The Internal Revenue Service Can Take Further Action to Ensure a Successful Year 2000 Rollover Period

The Internal Revenue Service Can Take Further Action to Ensure a Successful Year 2000 Rollover Period

December 1999

Reference Number: 2000-20-025

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

December 28, 1999

MEMORANDUM FOR COMMISSIONER ROSSOTTI

FROM: Pamela J. Gardiner /s/ Pamela J. Gardiner

Deputy Inspector General for Audit

SUBJECT: Final Audit Report - The Internal Revenue Service Can Take Further Action to Ensure a Successful Year 2000 Rollover Period

This report presents the results of our review of the Internal Revenue Service’s (IRS) progress in preparing for the century date change rollover period and beyond. In summary, the IRS’ effort has been effective in developing and implementing a strategy for the rollover period, and should reduce the risks associated with the Year 2000 (Y2K) event. However, we did find that staff had not been assigned to the business resumption teams in all locations, and specific procedures for identifying and reporting Y2K problems had not been fully developed.

We recommended that to help ensure a successful rollover, management should follow up to confirm that the tasks of assigning staff to business resumption teams and developing specific procedures for those staff have been completed.

Although the IRS' official comments were not available as of the date of this report, we incorporated comments provided by the Century Date Change Project Director.

Copies of this report are also being sent to the IRS managers who are affected by the report recommendation. Please contact me at (202) 622-6510 if you have questions, or your staff may call Scott E. Wilson, Associate Inspector General for Audit (Information Systems Programs), at (202) 622-8510.

Table of Contents

Not All Staff Assignments or Specific Procedures for the Year 2000 Rollover Are in Place

Conclusion

Appendix I – Detailed Objective, Scope, and Methodology

Appendix II – Major Contributors to This Report

Appendix III – Report Distribution List

Executive Summary

One of the most critical issues the Internal Revenue Service (IRS) faces this year is the need to make its computer systems Year 2000 (Y2K) compliant. The IRS has developed a strategy that details a comprehensive set of actions to be executed during the rollover period between the last days of 1999 and the first days of 2000. It calls for the IRS to designate key personnel to implement checklists affirming that essential support functions and business processes are performed as required.

Early in the development of this strategy, the Century Date Change (CDC) Project Office was charged with the responsibility of overseeing and coordinating the development of specific staffing plans to identify the number and skills of employees and contractors who will be needed to work during the rollover period. These Business Resumption Teams (BRTs) will be an integral part of the execution, monitoring, responding, and reporting phases of the strategy.

The objective of our review was to evaluate the IRS’ progress in preparing for the rollover period and beyond. We determined whether staff and contractors had been identified and whether procedures for the rollover period had been developed.

Results

Overall, the IRS’ efforts have been effective in developing and implementing a strategy for the rollover period and beyond and should reduce the risks associated with the Y2K event. The CDC Project Office has played a key role in developing and implementing a strategy to invoke the procedures in the Business Continuity and Contingency Plan.

However, several issues still need to be addressed. During the November 20, 1999, rehearsal, management identified the following concerns:

Inventory integrity continues to be a problem. Equipment assigned to certain locations could not be found, or equipment was not on the inventory listing.
There were capacity problems, causing slow access to the system for input.
In some cases, the reporting system was not completing form updates and was losing submitted data. This caused completed milestones to show a status of incomplete.
There was some confusion in the field as to what point in the process a trouble ticket, which is the official record of a reported system problem, is to be entered into the system. Current procedures require this to be done prior to a milestone being missed so the problem can be addressed as early in the process as possible.

These issues must be addressed prior to the rollover period, to ensure all equipment is updated to accept the century date change, and to enable the reporting of milestone completions during the rollover period. The rehearsal did establish, however, that the reporting system does work, personnel in the field were, in most cases, able to complete their assigned tasks, and their progress could be tracked. The system also identified positive events as well as problems in completing assigned milestones.

Not All Staff Assignments or Specific Procedures for the Year 2000 Rollover Are in Place

As of November 23, 1999, the project office had developed general guidelines for the business owners, who are the executives responsible for the agency’s core business processes, in establishing the BRTs and for reporting problems during the rollover period. However, staff had not been assigned to the BRTs in all locations, and specific procedures for identifying and reporting Y2K problems had not been fully developed.

Any more delays in identifying the staff for the BRTs, and the specific procedures to identify and report problems, increase the risk that the IRS will not be able to respond quickly to problems identified during the rollover period.

