oversight

Veterans Benefits Computer Systems: Risks of VBA's Year-2000 Efforts

Published by the Government Accountability Office on 1997-05-30.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                 United States General Accounting Office

GAO              Report to the Chairman, Subcommittee
                 on Oversight and Investigations,
                 Committee on Veterans’ Affairs,
                 House of Representatives

May 1997
                 VETERANS BENEFITS
                 COMPUTER SYSTEMS
                 Risks of VBA’s Year-2000
                 Efforts




GAO/AIMD-97-79
                   United States
GAO                General Accounting Office
                   Washington, D.C. 20548

                   Accounting and Information
                   Management Division

                   B-275674

                   May 30, 1997

                   The Honorable Terry Everett
                   Chairman, Subcommittee on Oversight
                     and Investigations
                   Committee on Veterans’ Affairs
                   House of Representatives

                   Dear Mr. Chairman:

                   Unless timely corrective action is taken, the Veterans Benefits
                   Administration (VBA), like other federal agencies, could face widespread
                   computer systems failures at the turn of the century due to incorrect
                   information processing relating to dates. In many systems, the year 2000
                   will be indistinguishable from 1900; this could make veterans who are due
                   to receive benefits appear ineligible. If this happened, issuance of benefits
                   checks that veterans rely on could be delayed or interrupted.

                   In response to your September 10, 1996, letter, we conducted a follow-up
                   review to determine VBA’s actions to address management and technical
                   weaknesses reported in a June 19, 1996, hearing on VBA’s modernization
                   effort. This report discusses our assessment of VBA’s actions to ensure that
                   the year-2000 computing problem will be adequately addressed. Our
                   review of VBA’s actions to address other management and technical
                   weaknesses will be discussed in a separate report.


                   Correcting the year-2000 problem is critical to VBA’s mission of providing
Results in Brief   benefits and services to veterans and their dependents. If not corrected,
                   calculations based on incorrect dates could result in inaccurate and late
                   payment of benefits to veterans, prompting financial stress to millions
                   across the country. VBA has acted to address the problem, but can do more.
                   First, the year-2000 management office structure and technical capabilities
                   are insufficient. Second, key year-2000 readiness assessment
                   processes—determining the potential severity of the year-2000 impact on
                   VBA’s operations, inventorying its information systems and their
                   components, and developing contingency plans—have not been
                   completed. Third, both VBA’s initial and revised strategies are risky in that
                   without sufficient information on the costs or potential problems
                   associated with its approach to making systems year-2000 compliant, it
                   cannot make informed choices as to which systems must be funded to




                   Page 1                          GAO/AIMD-97-79 Veterans Benefits Computer Systems
             B-275674




             avoid disruptions in service, versus which can be deferred. Deficiencies in
             these three areas add risk to an already difficult challenge.

             Addressing these problems will require close and continual top
             management attention and leadership. Contributing to the challenge facing
             VBA are the loss of key computer personnel, difficulties in obtaining
             necessary information from external sources on whether interfaces and
             third-party products are year-2000 compliant, and delays in upgrading
             systems at VBA data centers. The issue of whether third-party products are
             year-2000 compliant is being faced by other federal agencies as well.

             On April 11, 1997, at the conclusion of our review, the Department of
             Veterans Affairs’ (VA) chief information officer told us that VBA will
             (1) revise its year-2000 strategy to focus on converting the existing
             noncompliant benefits payment systems rather than replacing them and
             (2) acquire contractual support to assist in managing the year-2000 effort
             and in making necessary changes. We commend VBA for these initial steps
             and also the steps outlined in its May 16, 1997, comments to us. These are
             positive developments, and we look forward to seeing VBA’s plans to
             implement these steps.

             In addition, in its comments to us on May 16, 1997, VA concurred with all
             10 recommendations. The implementation of these recommendations will
             put VBA in a better position to avoid these types of problems in the future.


             VA comprises three major components: the Veterans Health
Background   Administration, which provides services through the nation’s largest
             health care system; the National Cemetery System, which provides burial
             services in 113 national cemeteries; and VBA, which provides nonmedical
             benefits to veterans and their dependents.

             In fiscal year 1996, VBA paid $20 billion in benefits to 10 million veterans
             and their dependents. These benefits are grouped into five major business
             areas—compensation and pension (the largest), educational assistance,
             housing loan guaranty, vocational rehabilitation and counseling, and
             insurance. VBA administers its benefits programs through 58 regional
             offices. These offices are supported by three software development
             centers located at Hines, Illinois; Austin, Texas; and Philadelphia.

             As early as 1985, VBA realized that its computer systems at these centers
             were nearing the end of their useful lives and were becoming difficult and



             Page 2                         GAO/AIMD-97-79 Veterans Benefits Computer Systems
B-275674




expensive to maintain. To replace its aging computer systems, VBA
developed a three-stage procurement plan to modernize its hardware and
software and better support its business areas and regional offices. For
stage I, VBA awarded a contract in December 1992 to acquire a number of
personal computers, local area networks, minicomputers, and commercial
off-the-shelf software for the 58 regional offices. For stage II, VBA awarded
a contract in July 1995 to acquire imaging equipment and associated
software for its educational assistance processing sites in Atlanta and St.
Louis.

This equipment would scan all documents in the chapter 301 education
claims folders. Stage III, which was canceled in 1996, was for procuring
mainframe computers for the Hines and Philadelphia data centers.

VBA’s modernization effort was intended to replace the functions of the
existing network through which benefits are delivered with new software
applications and relational databases2 to provide enhanced functionality
for users in all of VBA’s major businesses. The original plan was to
modernize the compensation and pension area first, and then the other
major business areas. In September 1995, however, VBA decided to redirect
its modernization as a result of a study prepared by a private contractor,
which concluded that VBA’s modernization approach was risky and too
large in scope. The current modernization is limited to replacing and
improving existing benefits payment systems. As one component of this,
VBA expects to have an on-line compensation and pension payment system
in place by December 31, 1998. This system is expected to provide the
same claims processing capability as the current benefits delivery
network, match or exceed the current system’s responsiveness, be easy to
use, and resolve the year-2000 problem.

Over the years, we have identified many weaknesses in VBA’s efforts to
modernize its operations and manage its information technology
resources. For example, as we reported in November 1992, VBA
procurements of hardware were not supported by a defined information
architecture, thereby increasing the risk that it would develop a system




1
 Chapter 30 relates to the Montgomery GI bill, which provides education benefits for veterans on
active duty after July 1, 1985.
2
 A relational database is a computer file that stores information in tables (rows and columns) and
conducts searches by using data in specified columns of a table to find additional data in another table.



Page 3                                     GAO/AIMD-97-79 Veterans Benefits Computer Systems
              B-275674




              that would not work as intended.3 Further, in June 19964 we reported and
              testified, that on the basis of our analysis of VBA’s software development
              processes, the agency is operating at a level-1 maturity capability,5 defined
              as ad hoc and chaotic.


