Year 2000 Computing Crisis: Customs Is Making Good Progress (Testimony,
06/29/99, GAO/T-AIMD-99-225).

Pursuant to a congressional request, GAO discussed the Customs Service's
progress in addressing the year 2000 computing problem.

GAO noted that: (1) addressing the year 2000 problem in time is critical
for the Customs Service because it relies extensively on information
technology (IT) to help enforce trade laws and collect and account for
duties, taxes, and fees on imports; (2) Customs has five
mission-critical systems: (a) the Automated Commercial System; (b)
Customs' Treasury Enforcement Communications System; (c) the Seized
Asset and Case Tracking System; (d) Customs' Automated Export System;
and (e) ADMIN, which is Customs' primary administrative system
supporting financial and human resource functions; (3) Customs must
assess and remediate a wide range of telecommunications equipment and
non-information technology assets installed in over 900 facilities; (4)
Customs reported that it had met milestones recommended by the Office of
Management and Budget for renovating and validating most of its
mission-critical systems; (5) it reported that it had completed
renovation, validation, and systems acceptance testing of all five of
its mission-critical systems; (6) Customs has also reported that it has
renovated most of its telecommunications equipment; (7) Customs reported
that it has assessed all of its mission-critical non-IT products and
that about 73 percent are compliant, about 15 percent require renovation
or replacement, and about 11 percent are to be retired; (8) to help
ensure that the information it reports on year 2000 progress is
reliable, Customs has implemented sound reporting controls; (9) Customs'
program management structures and processes are entirely consistent with
GAO guidance, and Customs' good progress to date is largely attributable
to this program management capability; (10) to ensure that plans,
policies, and guidelines are being implemented, the Year 2000 Program
manager is: (a) holding weekly status meetings with the Year 2000
Program Office staff and the project teams; (b) tracking, prioritizing,
and managing the risks associated with the IT and non-IT system
conversion efforts; (c) overseeing and managing budget-related issues;
and (d) conducting internal audit reviews to monitor and assess the
implementation of established year 2000 procedures; (11) structured and
disciplined processes have also been implemented for the testing phase
of Customs' year 2000 effort; and (12) Customs has implemented sound
management processes for developing business continuity and contingency
plans that help Customs to mitigate the risks associated with unexpected
internal and uncontrollable external failures.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  T-AIMD-99-225
     TITLE:  Year 2000 Computing Crisis: Customs Is Making Good
	     Progress
      DATE:  06/29/99
   SUBJECT:  Customs administration
	     Computer software verification and validation
	     Systems conversions
	     Computer software
	     Data integrity
	     Y2K
	     Information resources management
	     Strategic information systems planning
IDENTIFIER:  Customs Service Automated Commercial System
	     Customs Treasury Enforcement Communications System
	     Customs Service Seized Assets and Case Management Tracking
	     System
	     Customs Service Automated Export System
	     Customs ADMIN System
	     Y2K
	     Customs Service Year 2000 Program

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  This text was extracted from a PDF file.        **
** Delineations within the text indicating chapter titles,      **
** headings, and bullets have not been preserved, and in some   **
** cases heading text has been incorrectly merged into          **
** body text in the adjacent column.  Graphic images have       **
** not been reproduced, but figure captions are included.       **
** Tables are included, but column deliniations have not been   **
** preserved.                                                   **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************
ai99225t GAO United States General Accounting Office

Testimony Before the Subcommittee on International Economic Policy
and Trade, Committee on International Relations, House of
Representatives

For Release on Delivery Expected at 2 p. m. Tuesday, June 29, 1999

YEAR 2000 COMPUTING CRISIS Customs Is Making Good Progress
Statement of Jack L. Brock, Jr. Director, Governmentwide and
Defense Information Systems Accounting and Information Management
Division