It is critical for these teams to be in place and fully prepared prior to the rollover period, to ensure that key IRS functions would not be suspended should core business systems fail. Quick and effective responses to such scenarios are essential for the Y2K conversion to be successful.

Summary of Recommendations

Management is already addressing the problems identified during the rehearsal exercise. We recommend that the CDC Project Office take an even more active role in preparing for the rollover period. In addition to developing and distributing general procedures to the business owners, the CDC Project Office should assume full responsibility for following up to ensure that all staff and specific procedures are in place for the Y2K rollover activities.

Management's Response: Although the IRS’ official response was not available as of the date of this report, we incorporated comments provided by the CDC Project Director. He provided an update on actions regarding the problems identified during the first rehearsal exercise. Improvements have been noted in the second rehearsal exercise. The IRS will conduct a third rehearsal to ensure that all organizations have reported in during the exercise. In addition, the CDC Project Office will confirm contact points for 24 hours a day, seven days a week access to management and technical staff for each site during the rollover period.

Objective and Scope

Our objective was to evaluate the Internal Revenue Service’s (IRS) progress in preparing for the Year 2000 (Y2K) rollover period and beyond. We determined whether staff and contractors had been identified and whether procedures for the rollover period had been developed. To accomplish this, we:

Reviewed the Business Contingency Continuity Plan and the Century Date Change (CDC) Rollover Plan.
Discussed specific business process contingency plans with business owners.
Discussed the team oversight role of the CDC Project Office with "end game" personnel.
Reviewed the General Accounting Office’s (GAO) Day One Planning and Operations Guide.
Attended the November 20, 1999, rehearsal for the rollover period.

This audit was performed from September 1999 to November 1999 in accordance with Government Auditing Standards. Details of our audit objective, scope, and methodology are presented in Appendix I. Major contributors to this report are listed in Appendix II.

Background

The IRS rollover strategy details a comprehensive set of actions to be executed during the last days of 1999 and the first days of 2000. It calls for the IRS to designate key personnel to implement checklists affirming that essential support functions and business processes are performed as required.

Early in the development of the strategy, the CDC Project Office was charged with the responsibility of overseeing and coordinating the development of specific staffing plans to identify the number and skills of employees and contractors who will be needed to work during the rollover period and during the first weeks of 2000. These teams will be an integral part of the execution, monitoring, responding and reporting phases of the strategy, referred to by GAO in its Day One Planning and Operations Guide. All phases of the strategy must be supported by executive oversight with strong accountability at all levels.

Results

Overall, the IRS’ Y2K rollover effort has been effective in developing and implementing a strategy for the rollover period and beyond, and should reduce the risks associated with the Y2K event. The CDC Project Office has played a key role in developing and implementing a strategy to invoke the procedures in the Business Continuity and Contingency Plan.

However, several issues still need to be addressed. During the rehearsal on November 20, 1999, management identified the following concerns:

Inventory integrity continues to be a problem. Equipment assigned to certain locations could not be found, and some equipment was not on the IRS’ inventory listing.
There were capacity problems, causing slow access to the system for input.
In some cases, the reporting system was not completing form updates and was losing submitted data. This caused completed milestones to show a status of incomplete.
There was some confusion in the field as to what point in the process a trouble ticket, which is the official record of a reported system problem, is to be entered into the system. Current procedures require that this be done prior to a milestone being missed so the problem can be addressed as early in the process as possible.

These identified problems, if not resolved, pose additional risks during the rollover period that the transition of all equipment will not be completed, and all problems will not be adequately reported. However, management is currently working with personnel in the National Office and the field to solve them, and reduce the vulnerability to Y2K disruptions.

We identified one additional concern needing management’s attention.

Not All Staff Assignments or Specific Procedures for the Year 2000 Rollover Are in Place

As of November 23, 1999, the CDC Project Office had developed general guidelines for the business owners, who are the executives responsible for the agency’s core business processes, for establishing the Business Resumption Teams (BRTs) and reporting problems during the rollover period. However, staff had not been assigned to the BRTs in all locations, and specific procedures for identifying and reporting Y2K problems had not been fully developed.

These conditions exist because responsibilities have been dispersed between the CDC Project Office and the business owners. The CDC Project Office was responsible for developing the Y2K rollover plans and the business owners were responsible for implementing them. No person or function was accountable for the entire process. To date, the CDC Project Office has issued guidance, but the business owners, who have several competing priorities, have been slow to comply.