              In assessing actions taken by VBA to address the year-2000 problem, we
Scope and     reviewed and analyzed numerous documents, including VBA’s December
Methodology   13, 1996, Year-2000 Plan; its January 28, 1997, Year-2000 Risk Assessment;
              and the Department of Veterans Affairs’ January 13, 1997, Year-2000
              Readiness Review. To determine progress made in solving the year-2000
              problem we reviewed and analyzed VBA project plans, project schedules,
              and progress reports for the replacement initiatives identified by agency
              officials as crucial to solving the year-2000 problem, as well as project
              plans and schedules for the contingency and conversion initiatives. To
              determine the costs, benefits, and risks associated with the year-2000
              problem, we reviewed VA’s fiscal 1998 budget submission and VBA’s
              January 31, 1997, information resources management support plan. We
              used our draft year-2000 assessment guide6 to assess VBA’s readiness to
              achieve year-2000 compliance.

              In addition, we visited and/or interviewed project teams, including
              contractor support, in St. Petersburg, Florida, and Washington, D.C.;
              computer personnel at VBA’s data centers at Hines and Philadelphia, and its
              Austin Systems Development Center to discuss progress and problems
              involved with their year-2000 activities. We also discussed VBA’s year-2000
              efforts with VBA headquarters officials in Washington, D.C., plus
              representatives from VA’s Office of Information Resources Management.
              We performed our work from October 1996 through April 1997, in
              accordance with generally accepted government auditing standards. The
              Department of Veterans Affairs provided detailed comments on a draft of
              this report. These comments are an expansion of the Department’s initial


              3
               Veterans Benefits: Acquisition of Information Resources for Modernization Is Premature
              (GAO/IMTEC-93-6, Nov. 4, 1992).
              4
               Software Capability Evaluation: VA’s Software Development Process Is Immature (GAO/AIMD-96-90,
              June 19, 1996) and Veterans Benefits Modernization: Management and Technical Weaknesses Must Be
              Overcome If Modernization Is To Succeed (GAO/T-AIMD-96-103, June 19, 1996).
              5
               A capability maturity model was developed in 1991 by the Software Engineering Institute (Carnegie
              Mellon University, Pittsburgh) for use by organizations wishing to evaluate their capability to
              consistently and predictably produce high-quality software. The Institute’s mission is to provide
              leadership in advancing the state of the practice of software engineering to improve the quality of
              systems that depend on software.
              6
                Year 2000 Computing Crisis: An Assessment Guide [exposure draft] (GAO/AIMD-10.1.14,
              February 1997).
              Page 4                                   GAO/AIMD-97-79 Veterans Benefits Computer Systems
                         B-275674




                         comments dated April 22, 1997. They have been incorporated into the
                         report where appropriate and are included as appendix I.


                         At 12:01 a.m. on January 1, 2000, many computer systems worldwide could
High Risk of Year-2000   malfunction or produce inaccurate information simply because the date
Problems Can Be          has changed. Unless corrected, such failures could have a costly,
Reduced Using            widespread impact. Within VBA, compensation and pension systems that
                         relate dates—such as birth or military service—to benefits could be
Structured Approach      vulnerable.
and Rigorous Program
                         The problem is rooted in how dates are recorded and computed. For the
Management               past several decades, systems have typically used two digits to represent
                         the year—such as “97” for 1997—to save electronic storage space and
                         reduce operating costs. In such a format, however, 2000 is
                         indistinguishable from 1900. As an example of the potential impact of this
                         ambiguity, a veteran born in 1925 and therefore turning 75 in 2000 could be
                         seen as being negative 25 years old (if “now” is 1900)—not even born
                         yet—and hence ineligible for benefits that the veteran had been receiving.

                         Correcting this problem will not be easy or inexpensive, and must be done
                         while such systems continue to operate. Many of the government’s
                         computer systems were developed 20 to 25 years ago, use a wide array of
                         computer languages, and lack full documentation. Systems may contain up
                         to several million lines of software code that must be examined for
                         potential date-format problems.

                         The enormous challenge involved in correcting these systems is not
                         primarily technical, however: it is managerial. Agencies’ success or failure
                         will largely be determined by the quality of their program management and
                         executive leadership. Top agency officials must understand the
                         importance and urgency of this undertaking, and communicate this to all
                         employees. The outcome of these efforts will also depend on the extent to
                         which agencies have institutionalized key systems-development and
                         program-management practices, and on their experience with such
                         large-scale software development or conversion projects. Accordingly,
                         agencies must first assess their information resources management
                         capabilities and, where necessary, upgrade them. In so doing, they should
                         consider soliciting the assistance of other organizations experienced in
                         these endeavors.




                         Page 5                         GAO/AIMD-97-79 Veterans Benefits Computer Systems
    B-275674




    To assist agencies with these tasks, we have prepared a draft guide that
    discusses the scope of the challenge and offers a structured, step-by-step
    approach for reviewing and assessing an agency’s readiness to handle the
    year-2000 problem.7 The guide describes in detail five phases, each of
    which represents a major year-2000 program activity or segment. These
    are:

•   Awareness. This is a critical first step. Although many people may have
    heard about a year-2000 problem, they may not know what it entails or
    why it matters. For agency personnel, awareness is imperative. This is also
    the phase in which the agency team that will take the lead in correcting
    the problem is identified. The team then examines the problem’s potential
    impact, gauges the adequacy of agency resources, develops a strategy, and
    secures strong, visible executive support.
•   Assessment. The main thrust of this phase is separating mission-critical
    systems—which must be converted or replaced—from important ones that
    should be converted or replaced and marginal ones that may be addressed
    now or deferred. Since the year-2000 problem is primarily a business
    problem, it is essential to assess its likely impact on the agency’s major
    business functions. Following this, information systems in each business
    area should be inventoried and prioritized; project teams are then
    established and program plans devised. Testing strategies must be
    identified, and contingency plans developed as well.
•   Renovation. This phase deals with actual changes—converting, replacing,
    or eliminating selected systems and applications. In so doing, it is
    important to consider the complex interdependencies among these.
    Changes must be consistent agencywide, and information about them
    clearly disseminated to users.
•   Validation. Here, agencies test, verify, and validate all converted or
    replaced systems and applications, ensuring that they perform as
    expected. This critical phase may take over a year and consume up to half
    of the year-2000 program’s budget and resources. It is essential that
    agencies satisfy themselves that their testing procedures are up to the
    challenge and that their results can, indeed, be trusted.
•   Implementation. Deploying and implementing year-2000-compliant
    systems and components requires extensive integration and acceptance
    testing. And since not all agency systems will be converted or replaced
    simultaneously, it may be wise to operate in a parallel-processing
    environment for a time, using old and new systems side-by-side. Such
    redundancy can act as a fail-safe mechanism until it is clear that all
    changed systems are operating correctly.

    7
     GAO/AIMD-10.1.14, February 1997.



    Page 6                              GAO/AIMD-97-79 Veterans Benefits Computer Systems
                          B-275674




                          VBA has initiated actions to address the year-2000 awareness phase,
Awareness Actions         including an agencywide plan, a year-2000 strategy, and a program
Initiated, but More       management organization. However, executive management can further
Can Be Done               improve upon these actions by addressing deficiencies in the year-2000
                          program management office structure and technical and program
                          management capabilities. It is critical that these deficiencies be corrected
                          if VBA is to succeed in correcting the year-2000 problem.


