IRS' Year 2000 Efforts: Status and Risks (Testimony, 05/07/98,
GAO/T-GGD-98-123).

GAO discussed the results of its work to date on the Internal Revenue
Service's (IRS) efforts to have its information systems function
correctly when processing dates beyond December 31, 1999.

GAO noted that: (1) for its existing systems, IRS has made more progress
in converting application software then converting its information
systems infrastructure, which includes hardware, systems software, and
telecommunications; (2) despite its progress on converting applications,
IRS fell short of its goal to have the applications for 66 of the 127
systems that it considers mission-critical converted by January 1998;
(3) IRS is still assessing or in the early stages of converting its
hardware and systems software for two of its three levels of computing
operations--minicomputers/file servers and personal computers; (4) of
all the infrastructure areas, according to IRS' tracking systems,
telecommunications is at the highest risk for not being completed by
January 31, 1999; (5) in addition to converting systems, IRS is
undertaking two major system replacement projects as part of its year
2000 efforts; (6) both of these projects have encountered some schedule
delays; (7) GAO identified two significant risk areas to IRS' year 2000
efforts; (8) the first was the lack of master conversion and replacement
schedule; (9) the second was a limited approach to contingency planning;
(10) IRS is taking actions to address GAO's concerns regarding the lack
of a master conversion and replacement schedule; and (11) however, GAO
remains concerned that IRS' current approach to contingency planning
does not address the likelihood that system failures could occur once
systems are implemented.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  T-GGD-98-123
     TITLE:  IRS' Year 2000 Efforts: Status and Risks
      DATE:  05/07/98
   SUBJECT:  Computer software verification and validation
             Systems conversions
             Strategic information systems planning
             Data integrity
             Computer software
             Information resources management
IDENTIFIER:  IRS Year 2000 Conversion Project
             
******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************


Cover
================================================================ COVER


Before the Subcommittee on Oversight, House Committee on Ways and
Means

For Release
on Delivery
Expected at
10:00 a.m.  EDT
Thursday,
May 7, 1998

IRS' YEAR 2000 EFFORTS - STATUS
AND RISKS

Statement of Lynda D.  Willis, Director, Tax Policy and
Administration Issues, General Government Division

GAO/T-GGD-98-123

GAO/GGD-98-123T


(268851)


Abbreviations
=============================================================== ABBREV

  CIO - Chief Information Officer
  CRS - Communication Replacement System
  DIS - Distributed Input System
  IRS - Internal Revenue Service
  ISRP - Integrated Submission and Remittance Processing
  RPS - Remittance Processing System

IRS' YEAR 2000 EFFORTS:  STATUS
AND RISKS
====================================================== Chapter SUMMARY

The most critical issue IRS faces this year and in 1999 is the need
to make its computer systems Year 2000 compliant.  Completing this
complex task involves correcting millions of lines of computer code
and thousands of commercial hardware and software products that IRS
relies on to carry out its mission.  If these efforts are not
completed, IRS' tax processing and collection systems may fail to
operate or may generate millions of erroneous tax notices, refunds,
interest calculations, and account adjustments.  IRS has less than 9
months to complete the work that it believes is necessary to reach
its goal of having all of its systems Year 2000 compliant by January
31, 1999.  IRS established this goal so it would have almost a full
year, including a filing season, to test and make additional
corrections to its systems. 

As part of IRS' conversion efforts, it needs to (1) convert
applications, (2) upgrade or replace the computer hardware and
systems software that the applications run on, (3) upgrade its
telecommunication networks, and (4) ensure that external data
exchanges are addressed.  Thus far, IRS has made more progress in
converting its applications than in converting its information
systems infrastructure, such as hardware, systems software, and
telecommunications, that support and affect IRS' mission-critical
systems.  As of March 31, 1998, IRS reported that it had converted
the applications for 59 (46 percent) of the 127 systems it has
identified as mission-critical.  IRS officials said they are on
schedule for converting the applications for the other 68 systems by
January 31, 1999.  IRS either is assessing or in the early stages of
converting the hardware and systems software for two of its three
computing levels.  Of the infrastructure areas, telecommunications
networks will likely present the most significant challenge and may
be at the highest risk for not being completed by January 31, 1999. 
IRS is also experiencing some schedule delays in its two replacement
projects, but IRS officials said they expect to implement the Year
2000 critical elements by January 31, 1999. 

