Finally the last installment of the PDF file from the GAO, (is anyone still following this:o) http://www.gao.gov/new.items/ai99234t.pdf
 

United States General Accounting Office Testimony

Before the Subcommittee on Government Management,
Information and Technology, Committee on Government
Reform, House of Representatives

For Release on Delivery Expected at 9 a.m. EDT Friday, July 9, 1999
YEAR 2000 COMPUTING CHALLENGE

Important Progress Made, Yet Much Work Remains to  Avoid Disruption of Critical Services

Statement of Joel C. Willemssen

Director, Civil Agencies Information Systems

Accounting and Information Management Division
 

The Presidents Council is to be commended on the strides that it has made
to obtain Year 2000 readiness data critical to the nations well-being as well
as its other initiatives, such as the establishment of the Senior Advisors
Group. To further reduce the likelihood of major disruptions, in testimony
this January, we suggested that the Council consider additional actions
such as continuing to aggressively pursue readiness information in the
areas in which it is lacking.46 If the current approach of using associations
to voluntarily collect information does not yield the necessary information,
we suggested that the Council may wish to consider whether legislative
remedies (such as requiring disclosure of Year 2000 readiness data) should
be proposed. In response to this suggestion, the Council Chair stated that
the Council has focused on collaboration and communication with
associations and other groups as a means to get industries to share
information on their Year 2000 readiness and that the Council did not
believe that legislation would be necessary. The Councils next sector
report is expected to be released later this month.
 

Subsequent to the Councils April report, surveys in key sectors have been
issued. In addition, we have issued several products related to several of
these sectors. I will now discuss the results of some of these surveys and
our reviews.
 

Energy Sector

In April, we reported that while the electric power industry had concluded
that it had made substantial progress in making its systems and equipment
ready to continue operations into the year 2000, significant risks remained
since many reporting organizations did not expect to be Year 2000 ready
within the June 1999 industry target date.47 We, therefore, suggested that
the Department of Energy (1) work with the Electric Power Working Group
to ensure that remediation activities were accelerated for the utilities that
expected to miss the June 1999 deadline for achieving Year 2000 readiness
and (2) encourage state regulatory utility commissions to require a full
public disclosure of Year 2000 readiness status of entities transmitting and
distributing electric power. The Department of Energy generally agreed
with our suggestions. We also suggested that the Nuclear Regulatory
Commission (1) in cooperation with the Nuclear Energy Institute, work
with nuclear power plant licensees to accelerate the Year 2000 remediation
efforts among the nuclear power plants that expect to meet the June 1999
deadline for achieving readiness and (2) publicly disclose the Year 2000
readiness of each of the nations operational nuclear reactors. In response,
the Nuclear Regulatory Commission stated that it plans to focus its efforts
on nuclear power plants that may miss the July 1, 1999, milestone and that
it would release the readiness information on individual plants that same
month.

46 GAO/T-AIMD-99-50, January 20, 1999.
47 Year 2000 Computing Crisis: Readiness of the Electric Power Industry (GAO/AIMD-99-114, April 6,
1999).

Subsequent to our report, on April 30, 1999, the North American Electric
Reliability Council released its third status report on electric power
systems. According to the North American Electric Reliability Council, as
of March 31, 1999, reporting organizations, on average, had completed
99 percent of the inventory phase, 95 percent of the assessment phase, and
75 percent of the remediation/testing phase.

In May, we reported 48 that while the domestic oil and gas industries had
reported that they had made substantial progress in making their
equipment and systems ready to continue operations into the year 2000,
risks remained. In particular, a February industrywide survey found that
over a quarter of the oil and gas industries reported that they did not expect
to be Year 2000 ready until the second half of 1999leaving little time for
resolving unexpected problems. Moreover, although over half of our oil is
imported, little was known about the Year 2000 readiness of foreign oil
suppliers. Further, while individual domestic companies reported that they
were developing Year 2000 contingency plans, there were no plans to
perform a national-level risk assessment and develop contingency plans to
deal with potential shortages or disruptions in the nations overall oil and
gas supplies. We suggested that the Councils oil and gas working group
(1) work with industry associations to perform national-level risk
assessments and develop and publish credible, national-level scenarios
regarding the impact of potential Year 2000 failures and (2) develop
national-level contingency plans. The working group generally agreed with
these suggestions.
 

