I. INTRODUCTION

The Year 2000 date change is one of the most significant challenges ever faced by the Information Technology industry. It affects the functionality of computer hardware, software, and imbedded microchips in most modern mechanical devices used today. Potential failures can include programs that return erroneous results, end abnormally, or simply fail to operate. Everything ranging from accurate payroll and pension calculations to reliable electronic data transfers and uninterrupted utility service in the Year 2000 depends on the successful implementation of identified solutions. According to a Gartner Group Year 2000 expert, "The complexity of the project is not in the solution but rather in the size and scope of the project itself. This means that the Year 2000 requires "world class" project management." It is estimated that U.S. companies alone will spend billions of dollars addressing the software changes required by the coming millennium. In addition, organizations worldwide will also wrestle with meeting the impending deadline.

Background

The Year 2000 problem was created years ago when computer memory was much more expensive than today. To conserve memory space, programmers often represented a given year with only two digits in the date field, such as "75" for 1975. Program logic added the century indicator "19". If programs are not adjusted to incorporate the new century indicator before the year 2000, they will recognize the year "00" as 1900, not 2000, causing problems for many applications. For example, a pension benefit program may calculate a person’s retirement age by subtracting the birth year from the retirement year (i.e., 1997 minus 1942 equals 55 years). Because the year field contains only 2 digits, the computer actually subtracts "42" from "97". In the year 2000, the same program will calculate an erroneous retirement age of negative 42 because the computer assumes that the century indicator is "19" instead of "20".

For a computing environment to become Year 2000 compliant the following conditions must exist:

• the century indicator must be unambiguous for all dates in storage;

• all operations must give consistent results whether dates in the data, or the current system date, are before or after the millennial New Year’s Eve;

• February 29, 2000 must be properly recognized as leap day; and
• all dates must be properly and unambiguously recognized and presented on input and output interfaces (screens, reports, files, etc.)

Objectives, Scope, And Methodology

This audit was the third in a series of periodic reviews planned to monitor the House’s progress in meeting the Year 2000 deadline. The overall audit objectives were to assess the House Year 2000 program as it relates to current status, timetable for completion, and the allocation of priorities and resources. In addition, we evaluated the risk of disruption to essential House activities in Year 2000. The audit methodology consisted of an overall review and assessment of the Chief Administrative Officer’s (CAO) Year 2000 Program Plan and detailed review of 15 individual Year 2000 projects based on mission criticality, reported status, visibility, and other risk factors.

We assessed each project by reviewing available documentation, conducting interviews with key personnel, and comparing renovation techniques used against best practices discussed in Year 2000 literature. The scope of this audit did not include a review of the Year 2000 compliance of any House facilities, such as elevators, escalators, and fire detection systems. The Architect of the Capitol is responsible for Year 2000 facilities planning.

Our audit covered the period June 1, 1998 through September 30, 1998, and was conducted in accordance with Government Auditing Standards issued by the Comptroller General of the United States.

Internal Controls

During this review, we evaluated internal controls over the Year 2000 initiative. The internal control weaknesses we identified are described in the Results of Review section of this report.

Prior Audit Coverage

The Office of Inspector General (OIG) first addressed Year 2000 issues in a December 31, 1996 audit report entitled, Improvements Are Needed In The Management And Operations Of The Office Of The Chief Administrative Officer, (Report No. 96-CAO-15, Finding F). The finding concluded that House Year 2000 activities needed the benefit of a team leader assignment, an assessment of office level systems within the House environment, and an analysis to determine the impact of phasing out legacy application systems. The audit recommended that the CAO prepare a comprehensive Year 2000 strategy for the Committee on House Oversight’s² (CHO) review and approval. The Acting CAO concurred with the audit recommendation. Subsequent management actions were adequate to close the recommendation.

