Executive Summary

Introduction

Objective and Scope

Background

Results

Appendix I - Detailed Objectives, Scope and Methodology

Appendix II - Major Contributors to This Report

Appendix III - Report Distribution List

Appendix IV - Management’s Response to the Draft Report

Executive Summary

Bringing the Internal Revenue Service’s (IRS) systems into Year 2000 (Y2K) compliance requires close coordination with many external organizations that receive data from or provide data to the IRS. External organizations sharing data with the IRS include state and local governments, banks, other Federal agencies, and foreign governments. These external organizations are known as External Trading Partners (ETPs). Implementing Y2K compliance with ETPs is critical to ensure that the IRS can accurately process tax returns and other tax data beyond December 31, 1999.

We have been evaluating the IRS’ progress to implement Y2K compliance with ETPs due to the significant challenge and potential impact to its operations if the IRS is unable to exchange critical information. In a prior report (Evaluation of the IRS’ Efforts to Implement Year 2000 Compliance for External Trading Partners, November 24, 1998), we found that the Century Date Change (CDC) Project Office management had made considerable headway in inventorying external data exchanges and communicating the IRS’ Y2K format changes with ETPs. We also found that continued efforts were needed to ensure that IRS systems met Y2K compliance standards and to correct discrepancies in the inventory of external data exchanges. During this audit, we continued to evaluate the IRS’ progress to ensure Y2K conversion of external data exchanges and to follow up on corrective actions from the previous audit mentioned above.

The IRS continues to make significant progress to effectively implement Y2K compliance with ETPs. The CDC Project Office’s efforts have reduced the possibility that IRS operations will be interrupted due to problems occurring from the exchange of data files with ETPs after December 31, 1999. However, continued emphasis is still needed to improve the accuracy of data on the inventory system used to track and monitor Y2K compliance, the Integrated Network and Operations Management System (INOMS), and to complete two key ETP-related project milestones. Continuing to aggressively manage these areas will help further minimize the risks associated with the conversion of external data exchanges.

The CDC Project Office developed several reports to closely monitor the progress in several key activities, and elevated concerns to the Y2K Executive Steering Committee for senior-level intervention. CDC Project Office management is using the INOMS database as the primary source to track and measure progress in ETP-related activities. For example, three milestones (compatibility testing, technical contact, and production) are used to track the progress of each IRS function in converting their files. Compatibility testing refers to when the receiving agency (ETP or IRS) can successfully process the exchanged data file. However, we identified several inaccuracies in key data fields on INOMS.

Our analysis of 125 data files showed that:

• Twenty-eight of the 125 data files had at least one milestone date inaccurately shown as completed on INOMS. Twenty-three of the 28 data files had incorrect entries for the compatibility testing milestone which should represent the date that a test file was successfully exchanged with an ETP.
• Twenty of the 125 data files had an inaccurate date in at least 1 of the milestone fields.

These and other instances of unreliable information input by functional organizations hamper the CDC Project Office’s ability to monitor progress and raise important concerns to the Executive Steering Committee.

Procedures were implemented to certify the effective date of Y2K format changes with ETPs and to identify external data exchanges requiring the development of contingency plans, including data bridges. Data bridges are programs that enable a Y2K-compliant program to exchange data successfully with programs that are not yet Y2K compliant.

In addition, the CDC Project Office contracted with an outside vendor to reassess key ETPs that represented a potential level of risk to the IRS. While these efforts by the CDC Project Office are significant to ensure Y2K compliance with ETPs, two key project milestones are delayed. They should be closely managed to ensure completion prior to the final phase of end-to-end systems testing beginning in October 1999. End-to-end systems testing is a test of the most mission critical tax processing systems in a simulated Y2K environment.

The CDC Project Office scheduled the completion of all data file compatibility testing with ETPs for August 1998, which was not accomplished. As of March 10, 1999, the IRS had completed compatibility testing for 236 (88 percent) of 269 exchanged data files requiring conversion. Most data files not compatibility tested are scheduled for the latter conversion phases. The higher priority applications (i.e., mainframe applications) were scheduled in the earlier of the phases ranging from January 1997 through January 1999.