GAO/T-AIMD-99-225

  GAO/T-AIMD-99-225

Page 1 GAO/T-AIMD-99-225

Madam Chair and Members of the Subcommittee: Thank you for
inviting me to participate in today's hearing on Y2K, Customs
Flows, and Global Trade. I will specifically discuss the
challenges faced by the U. S. Customs Service in responding to the
century date problem. If this problem is not addressed in time,
key automated systems affecting trillions of dollars in trade
between the United States and other countries could malfunction,
resulting in delayed trade processing,

lost trade revenue, and increased illegal activities, such as
narcotics smuggling, money laundering, and commercial fraud.
Fortunately, Customs has made good progress to date addressing its
Year 2000 problem, thanks in large part to the effective Year 2000
program management structures and processes that it has in place
for doing so. Nevertheless, Customs faces certain Year 2000
challenges, such as completing end- to- end testing, before it
will be ready to cross into the new millenium. As you know,
however, Customs is only one player in a complex web of suppliers
and customers who have absolute dependence on governmental

and private infrastructure support systems involving
transportation and distribution, financing, telecommunications,
and power supply. Year 2000- related failures in any of the
infrastructure support systems or individual supplier systems and
customer systems could also disrupt trade

flow. Information on the status of public and private
infrastructure is uneven and often unavailable. Further,
information on customers and suppliers is even less available. We
do, however, have sufficient information about Customs to provide
you a good overview of its Year 2000 status. My testimony today
will `address these four key areas progress to date, program
management effectiveness, progress in leading a governmentwide
effort to ensure the continuity of cross- border inspections, and
future challenges facing the

agency. In preparing this testimony, we reviewed Customs' Year
2000 management and reporting structures and processes including
those relating to testing, contingency planning, risk management,
and quality assurance and

Page 2 GAO/T-AIMD-99-225

compared these to our Year 2000 Guidance 1 to determine whether
key internal controls are in place and functioning as intended. We
have also traced the reported status of selected system components
back to supporting systems documentation to verify the reported
information's accuracy. In addition, we developed an overview of
Customs' efforts to coordinate and facilitate a governmentwide
effort to ensure the continuity of cross- border inspections. Some
of the results of our work were

previously reported to the House Committee on Ways and Means. 2
Customs Relies Extensively on Automated Systems

Addressing the Year 2000 problem in time is critical for the
Customs Service because it relies extensively on information
technology to help enforce trade laws and collect and account for
duties, taxes, and fees on imports. 3 As the following
illustrates, Customs has five mission- critical systems that
contain over 20 million lines of application code and has
thousands of users within Customs, other government agencies, and
the trade community.  The Automated Commercial System (ACS)
tracks, controls, and processes all commercial goods imported into
the United States. Over

97 percent of the data filed for imported cargo entries are sent
through ACS, and more than 15,000 trade and other government
agency users have access to this system.  Customs' Treasury
Enforcement Communications System (TECS)

interfaces with the Federal Bureau of Investigation's National
Crime Information Center and a number of other law enforcement
systems and is the major automation component of the Interagency
Border

Inspection System, which serves as a clearinghouse for law
enforcement data. Some 27,000 users, including Customs;
Immigration and Naturalization Service; Internal Revenue Service;
Bureau of Alcohol, Tobacco, and Firearms; and the State
Department, rely on TECS. 1 Year 2000 Computing Crisis: An
Assessment Guide (GAO/ AIMD- 10. 1. 14, issued as an exposure
draft in February 1997, issued final in September 1997); Year 2000
Computing Crisis: Business Continuity and Contingency Planning
(GAO/ AIMD- 10. 1. 19, issued as an exposure draft in March 1998,
issued final in August 1998); and Year 2000 Computing Crisis: A
Testing Guide (GAO/ AIMD- 10. 1. 21, issued as an exposure draft
in June 1998, issued final in November 1998). 2 Year 2000
Computing Crisis: Customs Has Established Effective Year 2000
Program Controls (GAO/AIMD-99-37, March 29, 1999) and Year 2000
Computing Crisis: Customs Is Effectively Managing Its Year 2000
Program (GAO/T-AIMD-99-85, February 24, 1999). 3 During 1997,
Customs collected $22. 1 billion in revenue at more than 300 ports
of entry.

Let t er

Page 3 GAO/T-AIMD-99-225

 The Seized Asset and Case Tracking System (SEACATS) processes and
tracks activity associated with seizures for the initial law
enforcement interest in the property to its final disposition.
This system is used by more than 16, 000 Customs employees, and it
interfaces with the Justice Department and Internal Revenue
Service systems.  Customs' Automated Export System (AES) collects
export- related data from exporters and carriers and is used to
help target export violators. More than 28, 000 users nationwide
rely on this system.