Because of the Year 2000’s critical nature and inflexible deadline, the OIG conducted its first follow-up audit entitled, House Needs to Refocus Its Efforts To Meet the Year 2000 Deadline, (Report No. 97-CAO-13), dated September 29, 1997. This audit recommended that HIR institute project management controls over the process, revise and prepare follow-on documentation related to the Year 2000 plan, revise Year 2000 cost estimates, and update budget requests. Further recommendations were to coordinate data exchange issues with external organizations, adopt standard Year 2000 compliance contract language for information technology procurements, and expedite decisions regarding the replacement of mission critical information systems. The CAO concurred with the recommendations. While subsequent management actions were adequate to close the majority of these recommendations, some issues remain outstanding and are reemphasized within the current report. (See Exhibit for the status of all prior recommendations.)

II. RESULTS OF REVIEW

The House has made continued progress in preparing for the Year 2000 since September 1997.  The CAO has contracted with the Science Applications International Corporation to provide a Year 2000 program manager to coordinate the House’s Year 2000 efforts.  Specifically, the program manager is responsible for coordinating the efforts of House employees and providing the CHO periodic progress reports on Year 2000 priorities.  Also, the House adopted the General Accounting Office’s (GAO) Year 2000 Conversion Model for planning, managing, and evaluating Year 2000 projects within five distinct phases: awareness, assessment, renovation, validation, and implementation.  Table 1 provides a further description of the GAO Year 2000 Conversion Model.
 
 

Phase	Description
Awareness	Define the Year 2000 problem and gain executive level management support and sponsorship. Establish Year 2000 program team and develop an overall strategy. Ensure that everyone in the organization is fully aware of the issue.
Assessment	Assess the Year 2000 impact on the enterprise. Identify core business areas and processes, inventory and analyze systems supporting the core business areas, and prioritize their conversion or replacement. Develop contingency plans to handle data exchange issues, lack of data, and bad data. Identify and secure the necessary resources.
Renovation	Convert, replace, or eliminate selected platforms, applications, databases, and utilities. Modify interfaces.
Validation	Test, verify, and validate converted or replaced platforms, applications, databases, and utilities. Test the performance, functionality, and integration of converted or replaced platforms, applications, databases, utilities, and interfaces in an operational environment.
Implementation	Implement converted or replaced platforms, applications, databases, utilities, and interfaces. Implement data exchange contingency plans, if necessary.

Table 1 - GAO Year 2000 Conversion Model

In contrast to executive branch agencies that are renovating only mission critical systems, the CAO undertook an effort to make all of its systems Year 2000 compliant. The program manager and CAO employees assessed 718 user identified systems and considered components such as computer hardware, application programs, operating system software, ad hoc applications, telecommunications hardware and software, and office equipment inventories. Once assessment results were complete, the House determined whether each system would be retired, replaced, or renovated. Those systems that would remain in use were ultimately organized into 33 mission critical and other essential Year 2000 projects with a project manager to manage the project and coordinate activities with the Year 2000 program manager.

The project managers in 27 projects identified replacement as the optimal solution while the managers for 5 projects decided to renovate systems. House personnel began renovating the FFS Core System, Financial Management System (FMS) Staff Payroll, Legislative Information Management System (LIMS), Mainframe Application systems³, and the Fixed Assets Management System. The remaining project was an awareness program to alert Members and House Committees about potential Year 2000 issues in their individual offices, provide testing software for personal computers, and offer assistance as necessary.

We reviewed 15 individual projects and generally found renovation and replacement efforts either finished or nearing completion (with the exception of the COBOL portion of the Fixed Asset Contingency Project, discussed further on page 10 of this report). Although programmers have made the actual renovation code changes, those changes were generally undocumented at the time of our review. Published GAO guidelines recommend completing the renovation phase, including programming and documentation changes, by August 1998 to allow sufficient time for validation and implementation efforts.
 
