[Evaluation Report on the Year 2000 Readiness of Automated Information Systems at the Bureau of Indian Affairs]
[From the U.S. Government Printing Office, www.gpo.gov]

Report No. 98-I-479

Title: Evaluation Report on the Year 2000 Readiness of Automated
       Information Systems at the Bureau of Indian Affairs

Date:  June 5, 1998




                  **********DISCLAIMER**********

This file contains an ASCII representation of an OIG report.
No attempt has been made to display graphic images or illustrations.
Some tables may be included, but may not resemble those in the printed version.

A printed copy of this report may be obtained by referring to the PDF
file or by calling the Office of Inspector General, Division of
Acquisition and Management Operations at (202) 208-4599.

                  ******************************




U.S. Department of the Interior
Office of Inspector General


EVALUATION REPORT


YEAR 2000 READINESS OF
AUTOMATED INFORMATION SYSTEMS AT THE
BUREAU OF INDIAN AFFAIRS

REPORT NO. 98-I-479
JUNE 1998




EVALUATION REPORT


Memorandum

To:       Assistant Secretary for Indian Affairs
          The Special Trustee for American Indians

From:     Robert J. Williams
          Acting Inspector General

Subject:  Evaluation Report on the Year 2000
          Readiness of Automated Information
          Systems at the Bureau of Indian Affairs (No. 98-I-479)



INTRODUCTION

This report presents the results of our evaluation of the year 2000 (Y2K) readiness of
automated information systems at the Bureau of Indian Affairs.  The objective of our review
was to determine whether the Bureau (1) inventoried its automated information systems and
identified those systems that were mission critical and were not Y2K compliant, (2)
developed auditable cost estimates for renovating systems to be Y2K compliant, (3)
identified by name an individual responsible for ensuring that the Bureau is Y2K compliant,
(4) ensured that responsible individuals' personnel performance evaluation plans included
critical elements related to identifying and remedying Y2K problems, (5) developed a
credible plan that included milestones and a critical path to ensure that the Bureau is Y2K
compliant, and (6) developed a contingency plan that would address the failure of any part
of the systems not being Y2K ready.  This review was conducted at the request of the
Department of the Interior's Chief Information Officer to assist the Information Officer in
monitoring the progress of Departmental agencies in ensuring Y2K readiness, implementing
Y2K compliant systems, and validating the accuracy of the information reported by the
bureaus and Departmental offices to the Chief Information Officer.


BACKGROUND

The "Y2K problem" is the term used to describe the potential failure of information
technology systems, applications, and hardware related to the change to the year 2000.
Many computers that use two digits to keep track of the date will, on January 1, 2000,
recognize "double zero" not as 2000 but as 1900.  This could cause computers to stop
running or to start generating erroneous data. The problem has been recognized as nationally
significant by the President in Executive Order No. 13073, issued in February 1998.  The
Secretary of the Interior, in a December 1997 memorandum, stated that the Y2K problem
was critical to the Department's meeting its mission and that resolution of the problem was
one of his highest  priorities.  Further, Office  of Management  and  Budget Memorandum
98-02, "Progress Reports on Fixing Year 2000 Difficulties," issued on January 20, 1998,
requires all Federal executive branch agencies, to ensure that Federal Government systems
do not fail in the year 2000, to have all systems, applications, and hardware renovated by
September 1998; validated by January 1999; and implemented (that is, "fixes to all systems--
both mission critical and nonmission critical") by March  31, 1999,   to ensure that Federal
Government systems do not fail in the year 2000.  The Office of Management and Budget
states in Memorandum 98-02 that it is to provide "information to the Congress and the public
as part of its [Office of Management and Budget's] quarterly summary reports on agency
progress . . . [and] to report on the status of agency validation and contingency planning
efforts and on progress in fixing . . . equipment that is date sensitive."