Year-2000 Actions Have    VBA recognizes that the upcoming change of century poses significant
Been Initiated            challenges to the agency. In 1991, it conducted an initial analysis of the
                          year-2000 problem. According to VBA’s January 31, 1997, information
                          resources management support plan, correcting the year-2000 problem is
                          the agency’s number-one priority. A year-2000 charter has been developed,
                          defining the project management organization. VBA’s chief information
                          officer has overall responsibility for ensuring year-2000 compliance. In
                          addition, a VBA year-2000 project manager has been assigned, along with
                          site project coordinators at each of VBA’s systems development
                          centers—Hines, Philadelphia, and Austin. A consultant has also been
                          obtained to assist in managing the day-to-day responsibilities.

                          VBA also has developed an agencywide plan for achieving year-2000
                          compliance, using a multifaceted strategy. The primary focus of this
                          strategy has been to replace noncompliant systems with newly developed,
                          compliant systems. In the event the replacement projects are not
                          implemented in time, VBA has developed and has begun to implement a
                          contingency plan for the compensation and pension and educational
                          assistance payment systems to ensure their continued operation past the
                          year 2000. Another aspect of VBA’s strategy is to convert the existing
                          insurance and debt management systems.

                          VBA’s goal is to have all operating systems, applications and third-party
                          products (hardware, software, mainframes, minicomputers, operating
                          systems, and utilities) compliant by November 30, 1998. This will allow it
                          over 1 full year to test and correct problems, and to monitor the
                          applications’ execution.


VBA’s Year-2000 Program   It is essential that agencies appoint a year-2000 program manager and
Management Office         establish an agency-level program office to manage and coordinate
Structure Is Inadequate   year-2000 program activities. The problem and solutions involve a wide
                          range of dependencies among information systems: the need to



                          Page 7                         GAO/AIMD-97-79 Veterans Benefits Computer Systems
                          B-275674




                          (1) centrally develop or acquire conversion and validation standards,
                          inspection, conversion, and testing tools, (2) coordinate the conversion of
                          crosscutting information systems and their components, (3) establish
                          priorities, and (4) reallocate resources as needed.

                          Although VBA has appointed a year-2000 project manager and has
                          established a program management office, the functions of this office do
                          not adequately cover all of VBA’s year-2000 activities. According to the
                          project manager, her management functions are limited to conversion
                          projects for the compensation and pension and educational assistance
                          payment systems, and replacement projects for educational assistance
                          payment systems. She is not overseeing or coordinating year-2000
                          activities for any other conversion or replacement project. As a result, the
                          program management office is not necessarily aware of year-2000
                          problems in these other areas, such as the housing loan guaranty area,
                          which may require the office’s attention because they can adversely affect
                          the agency’s ability to provide benefits and services to veterans.

                          In addition, no one in VBA’s program management office is overseeing the
                          year-2000 work in the 58 regional offices. For example, VBA’s chief
                          information officer issued a September 16, 1996, memorandum to area,
                          service and regional office directors requesting that all regional office and
                          program sponsors develop an inventory of all locally developed
                          applications and locally acquired third-party products to determine
                          whether they are year-2000 compliant. These sponsors do not, however,
                          have to report this information to the program management office. In
                          contrast to VBA’s three systems development centers, there is no year-2000
                          site project coordinator in VBA’s regional offices.


Technical and Program     The ability to successfully manage the year-2000 problem will depend
Management Deficiencies   upon the degree to which an agency has institutionalized key systems
Exist                     development and program management practices, and on its experience in
                          managing large-scale software conversion or system development
                          projects. A systems architecture8 is essential to VBA’s plans to develop
                          compliant payment systems to replace its existing systems. Leading
                          organizations both in the private sector and in government use systems
                          architectures to guide mission-critical systems development and to ensure
                          the appropriate integration of information systems through common



                          8
                           An integrated information systems architecture is a blueprint to guide and constrain the development
                          and evolution of a collection of related automated information systems.



                          Page 8                                   GAO/AIMD-97-79 Veterans Benefits Computer Systems
B-275674




standards.9 The Congress also recognized the importance of systems
architectures as a means to improve the efficiency and effectiveness of
federal information systems by enacting the Clinger-Cohen Act of 1996.
The act, among other provisions, requires that department-level chief
information officers develop, maintain, and facilitate integrated systems
architectures.

An integrated systems architecture is divided into two principal
components—a logical component and a technical component. The logical
component is essential to ensuring that an agency’s information systems
support accomplishing its mission, while the technical component
provides the detailed guidance needed for developing evolving information
systems. The logical component includes a high-level description of the
organization’s mission, functional requirements, information requirements,
systems, information flows among systems, and interfaces between
systems. It defines the organization’s current and future missions,
concepts of operations, and interdependencies, such as information flows
and systems interfaces. The purpose of the logical architecture is to ensure
that systems meet the business needs of the organization.

The technical component of the integrated systems architecture details
specific information technology and communications standards and
approaches that will be used to build the systems, including those that
address critical hardware, software, communications, data management,
security, and performance characteristics. The purpose of the technical
architecture is to ensure that systems are interoperable,10 function
together efficiently, and will be cost-effective over their life cycle.

VBA has not developed a complete, integrated systems architecture for its
new systems development activities. Specifically, at the logical
architecture level, VBA has not developed or documented a comprehensive
analysis of the information flows among the various information systems,
nor has it performed the systems engineering analyses needed to define
and document—at an acceptable level to systems developers—the
interfaces among the various systems that must share needed data to
perform benefits delivery functions. At the technical architecture level, VBA
lacks several key elements as well. For example:


9
 Executive Guide: Improving Mission Performance Through Strategic Information Management and
Technology—Learning From Leading Organizations (GAO/AIMD-94-115, May 1994).
10
  Interoperability refers to the ability of a technical and/or software platform to operate with, or
exchange data with, other technical and software platforms, regardless of vendor or vendor-specific
technical standards.



Page 9                                    GAO/AIMD-97-79 Veterans Benefits Computer Systems
    B-275674




•   VBA has not performed the analysis necessary to define its security
    architecture. Without first performing a comprehensive threat and
    vulnerability assessment, VBA cannot develop security controls to prevent
    the intentional or accidental disclosure, modification, or destruction of
    sensitive information—information that is being processed and
    transmitted over communications lines or shared internally among those
    who need the data to process benefits claims or produce management
    reports.
•   VBA has not analyzed or developed performance characteristics or
    standards. As a result, it does not know what system capacity will be
    needed to run its new applications or how processing must be handled in
    order to maintain adequate performance.
•   VBA’s systems development teams are making changes to the database and
    data elements prior to obtaining the database administrator’s review and
    approval. This disregard or lack of knowledge of standard change
    management processes can result in redundancy and integrity problems
    and can increase the risk of system performance degradation.
•   VBA’s systems development teams were not until recently using a standard
    software development language when coding the applications software.
    For example, the graphical user interface software in the new
    compensation and pension payment system was being developed in
    JAM7,11 while the new educational assistance payment systems will be
    developed in Visual Basic.12 VBA recently decided to make Visual Basic its
    standard software development language. As a result, systems previously
    coded in JAM7 will need to be recoded in Visual Basic.