The certification of the compliant format and effective dates with ETPs was originally scheduled for April 1998. The CDC Project Office rescheduled the completion of ETP certifications for February 25, 1999. As of March 10, 1999, the IRS had completed 1,069 (89 percent) of the 1,203 certifications with ETPs. This percentage is significant given the volume of externally exchanged data files. However, continued delays in completing this milestone could jeopardize future data file exchanges if the ETP does not clearly communicate to the IRS its intent to convert or not convert to a Y2K-compliant format.

We recommended implementing an oversight process for ensuring accurate ETP information on INOMS and presenting delayed ETP-related project milestones at the Executive Steering Committee meetings to help further minimize the risks with the Y2K conversion efforts. Delayed project milestones should be completed prior to the final phase of the end-to-end systems testing beginning in October 1999. This will ensure that the IRS can continue accurate and uninterrupted processing beyond December 31, 1999.

IRS management responded to these recommendations and initiated corrective actions. The CDC Project Office is requesting the IRS organizations to validate their ETP file/data exchange mappings and is requesting the business owners of the data exchanges to validate that all their data exchanges and trading partners had been identified, and to notify the CDC Project Office of any additional data exchanges or trading partners. Also, the CDC Project Office will include delayed ETP-related milestones in the Executive Steering Committee "read ahead" material used for meetings. Management’s complete response is included in Appendix IV.

Management’s corrective actions to help improve the accuracy of ETP information on the inventory system were different than what we had recommended. In addition to having IRS organizations and field offices certify the accuracy of information on the inventory system, we believe that periodic sampling and independent validation of the inventory is needed.

Introduction

The Commissioner established a 12-step Servicewide Combined Management Program for the IRS’ Century Date Change (CDC) and the 1999 Filing Season efforts. The Internal Revenue Service’s (IRS) Year 2000 (Y2K) efforts are one of four critical Information Systems projects monitored monthly by the Commissioner’s Y2K Executive Steering Committee. We initiated this review as part of our plan to evaluate the IRS’ efforts to inventory External Trading Partners’ (ETPs) data exchanges and data files, establish milestones for completing the process, and establish an outreach program with ETPs.

We conducted the review between September 1998 and February 1999 as part of the Treasury Inspector General for Tax Administration’s coordinated reviews of the IRS’ Y2K efforts.

Objective and Scope

Our overall objective for this review was to evaluate IRS’ continued progress to ensure Y2K conversion of external data exchanges and to follow up on corrective actions from a previous audit (Evaluation of the IRS’ Efforts to Implement Year 2000 Compliance for External Trading Partners, November 24, 1998). We evaluated programs scheduled by the IRS for completion in phases I through V of the Y2K conversion process.

To accomplish this objective, we focused our tests in the following areas:

• Ensuring that the system in place to inform executive management of the project’s progress continued to operate effectively.
• Determining whether the Integrated Network and Operations Management System (INOMS) accurately reflected information related to external data exchanges.
• Evaluating the effectiveness of the certification process in ensuring that all ETPs comply with the Y2K standard.
• Evaluating the effectiveness of contingency plans developed for external data exchanges with ETPs, including the development of data bridges.

We performed our review at or obtained information from the CDC Project Office. We conducted the review in accordance with Government Auditing Standards.

Details of our audit objectives, scope, and methodology are included in Appendix I. Major contributors to this report are shown in Appendix II.

Background

The century date change problem is a major challenge to the IRS in converting data that it processes internally. Additionally, the IRS shares data with many external organizations, including state and local governments, banks, other Federal agencies, and foreign governments. External organizations that receive data from or provide data to the IRS are known as ETPs. Close coordination with the ETPs is essential to assure that the new Y2K-compliant date formats have been implemented and the date of the changes communicated.