The Department has a multitiered approach to managing the Y2K problem that includes a
top tier comprising the Secretary of the Interior; the Information Technology Steering
Committee, which comprises the Chief of Staff and Assistant Secretaries; and the Chief
Information Officer, who is responsible for the Department's Y2K issues.  This tier, which
represents senior-level Departmental managers, provides the Y2K project's overall direction
and resources and ensures accurate reporting to external organizations such as the Office of
Management and Budget and the Congress.  A Departmentwide Y2K project team, which
reports to the Chief Information Officer and comprises representatives from each agency and
the Office of the Secretary, is tasked with developing the Department's Year 2000
Management Plan, refining inventory data on the Department's mission-critical and
information technology portfolio systems, and monitoring and reporting the progress of each
conversion.  In addition, a Y2K Embedded Microchip Coordinators Team has been
established to inventory and monitor embedded microchip technology Y2K problems.  The
team  is led by the Office of Managing Risk and Public Safety and comprises representatives
of the eight Departmental bureaus, the Denver Administrative Service Center, and various
Departmental offices. The Department has developed the "Department of the Interior Year
2000 Management Plan," which focuses on resolution of the Y2K problem and provides an
overall strategy for managing Departmental mission-critical systems and infrastructure.

The Department's February 1998 "Year 2000 Management Plan," which was submitted to
the Office of Management and Budget, reported that the Department had 95 mission-critical
systems.  Of the 95 mission-critical systems reported by the Department to the Office of
Management and Budget, the Bureau of Indian Affairs and the Office of the Special Trustee
for American Indians had 15 systems (see Appendix 1), of which 4 are included in the
Department's information technology portfolio. To address the Y2K problems, the Bureau
and the Office of the Special Trustee established a project management team comprising
senior executives and a task group.  The senior executives are the Acting Director, Office of
Management and Administration, Bureau of  Indian Affairs, and the Deputy Director for
Operations, Office of the Special Trustee.  The task group comprises a manager and a
coordinator from the Office of Information Resources Management and nine members from
the Bureau's Operations Service Center (3) and other Program offices (5) and the Office of
the Special Trustee's Office of Trust Funds Management.


SCOPE OF EVALUATION

To accomplish our objective, we reviewed the documentation available that supported the
Bureau of Indian Affairs information submitted to the Department's Chief Information
Officer  through February 1998.  We performed our review at the Bureau's Operations
Service and Facilities Management and Construction Centers and the Office of  the Special
Trustee for American Indians Office of Trust Funds Management, all of which are located
in Albuquerque, New Mexico. We interviewed personnel responsible for project
coordination to identify the Bureau's Y2K plans and progress.  We also interviewed
personnel involved in various aspects of the Y2K project, including coordination,
compliance identification, software remediation, and project management.

The evaluation was conducted in accordance with the "Quality Standards for Inspections,"
issued by the President's Council on Integrity and Efficiency and, accordingly, included such
tests and inspection procedures considered necessary to accomplish the objective.  Our
conclusions on the status of the progress made by the Bureau in addressing and remediating
Y2K problems were based on reviews of documentation maintained by the Operations
Service Center and discussions with the Y2K coordinator and the Y2K task group members
who performed remediation or replacement of noncompliant applications or hardware.  As
specifically agreed to in our discussions with the Department's Chief Information Officer,
we did not validate or certify that the Bureau's systems were Y2K compliant.


RESULTS OF EVALUATION

Although the Bureau's Y2K project management had begun to identify systems and had
developed a master plan for remedying Y2K problems, it had not completed any of the six
objectives that the Chief Information Officer had requested us to evaluate.  The specific
actions taken by the Bureau related to each objective are discussed in the paragraphs that
follow.  As a result of not completing the objectives, we believe that there is an increased
risk that the Bureau may not meet the Office of Management and Budget's target date of
March 1999 for having compliant Y2K systems implemented.  The Bureau has recently
awarded contracts to assist in its assessment, renovation, and implementation of compliant
systems; therefore, we have not made any recommendations.  However, the Bureau should
ensure that sufficient resources are made available to meet its milestone dates.