 

Actions Needed to Fully Meet Year 2000 Goals

Although the House has made progress in preparing for the Year 2000, it risks being unprepared for the impending deadline without prompt, aggressive action to meet remaining challenges in the testing and implementation phases. With essentially one year remaining to complete the entire project, several important tasks remain unfinished. Completing these tasks will require leadership and strong program management on the part of the CAO’s staff. For example, the House should complete its Year 2000 testing by June 30, 1999 so that it can implement fully tested Year 2000 compliant systems and hardware by the end of 1999. Furthermore, before the House can complete testing, it needs to develop test guidelines and obtain external testing consultants and an isolated testing environment. In addition, although renovation work was essentially complete for most projects, project managers need to document the changes made to application programs. At the time of our review, the House had not completed replacement and renovation work on all Year 2000 projects and needs to expedite action on those projects. In particular, we rated three projects -- Members Information Network (MIN)/Integrated Systems and Information Services (ISIS) Federal Funding, Members Payroll Contingency, and Fixed Assets Contingency -- as high risk for not meeting Year 2000 deadlines because renovation and replacement efforts were substantially incomplete. Further, the House needs to develop business continuity and system contingency plans as preventative measures. Finally, the House should revalidate its estimate of resources needed to complete the Year 2000 effort.
 
 

Rigorous and Timely Testing Can Increase Confidence

Exhaustive testing is needed by June 30, 1999 to validate that the renovated systems will correctly process data in January 2000. Information system renovations for the Year 2000 may entail extensive changes to source code, data fields, and program logic. The combination of unusual dates and the multitude of changes can significantly affect the successful operation of the renovated systems. Without thorough verification that the systems still operate as intended, the House cannot be confident about operations in the Year 2000.

Testing Guidance. Both the GAO and the Software Productivity Consortium have published guidance on testing Year 2000 renovations. These guides describe key processes for effectively designing, conducting, and reporting on tests of incrementally larger system components. The system components require increasingly more complex levels of testing on individual software units, software integration, system acceptance, and end-to-end tests. Successful testing at the more complex levels is dependent uponcomplete testing at the lower levels. For example, unless interfacing systems have been thoroughly tested on their own, it would be much more difficult to isolate and correct errors that occur in end-to-end testing of several systems simultaneously.

Unit testing is performed to verify that individual software subprograms, subroutines or procedures work as intended. Software integration testing verifies that units of software, whether subprograms, programs, or applications, work together as intended after they successfully pass unit testing. System acceptance testing is performed by and for users to determine that the complete system, consisting of the renovated software program, target hardware, and systems software satisfies the users’ functional, performance, and security requirements. Finally, end-to-end testing verifies that a defined set of interrelated systems operate as intended in a live production environment. This testing would include not only systems owned and managed by an organization, but also external, interfacing systems. Because end-to-end testing for the Year 2000 will involve many modified systems, the complexity of performing the tests and identifying problems is greatly increased.

System acceptance and end-to-end testing should test correct date handling for the following conditions in a simulated Year 2000 environment:

• current date;
• Year 2000 rollover dates, and cutoff dates for the first months and quarters of Year 2000;
• Year 2001 rollover; and
• leap day calculations.

Further Testing Needed. In addition to renovating systems, the House has replaced a number of software components that require further testing. These include the operating system for the CMOS⁵ mainframe, CICS⁶, ADABAS⁷, and Natural⁸ languages, language compilers, and other related products. In each case, the manufacturer describes the replacement product as Year 2000 compliant. However, House managers need to perform thorough acceptance testing of these software products, using available tools to simulate the Year 2000, to assure themselves that all software and hardware components will work together properly in the next century.

After the successful completion of system acceptance tests, the House needs to perform end-to-end testing to validate that all bridge programs, windowing techniques, and other program changes designed to transfer data between systems work correctly. The House has two types of systems with different interface requirements. The mission critical LIMS interfaces with the Senate, Library of Congress, and the Government Printing Office, but not other House systems. The House financial systems interface with each other and with external systems. Therefore, end-to-end testing of the LIMS system could be conducted independently of end-to-end testing of the financial systems. At the time of our review, the House did not have a date or firm plans for end-to-end testing of their systems. A timeline in the draft CAO Year 2000 Testing Guideline & Year 2000 Compliance Certification showed testing to determine if systems were ready for the Year 2000 continuing until December 31, 1999. This schedule is extremely risky, as it leaves no time for implementation of renovated systems and no margin of error. Also, some systems must be Year 2000 compliant by the start of Fiscal Year (FY) 2000 in October 1999. GAO recommends that executive branch agencies complete system acceptance and end-to-end testing by March 31, 1999. To minimize potential risks and allow time for implementation of Year 2000 compliant systems, House managers should complete all system acceptance and end-to-end testing by June 30, 1999.