The CDC Project Office is responsible for monitoring the progress of the IRS’ Y2K conversion efforts for externally traded files and for supporting functional areas to ensure that the ETPs understand the CDC conversion process. The CDC Project Office uses the Trading Partner Data Exchange (TPDX) on INOMS to facilitate the tracking and reporting of ETP activities.

To facilitate management of the conversion, the implementation process was initially divided into five phases based on the semi-annual IRS production cycles. The completion dates for the five phases ranged from January 1997 through January 1999. The CDC Project Office has since added two phases for new development and exception applications with January 31, 2000, as the latest completion date. Any application scheduled for conversion in the latter two phases requires an approved waiver.

To track the progress of converting files exchanged with ETPs, the CDC Project Office established three milestones: technical contact, compatibility testing, and production. Technical contact represents the date when the programmer informs his or her ETP counterpart of the Y2K-compliant format and conversion date. Compatibility testing occurs when the receiving agency can successfully process the exchanged test file. The production milestone is achieved once the compliant file is fully implemented in production.

Key dates related to other CDC Project Office ETP activities include the following:

• September 1997 - contingency plans for non-conforming data exchanges were to be prepared.
• April 1998 - all certifications with ETPs were to be signed. The completion date was changed to February 1999.
• August 1998 - all data file exchanges with an ETP were to be tested.
• January 1999 - all bridges for non-conforming data exchanges were to be developed. Data bridges are programs that enable a Y2K-compliant program to exchange data successfully with programs that are not yet Y2K compliant.

Results

IRS is making considerable progress in effectively implementing Y2K compliance with ETPs. The CDC Project Office’s efforts reduce the possibility that IRS’ operations will be interrupted due to problems occurring from the exchange of data files with ETPs after

December 31, 1999. However, continued emphasis is still needed to improve the accuracy of data on INOMS and to complete two key ETP-related project milestones.

CDC Project Office management implemented controls and procedures to certify with ETPs the effective date of Y2K format changes and identify external data exchanges requiring the development of contingency plans. Other efforts by the CDC Project Office include the following:

• Identifying 295 ETPs and 410 externally exchanged data files as of March 10, 1999.
• Developing several reports to closely monitor the IRS’ progress in several key activities and elevating significant risks to the Executive Steering Committee for senior-level intervention.
• Contracting with an outside vendor to reassess key ETPs that represented a potentially high level of risk to the IRS.
• Issuing memoranda, starting on December 11, 1998, requiring contingency plans from functions responsible for data file exchanges determined to be at risk.

These efforts significantly reduce the risk that IRS operations will be interrupted due to problems occurring from the exchange of data files with ETPs after December 31, 1999.

While many of the procedures have been effective, closely monitoring the following areas will help further minimize the risks with the Y2K conversion efforts for data exchanges with external trading partners.

Reliable Data is Needed on the External Trading Partner Inventory System for the Century Date Change Project Office to Accurately Track Conversion Progress

CDC Project Office management is using the INOMS database as a tool to track and measure progress in ETP-related activities. As of March 10, 1999, the IRS reported 269 externally traded data files that required conversion to the Y2K-compliant format. The CDC Project Office established three milestones to track the progress of each function in converting its files. Each function is given a green, yellow, or red status based on the difference between the planned and actual percentage of completion. Functions receiving a red status are issued memoranda requiring the development of contingency plans.

We found several inaccuracies in the milestone fields in INOMS during our analysis of 125 externally exchanged data files. Specifically:

• Twenty-eight of the 125 data files (22 percent) had at least 1 milestone date erroneously entered as completed. Several of these files were incorrectly identified with having a date field requiring conversion, while others were files not externally traded. Twenty-three of the 28 data files had incorrect entries for the compatibility testing milestone.
• Twenty of the 125 data files (16 percent) had an inaccurate date in at least 1 of the milestone fields.

In addition, most of the data files containing bridges were not reflected on INOMS with a bridge indicator. Sixteen of the 125 data files had bridges. We determined that 11 (69 percent) of the 16 data files did not have a bridge indicator reflected on INOMS.