Automated Information Systems Inventory

All of the Bureau's mission- and nonmission-critical automated information systems may
not have been included in its inventory.  According to the Department's milestone dates,
agencies were required to have mission-critical systems inventoried and systems that were
not Y2K compliant identified by June 1997.  Although national systems that were deemed
mission critical by the Bureau had been identified and noncompliance had been determined,
8 of the 12 Bureau area offices and 10 of 15 Bureau program and division offices had not
responded to inventory requests made by the Bureau's Director, Office of Management and
Administration, dated January, July, and September 1997.   Therefore, the Bureau had little
assurance that all mission- and nonmission-critical systems had been identified and reported
to the Department's Chief Information Officer.


Auditable Cost Estimates

The documentation used to support the Bureau's cost estimates for correcting the Y2K
problem in each of the Bureau's 15 mission-critical systems was not maintained.  To
accurately report the costs associated with correcting the Y2K problem, Office of
Management and Budget guidelines state that costs to rectify noncompliant Y2K systems
should be specifically related to Y2K efforts, such as repairing the lines of source code or
replacing the systems.  If a noncompliant system is to be replaced for reasons not specifically
attributable to Y2K, the cost of replacement should not be reported as a cost to correct the
Y2K problem. However, any contract costs that are associated with the Bureau's efforts in
assessing, renovating, and implementing Y2K-ready systems should be included in the
Bureau's cost estimates.

Although the Bureau's cost estimates were not auditable, we attempted to determine whether
the methodology used by the Y2K task group to develop cost estimates was reasonable based
on a "re-creation" of cost estimates for 2 of the 15 systems.  The original methodology used
by the Bureau was based on an estimate of the percentage of date-sensitive lines of source
code to the total number of lines of source code multiplied by the Gartner Group's estimated
cost of $1.70 per line of source code to be corrected.  We determined that the methodology
used to develop the costs was reasonable; however, the estimates had not been updated to
reflect more recent information that may affect the estimates.  For example, applications that
run on the UNISYS platform were being "cleaned up" by deleting unnecessary lines of
source code, including the Oil and Gas module that had its total lines of source code reduced
from 43,989 to 41,250.  The methodology used by the Bureau may require that the estimated
lines of source code requiring remediation and the associated cost estimate be reduced. Also,
the cost to correct the Facilities, Construction, Operations, and Maintenance (FACCOM)
system, which is run on the IBM mainframe platform, for Y2K compliance will not be
accomplished through the code remediation effort, as originally anticipated by the Bureau.
Instead, the FACCOM system is scheduled to be replaced by March 1999.  The replacement
system is necessary to allow the system to operate with current mainframe or client/server
operating systems, not for reasons directly related to correcting Y2K problems.  Therefore,
the estimated cost of $254,000 reported to correct the Y2K problem for the FACCOM
system was overstated.

In addition, the cost of $4.8 million to remediate the Y2K problem in the Individual Indian
Monies (IIM) system as reported to the Department was incorrect.  The $4.8 million  was the
estimated cost for the first year of development and implementation of  the IIM  replacement
system.  The IIM is being replaced for a number of reasons, such as to meet the requirements
mandated by the American Indian Trust Fund Management Reform Act of 1994, not just to
correct the Y2K problem; therefore, the $4.8 million reported to remediate the Y2K problem
was overstated.  However, because the IIM replacement system is not planned to be
implemented until after the year 2000, costs to repair the existing system should be estimated
and reported to the Department.


Designation of Responsible Individuals

The Departmental Chief Information Officer requested that we determine whether
responsible officials had been specifically named.  As of March 18, 1998, the Assistant
Secretary for Indian Affairs had designated, by title, the Y2K executive; by office, the Y2K
coordinating office; and by name, the individuals who made up the Y2K task group. In
addition, a representative from the Office of the Special Trustee was included as part of the
Bureau's Y2K task group. We believe that designating the Y2K executive by title and the
Y2K coordinating office by office rather than by name and title of individuals did not meet
the intent of the Chief Information Officer's request to have responsible individuals named.