48 Year 2000 Computing Crisis: Readiness of the Oil and Gas Industries (GAO/AIMD-99-162, May 19,
1999).
 

Water Sector
 

As I previously mentioned, the Councils January and April assessment
reports provided only a general assessment of the drinking water sector
and did not contain detailed data. Similarly, in April we reported 49 that
insufficient information was available to assess and manage Year 2000
efforts in the water sector, and little additional information was expected
under the current regulatory approach. While the Councils water sector
working group had undertaken an awareness campaign and had urged
national water sector associations to continue to survey their
memberships, survey response rates had been low. Further, Environmental
Protection Agency officials stated that the agency lacked the rules and
regulations necessary to require water and wastewater facilities to report
on their Year 2000 status.

Our survey of state regulators found that a few states were proactively
collecting Year 2000 compliance data from regulated facilities, a much
larger group of states was disseminating Year 2000 information, while
another group was not actively using either approach. Additionally, only a
handful of state regulators believed that they were responsible for ensuring
facilities Year 2000 compliance or overseeing facilities business continuity
and contingency plans. Among our suggested actions was that the Council,
the Environmental Protection Agency, and the states determine which
regulatory organization should take responsibility for assessing and
publicly disclosing the status and outlook of water sector facilities Year
2000 business continuity and contingency plans. The Environmental
Protection Agency generally agreed with our suggestions but one official
noted that additional legislation may be needed if the agency is to take
responsibility for overseeing facilities Year 2000 business continuity and
contingency plans.
 
 
 

49 Year 2000 Computing Crisis: Status of the Water Industry (GAO/AIMD-99-151, April 21, 1999).
50 Year 2000 Computing Challenge: Concerns About Compliance Information on Biomedical Equipment
(GAO/T-AIMD-99-209, June 10, 1999).

Health Sector
 

The health sector includes health care providers (such as hospitals and
emergency health care services), insurers (such as Medicare and
Medicaid), and biomedical equipment. With respect to biomedical
equipment, on June 10 we testified 50 that, in response to our
September 1998 recommendation, 51 HHS, in conjunction with the
Department of Veterans Affairs, had established a clearinghouse on
biomedical equipment. As of June 1, 1999, 4,142 biomedical equipment
manufacturers had submitted data to the clearinghouse. About 61 percent
of these manufacturers reported having products that do not employ dates
and about 8 percent (311 manufacturers) reported having date-related
problems such as an incorrect display of date/time. According to the Food
and Drug Administration, the 311 manufacturers reported 897 products
with date-related problems. However, not all compliance information was
available on the clearinghouse because the clearinghouse referred the user
to 427 manufacturers web sites. Accordingly, we reviewed the web sites of
these manufacturers and found, as of June 1, 1999, a total of
35,446 products.52 Of these products, 18,466 were reported as not
employing a date, 11,211 were reported as compliant, 4,445 were shown as
not compliant, and the compliance status of 1,324 was unknown.
 

