TREASURY INSPEcTOR GENERAL

TREASURY INSPEcTOR GENERAL

FOR TAX ADMINISTRATION

REVIEW OF THE INTERNAL REVENUE SERVIcE'S

YEAR 2000 cONTINGENcY PLANNING EFFORTS

MARcH 1999

REFERENcE NO. 092705

Executive Summary

The task of converting all of the Internal Revenue Service’s (IRS’) computer systems to ensure they work properly in the Year 2000 is immense due to the size and complexity of the IRS’ processing environment. contingency planning needs to be an important part of the IRS’ overall Year 2000 conversion effort because of the risk that some systems may not be Year 2000 compliant when the century date change occurs.

The primary objective of this review was to assess the IRS' contingency planning efforts to address conversion problems and unexpected failures due to the century date change. This review did not include non-information technology and telecommunication contingency planning. These areas were excluded because the IRS was in the process of developing a contingency planning management method and an inventory tracking method for them at the time of our review.

It is important to note that the issues in this report were discussed with management on July 30, 1998, and a draft of this report was issued to management for comment on September 22, 1998. In their February 8, 1999 response to the draft report, IRS management did not concur with all of the findings and recommendations. Management’s comments are included in the body of this report where appropriate, and a full text of their comments is included as Appendix V.

Results

IRS has a process to identify risk areas for contingency planning purposes. Meetings are held weekly to discuss the conversion process and to assess the need for contingency plans. However, improvements are needed to ensure the process provides adequate coverage and is consistently followed.

In addition, because systems that have completed the conversion process may still fail, the IRS needs to complete a comprehensive Year 2000 contingency plan before the century date change. consolidating Year 2000 and non-Year 2000 efforts will make better use of resources and help expedite both processes.

To help ensure that adequate contingency plans are in place by the Year 2000, management should address the following issues.

The computer Inventory and Monitoring System Used for component conversions Has Missing, Inaccurate, and Inconsistent Data

Although there have been efforts to clean up the conversion data files, records still contain missing, inaccurate, and inconsistent data which may affect the contingency management process. Due to the size of the files, constant updates, and accesses by multiple users, validity checks are needed to minimize errors.

Late and Incomplete component conversions Are Not Effectively Followed Up On

Systems should not be considered satisfactory if components are past due dates or incomplete. A system with overdue or incomplete components, regardless of its overall conversion status, has the risk of not being Year 2000 compliant and may require contingency planning.

The Year 2000 certification Process Is Not Monitored to Indicate When contingency Planning Becomes Necessary

The certification process is a post-production validation to ensure that systems are Year 2000 compliant. Since the certification process can identify conversion problems, there is a need for procedures to identify "at risk" systems during certification for possible contingency action.

The Need for contingency Plans Is Not Always Identified, Evaluated, and Monitored

IRS established formal contingency Request Memorandum procedures to ensure that potential problems in critical systems would be adequately identified and addressed. However, these procedures are not always followed, unnecessarily delaying the development of contingency procedures.

Year 2000 and Non-Year 2000 contingency Planning Efforts Are Not Properly coordinated

Many of the same steps in the contingency planning process are needed for both Year 2000 and non-Year 2000 failures. However, the Service is establishing a new process for Year 2000. Starting a new process to develop contingency plans for Year 2000 failures increases the risk that adequate contingency plans will not be in place by the Year 2000. coordinating Year 2000 and non-Year 2000 contingency planning efforts should help expedite the process and build on expertise gained from business continuity planning efforts to date.

Summary of Recommendations

Review and correct Year 2000 inventory files on a recurring basis to ensure information used to identify the need for contingency plans is accurate and complete.
Establish validity checks for the Year 2000 inventory files.
Develop procedures to identify, monitor, and contact owners of components or systems that have not completed the 12 milestones for Year 2000 conversion within a reasonable period after the due date.
Develop procedures to identify "at risk" systems during the certification process.
Adhere to the formal contingency Request Memorandum process to ensure timely development of contingency procedures.
Assign responsibility for the IRS’ overall contingency management strategy, including Year 2000, and the coordination of resources to one area.
consider monitoring the status of contingency planning as part of the IRS’ Year 2000 dashboard report.

Management's Response: Management did not agree with all of our findings or recommendations. Management’s response and our comments related to the response are presented at the end of each report section. Management’s complete response is included as Appendix V.