House Plans for Testing. At the time of our review, the House had not yet developed complete testing plans or schedules. During the renovation phase, programmers performed unit tests on renovated software modules and users completed parallel testing of some systems. None of these tests, however, determined if the system could handle the critical Year 2000 dates that required the renovations. Further, interviews with Year 2000 project managers showed that most projects did not have a written test plan that detailed the specific type of tests to be conducted, what platform the test would be conducted on, or whether the renovated system would be tested with Year 2000 dates. In July 1998, House Information Resources (HIR) issued a draft Testing Program Plan for Year 2000 projects to provide test plan guidance to Year 2000 project managers. After receiving comments from the OIG and others and revisiting testing issues, HIR issued the CAO Year 2000 Testing Guideline & Year 2000 Compliance Certification in draft in October 1998. The second draft established three separate phases of testing in all Year 2000 projects and described what should be in system specific test plans. We reviewed the second draft and recommended that HIR add more specific test plan guidance on how to design and conduct Year 2000 tests. If this test plan guidance is to be effective, the House needs to complete the CAO testing guidelines by November 30, 1998.

External Testing Consultants. The programmers and project managers assigned to the Year 2000 projects have made significant progress in renovating House systems. System acceptance testing, however, requires a degree of experience and independence to design and conduct thorough tests. Since Year 2000 testing is a unique, one-time requirement, the House should obtain testing expertise and assistance from external sources. As the Year 2000 deadline moves closer, the demand for testing expertise will probably increase, causing the price of that expertise to rise accordingly. HIR received supplemental funding for testing expertise at the end of FY 1998 and was developing a procurement strategy at the time of this report. To minimize costs and expedite the development of test plans, the House should contract for testing consultants by November 30, 1998. The House should then task those consultants to develop specific test plans for each system by January 31, 1999 so that the House can determine test resources needed.

Isolated Test Environment. The House has performed renovation work on test copies of production software in logical partitions on the CMOS mainframe computer. Because testing new or changed systems can cause unexpected results to systems and data, system acceptance testing and end-to-end testing should be performed in an isolated test environment. The House is planning to purchase an RS 6000 computer with an OS 390-simulation card for development and testing purposes. The speedy purchase and installation of that system will provide an isolated environment for performing system acceptance testing of the mainframe systems. HIR received supplemental funding for an isolated test environment at the end of FY 1998. As of the date of this report, it has not yet obtained and installed the computer, or developed a complete plan for conducting tests in that environment. The House should complete these steps by February 15, 1999 and begin testing immediately thereafter.

Quick Action Needed. It is imperative that the House establishes priorities for testing and begins system acceptance and end-to-end testing as soon as possible. As of this audit report, FY 2000 is less than 12 months away and the House does not have firm test plans, sufficient testing expertise or an isolated test environment needed to complete the testing. Acquiring testing expertise and an isolated test environment both require prompt procurement actions to avoid any further delays in testing.

Renovation Work Needs To Be Documented

House computer programmers were highly experienced with the systems they renovated. In the interest of efficiency, they did not feel the need to thoroughly document Year 2000 changes to the application source code. This renovation work included expanding date fields, inserting routines that subtract 28 years from dates being processed, and writing bridge programs⁹. For example, LIMS and Staff Payroll system programmers told us that they had written bridge programs to exchange data with external interfaces. Also, COBOL programmers planned to write modified encapsulation routines for the Fixed Asset Contingency project. None of the Year 2000 programming changes has been formally documented. Without such documentation the House may lose the continued ability to maintain these renovated application programs if these programmers change positions or leave House employment in the future. Therefore, the House should develop standardized documentation for Year 2000 programming changes made before the responsible programmers leave their positions or forget the necessary information. This documentation should at least identify the types of changes made in the programs to accommodate the Year 2000, the location of the changes or new code, the location of bridge programs and the technique being used to convert dates between files, applications, and data exchanges. Since the programmers have completed the vast majority of renovation work, they should begin preparing documentation immediately and complete it by January 31, 1999.