    Along with not institutionalizing key systems development and program
    management practices, VBA cannot rely on its software-development
    processes. We assessed these processes using the Software Engineering
    Institute’s software capability maturity model; the result showed that VBA’s
    software development capability is at an “ad-hoc and chaotic” level—the
    lowest level of software development capability.13 At this level, VBA cannot
    reliably develop and maintain high-quality software on any major project
    within existing cost and schedule constraints, placing VBA modernization
    at significant risk. In this context, VBA relies solely on the various
    capabilities of individuals rather than on an institutional process that can
    yield repeatable results. To improve upon its software development

    11
     JAM7 is a commercial, off-the-shelf, 4th-generation software development tool, designed to be used
    with relational database management and transaction processing systems.
    12
      Visual Basic is a Windows programming language that is often used to write user interfaces for
    client/server applications.
    13
      GAO/AIMD-96-90, June 19, 1996.



    Page 10                                   GAO/AIMD-97-79 Veterans Benefits Computer Systems
                        B-275674




                        capability, VBA has recently obtained the assistance of the Software
                        Engineering Institute.


                        In the assessment phase, VBA has made limited progress in determining
Year-2000 Assessment    whether its information systems and their components are year-2000
Not Yet Complete        compliant. It has begun to develop inventories of its centralized internal
                        applications, internal/external interfaces, and third-party products. Also,
                        according to VBA’s year-2000 project manager, VBA has recently developed
                        an overall testing plan. However, key assessment processes have not been
                        completed. Specifically, VBA has not (1) assessed the severity of its
                        year-2000 problem, (2) completed its inventory or assessment of its
                        information systems, interfaces, and third-party products, or (3) developed
                        contingency plans for all its payment systems. Failure to address these key
                        processes increases the risk that VBA will not achieve year-2000
                        compliance by January 1 of that year.


VBA Has Not Assessed    Developing and publishing a high-level assessment of the year-2000 issue
Severity of Year-2000   provides executive management and staff with a broad overview of the
Problem                 potential impact the century change could have on the agency. Such an
                        assessment provides management with valuable information on which to
                        prioritize the agency’s year-2000 activities, as well as a means of obtaining
                        and publicizing management commitment and support for necessary
                        year-2000 initiatives.

                        VBA has performed no assessment of how its major business areas would
                        be affected if the year-2000 problem is not corrected in time. On the basis
                        of our discussions with VBA personnel, it is clear that VBA’s ability to deliver
                        benefits and services to veterans could be compromised if systems are not
                        changed. For example, veterans could receive inaccurate and/or delayed
                        compensation and pension benefits, receive debt-collection letters when
                        they do not actually owe money, cease to receive vocational rehabilitation
                        services, receive inaccurate insurance benefits, or have foreclosure
                        proceedings initiated unnecessarily due to erroneous date calculations.
                        These problems could all arise from the fact that the payment systems for
                        these major business areas use two digits to represent the year, rather
                        than four, to denote dates that affect benefits eligibility, such as date of
                        birth and dates of military service.




                        Page 11                         GAO/AIMD-97-79 Veterans Benefits Computer Systems
                                  B-275674




Inventory and Assessment          An agencywide inventory of information systems and their components
of Information Systems,           provides the necessary foundation for detailed year-2000 program
Interfaces, and Third-Party       planning. A thorough inventory ensures that all systems are identified and
                                  linked to a specific business area or process, and that all agencywide,
Products Are Incomplete           crosscutting systems are considered.

                                  According to its December 1996 year-2000 plan, VBA expected to have
                                  completed its inventories of systems applications, interfaces and
                                  exchanges, and third-party products by September 30, 1996. However, VBA
                                  had completed an inventory only of its software applications at its three
                                  systems development centers by that date. It had not completed
                                  inventories of the agency’s internal/external interfaces and data exchanges
                                  or third-party vendors and products. The status of VBA’s inventories and its
                                  assessment for year-2000 compliance is summarized below.

                              •   According to VBA’s February 17, 1997, inventory, it has 153 applications,
                                  consisting of 8,480 modules and 9.1 million lines of software code.
                                  According to VBA, of these applications, 22 are compliant, 20 are to be
                                  replaced with new compliant applications,14 and 111 are noncompliant. As
                                  shown in figure 1, no action has yet been taken to fix, replace, or retire
                                  about one-third of the noncompliant applications.




                                  14
                                   These applications currently do not exist. VBA’s inventory includes both existing applications and
                                  applications under development and/or planned.



                                  Page 12                                   GAO/AIMD-97-79 Veterans Benefits Computer Systems
                                       B-275674




Figure 1: Status of Noncompliant VBA
Applications

                                           Of the 111
                                           noncompliant
                                           applications:


                                                                              Replacing


                                          Converting                     29
                                                         41

                                                                              9     Eliminating
                                                                 32

                                                 111
                                                                      Unaddressed




                                        Of the 32 unaddressed noncompliant applications,

                                          10 await resources,
                                          11 await completion of analysis, and
                                          11 have not been scheduled for correction.


                                       VBA’s inventory of applications does not include local applications
                                       developed by its regional offices. Despite the chief information officer’s
                                       request that regional offices and program sponsors develop an inventory
                                       of all locally developed applications, he has said that such regional
                                       applications need not be included in the inventory of software applications
                                       because no mission-critical applications were locally developed. In our
                                       view, however, until each regional office has developed an inventory of




                                       Page 13                        GAO/AIMD-97-79 Veterans Benefits Computer Systems
                                 B-275674




                                 locally developed applications and provided the year-2000 program
                                 management office with a listing of these applications in terms of their
                                 criticality, there is no assurance that critical applications that require
                                 year-2000 compliance do not exist in the regions. According to VA’s
                                 year-2000 readiness review, VBA cannot adequately predict or plan the
                                 impact of the year-2000 change without a complete inventory of
                                 region-developed applications.

                             •   VBA has not completed its inventory of internal/external interfaces15 and
                                 data exchanges for its information systems. It has identified 410 interfaces
                                 to date, but acknowledges that more could exist. According to VBA’s
                                 year-2000 project manager, VBA plans to complete its inventory of
                                 interfaces by June 30, 1997. VBA has begun to assess whether the interfaces
                                 and data exchanges in its inventory contain date information, but it does
                                 not know when this will be completed. VBA also does not know at this time
                                 how it will validate incoming external data, address invalid data, or handle
                                 situations in which no data are received from the external source. The
                                 Office of Management and Budget (OMB) recently issued guidance
                                 recommending a standard date format for agencies to use when
                                 exchanging electronic data with date information.
                             •   VBA has developed an inventory of its third-party products but has not yet
                                 completed its review of these products for year-2000 compliance. The
                                 agency currently does not know when this will be completed because, like
                                 other federal agencies, it has had difficulty obtaining information on
                                 year-2000 compliance from third-party vendors. For example, many
                                 vendors have not yet decided whether they will be able to support their
                                 products beyond 1999. As a result, the VBA year-2000 project manager is
                                 concerned that the agency will not have sufficient time to purchase and
                                 implement year-2000-compliant hardware and software upgrades to its
                                 existing and new systems.


