United States General Accounting Office GAO Report to the Chairman, Subcommittee on Oversight and Investigations, Committee on Veterans’ Affairs, House of Representatives May 1997 VETERANS BENEFITS COMPUTER SYSTEMS Risks of VBA’s Year-2000 Efforts GAO/AIMD-97-79 United States GAO General Accounting Office Washington, D.C. 20548 Accounting and Information Management Division B-275674 May 30, 1997 The Honorable Terry Everett Chairman, Subcommittee on Oversight and Investigations Committee on Veterans’ Affairs House of Representatives Dear Mr. Chairman: Unless timely corrective action is taken, the Veterans Benefits Administration (VBA), like other federal agencies, could face widespread computer systems failures at the turn of the century due to incorrect information processing relating to dates. In many systems, the year 2000 will be indistinguishable from 1900; this could make veterans who are due to receive benefits appear ineligible. If this happened, issuance of benefits checks that veterans rely on could be delayed or interrupted. In response to your September 10, 1996, letter, we conducted a follow-up review to determine VBA’s actions to address management and technical weaknesses reported in a June 19, 1996, hearing on VBA’s modernization effort. This report discusses our assessment of VBA’s actions to ensure that the year-2000 computing problem will be adequately addressed. Our review of VBA’s actions to address other management and technical weaknesses will be discussed in a separate report. Correcting the year-2000 problem is critical to VBA’s mission of providing Results in Brief benefits and services to veterans and their dependents. If not corrected, calculations based on incorrect dates could result in inaccurate and late payment of benefits to veterans, prompting financial stress to millions across the country. VBA has acted to address the problem, but can do more. First, the year-2000 management office structure and technical capabilities are insufficient. Second, key year-2000 readiness assessment processes—determining the potential severity of the year-2000 impact on VBA’s operations, inventorying its information systems and their components, and developing contingency plans—have not been completed. Third, both VBA’s initial and revised strategies are risky in that without sufficient information on the costs or potential problems associated with its approach to making systems year-2000 compliant, it cannot make informed choices as to which systems must be funded to Page 1 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 avoid disruptions in service, versus which can be deferred. Deficiencies in these three areas add risk to an already difficult challenge. Addressing these problems will require close and continual top management attention and leadership. Contributing to the challenge facing VBA are the loss of key computer personnel, difficulties in obtaining necessary information from external sources on whether interfaces and third-party products are year-2000 compliant, and delays in upgrading systems at VBA data centers. The issue of whether third-party products are year-2000 compliant is being faced by other federal agencies as well. On April 11, 1997, at the conclusion of our review, the Department of Veterans Affairs’ (VA) chief information officer told us that VBA will (1) revise its year-2000 strategy to focus on converting the existing noncompliant benefits payment systems rather than replacing them and (2) acquire contractual support to assist in managing the year-2000 effort and in making necessary changes. We commend VBA for these initial steps and also the steps outlined in its May 16, 1997, comments to us. These are positive developments, and we look forward to seeing VBA’s plans to implement these steps. In addition, in its comments to us on May 16, 1997, VA concurred with all 10 recommendations. The implementation of these recommendations will put VBA in a better position to avoid these types of problems in the future. VA comprises three major components: the Veterans Health Background Administration, which provides services through the nation’s largest health care system; the National Cemetery System, which provides burial services in 113 national cemeteries; and VBA, which provides nonmedical benefits to veterans and their dependents. In fiscal year 1996, VBA paid $20 billion in benefits to 10 million veterans and their dependents. These benefits are grouped into five major business areas—compensation and pension (the largest), educational assistance, housing loan guaranty, vocational rehabilitation and counseling, and insurance. VBA administers its benefits programs through 58 regional offices. These offices are supported by three software development centers located at Hines, Illinois; Austin, Texas; and Philadelphia. As early as 1985, VBA realized that its computer systems at these centers were nearing the end of their useful lives and were becoming difficult and Page 2 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 expensive to maintain. To replace its aging computer systems, VBA developed a three-stage procurement plan to modernize its hardware and software and better support its business areas and regional offices. For stage I, VBA awarded a contract in December 1992 to acquire a number of personal computers, local area networks, minicomputers, and commercial off-the-shelf software for the 58 regional offices. For stage II, VBA awarded a contract in July 1995 to acquire imaging equipment and associated software for its educational assistance processing sites in Atlanta and St. Louis. This equipment would scan all documents in the chapter 301 education claims folders. Stage III, which was canceled in 1996, was for procuring mainframe computers for the Hines and Philadelphia data centers. VBA’s modernization effort was intended to replace the functions of the existing network through which benefits are delivered with new software applications and relational databases2 to provide enhanced functionality for users in all of VBA’s major businesses. The original plan was to modernize the compensation and pension area first, and then the other major business areas. In September 1995, however, VBA decided to redirect its modernization as a result of a study prepared by a private contractor, which concluded that VBA’s modernization approach was risky and too large in scope. The current modernization is limited to replacing and improving existing benefits payment systems. As one component of this, VBA expects to have an on-line compensation and pension payment system in place by December 31, 1998. This system is expected to provide the same claims processing capability as the current benefits delivery network, match or exceed the current system’s responsiveness, be easy to use, and resolve the year-2000 problem. Over the years, we have identified many weaknesses in VBA’s efforts to modernize its operations and manage its information technology resources. For example, as we reported in November 1992, VBA procurements of hardware were not supported by a defined information architecture, thereby increasing the risk that it would develop a system 1 Chapter 30 relates to the Montgomery GI bill, which provides education benefits for veterans on active duty after July 1, 1985. 