will meet its implementation schedule.  IRS has also
revised its schedule for completing mainframe consolidation because
of field office concerns about the ambitious schedule and the pending
expanded business requirements.  IRS plans to delay the consolidation
of data processing operations for five service centers from 1998
until after June 1999.  IRS officials said they expect to complete
the Year 2000 portions of the mainframe consolidation (i.e., terminal
replacement and the communication replacement system) by the original
completion date of December 1998.  However, according to IRS' weekly
status reports on mainframe consolidation, the communication
replacement system has been experiencing some difficulties and is
somewhat behind its original schedule for system testing. 

We identified two risk areas for IRS' Year 2000 effort during our
January 1998 briefing to your office:  (1) the lack of an integrated
master conversion and replacement schedule and (2) a limited approach
to contingency planning.  A master conversion and replacement
schedule, according to our Year 2000 assessment guide, should be a
part of an agency's Year 2000 program plan.  This schedule could be
used to track the progress of concurrent and interdependent projects
that must be completed for the agency's systems to function correctly
when processing dates beyond December 31, 1999.  In 1998, IRS has a
host of activities that it must complete concurrently so that its
systems will be able to function correctly in 2000.  Managing the
interdependencies of these activities is critical to help IRS ensure
the timely completion of its Year 2000 effort. 

A master conversion and replacement schedule could (1) establish the
sequential relationships between the tasks associated with the Year
2000 conversion and replacement activities, (2) identify how much a
task can slip without affecting other tasks or the overall Year 2000
effort, (3) help determine whether programming and testing resources
are likely to be available when needed, and (4) provide a tool for
prioritizing and assigning programming and testing resources that are
essential to the success of all Year 2000 efforts in the most
efficient manner.  Since our briefing, IRS has decided to have a
contractor develop an integrated schedule of its Year 2000-related
efforts, including making all of the necessary tax law changes for
1999.  IRS officials said they hope to have a baseline, master
integrated schedule in June 1998.\2

Contingency planning was the second risk area we identified during
our January 1998 briefing.  In part, due to IRS officials' concerns
that the same resources that are doing Year 2000 conversion work
would be needed to do contingency planning, IRS officials decided to
develop a process that would minimize the number of contingency plans
that would have to be developed.  Accordingly, IRS' contingency
management calls for developing contingency plans only for those
business functions or processes that are supported by application
software projects that are at risk of not being made Year 2000
compliant on schedule.  Therefore, IRS' contingency management plan
does not address the likelihood that information systems that are
converted on schedule may still experience system failures.  As a
result, IRS' approach falls short of what we believe is needed to
help ensure the continuity of IRS' core business processes in the
event of Year 2000-induced system failures. 


--------------------
\2 IRS officials said this schedule is to be available for the
Commissioner's June 1998 executive steering committee meeting on Year
2000.  That meeting is scheduled for June 11, 1998, which is after
the date that this report was sent to publishing. 


   IRS' YEAR 2000 EFFORTS ARE
   EXPERIENCING SOME DELAYS
------------------------------------------------------------ Letter :3

IRS is experiencing delays in completing conversion efforts for its
existing systems and major systems replacement efforts.  IRS has made
the most progress in converting its applications for the systems it
has deemed mission-critical.  Conversion efforts for systems software
and hardware, telecommunications networks, and external data
exchanges are still in the initial steps of IRS' 14-step conversion
process.  The completion schedule for mainframe consolidation, with
the exception of the Year 2000 critical aspects, has been extended
beyond December 1998. 

Table 1 shows how IRS has allocated each of the 14 steps in its
conversion process to our Year 2000 assessment, renovation,
validation, and implementation phases. 



                                Table 1
                
                   IRS' 14-Step Conversion Process as
                 Mapped to the GAO Year 2000 Conversion
                    Model's Assessment, Renovation,
                 Validation, and Implementation Phases

                                      IRS' 14-step conversion process
                                     ---------------------------------
GAO Year 2000 Conversion Model       Ste
phase                                p    Activity
-----------------------------------  ---  ----------------------------
Assessment                           1.   Requirements Definition

                                     2.   Requirements Response

Renovation                           3.   Year 2000 Impact Analysis

                                     4.   Year 2000 Source Code
                                          Compliance Form

                                     5.   Documentation Transmittal to
                                          Systems Acceptance Testing
                                          (SAT)