Contingency Plans Have           Agencies should develop realistic contingency plans—including
Not Been Developed for All       development and activation of manual or contract procedures—to ensure
Critical Systems                 the continuity of its major business processes. Three of VBA’s major
                                 business areas—loan guaranty, vocational rehabilitation and counseling,
                                 and insurance—do not have contingency plans. VBA recognizes that it may
                                 have to return to manual processing if critical systems in these major

                                 15
                                   An example of an external interface is the exchange of disability compensation information between
                                 the Department of Defense and VBA. Defense currently provides VBA with electronic information on
                                 the amount of disability benefits paid to a veteran by Defense for offset against the amount paid by
                                 VBA to this same veteran. This offset is necessary because, by law, the veteran cannot be paid twice
                                 for the same disability.



                                 Page 14                                  GAO/AIMD-97-79 Veterans Benefits Computer Systems
                        B-275674




                        businesses are not year-2000 compliant. Also, VBA’s year-2000 project
                        manager recently informed us that the agency is now developing a
                        contingency plan for several of its loan guaranty systems as a result of
                        concerns we identified.


                        VBA  lacks adequate information about the costs and risks associated with
Noncompliant            its year-2000 efforts to make informed choices about information
Systems: Inadequate     technology priorities. Agencies should prioritize their information
Assessment of Costs     technology projects to make effective use of two vital resources—people
                        and money. To make informed choices about information technology
and Risks Precludes     priorities, agencies need to assess the costs, benefits, and risks of
Informed                competing projects. In some instances, agencies may have to defer or
                        cancel new systems developments and allocate freed resources to achieve
Prioritization          year-2000 compliance.

                        VBA has not prioritized its efforts to replace or convert existing benefits
                        payment systems. Its year-2000 strategy calls for it to replace most existing
                        systems while simultaneously converting its existing compensation and
                        pension and educational assistance systems as a contingency. Since both
                        actions depend upon limited financial and personnel resources, VBA is at
                        serious risk that it may not be able to complete either in time.

                        Similarly, within its group of payment systems, VBA has not ranked them
                        on the basis of its need for particular functions within a system, nor has it
                        initiated work on the most important functions first. And since each
                        system has at least three distinct parts—on-line, batch, and text—these
                        parts need to be ranked in order of importance.

                        Reliable assessments of costs and risks are important prerequisites for
                        effectively prioritizing projects. In VA’s year-2000 readiness assessment, it
                        was estimated that year-2000 costs for VBA would be about $20 million for
                        fiscal years 1996 through 1999. However, this amount only covers the
                        conversion projects, such as the costs to upgrade the mainframes and
                        operating systems at the Hines and Philadelphia data centers. It does not
                        include costs to replace VBA’s aging systems with new, compliant payment
                        systems.


VBA’s Risk Assessment   VBA has prepared a year-2000 risk assessment identifying six major risk
Limited to Conversion   areas: the need for systems upgrades, lack of personnel resources,
Projects                insufficient information on third-party vendors and products, insufficient



                        Page 15                         GAO/AIMD-97-79 Veterans Benefits Computer Systems
                                B-275674




                                time to fix all applications, lack of budget resources, and insufficient
                                information on interfaces. However, VBA’s January 28, 1997, risk
                                assessment is generally limited to the risks associated with the projects to
                                convert the existing compensation and pension and educational assistance
                                payment systems. It does not discuss specific risks associated with VBA’s
                                replacement projects.

                                We have concerns about the risks associated with both the conversion and
                                replacement projects. These include schedule delays, loss of key
                                personnel, lack of sufficient funding for necessary upgrades, and data
                                center consolidation issues. These risks are discussed below.

Replacement Projects May Miss   VBA is at risk of not completing its replacement payment systems—for
Deadline                        compensation and pension, educational assistance, and housing loan
                                guaranty—before January 1, 2000. One reason, as discussed earlier, is
                                VBA’s lack of a complete, integrated systems architecture. Another factor
                                contributing to the risk that these three systems will not be completed on
                                time is the loss of systems control and quality assurance personnel due to
                                resignations, retirements, and reassignments. At the Hines systems
                                development center, for example, 6 out of 16 systems control and quality
                                assurance personnel were lost as a result of resignations and retirements.
                                Failure to replace these individuals will result in schedule delays during
                                the validation and testing phase of systems development.

                                Specifically, for the compensation and pension system, VBA has already
                                experienced a schedule delay on its replacement project. According to the
                                project manager, the system will not be ready for testing in July 1997, as
                                initially scheduled. The project manager is currently developing a revised
                                schedule for completing the project. The delay is due largely to the
                                realization that what is being developed is a stand-alone system rather
                                than an integrated one. Our analysis shows that additional delays to the
                                project’s schedule can result from VBA’s decision to change its software
                                applications programming language from JAM7 to Visual Basic. According
                                to the project manager, this change was necessary because most of the
                                agency’s systems development projects are written in Visual Basic.

                                For educational assistance payments, VBA is also experiencing schedule
                                delays in developing four new, compliant systems. According to its
                                December 13, 1996, year-2000 plan, these systems were to be completed by
                                the summer of 1998. To date, VBA has only started developing one
                                educational system. This system, scheduled initially for completion in
                                June 1997, is now 5 months behind schedule because of delays in contract



                                Page 16                        GAO/AIMD-97-79 Veterans Benefits Computer Systems
                          B-275674




                          award and problems in defining data elements. VBA does not know when
                          the remaining three educational assistance systems will be implemented
                          because each of these is contingent upon completion of the previous
                          educational system in the development sequence. In addition, the system’s
                          project manager told us that completion of the next system depends upon
                          the availability of funding for contractor support.

                          Finally, with respect to the housing loan guaranty systems, VBA is also at
                          risk. Its loan guaranty program uses a number of interrelated systems to
                          process loans, loan defaults, and property management. Most of these
                          systems are scheduled to be replaced.16 However, one key loan
                          system—loan services and claims—has encountered many systems
                          development problems and is currently about 6 months behind schedule.
                          According to the system’s project manager, phase 1 of this system will
                          now be deployed to one site in July 1997; phase II of this system would
                          then start. The project manager also said that phase II was scheduled to be
                          completed by mid-1998; however, the application will have to be recoded
                          from JAM7 to Visual Basic, and will not be completed on schedule. Several
                          other loan systems development activities have either just started or have
                          not yet begun.