2 A relational database is a computer file that stores information in tables (rows and columns) and conducts searches by using data in specified columns of a table to find additional data in another table. Page 3 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 that would not work as intended.3 Further, in June 19964 we reported and testified, that on the basis of our analysis of VBA’s software development processes, the agency is operating at a level-1 maturity capability,5 defined as ad hoc and chaotic. In assessing actions taken by VBA to address the year-2000 problem, we Scope and reviewed and analyzed numerous documents, including VBA’s December Methodology 13, 1996, Year-2000 Plan; its January 28, 1997, Year-2000 Risk Assessment; and the Department of Veterans Affairs’ January 13, 1997, Year-2000 Readiness Review. To determine progress made in solving the year-2000 problem we reviewed and analyzed VBA project plans, project schedules, and progress reports for the replacement initiatives identified by agency officials as crucial to solving the year-2000 problem, as well as project plans and schedules for the contingency and conversion initiatives. To determine the costs, benefits, and risks associated with the year-2000 problem, we reviewed VA’s fiscal 1998 budget submission and VBA’s January 31, 1997, information resources management support plan. We used our draft year-2000 assessment guide6 to assess VBA’s readiness to achieve year-2000 compliance. In addition, we visited and/or interviewed project teams, including contractor support, in St. Petersburg, Florida, and Washington, D.C.; computer personnel at VBA’s data centers at Hines and Philadelphia, and its Austin Systems Development Center to discuss progress and problems involved with their year-2000 activities. We also discussed VBA’s year-2000 efforts with VBA headquarters officials in Washington, D.C., plus representatives from VA’s Office of Information Resources Management. We performed our work from October 1996 through April 1997, in accordance with generally accepted government auditing standards. The Department of Veterans Affairs provided detailed comments on a draft of this report. These comments are an expansion of the Department’s initial 3 Veterans Benefits: Acquisition of Information Resources for Modernization Is Premature (GAO/IMTEC-93-6, Nov. 4, 1992). 4 Software Capability Evaluation: VA’s Software Development Process Is Immature (GAO/AIMD-96-90, June 19, 1996) and Veterans Benefits Modernization: Management and Technical Weaknesses Must Be Overcome If Modernization Is To Succeed (GAO/T-AIMD-96-103, June 19, 1996). 5 A capability maturity model was developed in 1991 by the Software Engineering Institute (Carnegie Mellon University, Pittsburgh) for use by organizations wishing to evaluate their capability to consistently and predictably produce high-quality software. The Institute’s mission is to provide leadership in advancing the state of the practice of software engineering to improve the quality of systems that depend on software. 6 Year 2000 Computing Crisis: An Assessment Guide [exposure draft] (GAO/AIMD-10.1.14, February 1997). Page 4 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 comments dated April 22, 1997. They have been incorporated into the report where appropriate and are included as appendix I. At 12:01 a.m. on January 1, 2000, many computer systems worldwide could High Risk of Year-2000 malfunction or produce inaccurate information simply because the date Problems Can Be has changed. Unless corrected, such failures could have a costly, Reduced Using widespread impact. Within VBA, compensation and pension systems that relate dates—such as birth or military service—to benefits could be Structured Approach vulnerable. and Rigorous Program The problem is rooted in how dates are recorded and computed. For the Management past several decades, systems have typically used two digits to represent the year—such as “97” for 1997—to save electronic storage space and reduce operating costs. In such a format, however, 2000 is indistinguishable from 1900. As an example of the potential impact of this ambiguity, a veteran born in 1925 and therefore turning 75 in 2000 could be seen as being negative 25 years old (if “now” is 1900)—not even born yet—and hence ineligible for benefits that the veteran had been receiving. Correcting this problem will not be easy or inexpensive, and must be done while such systems continue to operate. Many of the government’s computer systems were developed 20 to 25 years ago, use a wide array of computer languages, and lack full documentation. Systems may contain up to several million lines of software code that must be examined for potential date-format problems. The enormous challenge involved in correcting these systems is not primarily technical, however: it is managerial. Agencies’ success or failure will largely be determined by the quality of their program management and executive leadership. Top agency officials must understand the importance and urgency of this undertaking, and communicate this to all employees. The outcome of these efforts will also depend on the extent to which agencies have institutionalized key systems-development and program-management practices, and on their experience with such large-scale software development or conversion projects. Accordingly, agencies must first assess their information resources management capabilities and, where necessary, upgrade them. In so doing, they should consider soliciting the assistance of other organizations experienced in these endeavors. Page 5 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 To assist agencies with these tasks, we have prepared a draft guide that discusses the scope of the challenge and offers a structured, step-by-step approach for reviewing and assessing an agency’s readiness to handle the year-2000 problem.7 The guide describes in detail five phases, each of which represents a major year-2000 program activity or segment. These are: • Awareness. This is a critical first step. Although many people may have heard about a year-2000 problem, they may not know what it entails or why it matters. For agency personnel, awareness is imperative. This is also the phase in which the agency team that will take the lead in correcting the problem is identified. The team then examines the problem’s potential impact, gauges the adequacy of agency resources, develops a strategy, and secures strong, visible executive support. • Assessment. The main thrust of this phase is separating mission-critical systems—which must be converted or replaced—from important ones that should be converted or replaced and marginal ones that may be addressed now or deferred. Since the year-2000 problem is primarily a business problem, it is essential to assess its likely impact on the agency’s major business functions. Following this, information systems in each business area should be inventoried and prioritized; project teams are then established and program plans devised. Testing strategies must be identified, and contingency plans developed as well. • Renovation. This phase deals with actual changes—converting, replacing, or eliminating selected systems and applications. In so doing, it is important to consider the complex interdependencies among these. Changes must be consistent agencywide, and information about them clearly disseminated to users. • Validation. Here, agencies test, verify, and validate all converted or replaced systems and applications, ensuring that they perform as expected. This critical phase may take over a year and consume up to half of the year-2000 program’s budget and resources. It is essential that agencies satisfy themselves that their testing procedures are up to the challenge and that their results can, indeed, be trusted. • Implementation. Deploying and implementing year-2000-compliant systems and components requires extensive integration and acceptance testing. And since not all agency systems will be converted or replaced simultaneously, it may be wise to operate in a parallel-processing environment for a time, using old and new systems side-by-side. Such redundancy can act as a fail-safe mechanism until it is clear that all changed systems are operating correctly. 