Unreliable data, such as that for the bridge indicators and especially in the critical field of compatibility testing, diminishes the ability of the CDC Project Office to use INOMS and perform follow-up work such as requesting contingency plans. In May 1998, the Acting Associate Commissioner for Modernization/Chief Information Officer required that each head-of-office certify the accuracy and completeness of the Application Program Registry (APR) on INOMS. However, a considerable number of inaccuracies on the APR still exist for ETP files. Several programmers attributed the discrepancies to either not clearly understanding the field definition or not being involved in inputting the data on INOMS.

1. To provide for management oversight, the CDC Project Office should periodically sample the accuracy of the INOMS database and provide the results to the appropriate head-of-office for necessary action.

Management’s Response:

The CDC Project Office is not proposing a sampling of ETP data contained within INOMS; however, it plans to:

• Issue a memorandum requesting the IRS organizations to validate their ETP file/data exchange mappings. The CDC Project Office will provide printouts sorted by code maintenance organization of the files and the data exchanges to which they are mapped.
• Require re-validated responses within 30 days from the date of the memorandum.

Also, on March 23, 1999, the CDC Project Office issued a memorandum requesting the business owners of the data exchanges to validate that all their data exchanges and trading partners had been identified, and to notify the CDC Project Office of any additional data exchanges or trading partners. When each certification is completed by both the IRS and individual trading partner, three certification milestones are entered onto INOMS (e.g. operational date for exchanging data, the date the trading partner will be ready with the Y2K-compliant files, and the completion date of the certification).

The CDC Project Office requires the responsible IRS officials to forward the signed certifications to the IRS Governmental Liaison and Disclosure staff after they post the milestones to INOMS. The Governmental Liaison and Disclosure staff performs a 100 percent comparison of the forms and the entries on INOMS to assure certification milestones are posted accurately.

Management’s response includes some corrective actions to help improve the accuracy of ETP information on INOMS. However, we do not believe it goes far enough. More oversight on a periodic basis is needed rather than just continuing to assign the responsibility to the IRS organizations and field offices. Field offices in the past have had the responsibility for certifying the accuracy of information on INOMS and there continue to be inaccuracies. While the responsibility for oversight may be outside of the CDC Project Office, we believe that periodic sampling and feedback through some form of oversight and assigning accountability is needed.

Completion of Compatibility Testing and External Trading Partner Certifications Would Further Minimize the Risks Associated with the Conversion of External Data Exchanges

The CDC Project Office established a Work Breakdown Structure (WBS) for the Y2K Program activities related to the ETP plan. Using the WBS, CDC Project Office management divided the total ETP plan into several tasks and established completion dates for several milestones. As of February 3, 1999, the WBS reflected two key project milestones that were delayed. Specifically, there have been delays in:

• Compatibility Testing
• ETP Certifications

Although these delays are not critical, continued slippage could jeopardize the exchange of data files with ETPs on January 1, 2000. These activities should be completed prior to the final phase of the end-to-end systems testing beginning in October 1999. End-to-end systems testing is a test of the most mission critical tax processing systems in a simulated Y2K environment. This will ensure that the IRS can continue accurate and uninterrupted processing beyond December 31, 1999.

Compatibility testing must be conducted on a converted data file that is sent to or received from an ETP. The purpose of the testing is to ensure successful and accurate processing after the data file is placed into production in a Y2K-compliant format. Compatibility testing should be reported as complete once the receiver confirms that the exchanged file was successfully processed. The CDC Project Office had scheduled the completion of compatibility testing for August 5, 1998.

As of March 10, 1999, the CDC Project Office reported that the IRS had completed compatibility testing on 236 (88 percent) of the 269 files to be converted to a Y2K-compliant format. However, the actual percentage may be lower since our review of 125 data files reflected that compatibility testing had not been achieved on 9 of the 87 data files identified on INOMS as being completed. Most data files not compatibility tested are scheduled for the latter conversion phases. The higher priority applications (i.e., mainframe applications) were scheduled in the earlier of the phases ranging from January 1997 through January 1999.