Immediate Actions Needed on Some Projects

The House has not completed replacement and renovation work on all Year 2000 projects and needs to move quickly to finish renovation before starting end-to-end testing. The House selected replacement as the desired solution in the systems that provided current news articles and information on Federal funding to Members and staff, the Members Payroll System, and the Fixed Assets Management System. Although the planned replacement systems are commercially available, each requires customization before being implemented in the House environment. Table 2 lists the projects reviewed, the selected Year 2000 solution, and the current GAO Conversion Phase, as defined by House managers in the Year 2000 Program Plan published on September 30, 1998. The last column shows our risk assessment for each project’s ability to meet its own deadline. For example, the LIMS, MIN/ISIS Newswires, and MIN/ISIS Federal Funding projects were facing a December 31, 1998 deadline. This risk assessment is based on an evaluation of each project’s assessment, renovation, and validation efforts and the status of the project at the time of review. A discussion of each project with medium or high risk is located after the table.

MIN/ISIS Federal Funding. This system provides information on Federal grants and contracts to Members, Committee offices, and staff. This type of information is not readily available from any other source in the desired format. The need for procurement action in the case of this system is urgent since the Committee on House Oversight mandated that the existing system be retired from the mainframe by December 31, 1998. HIR has identified a target system and a vendor; however, it will require some development and customization to provide the expected level of service. Therefore, work must begin immediately to meet the planned schedule and allow time for testing before placing the service in the new production environment. If HIR cannot complete the purchase, installation, and testing of this service by December 15, 1998, the House will not have the service available in January 1999.¹¹

Members Payroll Contingency. Ultimately, the House plans to replace the Members and Staff payroll systems with a commercial, off-the-shelf payroll system. The implementation of a new system, will not, however, be achieved in time to provide payroll services in the Year 2000. The Staff Payroll has been successfully renovated to run in the Year 2000. However, the Members Payroll System is currently running on a non-compliant AS 400 computer with older software that is not compliant and cannot be upgraded. Limitations in this payroll system have caused Human Resources (HR) and HIR to add processing capabilities by using other software packages running on personal computers. As a result, the Members Payroll must be replaced by a package before September 30, 1999. The replacement package will likely consist of purchasing new software and hardware. However, as of October 30, 1998, the House was still preparing a requirements document for this payroll system. It is critical that House management selects a package and implements a Year 2000 compliant Members Payroll system as soon as possible. Quick action is required to ensure that the House has sufficient time to purchase software and hardware, install and customize the system, resolve all data transfer issues, perform system acceptance tests, and train the HR and HIR personnel on how to use the system by September 30, 1999.

Fixed Asset Contingency. The House has contracted to buy, customize, and install a new Fixed Assets Management System to track property items purchased by House officers. Because of uncertainty about whether the new system would be implemented before FY 2000, the House has renovated most of the existing system as a contingency. The existing system is comprised of three modules that are written in different programming languages. HIR has expanded the year date fields to four digits on the two modules that are written in Natural. The third module, which HIR considers the major component of the system, is written in COBOL and has not yet been renovated. HIR estimates that renovation of this module will take 6 months, but plans to evaluate the status of the Fixed Asset Management System replacement in December 1998. If, at that time, progress on the replacement system is not considered satisfactory, HIR will begin renovation of this last portion.

If renovation is necessary, the technique to be used on this final portion will be to encapsulate the dates by subtracting 20 years within the system. Users of the system will need to subtract 20 years before entering any dates. However, since these three modules are written in different languages and remediated using two different techniques, integration testing for the renovated system could be complicated because two modules interact with each other and all modules interact with other systems. Further, users’ system acceptance testing will require some degree of training to accustom the users to subtracting 20 years from input dates. Under the current House plan, the House will have at most 45 days for integration, system acceptance, and end-to-end testing on the Fixed Assets Management System before it has to be operational. GAO guidance suggests that all renovation work be completed by August 1998 to allow sufficient time for validation and implementation. As an absolute minimum, the House needs to advance the renovation schedule for the COBOL source code and complete the entire system renovation by April 14, 1999 in order to have adequate time for testing and implementation.