7 GAO/AIMD-10.1.14, February 1997. Page 6 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 VBA has initiated actions to address the year-2000 awareness phase, Awareness Actions including an agencywide plan, a year-2000 strategy, and a program Initiated, but More management organization. However, executive management can further Can Be Done improve upon these actions by addressing deficiencies in the year-2000 program management office structure and technical and program management capabilities. It is critical that these deficiencies be corrected if VBA is to succeed in correcting the year-2000 problem. Year-2000 Actions Have VBA recognizes that the upcoming change of century poses significant Been Initiated challenges to the agency. In 1991, it conducted an initial analysis of the year-2000 problem. According to VBA’s January 31, 1997, information resources management support plan, correcting the year-2000 problem is the agency’s number-one priority. A year-2000 charter has been developed, defining the project management organization. VBA’s chief information officer has overall responsibility for ensuring year-2000 compliance. In addition, a VBA year-2000 project manager has been assigned, along with site project coordinators at each of VBA’s systems development centers—Hines, Philadelphia, and Austin. A consultant has also been obtained to assist in managing the day-to-day responsibilities. VBA also has developed an agencywide plan for achieving year-2000 compliance, using a multifaceted strategy. The primary focus of this strategy has been to replace noncompliant systems with newly developed, compliant systems. In the event the replacement projects are not implemented in time, VBA has developed and has begun to implement a contingency plan for the compensation and pension and educational assistance payment systems to ensure their continued operation past the year 2000. Another aspect of VBA’s strategy is to convert the existing insurance and debt management systems. VBA’s goal is to have all operating systems, applications and third-party products (hardware, software, mainframes, minicomputers, operating systems, and utilities) compliant by November 30, 1998. This will allow it over 1 full year to test and correct problems, and to monitor the applications’ execution. VBA’s Year-2000 Program It is essential that agencies appoint a year-2000 program manager and Management Office establish an agency-level program office to manage and coordinate Structure Is Inadequate year-2000 program activities. The problem and solutions involve a wide range of dependencies among information systems: the need to Page 7 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 (1) centrally develop or acquire conversion and validation standards, inspection, conversion, and testing tools, (2) coordinate the conversion of crosscutting information systems and their components, (3) establish priorities, and (4) reallocate resources as needed. Although VBA has appointed a year-2000 project manager and has established a program management office, the functions of this office do not adequately cover all of VBA’s year-2000 activities. According to the project manager, her management functions are limited to conversion projects for the compensation and pension and educational assistance payment systems, and replacement projects for educational assistance payment systems. She is not overseeing or coordinating year-2000 activities for any other conversion or replacement project. As a result, the program management office is not necessarily aware of year-2000 problems in these other areas, such as the housing loan guaranty area, which may require the office’s attention because they can adversely affect the agency’s ability to provide benefits and services to veterans. In addition, no one in VBA’s program management office is overseeing the year-2000 work in the 58 regional offices. For example, VBA’s chief information officer issued a September 16, 1996, memorandum to area, service and regional office directors requesting that all regional office and program sponsors develop an inventory of all locally developed applications and locally acquired third-party products to determine whether they are year-2000 compliant. These sponsors do not, however, have to report this information to the program management office. In contrast to VBA’s three systems development centers, there is no year-2000 site project coordinator in VBA’s regional offices. Technical and Program The ability to successfully manage the year-2000 problem will depend Management Deficiencies upon the degree to which an agency has institutionalized key systems Exist development and program management practices, and on its experience in managing large-scale software conversion or system development projects. A systems architecture8 is essential to VBA’s plans to develop compliant payment systems to replace its existing systems. Leading organizations both in the private sector and in government use systems architectures to guide mission-critical systems development and to ensure the appropriate integration of information systems through common 8 An integrated information systems architecture is a blueprint to guide and constrain the development and evolution of a collection of related automated information systems. Page 8 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 standards.9 The Congress also recognized the importance of systems architectures as a means to improve the efficiency and effectiveness of federal information systems by enacting the Clinger-Cohen Act of 1996. The act, among other provisions, requires that department-level chief information officers develop, maintain, and facilitate integrated systems architectures. An integrated systems architecture is divided into two principal components—a logical component and a technical component. The logical component is essential to ensuring that an agency’s information systems support accomplishing its mission, while the technical component provides the detailed guidance needed for developing evolving information systems. The logical component includes a high-level description of the organization’s mission, functional requirements, information requirements, systems, information