In January 1998, GAO identified two risks to IRS' Year 2000 efforts. 
The first risk was the lack of a master conversion and replacement
schedule as called for in GAO's Year 2000 assessment guide.  This
schedule could be used to track the status of the many interdependent
tasks and the associated resource implications.  IRS is taking
actions to develop this schedule and, if properly developed, it could
meet the intent of the guide.  However, GAO remains concerned about
IRS' narrow approach to contingency planning, the second risk we
identified.  IRS' approach calls for developing contingency plans
only for those business functions that are supported by information
systems projects that are known to be at risk of not being fixed on
schedule.  Under this approach, IRS' business functions will be
ill-prepared to continue operations in the event of failures in
information systems that were made compliant on time but failed after
they were implemented. 


IRS' YEAR 2000 EFFORTS:  STATUS
AND RISKS
==================================================== Chapter STATEMENT

Madam Chairman and Members of the Subcommittee: 

We are pleased to be here today to discuss the results of our work to
date on the Internal Revenue Service's (IRS) efforts to have its
information systems function correctly when processing dates beyond
December 31, 1999.  These efforts are necessary because IRS'
information systems, many of which are over 25 years old, were
programmed to read two-digit date fields.  Therefore, if unchanged,
beginning January 1, 2000, these systems would interpret 2000 as
1900, and thus would seriously jeopardize critical tax processing and
collection operations.  According to IRS, the failure to change
two-digit date fields before 2000 could result in generating millions
of erroneous tax notices, refunds and bills.  IRS has less than 9
months to complete the work that it believes is necessary to reach
its goal of having all of its systems Year 2000 compliant by January
31, 1999.  Meeting this goal is important to help ensure that IRS (1)
can accurately process tax returns during the 1999 filing season and
(2) has almost a full year to test the multitude of changes that are
necessary and make additional corrections so that its systems operate
properly in the next millennium. 

Our statement today is based on the work we did to prepare a draft
report on the status of IRS' Year 2000 efforts.  Our draft report is
currently at IRS for comment.  In preparing that report, we
interviewed officials from IRS' National Office, computing centers,
service centers, regions, and district offices.  We analyzed and
compared IRS' planning, budget, and performance-monitoring
documentation with our Year 2000 assessment guide\1 as a part of a
structured approach for reviewing IRS' conversion efforts. 

Our statement today includes the following points: 

  -- For its existing systems, IRS has made more progress in
     converting application software than converting its information
     systems infrastructure, which includes hardware, systems
     software, and telecommunications.  Despite its progress on
     converting applications, IRS fell short of its goal to have the
     applications for 66 of the 127 systems that it considers
     mission-critical converted by January 1998.  IRS is still
     assessing or in the early stages of converting its hardware and
     systems software for two of its three levels of computing
     operations--minicomputers/file servers and personal computers. 
     Of all the infrastructure areas, according to IRS' tracking
     systems, telecommunications is at the highest risk for not being
     completed by January 31, 1999. 

  -- In addition to converting systems, IRS is undertaking two major
     system replacement projects as part of its Year 2000 efforts. 
     Both of these projects have encountered some schedule delays. 

  -- In a briefing to this Subcommittee in January 1998, we
     identified two significant risk areas to IRS' Year 2000 efforts. 
     The first was the lack of a master conversion and replacement
     schedule.  The second was a limited approach to contingency
     planning.  IRS is taking actions to address our concerns
     regarding the lack of a master conversion and replacement
     schedule.  However, we remain concerned that IRS' current
     approach to contingency planning does not address the likelihood
     that system failures could occur once systems are implemented. 


--------------------
\1 Year 2000 Computing Crisis:  An Assessment Guide
(GAO/AIMD-10.1.14, Sept.  1997). 


   STATUS OF CONVERSION AND
   REPLACEMENT EFFORTS
-------------------------------------------------- Chapter STATEMENT:1

To assist agencies in their Year 2000 conversion efforts, we
developed an assessment guide that includes a structured,
step-by-step approach that agencies may use for reviewing and
assessing their readiness to handle the Year 2000 problem.  The
assessment guide states that the Year 2000 conversion efforts should
be managed as a single, large information systems project.  The
assessment guide describes in detail the five phases of a Year 2000
conversion process (i.e., awareness, assessment, renovation,
validation, and implementation).  Each of these phases represents a
major Year 2000 program activity or segment.  To successfully address
the Year 2000 problem, effective program and project management is
required for all five phases. 