Conversion Projects May   VBA is also at risk that its work to convert its existing noncompliant
Likewise Be Delayed       payment systems may not be completed in time. This is primarily because
                          VBA has lost key computer specialists, including programmers, software
                          quality analysts, and hardware system specialists, as a result of
                          retirements and financial enticements offered to employees eligible to
                          retire. For example, the Hines systems development center lost 20
                          computer specialists in December 1996 and January 1997, due to
                          resignations and retirements. This loss in experienced personnel will make
                          it more difficult for VBA to complete its conversion projects in time.

                          In addition, many of the remaining staff have been reassigned from
                          year-2000 work to special projects.17 As a result, VBA personnel have
                          reviewed only 57 of 633 modules, or 9 percent, in the compensation and
                          pension system for compliance.18


                          16
                           These systems are automated loan processing, construction and valuation, loan service and claims,
                          and expanded lender interface.
                          17
                            According to VBA, these include legislative mandates, such as the spina bifida benefit to children of
                          Vietnam veterans exposed to Agent Orange and other herbicides; minimum income for widows, which
                          was previously provided by the Department of Defense; and a reduction in the clothing allowance for
                          incarcerated veterans.
                          18
                            The 633 modules relate to 4 compensation and pension applications.



                          Page 17                                   GAO/AIMD-97-79 Veterans Benefits Computer Systems
                            B-275674




                            Since VBA’s insurance system was essentially upgraded last year rather
                            than redesigned, its strategy for solving the year-2000 problem for the
                            insurance program has been to convert the existing system. According to
                            the year-2000 project manager, this effort is currently on schedule, but
                            delays can occur if additional staff are lost due to resignations and
                            retirements. And because of calculations using dates 1 year into the future,
                            the insurance system must not only be fixed but tested and ready to run by
                            January 1, 1999.

                            VBA also needs to ensure that its information feeder systems and
                            crosscutting systems are made year-2000 compliant.19 One example of
                            such a system is its beneficiary identification and records locator system.
                            VBA is in the process of developing a contract for the year-2000 work on
                            this system. VBA has also begun to recode its centralized accounts
                            receivable system.

Data Center Consolidation   A high-risk area associated with VBA’s contingency and replacement
Issue                       projects has been the issue of data-center consolidation. VBA is aware that
                            it needs to upgrade the mainframes and operating systems at its Hines and
                            Philadelphia data centers to run the existing benefits payment systems.
                            The current mainframes and operating systems at these locations are not
                            year-2000 compliant, and the vendors of these systems have informed VBA
                            that they will not support the current systems. VBA also knows that
                            upgrades are needed for the minicomputers that will run its new systems.
                            It has not formally requested upgrades to the mainframes and operating
                            systems at Hines and Philadelphia, but has discussed this matter with VA’s
                            Office of Information Resources Management.20

                            Conversely, VBA has requested upgrades to the minicomputers, but VA has
                            yet to approve this request. A key factor affecting VA’s approval of both
                            requests was its decision on which hardware platforms would run the
                            benefits payment systems—the existing and new systems—and where
                            these platforms would be located. VA and VBA were to submit a strategy
                            and implementation plan for data-center consolidation to OMB in July 1996
                            and December 1996, respectively. VA decided on March 28, 1997, to
                            terminate consideration of data-center consolidation, and focus its

                            19
                              Feeder systems provide data to one or more systems for processing, but are not dependent on these
                            systems for their own operation. For example, a personnel system would provide employee
                            information needed to process payroll. A crosscutting system processes, stores, or distributes common
                            information or data across all business functional areas of an organization. For example, a decision
                            support system can capture performance information covering several major business areas.
                            20
                             VA’s Office of Information Resources Management must approve all VBA procurements over
                            $250,000.



                            Page 18                                  GAO/AIMD-97-79 Veterans Benefits Computer Systems
                      B-275674




                      attention instead on achieving year-2000 compliance. As a result, VA will
                      approve upgrades to the mainframes and operating systems at Hines and
                      Philadelphia. Until the upgraded systems are operational, however, risks
                      associated with noncompliance will remain.


                      We met with VA’s and VBA’s chief information officers on March 27, 1997, to
Recent Developments   brief them on the results of our review. At that time we expressed concern
Are Encouraging       that VBA may not be able to complete its year-2000 efforts in time. In
                      response to our concerns, VA’s chief information officer informed us on
                      April 11, 1997, that VBA will redirect its year-2000 strategy by focusing on
                      converting the existing benefits payment systems, rather than on replacing
                      the noncompliant systems. He also stated that VA has established an
                      oversight committee consisting of one VBA executive, a senior manager
                      from VA’s Office of Information Resources Management, and an
                      independent contractor, to monitor and evaluate the progress of VBA’s
                      year-2000 effort. This contractor will assess the status of code conversion
                      and supplement the recoding work currently done by VBA staff. The
                      contractor is to issue a report in August 1997, along with an action plan
                      and a proposal for the level of effort required to complete year-2000
                      recoding activities in December 1998.

                      We are encouraged by this recent development. These actions should help
                      VBA achieve year-2000 compliance. We will continue to evaluate VBA’s plans
                      and strategies for how this will be accomplished.


                      Correcting the year-2000 computing problem is crucial if VBA is to be able
Conclusions           to provide uninterrupted benefits and services to veterans. This will not be
                      easy, and will require a proactive strategy. VBA will not be in a position to
                      make informed decisions on the best use of limited personnel and
                      financial resources until it completes the inventory and assessment of its
                      information systems and their components. Once this has been
                      accomplished, a reallocation of VBA’s resources toward completing the
                      conversion projects may be necessary, and the development of
                      contingency plans for all critical noncompliant information systems will be
                      essential. Making these goals a reality will necessitate a stronger project
                      management office structure for VBA’s year-2000 compliance activities,
                      along with improved technical and program management capabilities.




                      Page 19                        GAO/AIMD-97-79 Veterans Benefits Computer Systems
                         B-275674




                         In light of the serious risks associated with VBA’s year-2000 activities, we
Recommendations to       recommend that the Secretary of Veterans Affairs direct and ensure that
the Secretary of         VBA’s acting under secretary for benefits, in conjunction with VBA’s chief

Veterans Affairs         information officer,

                     •   strengthen VBA’s year-2000 program management office by assigning this
                         office oversight and coordination responsibilities for all year-2000
                         activities, including both system conversion and replacement projects in
                         the three systems development centers, the central office, and the regional
                         offices;
                     •   develop a complete, integrated systems architecture for its new systems
                         development activities, including a security architecture, performance
                         characteristics and standards, and change management policy;
                     •   assess how its major business areas would be affected if the year-2000
                         problem is not corrected in time and use the results of this assessment to
                         help prioritize the agency’s year-2000 activities, as well as a means of
                         obtaining and publicizing management commitment and support for
                         necessary year-2000 initiatives;
                     •   complete inventories of all information systems and their components,
                         including data interfaces and third-party products by June 30, 1997;
                     •   complete an analysis to determine whether VBA’s internal applications,
                         interfaces, and third-party products are compliant, and develop a plan for
                         addressing them, by July 31, 1997;
                     •   assess the cost, benefits, and risks of competing information technology
                         projects and prioritize them to make effective use of limited staff and
                         monetary resources, including deferring or canceling new systems
                         developments and reallocating the freed resources to achieving year-2000
                         compliance;
                     •   assess the agency’s personnel resource needs for achieving year-2000
                         compliance, and then develop a plan for obtaining these resources;
                     •   develop a risk assessment, by June 30, 1997, that discusses the risks
                         associated with each year-2000 project and its related costs;
                     •   develop a schedule for replacing and/or converting all year-2000 projects
                         by July 31, 1997; and
                     •   develop a year-2000 contingency plan for all critical information systems,
                         including development and activation of manual or contract procedures.