flows among systems, and interfaces between systems. It defines the organization’s current and future missions, concepts of operations, and interdependencies, such as information flows and systems interfaces. The purpose of the logical architecture is to ensure that systems meet the business needs of the organization. The technical component of the integrated systems architecture details specific information technology and communications standards and approaches that will be used to build the systems, including those that address critical hardware, software, communications, data management, security, and performance characteristics. The purpose of the technical architecture is to ensure that systems are interoperable,10 function together efficiently, and will be cost-effective over their life cycle. VBA has not developed a complete, integrated systems architecture for its new systems development activities. Specifically, at the logical architecture level, VBA has not developed or documented a comprehensive analysis of the information flows among the various information systems, nor has it performed the systems engineering analyses needed to define and document—at an acceptable level to systems developers—the interfaces among the various systems that must share needed data to perform benefits delivery functions. At the technical architecture level, VBA lacks several key elements as well. For example: 9 Executive Guide: Improving Mission Performance Through Strategic Information Management and Technology—Learning From Leading Organizations (GAO/AIMD-94-115, May 1994). 10 Interoperability refers to the ability of a technical and/or software platform to operate with, or exchange data with, other technical and software platforms, regardless of vendor or vendor-specific technical standards. Page 9 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 • VBA has not performed the analysis necessary to define its security architecture. Without first performing a comprehensive threat and vulnerability assessment, VBA cannot develop security controls to prevent the intentional or accidental disclosure, modification, or destruction of sensitive information—information that is being processed and transmitted over communications lines or shared internally among those who need the data to process benefits claims or produce management reports. • VBA has not analyzed or developed performance characteristics or standards. As a result, it does not know what system capacity will be needed to run its new applications or how processing must be handled in order to maintain adequate performance. • VBA’s systems development teams are making changes to the database and data elements prior to obtaining the database administrator’s review and approval. This disregard or lack of knowledge of standard change management processes can result in redundancy and integrity problems and can increase the risk of system performance degradation. • VBA’s systems development teams were not until recently using a standard software development language when coding the applications software. For example, the graphical user interface software in the new compensation and pension payment system was being developed in JAM7,11 while the new educational assistance payment systems will be developed in Visual Basic.12 VBA recently decided to make Visual Basic its standard software development language. As a result, systems previously coded in JAM7 will need to be recoded in Visual Basic. Along with not institutionalizing key systems development and program management practices, VBA cannot rely on its software-development processes. We assessed these processes using the Software Engineering Institute’s software capability maturity model; the result showed that VBA’s software development capability is at an “ad-hoc and chaotic” level—the lowest level of software development capability.13 At this level, VBA cannot reliably develop and maintain high-quality software on any major project within existing cost and schedule constraints, placing VBA modernization at significant risk. In this context, VBA relies solely on the various capabilities of individuals rather than on an institutional process that can yield repeatable results. To improve upon its software development 11 JAM7 is a commercial, off-the-shelf, 4th-generation software development tool, designed to be used with relational database management and transaction processing systems. 12 Visual Basic is a Windows programming language that is often used to write user interfaces for client/server applications. 13 GAO/AIMD-96-90, June 19, 1996. Page 10 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 capability, VBA has recently obtained the assistance of the Software Engineering Institute. In the assessment phase, VBA has made limited progress in determining Year-2000 Assessment whether its information systems and their components are year-2000 Not Yet Complete compliant. It has begun to develop inventories of its centralized internal applications, internal/external interfaces, and third-party products. Also, according to VBA’s year-2000 project manager, VBA has recently developed an overall testing plan. However, key assessment processes have not been completed. Specifically, VBA has not (1) assessed the severity of its year-2000 problem, (2) completed its inventory or assessment of its information systems, interfaces, and third-party products, or (3) developed contingency plans for all its payment systems. Failure to address these key processes increases the risk that VBA will not achieve year-2000 compliance by January 1 of that year. VBA Has Not Assessed Developing and publishing a high-level assessment of the year-2000 issue Severity of Year-2000 provides executive management and staff with a broad overview of the Problem potential impact the century change could have on the agency. Such an assessment provides management with valuable information on which to prioritize the agency’s year-2000 activities, as well as a means of obtaining and publicizing management commitment and support for necessary year-2000 initiatives. VBA has performed no assessment of how its major business areas would be affected if the year-2000 problem is not corrected in time. On the basis of our discussions with VBA personnel, it is clear that VBA’s ability to deliver benefits and services to veterans could be compromised if systems are not changed. For example, veterans could receive inaccurate and/or delayed compensation and pension benefits, receive debt-collection letters when they do not actually owe money, cease to receive vocational rehabilitation services, receive inaccurate insurance benefits, or have foreclosure proceedings initiated unnecessarily due to erroneous date calculations. These problems could all arise from the fact that the payment systems for these major business areas use two digits to represent the year, rather than four, to denote dates that affect benefits eligibility, such as date of birth and dates of military service. Page 11 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 Inventory and Assessment An agencywide inventory of information systems and their components of Information Systems, provides the necessary foundation for detailed year-2000 program