Validation                           6.   Unit Test Process Checklist

                                     7.   Compatibility Testing

                                     8.   Program Transmittal to SAT

                                     9.   SAT One-Third Complete

                                     10.  SAT Two-Thirds Complete

                                     11.  SAT End-of-Test Status
                                          Report

Implementation                       12.  Production Transmittal/
                                          Implementation

Validation\a                         13.  Program Level Certification

                                     14.  Systems Level
                                          Certification\b
----------------------------------------------------------------------
\a IRS has adapted our Year 2000 Conversion Model to include a
validation step to follow the implementation phase.  Under our model,
IRS' step 13 would be considered part of the validation phase (before
the implementation phase) and step 14 would be considered part of the
implementation phase. 

\b The Systems Level Certification includes an end-to-end test of
certain interlocking applications that need to exchange data to
perform their mission-critical tasks.  The test is designed to help
assure IRS that these applications are correctly performing all date
computations using data and system date clocks with January 1, 2000,
dates or later.  This test is scheduled to begin in January 1999. 

Source:  IRS' report to Congress on the status of its Year 2000
efforts as of October 1, 1997. 

Much of IRS' early Year 2000 efforts in 1996 focused on the awareness
and assessment phases of the applications for existing information
systems controlled by the CIO.\3 In May 1997, IRS began assessing the
date dependencies of applications for information systems that were
controlled by either field offices or business functional areas
(hereafter referred to as field/customer systems).  As a result of
the CIO and field/customer system assessments that were completed as
of March 31, 1998, IRS had identified 127 mission-critical systems,
including 7 telecommunications systems. 

As of April 24, 1998, IRS reported that it had completed the first 12
steps of its 14-step conversion process on applications for about 46
percent (59 systems) of its 127 mission-critical systems.  In doing
so, IRS fell short of its goal of having the applications for 66
systems converted by January 31, 1998.  IRS' schedule calls for
completing the first 12 steps for the remaining 54 percent (68
systems) of the mission-critical systems by January 1999.  IRS
officials said that they believe they are on track for meeting that
goal. 

IRS is still in the initial steps of its 14-step conversion process
for most of its systems software, hardware, and telecommunications
network components.  IRS is also still in the initial stages of
converting its external data exchanges.  Appendix II provides
additional information on the status of the conversion process for
each of these areas.  Of these infrastructure areas, according to
IRS, telecommunications networks present the most significant
conversion challenge and may be at the highest risk for not being
done by January 1999.  According to IRS, the capability to exchange
information, both voice and data, between various computer systems is
the backbone of IRS' ability to perform all of its tax processing and
customer service functions. 

IRS uses a telecommunications network that is supported through the
Department of the Treasury and additional networks that are unique to
IRS.  As of March 10, 1998, IRS had an inventory of the components
that are included in Treasury's network and was verifying a
preliminary inventory of the components in the networks unique to
IRS.  At the time of our review, a contractor was doing a risk
assessment to help develop a conversion schedule so that the most
important work would be scheduled first to minimize adverse impacts
if IRS is not able to complete all of its telecommunications work by
January 1999. 

IRS' systems replacement efforts (i.e., ISRP and mainframe
consolidation) are experiencing some delays.  For example, certain
ISRP software development that was to be completed in April 1998 is
now scheduled to be done by June 16, 1998.  As a result, the time
available for testing before the start of the second phase of the
pilot has been reduced.  ISRP project office officials still
anticipate that ISRP will be implemented nationwide by December 1998. 
The completion schedule for consolidating the data processing portion
of service center operations has been extended from December 1998
until after June 1999.  According to IRS officials, the need for this
extension stems from numerous factors, including field office
concerns about the ambitious schedule and expanded business
requirements for security, disaster recovery, and testing.  At the
time we were finalizing this report, IRS officials said they were
assessing various technical alternatives for meeting the expanded
business requirements.  They said they expect a revised business case
and budget estimates that reflect the impact of both the schedule and
requirements changes to be completed in June 1998.  IRS officials
said they expect to complete the Year 2000 portions of mainframe
consolidation (i.e., terminal replacement and the communication
replacement system) by the original completion date of December 1998. 
However, the communication replacement system has been experiencing
some difficulties and is somewhat behind its original schedule for
system testing. 