                         In commenting on a draft of this report, the Department of Veterans
Agency Comments          Affairs concurred with all 10 of our recommendations. VA stated that it
and Our Evaluation       considers successful resolution of VBA’s year-2000 challenges to be an




                         Page 20                         GAO/AIMD-97-79 Veterans Benefits Computer Systems
B-275674




overriding goal for VA and is redirecting all necessary resources to
anticipate and resolve any problems related to the year-2000 issue.

In addition, VA stated that it had several serious concerns with our draft
report. It believed that we did not identify all its accomplishments, and
that our report contained inaccuracies. VA stated that VBA has made
substantial progress in resolving many of the deficiencies mentioned in
our draft report, including (1) redirecting funds to support an independent
and impartial contractor to oversee the year-2000 program, (2) establishing
an oversight office, with contractor support, to monitor and evaluate VBA’s
year-2000 effort, (3) relieving VBA’s year-2000 project manager of
non-year-2000 duties to devote full attention to year-2000 activities, and
(4) assessing the possible impact of deferring or canceling new systems
developments to free resources to achieve year-2000 compliance. We are
encouraged by these recently stated actions by VBA and look forward to
seeing VBA’s plans to implement them.

VA also stated that VBA completed (1) a review of its year-2000 status in
1991, (2) an inventory of information systems, and (3) contingency plans
for all payment applications. Our review showed otherwise. We found that
VBA’s 1991 assessment of its year-2000 status contained no milestones or
discussion of cost and risk information for achieving year-2000
compliance. Also, as stated in our report, VBA’s inventory of information
systems applications does not include local applications developed by
VBA’s regional offices. We also noted that, according to VA’s year-2000
readiness review, VBA cannot adequately predict or plan the impact of the
year-2000 change without a complete inventory of region-developed
applications. Similarly, while VA stated that VBA has contingency plans for
all payment systems, we found that three of VBA’s major business
areas—loan guaranty, vocational rehabilitation and counseling, and
insurance—do not have contingency plans. VBA’s year-2000 project
manager recently informed us that the agency is now developing a
contingency plan for several of its loan guaranty systems as a result of
concerns we identified.

Another major concern expressed by VA with our draft report is the
extensive reference to our draft year-2000 assessment guide. VA indicated
that we used this document as a rigid audit guide in reviewing VBA’s
year-2000 effort. VA believes that VBA is meeting the spirit of our
assessment guide and the best practices developed by the
Governmentwide CIO Council Year 2000 Subcommittee. Our year-2000
assessment guide provides agencies with a structured, step-by-step



Page 21                        GAO/AIMD-97-79 Veterans Benefits Computer Systems
B-275674




approach for reviewing and assessing an agency’s readiness to handle the
year-2000 problem. It draws on the work of the Best Practices
Subcommittee of the Interagency Year 2000 Committee, and incorporates
guidance and practices identified by leading organizations in the
information technology industry. We welcome any comments from VA on
the content of our guide. Our guide was released in February 1997 as an
exposure draft and we plan to finalize it this summer. While we used the
guide to assess VBA’s readiness to achieve year-2000 compliance, our work
in this area preceded its February 1997 issuance, as evident in our June 19,
1996, testimony on VBA modernization.

VA stated that our draft report mischaracterized the nature and magnitude
of VBA’s year-2000 situation by inappropriately interchanging the terms
“systems” and “applications”. We have amended our report to reflect the
use of the term “applications” rather than “systems” when discussing VBA’s
inventory. However, we have appropriately used the term “systems” in our
report when discussing current and planned mission-critical systems for
each of VBA’s major business areas.

VA also stated that our report fails to balance the discussion of deficiencies
with recent developments in these areas. VA is concerned that our report
may unnecessarily alarm veterans without the benefit of knowledge about
VBA’s year-2000 accomplishments.


Specifically, VA was concerned about our characterization of VBA’s ability
to provide benefits and services to veterans if the year-2000 problem is not
corrected. On the basis of our discussions with VBA’s chief information
officer and project managers, as well as our review of VBA year-2000
documents, we believe that VBA’s ability to deliver benefits and services to
veterans could well be adversely affected if the year-2000 problem is not
solved. For example, in the vocational rehabilitation and counseling area,
benefits payments could be inaccurate, delayed, or terminated due to
incorrect processing of date-sensitive information. In the housing loan
guaranty area, veterans who are delinquent in making payments on their
guaranteed loans could have foreclosure proceedings initiated by
erroneous date calculations. These are accurate and fair examples of what
could happen if the year-2000 problem is not corrected. We are not trying
to unnecessarily alarm veterans with these examples. Rather, we are
seeking to raise these issues early enough for VBA to ensure no disruptions
of services. Without early action, VBA will have to take extraordinary
efforts to avoid disruption of services. These efforts will likely prove very




Page 22                         GAO/AIMD-97-79 Veterans Benefits Computer Systems
B-275674




costly, diverting resources from other services, and some level of impact
on service delivery may be unavoidable.

Lastly, VA offered some specific comments directed to particular language
in the draft report. These comments have been incorporated into the
report where appropriate, and are included in appendix I.


As agreed with your office, unless you publicly announce the contents of
this report earlier, we will not distribute it until 30 days from its date. At
that time, we will send copies to the Ranking Minority Member of the
Subcommittee on Oversight and Investigations, House Committee on
Veterans’ Affairs, and the Chairman and Ranking Minority Member of the
Subcommittee on Benefits, House Committee on Veterans’ Affairs. We will
also provide copies to the Chairmen and Ranking Minority Members of the
House and Senate Committees on Veterans’ Affairs, the House and Senate
Committees on Appropriations, the Secretary of Veterans Affairs, and the
Director of the Office of Management and Budget. Copies will also be
made available to other parties upon request. Please contact me at
(202) 512-6253 or by e-mail at willemssenj.aimd@gao.gov if you have any
questions concerning this report. Major contributors to this report are
listed in appendix II.

Sincerely yours,




Joel C. Willemssen
Director, Information Resources Management




Page 23                         GAO/AIMD-97-79 Veterans Benefits Computer Systems
Contents



Letter                                                                                              1


Appendix I                                                                                         26

Comments From the
Department of
Veterans Affairs
Appendix II                                                                                        38

Major Contributors to
This Report
Figure                  Figure 1: Status of Noncompliant VBA Applications                          13




                        Abbreviations

                        OMB       Office of Management and Budget
                        VA        Department of Veterans Affairs
                        VBA       Veterans Benefits Administration


                        Page 24                      GAO/AIMD-97-79 Veterans Benefits Computer Systems
Page 25   GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix I

Comments From the Department of
Veterans Affairs

Note: GAO comments
supplementing those in the
report text appear at the
end of this appendix.