Interfaces, and Third-Party planning. A thorough inventory ensures that all systems are identified and linked to a specific business area or process, and that all agencywide, Products Are Incomplete crosscutting systems are considered. According to its December 1996 year-2000 plan, VBA expected to have completed its inventories of systems applications, interfaces and exchanges, and third-party products by September 30, 1996. However, VBA had completed an inventory only of its software applications at its three systems development centers by that date. It had not completed inventories of the agency’s internal/external interfaces and data exchanges or third-party vendors and products. The status of VBA’s inventories and its assessment for year-2000 compliance is summarized below. • According to VBA’s February 17, 1997, inventory, it has 153 applications, consisting of 8,480 modules and 9.1 million lines of software code. According to VBA, of these applications, 22 are compliant, 20 are to be replaced with new compliant applications,14 and 111 are noncompliant. As shown in figure 1, no action has yet been taken to fix, replace, or retire about one-third of the noncompliant applications. 14 These applications currently do not exist. VBA’s inventory includes both existing applications and applications under development and/or planned. Page 12 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 Figure 1: Status of Noncompliant VBA Applications Of the 111 noncompliant applications: Replacing Converting 29 41 9 Eliminating 32 111 Unaddressed Of the 32 unaddressed noncompliant applications, 10 await resources, 11 await completion of analysis, and 11 have not been scheduled for correction. VBA’s inventory of applications does not include local applications developed by its regional offices. Despite the chief information officer’s request that regional offices and program sponsors develop an inventory of all locally developed applications, he has said that such regional applications need not be included in the inventory of software applications because no mission-critical applications were locally developed. In our view, however, until each regional office has developed an inventory of Page 13 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 locally developed applications and provided the year-2000 program management office with a listing of these applications in terms of their criticality, there is no assurance that critical applications that require year-2000 compliance do not exist in the regions. According to VA’s year-2000 readiness review, VBA cannot adequately predict or plan the impact of the year-2000 change without a complete inventory of region-developed applications. • VBA has not completed its inventory of internal/external interfaces15 and data exchanges for its information systems. It has identified 410 interfaces to date, but acknowledges that more could exist. According to VBA’s year-2000 project manager, VBA plans to complete its inventory of interfaces by June 30, 1997. VBA has begun to assess whether the interfaces and data exchanges in its inventory contain date information, but it does not know when this will be completed. VBA also does not know at this time how it will validate incoming external data, address invalid data, or handle situations in which no data are received from the external source. The Office of Management and Budget (OMB) recently issued guidance recommending a standard date format for agencies to use when exchanging electronic data with date information. • VBA has developed an inventory of its third-party products but has not yet completed its review of these products for year-2000 compliance. The agency currently does not know when this will be completed because, like other federal agencies, it has had difficulty obtaining information on year-2000 compliance from third-party vendors. For example, many vendors have not yet decided whether they will be able to support their products beyond 1999. As a result, the VBA year-2000 project manager is concerned that the agency will not have sufficient time to purchase and implement year-2000-compliant hardware and software upgrades to its existing and new systems. Contingency Plans Have Agencies should develop realistic contingency plans—including Not Been Developed for All development and activation of manual or contract procedures—to ensure Critical Systems the continuity of its major business processes. Three of VBA’s major business areas—loan guaranty, vocational rehabilitation and counseling, and insurance—do not have contingency plans. VBA recognizes that it may have to return to manual processing if critical systems in these major 15 An example of an external interface is the exchange of disability compensation information between the Department of Defense and VBA. Defense currently provides VBA with electronic information on the amount of disability benefits paid to a veteran by Defense for offset against the amount paid by VBA to this same veteran. This offset is necessary because, by law, the veteran cannot be paid twice for the same disability. Page 14 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 businesses are not year-2000 compliant. Also, VBA’s year-2000 project manager recently informed us that the agency is now developing a contingency plan for several of its loan guaranty systems as a result of concerns we identified. VBA lacks adequate information about the costs and risks associated with Noncompliant its year-2000 efforts to make informed choices about information Systems: Inadequate technology priorities. Agencies should prioritize their information Assessment of Costs technology projects to make effective use of two vital resources—people and money. To make informed choices about information technology and Risks Precludes priorities, agencies need to assess the costs, benefits, and risks of Informed competing projects. In some instances, agencies may have to defer or cancel new systems developments and allocate freed resources to achieve Prioritization year-2000 compliance. VBA has not prioritized its efforts to replace or convert existing benefits payment systems. Its year-2000 strategy calls for it to replace most existing systems while simultaneously converting its existing compensation and pension and educational assistance systems as a contingency. Since both actions depend upon limited financial and personnel resources, VBA is at serious risk that it may not be able to complete either in time. Similarly, within its group of payment systems, VBA has not ranked them on the basis of its need for particular functions within a system, nor has it initiated work on the most important functions first. And since each system has at least three distinct parts—on-line, batch, and text—these parts need to be ranked in order of importance. Reliable assessments of costs and risks are important prerequisites for effectively prioritizing projects. In VA’s year-2000 readiness assessment, it was estimated that year-2000 costs for VBA would be about $20 million for fiscal years 1996 through 1999. However, this amount only covers the conversion projects, such as the costs to upgrade the mainframes and operating systems at the Hines and Philadelphia data centers. It does not include costs to replace