--------------------
\3 CIO-controlled systems are generally large, mainframe-based tax
processing systems.  Field or business functional area systems are
smaller, more specialized systems that run on a variety of platforms. 


   IRS IS TAKING ACTION TO DEVELOP
   A MASTER SCHEDULE FOR
   COMPLETING INTERRELATED YEAR
   2000 TASKS
------------------------------------------------------------ Letter :4

In our briefing to your office, we said that IRS' ability to meet
future milestones was at increased risk because IRS lacked a master
schedule showing the relationships and interdependencies among the
many Year 2000 efforts that must be completed in 1998.  According to
our assessment guide, a master conversion and replacement schedule
should be a part of an agency's Year 2000 program plan.  This
schedule could be used to (1) establish the sequential relationships
among all of the tasks associated with all Year 2000 activities; (2)
identify how much a task's milestone completion date could slip
without affecting other tasks; (3) help determine whether programming
and testing resources will be available when needed, given the
concurrent milestone completion dates for various tasks; and (4)
provide a tool for assigning programming and testing resources that
are essential to the success of all efforts in the most efficient
manner. 

Understanding the schedule and resource interdependencies of all the
key activities that are needed to make its systems Year 2000
compliant is imperative if IRS is to make its mission-critical
systems Year 2000 compliant on time.  For example, IRS' mainframe
consolidation project is behind schedule because of start-up delays
and problems with implementing the systems software that is being
used to consolidate one of the mainframe platforms.  As a result of
the problems with the commercial off-the-shelf software, additional
testing is being done that was not initially expected.  This testing
requires staff from IRS' Information Systems Office of Technical
Support, which is also supporting the Century Date Change Project
Office in other efforts.  A master schedule showing both task and
resource requirements should help identify whether any of the
individual Year 2000 efforts will require the same staff for the same
time period. 

Recognizing that several major and complex projects, including
application software changes that are needed to implement recent tax
legislation, must be completed before the 1999 filing season, in
November 1997, the Commissioner of Internal Revenue announced the
establishment of an executive steering committee.  This committee is
to identify risks to the 1999 filing season and the entire Year 2000
effort and take actions to mitigate those risks.  As a part of this
effort, IRS developed a Century Date Change Project Schedule for its
Year 2000 activities.  While the project schedule identifies the
tasks for major Year 2000 activities, their corresponding start and
finish dates, and the primary organizations responsible for them, the
schedule does not yet establish a link between related tasks or
analyze how the timing of the various tasks may affect resource
availability.  Until these actions are complete, IRS cannot project
whether resources will be available when needed for concurrent tasks. 
Thus, IRS faces the risk that resources may not be available when
needed. 

On February 12, 1998, IRS issued a statement of work for a contractor
to provide program management support to the Commissioner's newly
established executive steering committee.  One of the support
activities that IRS identified in the statement of work was the
development of an integrated schedule identifying (1) the interfaces
and dependencies among Year 2000 projects and (2) efforts to
implement legislative changes for the 1999 filing season.  IRS
expects this schedule, along with related tasks and dependencies, to
be available in June 1998.  If properly developed, this schedule
should meet the intent of the master conversion and replacement
schedule called for in our assessment guide.  The contractor is to
work closely with IRS staff who are responsible for the various Year
2000 efforts to assess resource needs for new requirements or
resource shortages for existing requirements.  The contractor also is
to identify and recommend alternatives for allocating resources to
help IRS meet all of its requirements. 


   IRS' CONTINGENCY PLANNING
   APPROACH POSES RISK TO THE
   CONTINUITY OF OPERATIONS
------------------------------------------------------------ Letter :5

Contingency planning was the second risk area we identified during
our briefing to your office.  Under IRS' contingency planning
approach, IRS may be jeopardizing the continuity of operations for
core business processes in the event that Year 2000-induced system
failures occur. 