See comment 1.




                             Page 26   GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix I
Comments From the Department of
Veterans Affairs




Page 27                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix I
Comments From the Department of
Veterans Affairs




Page 28                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix I
Comments From the Department of
Veterans Affairs




Page 29                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix I
Comments From the Department of
Veterans Affairs




Page 30                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix I
Comments From the Department of
Veterans Affairs




Page 31                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
                 Appendix I
                 Comments From the Department of
                 Veterans Affairs




Now on p. 1.
See comment 2.




Now on p. 1.
See comment 3.


Now on p. 2.
See comment 4.

Now on p. 2.
See comment 5.


Now on p. 4.
See comment 1.



Now on p. 6.
See comment 6.

Now on p. 7.
See comment 7.

Now on p. 8.
See comment 8.


Now on p. 8.
See comment 1.




                 Page 32                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
                  Appendix I
                  Comments From the Department of
                  Veterans Affairs




Now on p. 8.
See comment 9.




Now on p. 11.
See comment 10.




Now on p. 12.
See comment 11.

Now on p. 12.
See comment 12.




Now on p. 13.
See comment 11.

Now on p. 13.
See comment 12.




Now on p. 13.
See comment 13.

Now on p. 14.
See comment 14.




                  Page 33                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
                        Appendix I
                        Comments From the Department of
                        Veterans Affairs




Now on p. 14.
See comment 15.



Now on p. 15.
See comment 7.

Now on p. 15.
See comment 2.

Now on pp. 15 and 16.
See comments 3 and 9.


Now on p. 17.
See comment 16.




Now on p. 18.
See comment 17.

Now on p. 18.
See comment 18.

Now on p. 18.
See comment 19.




                        Page 34                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
               Appendix I
               Comments From the Department of
               Veterans Affairs




               The following are GAO’s comments on the Department of Veterans Affairs’
               letter dated May 16, 1997.


               1. Discussed in agency comments section of report.
GAO Comments
               2. No change to report needed. As stated in our report, VBA has not
               completed key year-2000 readiness assessment processes. Specifically, VBA
               has not performed an assessment of how its major business areas would
               be affected if the year-2000 problem is not corrected in time. Similarly,
               Decision Systems Technology, Inc.’s Office of Information Resources
               Management Readiness Review did not assess how VBA’s major business
               areas would be affected if the year-2000 problem is not corrected. For
               example, veterans could receive inaccurate and/or delayed compensation
               and pension benefits or receive debt-collection letters when they do not
               actually owe money. In addition, VBA’s inventory of systems applications is
               incomplete because it does not include locally developed applications.
               Lastly, VBA has not developed contingency plans for three of its major
               business areas—loan guaranty, vocational rehabilitation and counseling,
               and insurance.

               3. VBA’s initial strategy of replacing and/or converting existing
               noncompliant benefits payment systems was risky. As stated in our report,
               VBA’s strategy did not contain sufficient information on the costs or
               potential problems associated with its approach to making its systems
               year-2000 compliant. We have acknowledged in this report that VBA
               recently redirected its year-2000 strategy by focusing on converting the
               existing noncompliant benefits payment systems rather than replacing
               them, and that this effort is expected to be completed in December 1998.
               In light of these developments, VBA must reevaluate the costs and risks
               associated with its new strategy. The results of this evaluation are
               especially important since VBA has decided only to exclude replacement of
               noncompliant benefits payment systems from its year-2000 strategy rather
               than discontinue these efforts. As a result, VBA’s new year-2000 strategy
               and replacement project effort continue to be dependent upon limited
               financial and personnel resources.

               4. Report changed to add “as with other federal agencies.”

               5. Report changed to include reference to VBA’s 1991 year-2000 study.

               6. Report changed to include “draft guide.”



               Page 35                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix I
Comments From the Department of
Veterans Affairs




7. No change to report needed. See Recent Developments section of
report.

8. Report changed. See Recent Developments section of report.

9. No change to report needed. The report section relating to VBA’s
“technical and program management deficiencies” was a critical part of
our analysis of VBA’s initial strategy for correcting its year-2000 problem.
Although VBA recently decided to make year-2000 changes to existing
systems its top priority and to no longer rely on replacement of the
noncompliant systems as a year-2000 solution, this does not take away the
fact that these deficiencies exist, and VBA continues to devote limited
financial and personnel resources to the replacement projects.

10. Report changed to include VBA’s 1991 year-2000 study. The report
already noted that VBA has begun to develop inventories of its systems
applications, internal/external interfaces, and third-party products.
However, these inventories were not completed by the end of our audit
work on April 11, 1997. Also, as stated in our report, until each regional
office has developed an inventory of regional applications and provided
the year-2000 program management office with a listing of these
applications in terms of their criticality, there is no assurance that critical
applications that require year-2000 compliance do not exist in the regions.

11. Report changed to replace “systems” with “applications.”

12. No change to report needed. According to the chart in our draft and
final report, the 32 noncompliant applications have not been addressed
(fixed, replaced, or retired) because 10 are awaiting resources, 11 are
awaiting completion of an analysis, and 11 have not been scheduled for
correction.

13. Report changed to delete the word “internal.”

14. Report changed to reflect VBA’s plans to complete its inventory of
interfaces by June 30, 1997, and that “VBA has begun to assess whether its
data exchange interfaces contain date information.”

15. Report changed to reflect issuance of OMB’s guidance recommending a
standard date format for agencies to use when exchanging electronic data
with date information. We encourage VBA to make appropriate use of the




Page 36                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix I
Comments From the Department of
Veterans Affairs




OMB guidance, since VA did not indicate in its comments whether VBA plans
to use this guidance.

16. Report changed to replace the word “assessed” with “reviewed” and to
explain how the 633 modules in the compensation and pension system
relate to 4 of the 153 applications.

17. Report changed to explain why VBA did not perform year-2000 repairs
to its insurance application.

18. Report changed to define “feeder” and “crosscutting” systems.

19. Report changed to add “support the current system.”




Page 37                           GAO/AIMD-97-79 Veterans Benefits Computer Systems
Appendix II

Major Contributors to This Report


                       Helen Lew, Assistant Director
Accounting and         Leonard J. Latham, Technical Assistant Director
Information            Mary J. Dorsey, Senior Information Systems Analyst
Management Division,   Tonia L. Johnson, Senior Information Systems Analyst
                       Michael P. Fruitman, Communications Analyst
Washington, D.C.




(511208)               Page 38                      GAO/AIMD-97-79 Veterans Benefits Computer Systems
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order
made out to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address
are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 6015
Gaithersburg, MD 20884-6015

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (301) 258-4066, or TDD (301) 413-0006.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512-6000 using a
touchtone phone. A recorded menu will provide information on
how to obtain these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov




PRINTED ON    RECYCLED PAPER
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. G100
Official Business
Penalty for Private Use $300

Address Correction Requested