VBA’s aging systems with new, compliant payment systems. VBA’s Risk Assessment VBA has prepared a year-2000 risk assessment identifying six major risk Limited to Conversion areas: the need for systems upgrades, lack of personnel resources, Projects insufficient information on third-party vendors and products, insufficient Page 15 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 time to fix all applications, lack of budget resources, and insufficient information on interfaces. However, VBA’s January 28, 1997, risk assessment is generally limited to the risks associated with the projects to convert the existing compensation and pension and educational assistance payment systems. It does not discuss specific risks associated with VBA’s replacement projects. We have concerns about the risks associated with both the conversion and replacement projects. These include schedule delays, loss of key personnel, lack of sufficient funding for necessary upgrades, and data center consolidation issues. These risks are discussed below. Replacement Projects May Miss VBA is at risk of not completing its replacement payment systems—for Deadline compensation and pension, educational assistance, and housing loan guaranty—before January 1, 2000. One reason, as discussed earlier, is VBA’s lack of a complete, integrated systems architecture. Another factor contributing to the risk that these three systems will not be completed on time is the loss of systems control and quality assurance personnel due to resignations, retirements, and reassignments. At the Hines systems development center, for example, 6 out of 16 systems control and quality assurance personnel were lost as a result of resignations and retirements. Failure to replace these individuals will result in schedule delays during the validation and testing phase of systems development. Specifically, for the compensation and pension system, VBA has already experienced a schedule delay on its replacement project. According to the project manager, the system will not be ready for testing in July 1997, as initially scheduled. The project manager is currently developing a revised schedule for completing the project. The delay is due largely to the realization that what is being developed is a stand-alone system rather than an integrated one. Our analysis shows that additional delays to the project’s schedule can result from VBA’s decision to change its software applications programming language from JAM7 to Visual Basic. According to the project manager, this change was necessary because most of the agency’s systems development projects are written in Visual Basic. For educational assistance payments, VBA is also experiencing schedule delays in developing four new, compliant systems. According to its December 13, 1996, year-2000 plan, these systems were to be completed by the summer of 1998. To date, VBA has only started developing one educational system. This system, scheduled initially for completion in June 1997, is now 5 months behind schedule because of delays in contract Page 16 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 award and problems in defining data elements. VBA does not know when the remaining three educational assistance systems will be implemented because each of these is contingent upon completion of the previous educational system in the development sequence. In addition, the system’s project manager told us that completion of the next system depends upon the availability of funding for contractor support. Finally, with respect to the housing loan guaranty systems, VBA is also at risk. Its loan guaranty program uses a number of interrelated systems to process loans, loan defaults, and property management. Most of these systems are scheduled to be replaced.16 However, one key loan system—loan services and claims—has encountered many systems development problems and is currently about 6 months behind schedule. According to the system’s project manager, phase 1 of this system will now be deployed to one site in July 1997; phase II of this system would then start. The project manager also said that phase II was scheduled to be completed by mid-1998; however, the application will have to be recoded from JAM7 to Visual Basic, and will not be completed on schedule. Several other loan systems development activities have either just started or have not yet begun. Conversion Projects May VBA is also at risk that its work to convert its existing noncompliant Likewise Be Delayed payment systems may not be completed in time. This is primarily because VBA has lost key computer specialists, including programmers, software quality analysts, and hardware system specialists, as a result of retirements and financial enticements offered to employees eligible to retire. For example, the Hines systems development center lost 20 computer specialists in December 1996 and January 1997, due to resignations and retirements. This loss in experienced personnel will make it more difficult for VBA to complete its conversion projects in time. In addition, many of the remaining staff have been reassigned from year-2000 work to special projects.17 As a result, VBA personnel have reviewed only 57 of 633 modules, or 9 percent, in the compensation and pension system for compliance.18 16 These systems are automated loan processing, construction and valuation, loan service and claims, and expanded lender interface. 17 According to VBA, these include legislative mandates, such as the spina bifida benefit to children of Vietnam veterans exposed to Agent Orange and other herbicides; minimum income for widows, which was previously provided by the Department of Defense; and a reduction in the clothing allowance for incarcerated veterans. 18 The 633 modules relate to 4 compensation and pension applications. Page 17 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 Since VBA’s insurance system was essentially upgraded last year rather than redesigned, its strategy for solving the year-2000 problem for the insurance program has been to convert the existing system. According to the year-2000 project manager, this effort is currently on schedule, but delays can occur if additional staff are lost due to resignations and retirements. And because of calculations using dates 1 year into the future, the insurance system must not only be fixed but tested and ready to run by January 1, 1999. VBA also needs to ensure that its information feeder systems and crosscutting systems are made year-2000 compliant.19 One example of such a system is its beneficiary identification and records locator system. VBA is in the process of developing a contract for the year-2000 work on this system. VBA has also begun to recode its centralized accounts receivable system. Data Center Consolidation A high-risk area associated with VBA’s contingency and replacement Issue projects has been the issue of data-center consolidation. VBA is aware that it needs to upgrade the mainframes and operating systems at its Hines and Philadelphia data centers to run the existing benefits payment systems. The current mainframes and operating systems at these locations are not year-2000 compliant, and the vendors of these systems have informed VBA that they will not support the current systems. VBA also knows