IRS' Chief Information Officer (CIO) established several parallel
efforts to help ensure that IRS achieves Year 2000 compliance by
January 31, 1999.  These efforts include creating the Century Date
Change Project Office, which is responsible for coordinating the
conversion of most existing information systems that can be made Year
2000 compliant as well as ensuring that all systems are converted in
accordance with a 14-step conversion process.  That process
incorporates the five phases included in our assessment guide.  Some
of the steps involved in converting existing systems include (1)
correcting millions of lines of application code; (2) upgrading
thousands of hardware and systems software products for IRS' three
levels of computing operations--mainframes, minicomputers/file
servers, and personal computers, (3) upgrading telecommunications
networks; and (4) ensuring that external data exchanges are Year 2000
compliant. 

The other parallel Year 2000 efforts are two major system replacement
projects--the replacement of the Distributed Input System (DIS) and
the Remittance Processing System (RPS) with the Integrated Submission
and Remittance Processing (ISRP) system and the consolidation of the
mainframe computer processing operations at 10 service centers to 2
computing centers.  IRS personnel use DIS to input taxpayer data and
RPS to input remittance data.  According to IRS, these two systems
are old, and it is not cost-beneficial to make them Year 2000
compliant.  Therefore, IRS decided to replace DIS and RPS with ISRP. 
ISRP will be piloted in two phases at the Austin Service Center.  The
first phase is underway and the second phase is scheduled to begin
July 31, 1998.  Nationwide implementation is scheduled for January
1999. 

As a part of its mainframe consolidation effort, IRS is to (1)
replace and/or upgrade service center mainframe hardware, systems
software, and the associated telecommunications infrastructure; (2)
replace about 16,000 terminals that support frontline customer
service and compliance operations; and (3) replace the Communication
Replacement System (CRS) that provides security functions for on-line
taxpayer account databases.  Replacements of the terminals and CRS
are critical to IRS' achieving Year 2000 compliance. 


      CONVERSION OF EXISTING
      SYSTEMS
------------------------------------------------ Chapter STATEMENT:1.1

According to IRS, before January 1999, it needs to complete 12 steps
of its 14-step process for converting (1) the applications for its
existing systems; (2) telecommunications networks; and (3) systems
software and/or hardware for mainframes, minicomputers/file servers,
and personal computers.  In addition, before January 31, 1999, IRS
needs to (1) make its systems for external data exchanges Year 2000
compliant; (2) replace its data input and remittance processing
systems and, at a minimum, the Year 2000 portions of its mainframe
consolidation program; and (3) modify application software to
implement tax law changes for the 1999 and 2000 filing seasons. 

Much of IRS' initial Year 2000 efforts focused on the awareness and
assessment phases for the applications for existing information
systems controlled by the CIO.\2 In May 1997, IRS began assessing the
date dependencies of applications for information systems that were
controlled by either field offices or business functional areas
(hereafter referred to as field/customer systems).  As a result of
the CIO and field/customer system assessments, as of March 31, 1998,
IRS had identified 127 mission-critical systems, including 7
telecommunications systems. 

IRS has made more progress in converting its applications than in
converting its information systems infrastructure.  Specifically, as
of March 31, 1998, IRS reported that it had completed the first 12
steps of its 14-step conversion process for applications for about 59
(46 percent) of its 127 mission-critical systems.  IRS' goal is to
convert the applications for the remaining 68 mission-critical
systems by January 31, 1999.  IRS officials said they believe they
are on track for meeting that goal. 

IRS has completed its assessment of the hardware and systems software
for its mainframe computers.  Conversion efforts for other
infrastructure areas---hardware and systems software for
minicomputers/file servers and personal computers, telecommunications
networks, and external data exchanges--are, for the most part, either
in the assessment phase or the early stages of conversion.  According
to IRS, of these areas, telecommunications networks will likely
present the most significant conversion challenge and may be at the
highest risk for not being completed by January 31, 1999. 