Annual Personnel Performance Evaluation Plans

The Secretary of the Interior's December 1997 memorandum and the Assistant Secretary for
Indian Affairs February 1998 memorandum required that "a critical performance element for
identifying and remedying the Y2K" problem be included as part of each responsible
official's annual performance plan.  Responsible officials are defined in the memorandum
as agency directors, agency Y2K executives, agency information resources management
coordinators, safety officials, and all others as determined by the Y2K executive. In addition,
the Assistant Secretary required that the elements be included in the annual personnel
performance plans by February 27, 1998.  However, as of March 18, 1998, we found that
except for one member of the Y2K task group, the elements were not included in the annual
personnel performance plans of the Bureau's  and the Office of the Special Trustee's Y2K
executives and the individual members of the Y2K task group, which included the Director,
Information Resources Management.


Plan for Milestones

We found no documentation to support the milestones established by the Bureau. The 15
systems included in the Bureau's inventory were being evaluated and remediation was
planned for Y2K compliance.  However, the milestone dates established in the Bureau's Y2K
master plan for analyzing existing code had slipped by approximately 2 months.  According
to a member of the Y2K task group, these dates were not met because the software tool
planned for use in identifying and assisting in remediating lines of source code was originally
estimated to be available in January 1998; however, as of March 18, 1998, the tool had not
been purchased.  Therefore, the current Y2K master plan may not reflect achievable
milestone dates.  However, Bureau officials indicated at the exit conference and in the
Bureau's written response that they believed the acquisition of the "Millennium Solution"
tool has brought the Bureau back on schedule.


Contingency Plans

We found that a formal contingency plan had been developed for only 1 of the 15 mission-
critical systems. Since the milestone dates established by the Bureau have slipped by
approximately 2 months, there may be a need for formalizing contingency plans for the
remaining 14 systems.  If additional mission-critical systems are subsequently identified (see
section "Automated Information Systems Inventory" in this report), contingency plans for
these systems may also need to be developed.  However, the Y2K task group member
responsible for the Bureau's application software and national systems stated that once the
software tool was acquired, the milestone dates established in the master plan for the 15
systems could be met through personnel efforts such as increasing the number of shifts
worked and the number of contractor staff.


Other Issues

The Department of the Interior and the Office of Management  and Budget required that an
inventory of all data exchanges with outside parties be completed by February 1, 1998, and
that coordination with these parties to determine a transition plan occur by March 1, 1998.
The Assistant Secretary for Indian Affairs had established a March 30, 1998, target date for
the Y2K task group to contact the tribes and tribal organizations to ensure that systems which
interface with Bureau systems are Y2K compliant.  However,  we found that the letter
requesting  information from the Bureau's data exchange  partners to accomplish the
coordination effort had not been issued as of March 18, 1998.

The Bureau has reported to the Departmental Chief Information Officer that it has four
systems which are compliant except for independent verification and validation.  However,
the Bureau has not conducted regression testing, integrated testing, or Y2K testing  on
these systems.  Instead, the Bureau's Y2K project management has relied on the recent
design and implementation of these systems.

On May 12, 1998, we held an exit conference to discuss a preliminary draft of the report
with Y2K officials from the Bureau and the Office of the Special Trustee and with the
Department's Deputy Chief Information Officer.  Office of the Special Trustee officials
generally agreed with our findings but provided no written response to the report.  Bureau
officials also generally agreed with our findings and provided additional information in a
May 15, 1998, response (see Appendix 2).  Based on the discussions and the response, we
made changes to the report as appropriate; however, we did not revise our report to reflect
changes or improvements made by the Bureau since March 18, 1998.  In its response, the
Bureau stated that contracts had been awarded and corrective actions were being taken to
ensure that its automated information systems will be Y2K compliant.

The legislation, as amended, creating the Office of Inspector General requires semiannual
reporting to the Congress on all audit reports issued, the monetary impact of audit findings,
actions taken to implement audit recommendations, and identification of each significant
recommendation on which corrective action has not been taken.