IRS' Century Date Change Project Office has developed a "Century Date
Change Contingency Management Plan." This plan states that
"developing contingency procedures for all of IRS' numerous systems
will require a significant amount of knowledgeable resources, in most
cases the same resources assigned to perform the actual century date
change conversion effort." To minimize the number of contingency
plans that IRS would have to develop, the contingency management plan
calls for developing contingency plans only for those business
functions or processes that are supported by application software
projects that are at risk of not being made Year 2000 compliant on
schedule.  The Century Date Change Project Office has established
criteria to identify such projects.  For these projects, IRS is to
initiate a business function impact analysis.  Once that analysis is
complete, technical and business owners evaluate available
alternatives, including using any existing contingency procedures,
such as manual procedures, or an alternative technological solution,
such as commercial off-the-shelf software.  IRS plans to use a
similar approach for initiating contingency plans for business
functions when the conversion of infrastructure areas, such as
systems software, external data exchanges, and telecommunications
network components, falls behind schedule. 

IRS' "Century Date Change Contingency Management Plan" does not
address the likelihood that information systems that are converted on
schedule may experience system failures.  As a result, IRS will be
ill-prepared to effectively manage Year 2000-induced system failures
that could affect core business processes.  IRS' contingency
management plan does not address the possibility that (1) IRS may
have overlooked a date dependency during its assessment phase of
applications or infrastructure areas or (2) even if system conversion
and replacement efforts are completed on time and fully tested,
unexpected failures may occur. 

Aspects of contingency planning are under way for IRS' replacement
projects (i.e., ISRP and mainframe consolidation).  For example, the
ISRP project office has developed a contingency plan that identifies
(1) various risks to the ISRP pilot and nationwide implementation,
(2) the probability of those risks, and (3) contingency options for
addressing those risks.  IRS is also taking steps to make its
existing service center mainframe computers Year 2000 compliant in
the event that the consolidation of tax processing to the computing
centers is not completed according to schedule.  IRS expects to make
its existing service center mainframe computers Year 2000 compliant
by January 1999.  Also, as part of a larger effort to enhance IRS'
disaster recovery capabilities, IRS officials said they have
identified expanded disaster recovery requirements for service center
data processing.  At the time we were finalizing this report, IRS
officials said they were assessing various technical alternatives for
meeting those requirements so they can be incorporated in the
mainframe consolidation project. 

Our exposure draft on business continuity and contingency planning
states that agencies must start business continuity and contingency
planning now to reduce the risk of Year 2000 business failures.\4
Among other things, the exposure draft states that agencies need to
do a business impact analysis to determine the effect of
mission-critical system failures on the viability of agency
operations.  This analysis is to include examining business
priorities; dependencies; service levels; and, most important, the
business process dependency on mission-critical information systems. 
According to our exposure draft, the business impact analysis
triggers the development of contingency plans for each core business
process, including any information system components that support
that process.  Contingency plans would also address the actions IRS
may take, for example, to notify taxpayers in the event that Year
2000 failures cause significant delays in processing tax returns and
issuing refunds.  IRS has undertaken efforts in the past to identify
its core business processes as a part of various reengineering
efforts that could be the starting point for a business impact
analysis.  For example, in 1996, as part of an effort to redesign its
work processes, IRS began an effort to identify and map core business
processes. 


--------------------
\4 Year 2000 Computing Crisis:  Business Continuity and Contingency
Planning (GAO/AIMD-10.1.19, Mar.  1998). 


   CONCLUSIONS
------------------------------------------------------------ Letter :6

IRS is still assessing some of its infrastructure components and
faces the risk of not completing all of its Year 2000 efforts by
January 1999.  Moreover, IRS, like other agencies, is likely to
encounter Year 2000-induced failures in some systems that were fully
assessed, tested, and implemented.  IRS' "Century Date Contingency
Management Plan" focuses on developing contingency plans only for
business functions that are supported by application software
projects that are behind schedule.  The possibility exists that
existing contingency or disaster recovery plans that were developed
for other than Year 2000 purposes may be applicable to Year 2000
failures.  However, if these plans are not applicable, under IRS'
"Century Date Contingency Management Plan," IRS has no assurance that
its core business processes will be able to continue to function,
albeit, possibly at some reduced level of service, in the event that
Year 2000-induced failures occur in systems that were converted
according to schedule. 


   RECOMMENDATIONS
------------------------------------------------------------ Letter :7

We recommend that the Commissioner of Internal Revenue take the
following steps to better ensure that IRS has adequately assessed the
vulnerabilities of its core business processes in the event of Year
2000-induced system failures: 

  -- solicit the input of business functional area officials to
     identify IRS' core business processes and prioritize those
     processes that must continue in the event of Year 2000-induced
     failures;

  -- map IRS' mission-critical systems to those core business
     processes;

  -- determine the impact of information system failures on each core
     business process;

  -- assess any existing business continuity and contingency plans
     that may have been developed for non-Year 2000 reasons to
     determine whether these plans are applicable to Year
     2000-induced failures, and

  -- develop and test contingency plans for core business processes
     if existing plans are not appropriate. 