Business Continuity and Contingency Planning Would Be Prudent

At the time of our review, the House had not prepared business continuity and contingency plans for Year 2000 problems. A business continuity plan is a means of focusing on the risk of Year 2000-induced failures and safeguarding an entity’s ability to produce a minimally acceptable level of outputs and services in the event that internal or external mission-critical information systems and services fail. Even if the House successfully assesses, renovates, and tests its own applications and hardware; it still faces risk because of possible utility and basic service outages. GAO published a draft guide on Business Continuity and Contingency Planning in June 1998. This guide provides a conceptual framework for managing the risk of potential disruptions caused by the Year 2000, performing a business impact analysis, developing contingency plans and testing those plans to ensure smooth execution if needed.

Assessing the Problem. A business impact analysis defines and documents potential disruptions should essential infrastructure services be lost, assesses the potential impact of mission-critical system failures, and defines the minimum acceptable output levels for each core business process. Experts on the Year 2000 estimate that the probability of losing local electrical power for longer than one day is 55 percent. The House office buildings receive their electrical power from the Potomac Electric Power Company (PEPCO). Although PEPCO is addressing the Year 2000 issue, it cannot provide any information on its state of readiness and currently provides no assurances to its customers. Although the loss of local telephone services is considered less likely (20 percent), it still poses a threat. To allow time for developing and testing contingency plans, the House should perform a House-wide business impact analysis by June 30, 1999.

Developing Options. Contingency plans provide possible options to the problems raised in a business impact analysis. The House originally planned for several system replacements and turned to renovation options when the time to procure and implement new systems grew shorter. At this time, none of the renovated systems have been systematically tested with Year 2000 dates. Further, many of these systems interface with other Federal systems in both the Legislative and Executive branches. Although the House has identified all interfaces and put bridge programs in place to handle data in both 2 and 4 digit year format, the House cannot be certain that these interfacing systems will continue to operate after the turn of the century. Therefore, the Year 2000 project and program managers need to address contingency planning for each mission-critical system used in the House. Contingency planning would enable managers to identify possible solutions for problems that may be identified by system acceptance or end-to-end testing. Similarly, managers should evaluate the impact of not receiving data as expected from interfacing systems and identify possible options. As the final step in contingency planning, House managers should develop and document a risk-reduction strategy and procedures for the period immediately before and after January 1, 2000. Best practices dictate that this strategy should incorporate a shutdown of all information systems on December 31, 1999 and a phased power-up on January 1, 2000.

Validating Solutions. The final step in business continuity planning is to determine whether the strategy and individual contingency plans can provide the desired level of support within a specified period of time. The chosen strategy should be independently reviewed and validated by scrutinizing, testing, revising, and retesting the viability of individual plans. Subsequent to the end of our audit fieldwork, the House began to establish its processes for business continuity and contingency planning. To allow time for coordination with outside parties, review by House officials, and testing, the House should complete individual contingency plans for mission-critical projects by October 31, 1999. This effort has a tight schedule and may require significant resources from HIR and other House offices to complete. The House should have a validated strategy, tested business continuity and contingency plans, and updated disaster recovery procedures in place by November 30, 1999.

Resource Estimates Need Validation

The House did not have complete testing and implementation plans when it developed the estimate of resources needed to complete Year 2000 projects. Therefore, we were unable to determine if those estimates are reasonable. The House estimated that Year 2000 efforts would cost approximately $24 million, as of September 30, 1998. This includes expenditures incurred to date, as well as projected costs for the remainder of the program. The estimate also includes additional Year 2000 funds of $6.373 million received in supplemental 1998 reprogramming actions. Table 3 summarizes program costs by fiscal year.
 