Further delays reduce the amount of time available for programmers to schedule testing with the ETPs prior to placing the file into production, exposing the IRS to additional risk.

In June 1998, the CDC Project Office began the certification process in phases for which IRS executives and trading partners certify their readiness to be Y2K compliant. The certification forms are very important since they provide the IRS assurance that the ETPs are informed of the standards and that the ETPs will be ready to accept or provide externally traded files to the IRS using the CDC standard.

We reviewed the certification process and determined that the CDC Project Office established adequate controls to ensure that:

• All known data exchanges were included in the certification process.
• Responses not received were identified and follow-up procedures implemented.
• ETPs not ready to comply with the standard by the required operational date could be adequately addressed.

However, the IRS has also experienced a significant delay in completing this milestone. In a prior report (Evaluation of the IRS’ Efforts to Implement Year 2000 Compliance for External Trading Partners,

November 24, 1998), we advised Information Systems management that the completion of certifications with ETPs was significantly behind the scheduled April 30, 1998, completion date. The CDC Project Office rescheduled the completion of this milestone for February 25, 1999.

As of March 10, 1999, the CDC Project Office reported that the IRS had completed 1,069 (89 percent) of the 1,203 certifications with ETPs for externally exchanged data files. This percentage is significant given the volume of externally exchanged data files. However, continued delays in completing this milestone could jeopardize future data file exchanges if the ETP does not clearly communicate to the IRS its intent to convert or not convert to a Y2K-compliant format.

1. CDC Project Office management should ensure that delayed ETP-related project milestones are presented at the Executive Steering Committee meetings to ensure senior-level intervention when warranted.

Management’s Response:

The CDC Project Office will include delayed ETP-related milestones in the Executive Steering Committee "read ahead" material. An ETP presentation will be made if there are major ETP risks identified at a future Executive Steering Committee meeting.

Conclusion

Identifying all externally exchanged data files and updating them to ensure they are Y2K compliant is critical to the IRS. The risk to the IRS is high if ETPs or the IRS have not updated the files according to Y2K standards. The CDC Project Office has implemented many effective procedures to monitor external data exchange conversion efforts to reduce the possibility of problems occurring after December 31, 1999. However, to further minimize the risk of problems occurring from the exchange of data files with ETPs after December 31, 1999, the IRS needs to continue its efforts to ensure the accuracy of data on INOMS and resolve delays in meeting milestone dates.

Detailed Objectives, Scope and Methodology

Our overall objective for this review was to evaluate the Internal Revenue Service’s (IRS) continued progress to ensure Year 2000 (Y2K) conversion of external data exchanges and to follow up on corrective actions from a previous audit (Evaluation of the IRS’ Efforts to Implement Year 2000 Compliance for External Trading Partners, November 24, 1998).