In addition to the establishment of a clearinghouse, our September 1998
report also recommended that HHS and the Department of Veterans Affairs
take prudent steps to jointly review manufacturers test results for critical
care/life support biomedical equipment. We were especially concerned
that the departments review test results for equipment previously deemed
to be noncompliant but now deemed by manufacturers to be compliant, or
equipment for which concerns about compliance remained. In May 1999,
the Food and Drug Administration, a component agency of HHS,
announced that it planned to develop a list of critical care/life support
medical devices and the manufacturers of these devices, select a sample of
manufacturers for review, and hire a contractor to develop a program to
assess manufacturers activities to identify and correct Year 2000 problems
for these medical devices. In addition, if the results of this review indicated
a need for further review of manufacturer activities, the contractor would
review a portion of the remaining manufacturers not yet reviewed.
Moreover, according to the Food and Drug Administration, any
manufacturer whose quality assurance system appeared deficient based on
the contractors review would be subject to additional reviews to determine
 

51 Year 2000 Computing Crisis: Compliance Status of Many Biomedical Equipment Items Still Unknown
(GAO/AIMD-98-240, September 18, 1998).
52 Because of limitations in many of the manufacturers web sites, our ability to determine the total
number of biomedical equipment products reported and their compliance status was impaired.
Accordingly, the actual number of products reported by the manufacturers could be significantly higher
than the 35,446 products that we counted.

Moreover, according to the Food and Drug Administration, any
manufacturer whose quality assurance system appeared deficient based on
the contractors review would be subject to additional reviews to determine
what actions would be required to eliminate any risk posed by
noncompliant devices.

In April testimony 53 we also reported on the results of a Department of
Veterans Affairs survey of 384 pharmaceutical firms and 459
medical-surgical firms with whom it does business. Of the 52 percent of
pharmaceutical firms that responded to the survey, 32 percent reported
that they were compliant. Of the 54 percent of the medical-surgical firms
that responded, about two-thirds reported that they were compliant.

Banking and Finance Sector

A large portion of the institutions that make up the banking and finance
sector are overseen by one or more federal regulatory agencies. In
September 1998 we testified on the efforts of five federal financial
regulatory agencies 54 to ensure that the institutions that they oversee are
ready to handle the Year 2000 problem. 55 We concluded that the regulators
had made significant progress in assessing the readiness of member
institutions and in raising awareness on important issues such as
contingency planning and testing. Regulator examinations of bank, thrift,
and credit union Year 2000 efforts found that the vast majority were doing a
satisfactory job of addressing the problem. Nevertheless, the regulators
faced the challenge of ensuring that they are ready to take swift action to
address those institutions that falter in the later stages of correction and to
address disruptions caused by international and public infrastructure
failures.

In April, we reported that the Federal Reserve System--which is
instrumental to our nations economic well-being, since it provides
depository institutions and government agencies services such as
processing checks and transferring funds and securities, has effective
controls to help ensure that its Year 2000 progress is reported accurately
and reliably.56 We also found that it is effectively managing the renovation
and testing of its internal systems and the development and planned testing
of contingency plans for continuity of business operations. Nevertheless,
the Federal Reserve System still had much to accomplish before it is fully
ready for January 1, 2000, such as completing validation and
implementation of all of its internal systems and completing its
contingency plans.

53 Year 2000 Computing Crisis: Action Needed to Ensure Continued Delivery of Veterans Benefits and
Health Care Services (GAO/T-AIMD-99-136, April 15, 1999).
54 The National Credit Union Administration, the Federal Deposit Insurance Corporation, the Office of
Thrift Supervision, the Federal Reserve System, and the Office of the Comptroller of the Currency.
55 Year 2000 Computing Crisis: Federal Depository Institution Regulators Are Making Progress, But
Challenges Remain (GAO/T-AIMD-98-305, September 17, 1998).
56 Year 2000 Computing Crisis: Federal Reserve Has Established Effective Year 2000 Management
Controls for Internal Systems Conversion (GAO/AIMD-99-78, April 9, 1999).
 