We appreciate the assistance of personnel at the Bureau of Indian Affairs and the Office
of the  Special Trustee for American Indians in the conduct of our audit.


BUREAU OF INDIAN AFFAIRS MISSION-CRITICAL SYSTEMS INVENTORY

System Name or Acronym


Description

Estimated Cost for Compliance



Social Services
A system that processes general assistance
payments to individual Indians.
                                                             $72,250
Individual Indian Monies
(IIM)  Tracks funds due individual Indians and tribes
from leasing, permits, and other uses of Indian
lands. (Interfaces with IRMS.)                              $4,800,000
Land Records Information
System (LRIS)  A land title system showing and tracking
Indian ownership, including all rights
conveyed or changed over time.  Provides
official reports for title status and probate
inventory.                                                   $68,000
Omni Trust ES  A system for tracking funds applied to Indian
trust accounts and allotments to individual
Indians.  Records investing and payout
information. (Interfaces with IRMS.)                         0
Facilities,  Construction,
Operations, and
Maintenance (FACCOM)   Maintains facilities inventory data, prioritizes
deferred maintenance deficiencies, monitors
progress of constructions projects, and
calculates operations and maintenance funding
for all property owned or operated by the
Bureau of Indian Affairs.                                    $254,000
National Indian Irrigation
Management System
(NIIMS)  Tracks and bills assessments for costs of
operations and maintenance of Indian
irrigation projects to be reimbursed to the
Government.                                                  $42,500




System Name or Acronym


Description
                          Estimated
Cost for
Compliance

Lease/Range - Subsystem
of the Integrated Records
Management System
(IRMS)  A system for managing payouts for leases on
Indian lands, based on interests in contracts on
Indian lands.                                                $43,000
Owner - Subsystem of the
Integrated Records
Management System
(IRMS)  A system that tracks ownership of Indian
tribal and trust lands.                                      $35,000
People - Subsystem of the
Integrated Records
Management System
(IRMS)    A census and demographic database on
individuals who are enrolled members of
tribes or who have interests in Indian trust
assets.                                                      $34,700
Royalty Distribution and
Reporting System (RDRS)  A tracking system for mineral and surface
land ownership for oil and mineral leases.                   $9,200
Lease Distribution  A payout system for leases on Indian trust
lands                                                        $1,700
Loan Management
Accounting System
(LOMAS)  A loan management and accounting system
for economic development programs.
Osage Annuity System  A system to pay out monies to members of the
Osage Tribe who are decedents of the original
Head Right owners.
Tribal Allocation Priority
System (TAPS)  A system that is used to develop budget
estimates based on tribal priorities.                        $5,000
Land Title Mapping
System (GIS)  A geographical information system (GIS) that
has been tailored to support the use and
application of spatial data technologies
throughout the Bureau of Indian Affairs.
Reports boundary and ownership in a land
status map.

Total                                                     $5,365,350




ILLEGAL OR WASTEFUL ACTIVITIES SHOULD BE REPORTED TO THE OFFICE OF
INSPECTOR GENERAL BY:

Sending written documents to:



Within the Continental United States

U.S. Department of the Interior
Office of Inspector General
1849 C Street,N.W.
Mail Stop 5341
Washington, D.C. 20240

Calling:

Our 24 hour
Telephone HOTLINE
1-800-424-5081 or
(202) 208-5300

TDD for hearing impaired
(202) 208-2420 or
1-800-354-0996



Outside the Continental United States


Caribbean Region

U.S. Department of the Interior
Office of Inspector General
Eastern Division- Investigations
1550 Wilson Boulevard
Suite 410
Arlington, Virginia 22209

Calling:
(703) 235-9221


North Pacific Region

U.S. Department of the Interior
Office of Inspector General
North Pacific Region
238 Archbishop F.C. F'lores Street
Suite 807, PDN Building
Agana, Guam 96910


Calling:
(700) 550-7428 or
COMM 9-011-671-472-7279