ADMIN is Customs' primary administrative system supporting
financial and human resource functions. It is composed of 40
separate systems that interface with each other and with ACS, AES,
and TECS. In addition to fixing and testing its systems, Customs
must assess and remediate a wide range of telecommunications
equipment and non- information technology (non- IT) assets
installed in over 900 facilities. This non- IT equipment includes
check- writers; scanners; optical readers; security systems such
as badge readers, x- ray systems, cameras, secured doors, and
safes; fire alarms; heating and air conditioning systems; planes;
and automobiles.

Customs Is Making Good Progress in Addressing Its Year 2000
Problem

Customs reported that as of January 1999, it had met milestones
recommended by the Office of Management and Budget (OMB) for
renovating and validating most of its mission- critical systems. 4
Specifically, it reported that it had completed renovation,
validation, and systems acceptance testing 5 of all five of its
mission- critical systems. Moreover, Customs is currently
conducting end- to- end tests 6 for these systems and plans to
complete these tests by August 30, 1999. Customs has also reported
that it has renovated most of its telecommunications equipment.
Specifically, Customs reported that it 4 OMB requires that
agencies complete renovation of their mission- critical systems by
September 1998, validation by January 1999, and implementation by
March 1999. 5 The purpose of system acceptance testing is to
verify that the complete system (i. e., the full complement of
application software running on the target hardware and systems
software infrastructure) satisfies specified requirements
(functional, performance, and security) and is

acceptable to end users. 6 The purpose of end- to- end testing is
to verify that a defined set of interrelated systems, which
collectively support an organizational core business area or
function, interoperate as intended in an operational environment,
either actual or simulated.

Page 4 GAO/T-AIMD-99-225

 has assessed, renovated, validated, and implemented all of its
national data center- related telecommunications;  has assessed
all telecommunications equipment in its field offices and
completed needed renovations at all but one field site; 7 and

 has completed all needed work on its headquarters voice
communications equipment and, as of June 1999, has completed about
93 percent of the work needed on field office voice communications

equipment, including telephone and voice mail, and plans to
complete the remaining 7 percent by the end of June 1999. As of
June 1999, Customs reported that it has assessed all of its
mission- critical non- information technology products and that
about 73 percent are compliant, about 15 percent require
renovation or replacement, and about 11 percent are to be retired.
Customs expects to complete this work by the end of June 1999. To
help ensure that the information it reports on Year 2000 progress
is reliable, Customs has implemented sound reporting controls. For
example, quality review teams review the information reported for
(1) consistency

(by comparing it to previously reported information), (2)
completeness (by comparing it to reporting standards), and (3)
accuracy (by validating it through observation, inquiry, or review
of supporting documentation). Our review of quality review team
results, as well as our independent review of the reliability of
the information reported in selected system components, disclosed
no discrepancies between what was being reported and what
supporting system documentation showed actual progress to be.

Effective Management Structure and Processes Are Key to Customs'
Success Our Year 2000 Guides provide a framework for effective
Year 2000 program

management. Collectively, they define a comprehensive set of
program management controls for planning, directing, monitoring,
and reporting on Year 2000 efforts. Customs' program management
structures and processes are entirely consistent with our
guidance, and Customs' good progress to date is largely
attributable to this program management capability. Along these
lines, Customs has done the following:

7 Telecommunications equipment in the Ottawa, Canada, field site
will be upgraded after an office move in October 1999.

Page 5 GAO/T-AIMD-99-225

 Established a Year 2000 Program Office and designated a Year 2000
Program Manager in May 1997 and charged the office with authority
over and responsibility for agencywide Year 2000 efforts,
including such

functional areas as Year 2000 contracting, budgeting and planning,
technical support to project teams, quality assurance, auditing,
and reporting.  Developed a Year 2000 Strategic Plan and Year 2000
Operational Program Management Plan in June 1998, which (1)
identified organizational roles and responsibilities, (2)
established schedules for completing each program phase and
described the tasks to be completed under each phase, (3)
established reporting requirements to

track progress in the various phases, (4) defined performance
measures, and (5) estimated and allocated resources for the tasks
and system activities within these phases.  Issued policies,
guidelines, and procedures for managing and implementing the Year
2000 program, including guidance on quality assurance,
configuration management, and testing, as well as business
continuity and contingency planning.