	Actual		Estimated
	1996	1997	1998	1999	2000	Total
Program Plan	190,000	1,090,000	14,750,000	6,190,000	1,500,000	23,720,000

Table 3 - Year 2000 Program Costs

The House has spent approximately $9.6 million,¹² or 41 percent of the projected Year 2000 program cost for assessment and renovation work. This leaves approximately $14.1 million or 59 percent of the estimated total cost to cover testing and implementation. Year 2000 practitioners estimate that testing efforts will consume between 45 and 70 percent of an entity’s total Year 2000 costs. Although the House’s percentage for testing and implementation appears to be reasonable, the lack of testing plans makes it difficult to accurately project remaining costs and validate the House’s total cost estimate. Should testing actually consume 70 percent of the project’s cost, the $9.6 million spent on assessment and renovation would only represent 30 percent of the total costs. In this scenario, the House could spend up to $8.4 million more than the total cost currently projected. Conversely, if testing should require less than 59 percent of the total funding, the House would be holding project funds needlessly. To ensure sufficient funding, the House should revisit the estimated Year 2000 costs after it develops complete test plans, and during the development of business continuity, and system contingency plans, by no later than May 1, 1999.

Conclusion

The House has reached the most critical part of the Year 2000 process and now needs to exhibit "world class management" to successfully meet the next millennium. FY 2000 is less than 12 months away and a significant number of tasks, as identified in this report, need timely and decisive action. First, the House needs to conduct comprehensive system acceptance and end-to-end testing on all applications, system software, and hardware to ensure they will work properly in the Year 2000. Testing will require the completion of test guidance, the acquisition of external testing consultants, and purchase and installation of an isolated test environment. Further, the House needs to expeditiously acquire replacement systems for several non-Year 2000 compliant systems, complete renovation work on the Fixed Asset Contingency project, and document all Year 2000 renovations. Finally, the House should develop business continuity and contingency plans and revalidate its resource estimates for Year 2000 resources.

Recommendations

We recommend that the Chief Administrative Officer:

1. Complete testing guidance for Year 2000 project managers by November 30, 1998.
2. Secure a contractor to assist with acceptance testing on renovated systems by November 30, 1998.
3. Complete development of test plans for each Year 2000 project by January 31, 1999.
4. Procure, install, and implement an isolated test environment for Year 2000 testing by February 15, 1999.
5. Develop standardized documentation requirements for project managers to document the Year 2000 changes made in the programs, the location of the changes or new code, the location of bridge programs and the technique being used to convert dates between files, applications, and data exchanges. This documentation effort should be complete by January 31, 1999.
6. Complete and document system acceptance and end-to-end testing, using Year 2000 critical dates to test the system and identify potential errors by June 30, 1999.
7. Procure, test, and implement commercial software packages to replace the non-Year 2000 compliant Members Information Network/Integrated Systems and Information Services Federal Funding by March 31, 1999.
8. Select, procure, test, and implement a Year 2000 compliant, commercial software package to replace the non-Year 2000 compliant Members Payroll by September 30, 1999.
9. Complete renovation work on the existing Fixed Assets Management System by April 14, 1999.
10. Develop a House-wide business impact analysis to assess business continuity issues by June 30, 1999.
11. Develop contingency plans for mission critical systems by October 31, 1999; and validate the business continuity strategy, test contingency plans, and update disaster recovery procedures by November 30, 1999.
12. Review the Year 2000 cost estimates after developing test plans and while developing business continuity and contingency plans to ensure that adequate funding will be available for the remainder of the Year 2000 project, and revise the budget requests as necessary by May 1, 1999.

The CAO concurred with the recommendations in this report and reported that some actions are complete (see Appendix). Specifically, House Information Resources has already prepared revised testing guidance and secured contractor support to assist with testing. Efforts have begun to develop test plans, implement a test environment, and document Year 2000 program changes. In addition, management plans to perform and document system acceptance and end-to-end tests; replace the Federal Funding Services and Members Payroll systems; accelerate the renovation work for the Fixed Assets Management System; develop a House-wide business impact analysis and appropriate contingency plans; and review remaining budgetary needs for the Year 2000 project.

Office of Inspector General Comments

Management’s completed actions on Recommendations 1 and 2 are sufficient and therefore we consider these recommendations closed. The other actions taken or planned are responsive to the issues identified and, when fully implemented, should satisfy the intent of the recommendations.