In addition to the domestic banking and finance sector, large U.S. financial
institutions have financial exposures and relationships with international
financial institutions and markets that may be at risk if these international
organizations are not ready for the date change occurring on January 1,
2000. In April, we reported 57 that foreign financial institutions had
reportedly lagged behind their U.S. counterparts in preparing for the Year
2000 date change. Officials from four of the seven large foreign financial
institutions we visited said they had scheduled completion of their Year
2000 preparations about 3 to 6 months after their U.S. counterparts, but
they planned to complete their efforts by mid-1999 at the latest. Moreover,
key international market supporters, such as those that transmit financial
messages and provide clearing and settlement services, told us that their
systems were ready for the date change and that they had begun testing
with the financial organizations that depended on these systems. Further,
we found that seven large U.S. banks and securities firms we visited were
taking actions to address their international risks. In addition, U.S. banking
and securities regulators were also addressing the international Year 2000
risks of the institutions that they oversee.

With respect to the insurance industry, in March we concluded that
insurance regulator presence regarding the Year 2000 area was not as
strong as that exhibited by the banking and securities industry.58 State
insurance regulators we contacted were late in raising industry awareness
of potential Year 2000 problems, provided little guidance to regulated
institutions, and failed to convey clear regulatory expectations to
companies about Year 2000 preparations and milestones. Nevertheless, the
insurance industry is reported by both its regulators and by other outside
observers to be generally on track to being ready for 2000. However, most
of these reports are based on self-reported information and, compared to
other financial regulators, insurance regulators efforts to validate this
information generally began late and were more limited.

57 Year 2000: Financial Institution and Regulatory Efforts to Address International Risks
(GAO/GGD-99-62, April 27, 1999).
58 Insurance Industry: Regulators Are Less Active in Encouraging and Validating Year 2000 Preparedness
(GAO/T-GGD-99-56, March 11, 1999).
 

In a related report in April,59 we stated that variations in oversight
approaches by state insurance regulators also made it difficult to ascertain
the overall status of the insurance industrys Year 2000 readiness. We
reported that the magnitude of insurers Year 2000-related liability
exposures could not be estimated at that time but that costs associated
with these exposures could be substantial for some property-casualty
insurers, particularly those concentrated in commercial-market sectors. In
addition, despite efforts to mitigate potential exposures, the Year
2000-related costs that may be incurred by insurers would remain uncertain
until key legal issues and actions on pending legislation were resolved.

Transportation Sector

A key component to the nations transportation sector are airports. This
January we reported on our survey of 413 airports. 60 We found that while
the nations airports are making progress in preparing for the year 2000,
such progress varied. Of the 334 airports responding to our survey, about
one-third reported that they would complete their Year 2000 preparations
by June 30, 1999. The other two-thirds either planned on a later date or
failed to estimate any completion date, and half of these airports did not
have contingency plans for any of 14 core airport functions. Although most
of those not expecting to be ready by June 30 are small airports, 26 of them
are among the nations largest 50 airports.

On June 18, the Federal Aviation Administration issued an air industry Year
2000 status report that included information on airports and airline
carriers. Table 3 provides the assessment, renovation, validation, and
implementation information contained in this report.

59 Year 2000: State Insurance Regulators Face Challenges in Determining Industry Readiness
(GAO/GGD-99-87, April 30, 1999).
60 Year 2000 Computing Crisis: Status of Airports Efforts to Deal With Date Change Problem
(GAO/RCED/AIMD-99-57, January 29, 1999).
 

Table 3 snipped

Manufacturing and Small Business Sector
 

The manufacturing and small business sector includes the entities that
produce or sell a myriad of products such as chemicals, electronics, heavy
equipment, food, textiles, and automobiles. With respect to the chemical
industry, table 4 contains the latest survey data by Chemical Manufacturers
Association--which represents over 190 primarily large chemical
companies--and shows that while some companies systems are Year 2000
ready, others are in varying stages of completion. This survey provided
information on the Year 2000 readiness stage of 123 respondents with
respect to their business systems, manufacturing, inventory, and
distribution systems, embedded systems, and supply chain as of May 12, 1999.