The CDC Project Office has also been given the overall responsibility for determining the numbers of employees and the skills needed for the Y2K rollover activities. The business owners are responsible for identifying the specific employees and ensuring that they will be available for the rollover period. The individuals who will perform the required tasks in the field will be comprised of a combination of business system, technical, and security personnel. These individuals should be able to react to any service disruption, regardless of whether it is business or infrastructure related. The personnel assigned to these teams are a direct responsibility of operating personnel in the local IRS offices.

The CDC Project Office must rely on site operations functions to form these groups, and train and prepare them with specific instructions to perform their tasks. Management information about the current status of preparations in the field sites is not sufficient. Any follow-up that does take place is done on an exception basis and is accomplished through the business owner’s staff.

Any more delays in identifying the staff for the BRTs, and the specific procedures to identify and report problems increase the risk that the IRS will not be able to respond quickly to problems identified during the rollover period.

It is critical for these teams to be in place and fully prepared prior to the rollover period to ensure that key IRS functions will not be suspended should core business systems fail. Quick and effective responses to such scenarios are essential for the Y2K conversion to be successful.

Recommendation

We recommend that the CDC Project Office take an even more active role in preparing for the rollover period. In addition to developing and distributing general procedures to the business owners, the CDC Project Office should assume full responsibility for following up to ensure that all staff and specific procedures are in place for the Y2K rollover activities.

Management's Response: The official management response was not available as of the date of this report; however, we have incorporated comments provided by the CDC Project Director. The CDC Project Director responded by providing an update on actions regarding problems identified during the first rehearsal. In each case, improvements have been noted in the second rehearsal. Management stated that the IRS will confirm contact points for access to management and technical staff 24 hours a day, seven days a week. The CDC Project Office has held four End Game conferences and four training sessions with representatives from the sites to communicate expectations. In addition, a third rehearsal will be held to ensure that all organizations have reported in during the rehearsal exercise.

Conclusion

The IRS’ Y2K rollover effort has been an effective and comprehensive one by identifying and assessing rollover risks and planning to decrease those risks. By taking further action to confirm that staff and specific procedures are in place, management can increase the chances for a successful rollover period.

Appendix I

Detailed Objective, Scope, and Methodology

Our objective was to evaluate the Internal Revenue Service’s (IRS) progress in preparing for the rollover period and beyond. We determined whether staff and contractors had been identified and whether procedures for the rollover period had been developed. To accomplish this, we:

Obtained IRS requirements, other government requirements, and acceptable managerial practices for contingency plans and system failures.
Reviewed the Business Contingency Continuity Plan and the Century Date Change (CDC) Rollover Plan, and determined if Year 2000 failure scenarios were clearly defined and documented.
Ascertained whether the plans established criteria for activating contingency plans to include a "zero day" strategy and procedures. Also, we discussed specific business process contingency plans with business owners.
Discussed with CDC Project Office personnel whether a business resumption team for each core business process has been established. Determined the team’s responsibilities and plan of action. Also, we discussed the oversight role of the CDC Project Office with "end game" personnel.
Reviewed the General Accounting Office’s Day One Planning and Operations Guide.
Attended the November 20, 1999, rehearsal for the rollover period.

Appendix II

Major Contributors to This Report

Scott Wilson, Associate Inspector General for Audit (Information Systems Programs)

Stephen Mullins, Director

Richard Hayes, Audit Manager

Edward Chin, Senior Auditor

Gerald Horn, Senior Auditor

David Hodge, Auditor

James McCormick, Auditor

Appendix III

Report Distribution List

Deputy Commissioner Operations C:DO

Chief Information Officer IS

Deputy Chief Information Officer (Operations) IS

Deputy Chief Information Officer (Systems) IS

Assistant Commissioner, National Operations IS:O

Assistant Commissioner, Program Evaluation and Risk Analysis M:OP

Assistant Commissioner, Service Center Operations IS:SC

Director, Century Date Change Project Office IS:CD

Director, Systems Support Division IS:S:TS

Office of the Chief Counsel CC

Office of Management Controls M:CFO:A:M

National Director for Legislative Affairs CL:LA

Audit Liaisons:

Century Date Change Project Office IS:CD

Office of Information Systems Program Oversight IS:IR:O