   AGENCY COMMENTS AND OUR
   EVALUATION
------------------------------------------------------------ Letter :8

We requested comments on a draft of this report from the Commissioner
of Internal Revenue or his designated representative.  IRS provided
us with comments during a May 4, 1998, meeting with the Acting Chief
Information Officer and his staff.  Those comments were reiterated in
a May 8, 1998, letter from the Commissioner of Internal Revenue,
which is reproduced in appendix III. 

The Commissioner said that IRS agrees that it must develop
contingency plans to manage any adverse impacts of a less-than-fully
successful century date program, and that IRS will take the following
actions to address our recommendations regarding contingency
planning.  He said that to leverage the limited resources on the
remaining Year 2000 conversion and testing efforts, IRS will focus
contingency planning on those areas that have the greatest risk and
highest business impact.  Specifically, the Commissioner said the
Acting Chief Information Officer will be working with the other Chief
Officers to document IRS' current business processes, the systems
that support them, the impact if these processes or systems fail, and
the probability or potential for Year 2000 risk.  The Commissioner
said that contingency plans will be developed for those areas that
meet all of the following criteria:  (1) high business impact, (2)
high risk associated with failure, and (3) high probability of
systems failure/instability due to Year 2000 conversion. 

We believe that these actions, if implemented properly, address most
of the steps we identified in our contingency planning
recommendations and should put IRS in a better position to respond to
unexpected failures as a result of the Year 2000 problem than was the
case under its previous contingency planning approach.  However, we
remain concerned that IRS will be ill-prepared in the event a failure
occurs in a high business impact area that is supported by a system
that IRS assesses as having a low probability of failure, but
subsequently fails unexpectedly.  We recognize that IRS needs to
leverage its resources, particularly its information systems
resources, to ensure that it completes all of the required Year 2000
conversion work on schedule.  However, we believe it would be prudent
for IRS' business officials who are responsible for high business
impact areas, regardless of the perceived Year 2000 risks, to begin
identifying alternative business procedures or processes that may
need to be implemented in the event of unexpected systems failure. 

In addition to commenting on our recommendations, IRS provided us
with updated information on the status of its Year 2000 efforts.  We
have incorporated that updated information in the report where
appropriate.  The updated information is also included in IRS'
"Status Update Summary," which is also reproduced in appendix III. 


   SCOPE AND METHODOLOGY
------------------------------------------------------------ Letter :9

To determine IRS' progress and identify the risks facing its Year
2000 conversion efforts, we interviewed officials from the National
Office, computing centers, service centers, regions, and district
offices.  We analyzed and compared IRS' planning, budget, and
performance-monitoring documentation with our Year 2000 assessment
guide as a part of a structured approach for reviewing IRS'
conversion efforts.  We did not review existing business continuity
or contingency plans that IRS may have been developing for other than
Year 2000-induced failures. 

We conducted our work in accordance with generally accepted
government auditing standards between October 1996 and May 1998. 


---------------------------------------------------------- Letter :9.1

We are sending copies of this report to the Subcommittee's Ranking
Minority Member; the Chairmen and Ranking Minority Members of the
House Committee on Ways and Means and the Senate Committee on
Finance, Subcommittee on Taxation and IRS Oversight; various other
congressional committees; the Secretary of the Treasury; the
Commissioner of Internal Revenue; the Director of the Office of
Management and Budget; and other interested parties.  We will also
make copies available to others upon request. 

The major contributors to this report are listed in appendix IV. 
Please contact me at (202) 512-9110 if you have any questions about
this report. 

Sincerely yours,

Lynda D.  Willis
Director, Tax Policy and
 Administration Issues


DESCRIPTION OF THE FIVE PHASES OF
OUR YEAR 2000 ASSESSMENT GUIDE
=========================================================== Appendix I

Our Year 2000 assessment guide\5 describes in detail the five phases
that agencies need to complete when making their systems Year 2000
compliant.  Each of the following phases represents a major Year 2000
program activity or segment: 

  -- Awareness.  This phase entails defining the Year 2000 problem,
     gaining executive level support and sponsorship, and ensuring
     that everyone in the organization is fully aware of the issue. 
     It is also during this phase that the agency is to establish a
     Year 2000 program team and develop an overall strategy. 

