TREASURY INSPEcTOR GENERAL

FOR TAX ADMINISTRATION

REVIEW OF THE INTERNAL REVENUE SERVIcE'S

YEAR 2000 END-TO-END SYSTEM INTEGRATION

TEST EFFORTS - OVERALL PLANNING AND EXEcUTION OF TEST I

April 1999

Reference No. 094002

Executive Summary

Within the Internal Revenue Service (IRS), the end-to-end system integration test serves as the final phase for assessing the Year 2000 (Y2K) compliance of its tax processing software, hardware, and communication suites. The IRS’ Y2K end-to-end system integration test is being controlled by the Information Systems Product Assurance function, with significant levels of contractor support. The primary goal of the end-to-end system integration test is to create an off-line test environment that replicates IRS’ tax processing environment. Planning for the end-to-end system integration test began in May 1998, and testing will run through December 1999.

The objective of our review was to assess the IRS’ overall planning efforts for the Y2K end-to-end system integration test and to evaluate the effectiveness of Test I, which was conducted in July and August 1998. Test I was designed to provide a limited assessment of whether the IRS’ systems software components, application components, and commercial off-the-shelf products will work through the year 2000.

Results

Despite initial delays in the planning and conducting of Y2K end-to-end system integration test activities, IRS Information Systems made significant progress in preparing an overall approach to conducting the test. In addition, the end-to-end system integration test team met their limited objectives for executing Test I. We did, however, identify the need for the IRS to prepare a systematic risk analysis of its systems and provide improved oversight for key support systems that will not be included in its Servicewide end-to-end test. We also identified the need for the IRS to better coordinate its planning efforts for the end-to-end system integration test.

The Internal Revenue Service Needs to Perform a Detailed Analysis and Risk Review of Its Systems to Support the End-to-End System Integration Test

The IRS’ basis for selecting the systems included in the end-to-end system integration test was primarily judgmental. Management did not perform a detailed risk analysis or in-depth review of the systems prior to their selection. We identified several systems not selected for the end-to-end system integration test that have similar risk attributes to selected systems. The systems we identified are used to initiate updates to taxpayer accounts and, in some cases, could result in additional contacts with taxpayers. Although the systems to be included in the end-to-end system integration test have already been selected, a detailed analysis of the business value and potential risk exposure of all major IRS systems would provide benefit throughout the entire testing process.

The Internal Revenue Service Needs to Improve Oversight of the End-to-End Testing of Key Systems Not Included in Its Servicewide Test

Additional management attention is needed to ensure key Operations support systems not selected for the coordinated end-to-end system integration test are identified and receive sufficient emphasis and testing resources. Presently, the owners of these systems are expected to perform their own testing based on instructions received from the Product Assurance function. There is no centralized oversight within the Operations area for this process.

Additional benefit could also be gained by mandating the use of the Product Assurance test bed for the review of all key Operations support systems not selected for coordinated testing. This would ensure these systems are analyzed for Y2K compliance in a secure and controlled environment.

Summary of Recommendations

To improve the end-to-end testing of its systems, we recommended that IRS management:

Management’s Response: IRS management agreed to identify all key support systems not selected for the end-to-end system integration test. The century Date change Project Office has established an end-to-end test team to provide technical coordination and support to system owners responsible for their own end-to-end testing. The Project Office will coordinate with system owners to identify resource requirements, support the establishment and implementation of system test plans, assist with the identification and scheduling of test beds and test bed alternatives, and serve as the primary interface among testers, Product Assurance, Telecommunications and other teams which may influence the timeliness and success of the end-to-end testing.

The century Date change Project Office did not agree to perform a detailed analysis of the business value and potential risk exposure of all major systems because all IRS systems will be end-to-end tested. They also did not agree that the use of the Product Assurance test bed should be mandated. Management’s complete response to a draft of this report is included as Appendix IV.

Office of Audit comments: Since IRS has allotted a three-month period from October 1, 1999, through December 31, 1999, to conduct the end-to-end test of over 90 mission critical systems, it would be prudent for IRS to plan some alternative actions if either time or resources run short to complete the test of all systems.

In a memorandum dated August 11, 1998, we also recommended that Information Systems take the following actions to improve the planning and execution of the end-to-end system integration test (management’s response is denoted in italics).

Office of Audit comments: IRS Management has taken several steps to mitigate the risk we identified in our memorandum, including the establishment of an end-to-end test team to provide technical support to system owners responsible for their own end-to-end testing and the identification of representatives within Operations responsible for coordinating Y2K compliance. We believe that these actions may not suffice to assure that end-to-end testing efforts are given priority, especially when test activities may require testing partners outside of Information Systems to take actions that conflict with their organizational interests. The decision not to appoint an executive-level official heightens the importance of performing a detailed analysis of the IRS systems inventory to assess the business value and potential risk exposure of all its major systems and establishing a priority ranking.

The complete text of this memorandum and management’s response are included as Appendices V and VI, respectively.