EXHIBIT

Entity Report and Recommendation Number	RECOMMENDATION ACTIONS COMPLETED TO DATE ACTIONS NEEDED FOR CLOSURE	PRIORITY STATUS TARGET DATE
HOUSE INFORMATION RESOURCES:
96-CAO-15 F	RECOMMENDATION: Prepare a comprehensive strategy addressing the potential impact of the Year 2000 issue, for review and approval by the Committee on House Oversight. The strategy should include the requirements discussed in this finding. ACTION COMPLETED: The House prepared an initial Year 2000 Program Plan followed by periodic updates. The Plan reported on the Year 2000 assessment of House systems, identified 33 renovation projects, and established schedules to monitor progress.	Closed
97-CAO-13 1	RECOMMENDATION: Establish formal project management controls and techniques as follows: Define the role of the Year 2000 project leader and establish it as a full-time position. Prepare a Year 2000 charter which formally assigns the authority and responsibilities for the Year 2000 initiative to the project leader and staff within House Information Resources, and defines the project leader roles and responsibilities with respect to organizations/activities outside House Information Resources whose systems may be affected by the Year 2000 problem. Institute a status reporting mechanism to inform upper management of Year 2000 progress. Conduct a detailed level of effort analysis which estimates the resources needed to complete the initiative. Purchase software tools and secure a contractor, as necessary, to assist with conversions and testing. Determine whether all systems are needed and on which platform they will reside. Attend the Chief Information Officer Council Subcommittee on Year 2000, as appropriate. ACTION COMPLETED TO DATE: Recommendation parts a., b., c., e., f., and g. were completed before the issuance of this report. Recommendation d is superseded by Recommendation 12 in this report and therefore closed.	Closed
97-CAO-13 2	RECOMMENDATION: Revise and prepare follow-on document(s) to the Year 2000 plan which include the following activities: Prepare a schedule of Year 2000 tasks (e.g., PERT chart concept) showing milestones and interdependencies of issues/organizations. As necessary, re-prioritize and accelerate out-year projects in the Year 2000 plan to meet remaining government milestones. Develop detailed implementation plans for each system to be converted. Expeditiously develop a follow-on document to the Year 2000 plan which addresses, in detail, the last three phases of the Year 2000 effort for review and approval by the Committee on House Oversight. In preparing the follow-on document, as recommended in 2.d. above, develop testing strategies, plans, milestones, and ensure testing capacity is available, and quality assurance is an integral element. ACTIONS COMPLETED TO DATE: A Year 2000 program assessment was prepared and will be updated quarterly. Recommendation parts a., b., and d. are completed. ACTIONS NEEDED FOR CLOSURE: Develop testing strategies, plans, and milestones. Also, develop detailed implementation plans for each system converted.	HIGH                                                     Substantial Progress 3/31/99
97-CAO-13 3	RECOMMENDATION: As necessary, revise the Year 2000 cost estimates and prepare revised budget requests based on new figures. ACTIONS COMPLETED: The Year 2000 methodology (per the May 1997 Year 2000 plan) included budget and resource estimates. House Information Resources’ FY 1998 and 1999 budget requests include estimates for the Year 2000 project. The Year 2000 project plan update includes a revised cost estimate for the Year 2000 project.	Closed
97-CAO-13 4	RECOMMENDATION: Coordinate data exchange issues with the external organizations that interact with the House’s systems. ACTIONS COMPLETED TO DATE: The Year 2000 project manager is maintaining contact with the Legislative branch throughout all phases of the Year 2000 project.	Closed
97-CAO-13 5	RECOMMENDATION: Adopt the standard Year 2000 contract language into all procurements relating to information technology purchases. ACTIONS COMPLETED: The House adopted Year 2000 contract language for information technology procurements.	Closed
97-CAO-13 6	RECOMMENDATION: Expedite decisions regarding Office Systems Management and the Financial Management System Payroll replacement efforts, closely monitor these activities to ensure timely completion, and prepare contingency plans, as necessary. ACTIONS COMPLETED TO DATE: Project managers have been assigned to Office Systems Management and Payroll replacement tasks and contractors have been retained to complete the requirements analysis for each project. The Office of Inspector General is also providing assistance regarding these acquisitions. Additional funding has been obtained for both projects. This recommendation is superseded by Recommendations 8 and 9 in this report and is therefore closed.	Closed