that upgrades are needed for the minicomputers that will run its new systems. It has not formally requested upgrades to the mainframes and operating systems at Hines and Philadelphia, but has discussed this matter with VA’s Office of Information Resources Management.20 Conversely, VBA has requested upgrades to the minicomputers, but VA has yet to approve this request. A key factor affecting VA’s approval of both requests was its decision on which hardware platforms would run the benefits payment systems—the existing and new systems—and where these platforms would be located. VA and VBA were to submit a strategy and implementation plan for data-center consolidation to OMB in July 1996 and December 1996, respectively. VA decided on March 28, 1997, to terminate consideration of data-center consolidation, and focus its 19 Feeder systems provide data to one or more systems for processing, but are not dependent on these systems for their own operation. For example, a personnel system would provide employee information needed to process payroll. A crosscutting system processes, stores, or distributes common information or data across all business functional areas of an organization. For example, a decision support system can capture performance information covering several major business areas. 20 VA’s Office of Information Resources Management must approve all VBA procurements over $250,000. Page 18 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 attention instead on achieving year-2000 compliance. As a result, VA will approve upgrades to the mainframes and operating systems at Hines and Philadelphia. Until the upgraded systems are operational, however, risks associated with noncompliance will remain. We met with VA’s and VBA’s chief information officers on March 27, 1997, to Recent Developments brief them on the results of our review. At that time we expressed concern Are Encouraging that VBA may not be able to complete its year-2000 efforts in time. In response to our concerns, VA’s chief information officer informed us on April 11, 1997, that VBA will redirect its year-2000 strategy by focusing on converting the existing benefits payment systems, rather than on replacing the noncompliant systems. He also stated that VA has established an oversight committee consisting of one VBA executive, a senior manager from VA’s Office of Information Resources Management, and an independent contractor, to monitor and evaluate the progress of VBA’s year-2000 effort. This contractor will assess the status of code conversion and supplement the recoding work currently done by VBA staff. The contractor is to issue a report in August 1997, along with an action plan and a proposal for the level of effort required to complete year-2000 recoding activities in December 1998. We are encouraged by this recent development. These actions should help VBA achieve year-2000 compliance. We will continue to evaluate VBA’s plans and strategies for how this will be accomplished. Correcting the year-2000 computing problem is crucial if VBA is to be able Conclusions to provide uninterrupted benefits and services to veterans. This will not be easy, and will require a proactive strategy. VBA will not be in a position to make informed decisions on the best use of limited personnel and financial resources until it completes the inventory and assessment of its information systems and their components. Once this has been accomplished, a reallocation of VBA’s resources toward completing the conversion projects may be necessary, and the development of contingency plans for all critical noncompliant information systems will be essential. Making these goals a reality will necessitate a stronger project management office structure for VBA’s year-2000 compliance activities, along with improved technical and program management capabilities. Page 19 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 In light of the serious risks associated with VBA’s year-2000 activities, we Recommendations to recommend that the Secretary of Veterans Affairs direct and ensure that the Secretary of VBA’s acting under secretary for benefits, in conjunction with VBA’s chief Veterans Affairs information officer, • strengthen VBA’s year-2000 program management office by assigning this office oversight and coordination responsibilities for all year-2000 activities, including both system conversion and replacement projects in the three systems development centers, the central office, and the regional offices; • develop a complete, integrated systems architecture for its new systems development activities, including a security architecture, performance characteristics and standards, and change management policy; • assess how its major business areas would be affected if the year-2000 problem is not corrected in time and use the results of this assessment to help prioritize the agency’s year-2000 activities, as well as a means of obtaining and publicizing management commitment and support for necessary year-2000 initiatives; • complete inventories of all information systems and their components, including data interfaces and third-party products by June 30, 1997; • complete an analysis to determine whether VBA’s internal applications, interfaces, and third-party products are compliant, and develop a plan for addressing them, by July 31, 1997; • assess the cost, benefits, and risks of competing information technology projects and prioritize them to make effective use of limited staff and monetary resources, including deferring or canceling new systems developments and reallocating the freed resources to achieving year-2000 compliance; • assess the agency’s personnel resource needs for achieving year-2000 compliance, and then develop a plan for obtaining these resources; • develop a risk assessment, by June 30, 1997, that discusses the risks associated with each year-2000 project and its related costs; • develop a schedule for replacing and/or converting all year-2000 projects by July 31, 1997; and • develop a year-2000 contingency plan for all critical information systems, including development and activation of manual or contract procedures. In commenting on a draft of this report, the Department of Veterans Agency Comments Affairs concurred with all 10 of our recommendations. VA stated that it and Our Evaluation considers successful resolution of VBA’s year-2000 challenges to be an Page 20 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 overriding goal for VA and is redirecting all necessary resources to anticipate and resolve any problems related to the year-2000 issue. In addition, VA stated that it had several serious concerns with our draft report. It believed that we did not identify all its accomplishments, and that our report contained inaccuracies. VA stated that VBA has made substantial progress in resolving many of the deficiencies mentioned in our draft report, including (1) redirecting funds to support an independent and impartial contractor to oversee the year-2000 program, (2) establishing an oversight office, with contractor support, to monitor and evaluate VBA’s year-2000 effort, (3) relieving VBA’s year-2000 project manager of non-year-2000 duties to devote full attention to year-2000 activities, and (4) assessing the possible