 Most important, engaged its senior executives in the Year 2000
effort by charging the agency's Executive Council 8 with approving
and overseeing the implementation of the Year 2000 strategy and
resolving such issues as institutional Year 2000 priorities. To
ensure that the plans, policies, and guidelines are being
implemented, the Year 2000 program manager is (1) holding weekly
status meetings with the Year 2000 Program Office staff and the
project teams, (2) tracking, prioritizing, and managing the risks
associated with the IT and non- IT system conversion efforts, (3)
overseeing and managing budget- related issues, and (4) conducting
internal audit reviews to monitor and assess the implementation of
established Year 2000 procedures. The Program Office is also
tracking progress against plans and identifying issues that may
affect its strategy by using a central database.

Structured and disciplined processes have also been implemented
for the testing phase of Customs' Year 2000 effort. This is
important since Customs' key mission- critical systems run
hundreds of interdependent applications and must interface with
thousands of external systems. In particular, Customs designated a
Year 2000 test manager for 8 The council is co- chaired by the
Chief Information Officer and the Chief Financial Officer and
includes the Year 2000 project managers as members.

Page 6 GAO/T-AIMD-99-225

mission- critical IT systems and assigned this manager authority
and responsibility for key testing activities, such as defining
exit criteria, designing and planning the tests, and executing the
tests. It also provided an agencywide definition of Year 2000
compliance in its Year 2000 Application Testing Strategy and Plan,
engaged an independent verification and validation (IV& V) agent
to ensure that process standards have been followed and that
software products perform as intended, provided for ensuring that
vendor- supported IT and non- IT products have been tested and
that they are Year 2000 compliant, and established a Year 2000
test environment. These controls and processes have enabled
Customs to meet milestones recommended by OMB for renovating and
validating mission- critical systems and to allow time to conduct
end- to- end tests.

Finally, Customs has implemented sound management processes for
developing business continuity and contingency plans that help
Customs to mitigate the risks associated with unexpected internal
and uncontrollable external failures. Specifically, Customs
established a business continuity work group, developed a high-
level business continuity planning strategy, developed a master
schedule and milestones, implemented a risk management process and
established a reporting system, and implemented quality assurance
reviews. It then performed a business impact analysis to

determine the effect that failures of mission- critical
information systems have on the viability and effectiveness of
agency core business processes. By defining disruption scenarios
and assessing business, legal, and regulatory risks for major
business processes, this analysis provided Customs the information
needed to develop contingency plans for

continuity of operations. Customs is now in the process of testing
its contingency plans and it plans to complete contingency plan
testing, including plans for non- IT systems, by October 1999.
Customs' Progress in Ensuring Continuity of Cross- Border
Inspections In April 1998, we recommended that the Chairman,
President's Council on Year 2000 Conversion, select priority areas
and designate a lead agency to be responsible for ensuring that
end- to- end testing of the processes and systems supporting these
areas occurs across organizational boundaries. 9 In response to
our recommendation, on March 26, 1999, OMB issued a 9 Year 2000
Computing Crisis: Potential for Widespread Disruption Calls for
Strong Leadership and Partnerships (GAO/AIMD-98-85, April 30,
1998).

Page 7 GAO/T-AIMD-99-225

memorandum 10 to federal agencies designating lead agencies for
the government's 42 high- impact programs. 11 Customs was
designated as the lead agency for the cross- border inspection
high- impact program, which

Customs defines as its trade compliance, outbound, and passenger
processes. According to Customs, these processes involve systems
belonging to Customs, other government agencies, state
governments, international governments, and the trade community.
OMB asked each lead agency to (1) identify its partners integral
to program implementation, (2) take a leadership role in convening
the partners, (3) ensure that each partner has an adequate Year
2000 plan and, if not, help each partner without one, and (4)
develop a plan to ensure that the program will operate
effectively. The plan may include testing data exchanges across
partners, developing complementary business continuity and
contingency plans, and sharing information on readiness with other

partners and the public. In addition, OMB asked each lead agency
to provide OMB with a schedule and milestones for the key
activities in the plan by April 15, 1999, a monthly report of
progress against that schedule, and a planned date for an event to
inform the public that the program is Year 2000 ready.