  -- Assessment.  This phase entails assessing the Year 2000 impact
     on the agency, identifying core business areas, inventorying and
     analyzing the systems supporting the core business areas, and
     prioritizing the conversion or replacement of these systems.  It
     is also during this phase that the agency is to initiate
     contingency planning and identify and secure the necessary
     resources. 

  -- Renovation.  This phase deals with converting, replacing, or
     eliminating selected systems and applications.  In so doing, it
     is important that the agency consider the complex
     interdependencies among the systems and applications. 

  -- Validation.  This phase deals with testing, verifying, and
     validating all converted or replaced systems and applications
     and ensuring that they perform as expected.  This entails the
     agency testing in an operational environment the performance,
     functionality, and integration of converted or replaced systems,
     applications, and databases. 

  -- Implementation.  This phase entails deploying and implementing
     Year 2000-compliant systems and components.  It is also during
     this phase that the agency's data exchange contingency plans are
     implemented, if necessary. 


--------------------
\5 GAO/AIMD-10.1.14. 


ADDITIONAL INFORMATION ON THE
STATUS OF THE CONVERSION OF IRS'
INFRASTRUCTURE AREAS
========================================================== Appendix II

This appendix contains additional information on the status of IRS'
infrastructure areas that were in the initial steps of IRS' 14-step
conversion process at the time of our review.  These initial steps
are comparable to either our assessment or renovation phase of our
Year 2000 Conversion Model.  According to the Office of Management
and Budget's guidelines, agencies were to have completed the
assessment phase by June 1997.  IRS placed a priority on assessing
its mainframe computers first because these computers encompass most
of IRS' tax processing systems.  IRS is still assessing its
telecommunications networks, external data exchanges, and the systems
software and hardware for minicomputers/file servers and personal
computers. 


   MAINFRAME COMPUTER HARDWARE AND
   SYSTEMS SOFTWARE
-------------------------------------------------------- Appendix II:1

IRS has completed its assessment of its mainframe computers and has
scheduled their conversion.  All existing mainframe hardware and
systems software are currently scheduled to be converted between
January 1998 and January 1999.  IRS' mainframe computer systems
constitute the core of IRS' data processing activities, including the
processing of tax return and remittance data and the storage of
taxpayer account and collection activity data.  These systems are
currently located at IRS' 10 service centers, the Martinsburg
Computing Center, and the Detroit Computing Center. 

Most of IRS' mainframe computers are being replaced as a part of IRS'
mainframe consolidation project.  In the event that not all centers
can be consolidated by 2000, IRS is proceeding with plans to make its
existing mainframe hardware and systems software at the service
centers Year 2000 compliant.  Some mainframe computers, such as those
supporting master-file processing at the Martinsburg Computing Center
and others at the Detroit Computing Center, are not included in the
mainframe consolidation project.  These mainframe computers are to be
upgraded to achieve Year 2000 compliance by January 1999. 


   TELECOMMUNICATIONS NETWORKS
-------------------------------------------------------- Appendix II:2

IRS is still in the assessment phase for its telecommunications
networks.  IRS relies extensively on telecommunications networks to
accomplish its mission.  According to the IRS' Year 2000
Telecommunications Project Management Plan, the IRS'
telecommunications network is a critical component of IRS' tax
processing and customer service operations.  The capability to
exchange information, both voice and data, among its various computer
systems is the backbone of IRS' ability to perform all of its tax
processing and customer service functions. 

According to the Commissioner's Executive Steering Committee
documents, the telecommunications networks conversion is
significantly behind schedule for meeting the January 1999 milestone. 
Although IRS has established conversion schedules for the
mission-critical areas of its telecommunications networks and is
integrating these schedules into an overall plan, many of the
individual components that make up these mission-critical areas have
not been fully assessed.  Generally, these components have not been
fully assessed because IRS' inventory of telecommunications resources
has not been sufficiently detailed to allow IRS to (1) confirm the
Year 2000-compliant status of all telecommunications components, (2)
develop detailed conversion schedules, and (3) track conversion
progress against those schedules.  In part, the inventory has been
difficult to compile because IRS' telecommunications networks include
both IRS-owned and multiple vendor-maintained networks and equipment,
such as the Treasury-supported network, that cannot be easily
combined to serve as a comprehensive source of information. 