According to IRS, the capability to exchange information, both voice
and data, among various computer systems is the backbone of IRS'
ability to perform all of its tax processing and customer service
functions.  IRS uses a telecommunications network that is supported
through the Department of the Treasury and additional networks that
are unique to IRS.  As of March 10, 1998, IRS had an inventory of the
components that are included in Treasury's network and was verifying
a preliminary inventory of the components in the networks unique to
IRS.  A contractor is currently doing a risk assessment to help
develop a conversion schedule so that the most important work will be
scheduled first to minimize adverse impacts if IRS is unable to
complete all of its telecommunications work by January 31, 1999. 


--------------------
\2 CIO-controlled systems are generally large, mainframe-based tax
processing systems.  Field or business functional area systems are
smaller, more specialized systems that use a variety of platforms. 


      SYSTEM REPLACEMENT EFFORTS
------------------------------------------------ Chapter STATEMENT:1.2

The two major system replacement projects included in IRS' Year 2000
efforts are experiencing some schedule slippages.  For example,
certain software development for ISRP that was to be completed in
April 1998 is now scheduled to be done in June 1998.  As a result,
the time available for testing before the start of the second phase
of the pilot has been reduced.  ISRP officials do not believe this
two-month delay will affect either the start of the second phase of
the ISRP pilot or its nationwide implementation.  According to IRS
officials, IRS has revised its mainframe consolidation completion
schedule because of field office concerns about the ambitious
schedule and pending expanded business requirements.  Under the
revised schedule, IRS plans to delay the consolidation of data
processing operations of five service centers from 1998 until after
June 1999.  IRS officials said they expect to complete the Year 2000
portions of mainframe consolidation (e.g., terminal replacement and
CRS) by January 31, 1999.  However, according to IRS' weekly status
reports on mainframe consolidation, CRS has been experiencing some
difficulties and is somewhat behind its original schedule for system
testing. 


   IRS IS TAKING ACTIONS TO
   DEVELOP A MASTER CONVERSION AND
   REPLACEMENT SCHEDULE
-------------------------------------------------- Chapter STATEMENT:2

In our January briefing to your office, we identified two major risk
areas for IRS' Year 2000 effort:  (1) the lack of an integrated
master conversion and replacement schedule and (2) a limited approach
to contingency planning.  IRS is taking action to have a contractor
develop a master conversion and replacement schedule.  A master
conversion and replacement schedule, according to our Year 2000
assessment guide, should be a part of an agency's Year 2000 Program
Plan.  This schedule could be used to track the progress of
concurrent and interdependent projects that must be ready for
integrated systems testing at the end of January 1999.  This year,
IRS has a host of activities that it must complete concurrently so
that its systems will be able to function correctly in 2000. 
Managing the interdependencies of these activities is critical to
help IRS ensure the timely completion of its Year 2000 effort. 

A master conversion and replacement schedule could (1) establish the
sequential relationships between the tasks associated with the Year
2000 conversion and replacement activities, (2) identify how much a
task can slip without affecting other tasks or the overall Year 2000
effort, (3) help determine whether programming and testing resources
are likely to be available when needed, and (4) provide a tool for
prioritizing and assigning programming and testing resources that are
essential to the success of all Year 2000 efforts in the most
efficient manner. 

Recognizing that several major and complex projects, including
application software changes that are needed to implement recent tax
legislation, must be completed before the 1999 filing season, in
November 1997, the Commissioner of Internal Revenue announced the
establishment of an executive steering committee.  This committee is
to identify risks to the 1999 filing season and the entire Year 2000
effort and take actions to mitigate those risks.  As a part of this
effort, IRS developed a Century Date Change Project Schedule for its
Year 2000 activities.  Although the project schedule identifies the
tasks for major Year 2000 activities, their corresponding start and
finish dates, and the primary organizations responsible for them, the
schedule does not yet establish a link between related tasks or
analyze how the timing of the various tasks may affect resource
availability.  Until these actions are complete, IRS cannot project
whether resources will be available when needed for concurrent tasks. 
Thus, IRS faces the risk that resources may not be available when
needed. 

IRS currently has a contractor working on the development of an
integrated schedule of its Year 2000-related efforts, including
making all of the necessary tax law changes for 1999.  If properly
developed, this schedule should meet the intent of the master
conversion and replacement schedule called for in our assessment
guide.  But time is running out for completing such a schedule. 
Unless IRS obtains this schedule soon, its value as a management tool
to help anticipate bottlenecks is diminished. 