In April 1999, Customs provided OMB with a plan, including a
schedule and milestones, for ensuring compliance of the cross-
border inspection high- impact area. Since then, Customs has
provided OMB with monthly status reports showing its progress
against these milestones. In implementing its plan, Customs
reported that it has taken a number of steps to satisfy OMB's
requirements and to help ensure the continuity of the

cross- border inspection program.  First, Customs has identified
its external partners, including the trade community and other
federal agencies (e. g., the Department of Agriculture and the
Food and Drug Administration), responsible for implementing the
cross- border inspection program.  Second, Customs has tested or
has plans to test its contingency plans for its trade compliance,
passenger, and outbound process areas those

that Customs has determined make up the cross- border inspection
services jointly with its business partners in the trade community
and 10 OMB Memorandum 99- 12, Assuring the Year 2000 Readiness of
High- Impact Federal Programs, March 26, 1999. 11 OMB later added
a 43rd high- impact program.

Page 8 GAO/T-AIMD-99-225

federal agencies. Customs reported that it has completed testing
for its passenger process and is currently evaluating and
documenting the test results. In addition, Customs' officials
stated that Customs is currently testing its contingency plans for
the trade compliance process area at two selected ports.  Third,
Customs officials stated that Customs has developed test plans and
is conducting end- to- end tests with its business partners,
including the trade community and federal agencies.  Fourth,
Customs plans to issue a press release to inform the public that
the program is Year 2000 ready in mid- October. Important
Challenges Still Face Customs in Months to Come

Notwithstanding either Customs' good progress to date or the
effectiveness of its program management controls, Customs still
has very important and challenging tasks to complete to
effectively reduce its chances of serious business disruptions. In
particular, Customs still needs to conduct end- to- end testing of
the systems that support important trade missions. These tests
will be particularly challenging since Customs depends on hundreds
of business partners and their respective systems. Additionally,
Customs still needs to complete testing of contingency plans for
ensuring continuity of its core business areas in the event of
Year 2000- induced system failures. For Customs, this is
especially challenging because it involves 42 distinct lines of
business that cut across some 300 organization units located
throughout the United States, each with its own unique and
localized Year 2000 readiness issues. Moreover, Customs, like most
organizations, faces serious risks outside its control. For
example, Customs depends on public infrastructure systems, such as
those that provide power, water, transportation, and voice and
data telecommunications. Given the number of Customs ports of
entry throughout the United States, even localized disruptions in
infrastructure- related services could seriously degrade Customs
business operations. As Customs works to develop, test, and
complete its contingency plans, it must ensure that these
localized event scenarios are

adequately addressed. Finally, Madam Chair, as noted earlier,
Customs readiness for Year 2000 does not provide assurance that U.
S. trade interests will be unaffected. Uncertainties surrounding
the readiness of suppliers, customers, distributors, and
supporting infrastructure throughout the world limit our ability
to predict the Year 2000 impact on global trade.

Let t er

Page 9 GAO/T-AIMD-99-225

This concludes my statement. I would be glad to respond to any
questions that you or other Members of the Subcommittee may have
at this time. Contact and Acknowledgements

For information about this testimony, please contact Jack L.
Brock, Jr., at (202) 512- 6240 or by email at brockj. aimd@ gao.
gov. Individuals making key contributions to this testimony
included Cristina Chaplain and Deborah Davis.

(511162) Let t er

Ordering Information The first copy of each GAO report and
testimony is free. Additional copies are $2 each. Orders should be
sent to the following address, accompanied by a check or money
order made out to the Superintendent of Documents, when necessary,
VISA and

MasterCard credit cards are accepted, also. Orders for 100 or more
copies to be mailed to a single address are discounted 25 percent.

Orders by mail: U. S. General Accounting Office P. O. Box 37050
Washington, DC 20013

or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW)
U. S. General Accounting Office Washington, DC

Orders may also be placed by calling (202) 512- 6000 or by using
fax number (202) 512- 6061, or TDD (202) 512- 2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512- 6000 using a
touchtone phone. A recorded menu will provide information on how
to obtain these lists. For information on how to access GAO
reports on the INTERNET, send an e- mail message with info in the
body to:

info@ www. gao. gov or visit GAO's World Wide Web Home Page at:
http:// www. gao. gov

United States General Accounting Office Washington, D. C. 20548-
0001

Official Business Penalty for Private Use $300

Address Correction Requested Bulk Mail

Postage & Fees Paid GAO Permit No. GI00

*** End of document. ***