IRS, Treasury, and contractors have formed integrated teams to
address the Year 2000 telecommunications issues.  IRS is currently
validating the inventory of the Treasury- supported network by
conducting site-specific inventories at its service centers.  In
addition to needing quality inventory data, IRS' conversion solutions
and plans for some areas are largely dependent on the ability of
vendors to provide Year 2000-compliant products in a timely manner. 
After these products are received, IRS must test them to ensure that
they work within IRS' own data processing environment.  According to
IRS officials, a test plan for the Treasury-supported network has
been developed. 

Given the large extent to which IRS relies on telecommunications
networks to accomplish its mission and the high degree of risk
associated with not making IRS' telecommunications networks Year 2000
compliant, IRS' telecommunications project plan calls for steps to
mitigate this risk.  The plan calls for initiating efforts to ensure
that the portions of IRS' telecommunications networks that are most
critical to IRS' operations are scheduled first and receive the
necessary resources in accordance with their priority to IRS'
operations.  At the time of our review, a contractor was doing a risk
assessment to help develop a conversion schedule so that the most
important work is scheduled first to minimize adverse impacts if IRS
is not able to complete all of its telecommunications work by January
1999.  According to IRS documents, this risk assessment will also
trigger the development of contingency plans for mission-critical
systems that are found to be at risk for not being converted on time. 
As an additional contingency measure, according to IRS, it is
building redundancy into telecommunications networks to provide
limited access if a portion of the network fails due to Year 2000
compatibility issues. 


   EXTERNAL DATA EXCHANGES
-------------------------------------------------------- Appendix II:3

IRS hopes to complete its assessment of external data exchanges by
June 30, 1998.  IRS, like most organizations, exchanges data in an
electronic format with other organizations for a variety of purposes. 
These data exchanges involve both other government agencies as well
as private sector organizations.  For example, IRS (1) transmits
information electronically to the Treasury's Financial Management
Service (FMS) for the purposes of reporting revenue receipts and the
issuance of refund checks and (2) receives wage information (W-2)
from the Social Security Administration (SSA) to verify the accuracy
of individuals' reported income.  IRS also receives interest income
data from banks and provides information to many states to assist
them with taxpayer compliance activities. 

In September 1997, IRS initiated a plan to identify (1) all of its
external data exchange organizations and (2) the actions needed to
ensure that data exchanges are not adversely impacted by the Year
2000 problem.  IRS has notified these organizations that Treasury has
adopted a four-digit date field.  IRS reports that as part of its
application conversion efforts it has already converted more than 50
percent of the more than 300 data files that it exchanges with more
than 400 organizations.  A key portion of the remaining work involves
contacting each of the organizations and verifying that it is aware
of the IRS' plans for conversion and it has taken steps to ensure the
continued receipt and transmission of data. 

IRS has also identified a group of organizations whose external data
exchanges are most critical to IRS' operations and plans to commit
additional attention and resources to these organizations to ensure
that Year 2000 data exchange issues are thoroughly addressed.  These
organizations include government agencies, such as FMS, SSA, and the
Federal Reserve, as well as private firms that are involved in
activities such as the Electronic Federal Tax Payment System for
federal employment tax deposits and banks that provide "lockbox"
processing of $170 billion in remittances annually.  To ensure that
these most critical areas are thoroughly addressed, IRS has hired a
contractor to conduct site visits to validate that the systems that
receive/provide these data are on track to be Year 2000 compliant. 
At the time of our review, IRS was validating its inventory of
external data exchanges and obtaining agreements regarding the
organizations' plans for converting their systems so that data
exchanges can be made Year 2000 compliant. 


   MINICOMPUTER/FILE-SERVER
   HARDWARE AND SYSTEMS SOFTWARE
-------------------------------------------------------- Appendix II:4

For the most part, IRS has completed its assessment of its
minicomputer/file-server hardware and systems software.  In the last
10 to 15 years, IRS has developed a number of information systems
that use minicomputer and file-server technologies, rather than the
mainframe-based technology that it has used for the past 30 years. 
IRS has identified 39 mission-critical systems that use minicomputer
and file-server technologies.  These systems support a variety of
programs, including electronic filing, customer service, returns
processing, fraud detection, criminal investigation, and compliance
research activities.  Many of these systems input data to IRS'
mainframe-based systems and, as such, are key elements of IRS' tax
processing system. 