1. To ensure that the status of External Trading Partner (ETP) activities is accurately reflected and reported to the Century Date Change (CDC) Project Office Director and Executive Steering Committee, we:
1. Reviewed the status of ETP activities reported to the CDC Project Office Director at the biweekly ETP conference calls.
2. Reviewed the status of ETP activities reported at the monthly Executive Steering Committee meetings.
2. To evaluate the effectiveness of the vendor’s performance completing the key ETP workplan and the CDC Project Office’s actions to ensure key ETPs continue to make adequate Y2K progress, we:
1. Reviewed the Key ETP Follow-up Review Workplan to determine if the deliverables provide a value-added service.
2. Reviewed the deliverables provided by the vendor to determine if the requirements contained in the workplan were met.
3. Determined whether issues identified regarding key and significant ETPs were properly reported and addressed by the CDC Project Office and the Executive Steering Committee.
4. Determined whether actions taken by the CDC Project Office will effectively address ETPs who are not making adequate Y2K progress.
3. To evaluate the accuracy of certain Integrated Network and Operations Management System (INOMS) data for external data exchanges, we:
1. Reviewed a sample of 73 data files scheduled for conversion in Phases IV and V and determined whether:
1. Appropriate fields on the Application Program Registry (APR) and Trading Partner Data Exchange (TPDX) are populated.
2. The linked component, data exchange, and ETP are all accurate.
2. Reviewed a sample of 125 data files scheduled for conversion in Phases I-V and determined whether the milestone conversion dates are accurate by:
1. Contacting the ETP programmers to verify the technical contact date.
2. Reviewing documentation supporting compatibility testing for the data exchanges documented as Y2K compliant and ensuring that all issues have been resolved.
3. Examining documentation (i.e., program transmittals) to verify the accuracy of the data file production date and determining whether or not a bridge is in place.
3. Followed up on the INOMS accuracy issues identified in the previous audit by:
1. Verifying that data files inaccurately linked to data exchanges and ETPs were corrected.
2. Ensuring that missing files, data exchanges, and ETPs were added to the INOMS inventory.
4. To evaluate the effectiveness of the certification process in ensuring that all ETPs comply with the Y2K standard, we:
1. Performed a walkthrough and flowcharted the certification process.
2. Reviewed the certification process and assessed whether it includes adequate controls to ensure that:
1. All known data exchanges on INOMS are included in the certification process.
1. Obtained documentation from the CDC Project Office identifying the data exchange files that are to be included in the certification process.
2. Researched INOMS to identify all known data files that should be included in the certification process.
3. Reconciled the above two lists.
2. Responses not received from ETPs are identified and follow-up procedures are implemented.
3. ETPs that will not be ready to comply with the standard by the required operational date are adequately addressed.
3. Selected a sample of 103 data exchanges and determined whether:
1. Certifications were issued to and signed by the ETP.
2. The certification completion date, trading partner ready date, and operational date are properly reflected on INOMS.
5. To evaluate the effectiveness of contingency plans developed by the CDC Project Office for external data exchanges with ETPs, we:
1. Identified prior Audit and Government Accounting Office (GAO) reports addressing the IRS’ Y2K contingency plans for ETPs and determined:
1. The scope of the audit work.
2. Issues identified during the reviews, including recommendations.
3. Management’s proposed corrective actions for each finding.
4. The current status of the corrective actions.
2. Reviewed GAO and other agency contingency plan requirements and determined whether the CDC Project Office’s contingency management plan effectively addresses ETP contingency requirements, to include:
1. Prioritizing data exchanges.
2. Receiving non-compliant files.
3. Developing data bridges.
3. Evaluated the development of bridges for ETP exchanged data files that have characteristics of not meeting Y2K conversion standards timely by:
1. Identifying 70 data files that have characteristics of not meeting Y2K conversion standards.
2. Determining whether bridges have been developed for the 70 data files.

1. Determining whether the bridges have been tested and can be implemented timely.

Major Contributors to This Report

Scott E. Wilson, Associate Inspector General (Information Systems Program)

Susan Boehmer, Acting Regional Inspector General for Audit

Thomas H. Black, Acting Deputy Regional Inspector General for Audit

Lynn W. Wofchuck, Audit Manager

Van A. Warmke, Senior Auditor

Mark K. Carder, Auditor

Andrea M. Hayes, Auditor

Olivia H. Jasper, Auditor

Linda W. Screws, Auditor

Tina Wong, Auditor

Report Distribution List

Chief Information Officer IS

Deputy Commissioner for Operations C:DO

Deputy Commissioner for Modernization C:DM

Deputy Chief Information Officer, Operations IS

Deputy Chief Information Officer, Systems IS

Y2K Program Director IS:CD

Chief Operations Officer OP

Chief, Audit Assessment and Control Section IS:I:IS:O:A

National Director for Legislative Affairs CL:LA

Assistant Commissioner (Program Evaluation and Risk Analysis) M:OP

Office of Management Controls M:CFO:A:M

Audit Liaison:

Office of Information Systems Program Oversight IS:IR:O

Century Date Change Project Office IS:CD

Deputy Chief Information Officer, Operations IS

Deputy Chief Information Officer, Systems IS

Chief Operations Officer OP

Management’s Response to the Draft Report