Table 4 snipped

Since the Chemical Manufacturers Association represented mainly large
companies, a survey of small and mid-sized chemical companies was
sponsored by several industry associations 61 to assist the Congress, the
administration, and the U.S. Chemical Safety and Hazard Investigation
Board by obtaining information on the preparedness of this segment of the
industry. Table 5 contains the results of the survey, which was conducted
between March and May 1999.

Table 5 snipped

Another key segment of the economy are small businesses. The National
Federation of Independent Business and Wells Fargo sponsored a third
survey of the Year 2000 preparedness of small businesses between
mid-April and mid-May 1999. This survey found that 84 percent of small
businesses are directly exposed to a possible Year 2000 problem. Of the
small businesses directly exposed to the Year 2000 problem, 59 percent had
taken action, 12 percent planned to take action, and 28 percent did not plan
to take action (the other 1 percent responded that the question was not
applicable). In addition, 43 percent of the small businesses that were
aware of the Year 2000 problem had made contingency plans to minimize
the impact of potential problems.

In summary, while improvement has been shown, much work remains at
the national, federal, state, and local levels to ensure that major service
disruptions do not occur. Specifically, remediation must be completed,
end-to-end testing performed, and business continuity and contingency
plans developed. Similar actions remain to be completed by the nations
key sectors. Accordingly, whether the United States successfully confronts
the Year 2000 challenge will largely depend on the success of federal, state,
and local governments, as well as the private sector working separately and
together to complete these actions. Accordingly, strong leadership and
partnerships must be maintained to ensure that the needs of the public are
met at the turn of the century.

Mr. Chairman, this concludes my statement. I would be happy to respond
to any questions that you or other members of the Subcommittee may have
at this time.

-- Brian (imager@home.com), July 30, 1999

Answers

Response to (Part Three) GAO Report Important Progress Made, Yet Much Work Remains to Avoid Disruption of Critical Services

Dear Brian, Many thanks for this.What a management shambles!!!And to think that the USA is suppose to lead the World.

Kind of lends credence to the fears expressed about the progress made in other countries by those in the know.

-- Chris (griffen@globalnet.co.uk), July 30, 1999.

Chris

Yes it makes me glad to be a Canadian. We treated it as a risk management and instituded a contingency plan with our defence department and leading folk. Our report comes out in September when we will see the true state of affairs.

What really blows me away is that this document never made it to the press (I was watching before hand) and has recieved little notice on this forum.

I think most are into chatting and not learning about the issues.

Kind of how we got in the mess we are in.

-- Brian (imager@home.com), July 30, 1999.

Thanks for the series Brian. As I read through the information it dawned on me that there is a growing awareness that the situation is not as advanced as GAO had thought.

I also sensed a feeling of frustration from the writer(s) that there was not only insufficient information available, but that which is there leaves a murky outlook.

There is also no where else to go once the second half of 1999 is used as the time frame for completion. No more slippage.

If the history of y2k tells me anything, it is that there is not enough time left and this report tends to substantiate that for me.

It would appear that the government really wants to know what to expect and is unable to reach any solid conclusions. I would love to read the classified stuff on this. I will bet that is frightening.

-- Mike Lang (webflier@erols.com), July 30, 1999.

Mike

You are one of the few that has hit the nail on the head.

I find that Sen. R. Bennett has told folks to "hoard information" and has always placed the Chemical Report front and center of the Senate Y2K website, which is a difinitive document in regards to Y2K understanding. But few have read it and fewer understand the implications.

Joel W. I believe has the view that you take. A level of disbelief at the "tardiness" in remediating the Y2K problem and the lack of concrete information.

One thing that I have noted in my investigations is that the folks in the higher positions seem to have this understated manner quite like Alan Greenspan. A tone in their voice or a selection of words conveys more meaning than one would consider at first thought. Most folk have grown to the MTV mentality that one must be shocked to get attention. Others believe in sublety

We have a great disconnect.

-- Brian (imager@home.com), July 30, 1999.