Because organizational control over these systems is scattered across
various project offices within IRS' information systems organization
and business or functional units, IRS has taken longer to identify
and assess these systems than it has taken for its mainframe- based
systems.  The lack of an accurate inventory has also hindered
progress in completing the assessment of these systems. 

IRS is relying on vendors to provide the Year 2000 solution for 12
platforms (i.e., a combination of computer hardware and systems
software).  These platforms currently support 39 mission-critical
systems and several other important applications.  According to the
Commissioner's Executive Steering Committee documents, IRS
established March 15, 1998, as the date by which IRS wanted some
assurance by the vendors that a Year 2000 solution existed for these
platforms.  Of the 12 platforms, 2 will be retired (1 of which will
be replaced when ISRP is implemented nationwide.) IRS has determined
that two platforms cannot be made Year 2000 compliant, and, at the
time of our review, IRS was still evaluating its replacement options
for them.  As of April 10, 1998, IRS had either received or was about
to receive the eight remaining platforms.  IRS had identified a
relational database as its greatest risk for its minicomputers and
file servers because it supports 15 mission-critical systems, and IRS
is the vendor's only customer for this product.  IRS officials told
us that as of May 8, 1998, the vendor had provided a version of this
database to IRS for testing.  IRS officials said that once testing is
completed, they will take the necessary steps to procure this
database and make it available to the various users. 

Despite having identified the Year 2000 solutions for various
minicomputer/file-server platforms, as of May 8, 1998, IRS had not
yet completed a plan for migrating business or functional
organizations from their current minicomputer/file-server platforms
to the ones that are Year 2000 compliant.  Specifically, as of May 8,
1998, IRS was beginning to develop for business and functional
organizations (1) a schedule of critical tasks, (2) the associated
milestones for completing the tasks, and (3) guidance on how to
complete the tasks. 


   PERSONAL COMPUTER HARDWARE AND
   COMMERCIAL SOFTWARE
-------------------------------------------------------- Appendix II:5

IRS is in the assessment phase for personal computer hardware and
commercial software (i.e., systems software and applications).  IRS
uses personal computers extensively for a wide range of functions,
including (1) providing customer service staff with access to
taxpayer account databases, (2) allowing compliance staff to collect
detailed information and do complex calculations while working in the
field, (3) entering information from tax returns and remittances, and
(4) doing essential administrative functions.  IRS has identified
134,000 personal computers that it must assess to determine if the
hardware and/or the associated systems software is Year 2000
compliant or must be converted.  IRS has estimated that approximately
60,000 of these computers support mission-critical functions.  Of
these 60,000 computers, IRS is currently replacing approximately
16,000 as part of IRS' service center mainframe consolidation
project.  IRS' goal is to convert all personal computers by January
1999. 

The Century Date Change Project Office is assigning Year 2000
conversion responsibility for personal computers to the organizations
within IRS that currently share responsibility for purchasing and
maintaining personal computers and their associated commercial
software.  According to the Century Date Change Project Office, as of
March 1998, it had assigned responsibility for converting 75,000 of
these personal computers. 




(See figure in printed edition.)Appendix III
COMMENTS FROM THE INTERNAL REVENUE
SERVICE
========================================================== Appendix II



(See figure in printed edition.)



(See figure in printed edition.)



(See figure in printed edition.)


MAJOR CONTRIBUTORS TO THIS REPORT
========================================================== Appendix IV

GENERAL GOVERNMENT DIVISION,
WASHINGTON, D.C. 

Sherrie Russ, Assistant Director
Christopher Hess, Senior Evaluator
Monika Gomez, Evaluator
Troy Thompson, Evaluator
Elizabeth W.  Scullin, Communications Analyst

ATLANTA FIELD OFFICE

A.  Carl Harris, Assistant Director
Joanna Stamatiades, Evaluator-in-Charge
Robert Arcenia, Senior Evaluator
Linda Standau, Senior Evaluator
Ronald Heisterkamp, Evaluator


*** End of document. ***