TREASURY INSPEcTOR GENERAL
FOR TAX ADMINISTRATION
REVIEW OF THE INTERNAL REVENUE SERVIcE'S
YEAR 2000 cONTINGENcY PLANNING EFFORTS
REFERENcE NO. 092705
The task of converting all of the Internal Revenue Serviceís (IRSí) computer systems to ensure they work properly in the Year 2000 is immense due to the size and complexity of the IRSí processing environment. contingency planning needs to be an important part of the IRSí overall Year 2000 conversion effort because of the risk that some systems may not be Year 2000 compliant when the century date change occurs.
The primary objective of this review was to assess the IRS' contingency planning efforts to address conversion problems and unexpected failures due to the century date change. This review did not include non-information technology and telecommunication contingency planning. These areas were excluded because the IRS was in the process of developing a contingency planning management method and an inventory tracking method for them at the time of our review.
It is important to note that the issues in this report were discussed with management on July 30, 1998, and a draft of this report was issued to management for comment on September 22, 1998. In their February 8, 1999 response to the draft report, IRS management did not concur with all of the findings and recommendations. Managementís comments are included in the body of this report where appropriate, and a full text of their comments is included as Appendix V.
IRS has a process to identify risk areas for contingency planning purposes. Meetings are held weekly to discuss the conversion process and to assess the need for contingency plans. However, improvements are needed to ensure the process provides adequate coverage and is consistently followed.
In addition, because systems that have completed the conversion process may still fail, the IRS needs to complete a comprehensive Year 2000 contingency plan before the century date change. consolidating Year 2000 and non-Year 2000 efforts will make better use of resources and help expedite both processes.
To help ensure that adequate contingency plans are in place by the Year 2000, management should address the following issues.
The computer Inventory and Monitoring System Used for component conversions Has Missing, Inaccurate, and Inconsistent Data
Although there have been efforts to clean up the conversion data files, records still contain missing, inaccurate, and inconsistent data which may affect the contingency management process. Due to the size of the files, constant updates, and accesses by multiple users, validity checks are needed to minimize errors.
Late and Incomplete component conversions Are Not Effectively Followed Up On
Systems should not be considered satisfactory if components are past due dates or incomplete. A system with overdue or incomplete components, regardless of its overall conversion status, has the risk of not being Year 2000 compliant and may require contingency planning.
The Year 2000 certification Process Is Not Monitored to Indicate When contingency Planning Becomes Necessary
The certification process is a post-production validation to ensure that systems are Year 2000 compliant. Since the certification process can identify conversion problems, there is a need for procedures to identify "at risk" systems during certification for possible contingency action.
The Need for contingency Plans Is Not Always Identified, Evaluated, and Monitored
IRS established formal contingency Request Memorandum procedures to ensure that potential problems in critical systems would be adequately identified and addressed. However, these procedures are not always followed, unnecessarily delaying the development of contingency procedures.
Year 2000 and Non-Year 2000 contingency Planning Efforts Are Not Properly coordinated
Many of the same steps in the contingency planning process are needed for both Year 2000 and non-Year 2000 failures. However, the Service is establishing a new process for Year 2000. Starting a new process to develop contingency plans for Year 2000 failures increases the risk that adequate contingency plans will not be in place by the Year 2000. coordinating Year 2000 and non-Year 2000 contingency planning efforts should help expedite the process and build on expertise gained from business continuity planning efforts to date.
Summary of Recommendations
Management's Response: Management did not agree with all of our findings or recommendations. Managementís response and our comments related to the response are presented at the end of each report section. Managementís complete response is included as Appendix V.