   IRS' CONTINGENCY PLANNING
   APPROACH POSES RISK TO
   CONTINUITY OF OPERATIONS
-------------------------------------------------- Chapter STATEMENT:3

Contingency planning was the second risk area we identified in our
January 1998 briefing.  In part, due to concerns that the same
resources that are doing Year 2000 conversion work would be needed to
do contingency planning, IRS officials decided to develop a
contingency planning process that would minimize the number of
contingency plans that would have to be developed.  Accordingly, IRS'
"Century Date Change Contingency Management Plan" calls for
developing contingency plans only for those business functions or
processes that are supported by application projects that are at risk
of not being made Year 2000 compliant on schedule. 

The Century Date Change Project Office has established criteria to
identify such projects.  For these projects, IRS is to initiate a
business function impact analysis.  Once that analysis is complete,
technical and business owners evaluate available alternatives,
including using any existing contingency procedures, such as manual
procedures, or using an alternative technological solution, such as
commercial off-the-shelf software.  IRS plans to use a similar
approach for initiating contingency plans for business functions when
the conversion of infrastructure areas such as systems software,
external data exchanges, and telecommunications network components
fall behind schedule. 

IRS' "Century Date Change Contingency Management Plan" does not
address the likelihood that information systems that are converted on
schedule may experience system failures.  As a result, IRS will be
ill-prepared to effectively manage all Year 2000-induced system
failures that could affect core business processes.  IRS' contingency
management plan does not address the possibility that (1) IRS may
have overlooked a date dependency during its assessment phase of
applications or infrastructure areas or (2) even if system conversion
and replacement efforts are completed on time and fully tested,
unexpected system failures may occur. 

Aspects of contingency planning are under way for IRS' replacement
projects (i.e., ISRP and mainframe consolidation).  For example, the
ISRP project office has developed a contingency plan that identifies
(1) various risks to the ISRP pilot and nationwide implementation,
(2) the probability of those risks, and (3) contingency options for
addressing those risks.  Also, as part of a larger effort to enhance
IRS' disaster recovery capabilities, IRS officials said they hope to
finalize expanded disaster recovery requirements for service center
data processing in May 1998 so that those requirements can be
included in the mainframe consolidation project. 

Our exposure draft on business continuity and contingency planning
states that agencies must start business continuity and contingency
planning now to reduce the risk of Year 2000 business failures.\3
Among other things, the exposure draft states that agencies need to
do a business impact analysis to determine the effect of
mission-critical system failures on the viability of agency
operations.  This analysis is to include examining business
priorities; dependencies; service levels; and, most importantly, the
business process dependency on mission-critical information systems. 
According to our exposure draft, the business impact analysis
triggers the development of contingency plans for each core business
process, including any information system components that support
that process.  Contingency plans would also address the actions IRS
may take, for example, to notify taxpayers in the event that Year
2000 failures cause significant delays in processing tax returns and
issuing refunds. 

In summary, IRS established the goal to complete its Year 2000 work
by January 31, 1999, so that it would have converted and replaced
systems implemented for the 1999 filing season.  By establishing this
goal, IRS built a safety net into its schedule to allow time to work
out problems with converted and replaced systems before January 1,
2000.  However, given the conversion status of some of its
infrastructure areas, IRS runs the risk of not completing all of its
work by the January 31, 1999, milestone.  Moreover, even if all of
IRS' work is completed according to schedule, the potential exists
for failures in systems that were fully assessed, converted, tested
and implemented according to schedule.  We remain concerned about
IRS' narrow approach to contingency planning which focuses on
developing contingency plans only for business functions that are
supported by information systems projects that have a known risk of
not being completed according to schedule.  Under this approach, IRS
has no assurance that its core business processes will be able to
continue to function, albeit, possibly at some reduced level of
service, in the event that Year 2000-induced system failures occur in
systems that were converted according to schedule. 


--------------------
\3 Year 2000 Computing Crisis:  Business Continuity and Contingency
Planning (GAO/AIMD-10.1.19, Mar.  1998). 


------------------------------------------------ Chapter STATEMENT:3.1

That concludes my prepared statement.  We welcome any questions that
you may have. 

*** End of document. ***