impact of deferring or canceling new systems developments to free resources to achieve year-2000 compliance. We are encouraged by these recently stated actions by VBA and look forward to seeing VBA’s plans to implement them. VA also stated that VBA completed (1) a review of its year-2000 status in 1991, (2) an inventory of information systems, and (3) contingency plans for all payment applications. Our review showed otherwise. We found that VBA’s 1991 assessment of its year-2000 status contained no milestones or discussion of cost and risk information for achieving year-2000 compliance. Also, as stated in our report, VBA’s inventory of information systems applications does not include local applications developed by VBA’s regional offices. We also noted that, according to VA’s year-2000 readiness review, VBA cannot adequately predict or plan the impact of the year-2000 change without a complete inventory of region-developed applications. Similarly, while VA stated that VBA has contingency plans for all payment systems, we found that three of VBA’s major business areas—loan guaranty, vocational rehabilitation and counseling, and insurance—do not have contingency plans. VBA’s year-2000 project manager recently informed us that the agency is now developing a contingency plan for several of its loan guaranty systems as a result of concerns we identified. Another major concern expressed by VA with our draft report is the extensive reference to our draft year-2000 assessment guide. VA indicated that we used this document as a rigid audit guide in reviewing VBA’s year-2000 effort. VA believes that VBA is meeting the spirit of our assessment guide and the best practices developed by the Governmentwide CIO Council Year 2000 Subcommittee. Our year-2000 assessment guide provides agencies with a structured, step-by-step Page 21 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 approach for reviewing and assessing an agency’s readiness to handle the year-2000 problem. It draws on the work of the Best Practices Subcommittee of the Interagency Year 2000 Committee, and incorporates guidance and practices identified by leading organizations in the information technology industry. We welcome any comments from VA on the content of our guide. Our guide was released in February 1997 as an exposure draft and we plan to finalize it this summer. While we used the guide to assess VBA’s readiness to achieve year-2000 compliance, our work in this area preceded its February 1997 issuance, as evident in our June 19, 1996, testimony on VBA modernization. VA stated that our draft report mischaracterized the nature and magnitude of VBA’s year-2000 situation by inappropriately interchanging the terms “systems” and “applications”. We have amended our report to reflect the use of the term “applications” rather than “systems” when discussing VBA’s inventory. However, we have appropriately used the term “systems” in our report when discussing current and planned mission-critical systems for each of VBA’s major business areas. VA also stated that our report fails to balance the discussion of deficiencies with recent developments in these areas. VA is concerned that our report may unnecessarily alarm veterans without the benefit of knowledge about VBA’s year-2000 accomplishments. Specifically, VA was concerned about our characterization of VBA’s ability to provide benefits and services to veterans if the year-2000 problem is not corrected. On the basis of our discussions with VBA’s chief information officer and project managers, as well as our review of VBA year-2000 documents, we believe that VBA’s ability to deliver benefits and services to veterans could well be adversely affected if the year-2000 problem is not solved. For example, in the vocational rehabilitation and counseling area, benefits payments could be inaccurate, delayed, or terminated due to incorrect processing of date-sensitive information. In the housing loan guaranty area, veterans who are delinquent in making payments on their guaranteed loans could have foreclosure proceedings initiated by erroneous date calculations. These are accurate and fair examples of what could happen if the year-2000 problem is not corrected. We are not trying to unnecessarily alarm veterans with these examples. Rather, we are seeking to raise these issues early enough for VBA to ensure no disruptions of services. Without early action, VBA will have to take extraordinary efforts to avoid disruption of services. These efforts will likely prove very Page 22 GAO/AIMD-97-79 Veterans Benefits Computer Systems B-275674 costly, diverting resources from other services, and some level of impact on service delivery may be unavoidable. Lastly, VA offered some specific comments directed to particular language in the draft report. These comments have been incorporated into the report where appropriate, and are included in appendix I. As agreed with your office, unless you publicly announce the contents of this report earlier, we will not distribute it until 30 days from its date. At that time, we will send copies to the Ranking Minority Member of the Subcommittee on Oversight and Investigations, House Committee on Veterans’ Affairs, and the Chairman and Ranking Minority Member of the Subcommittee on Benefits, House Committee on Veterans’ Affairs. We will also provide copies to the Chairmen and Ranking Minority Members of the House and Senate Committees on Veterans’ Affairs, the House and Senate Committees on Appropriations, the Secretary of Veterans Affairs, and the Director of the Office of Management and Budget. Copies will also be made available to other parties upon request. Please contact me at (202) 512-6253 or by e-mail at email@example.com if you have any questions concerning this report. Major contributors to this report are listed in appendix II. Sincerely yours, Joel C. Willemssen Director, Information Resources Management Page 23 GAO/AIMD-97-79 Veterans Benefits Computer Systems Contents Letter 1 Appendix I 26 Comments From the Department of Veterans Affairs Appendix II 38 Major Contributors to This Report Figure Figure 1: Status of Noncompliant VBA Applications 13 Abbreviations OMB Office of Management and Budget VA Department of Veterans Affairs VBA Veterans Benefits Administration Page 24 GAO/AIMD-97-79 Veterans Benefits Computer Systems Page 25 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Note: GAO comments supplementing those in the report text appear at the end of this appendix. See comment 1. Page 26 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Page 27 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Page 28 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Page 29 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Page 30 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Page 31 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Now on p. 1. See comment 2. Now on p. 1. See comment 3. Now on p. 2. See comment 4. Now on p. 2. See comment 5. Now on p. 4. See comment 1. Now on p. 6. See comment 6. Now on p. 7. See comment 7. Now on p. 8. See comment 8. Now on p. 8. See comment 1. Page 32 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Now on p. 8. See comment 9. Now on p. 11. See comment 10. Now on p. 12. See comment 11. Now on p. 12. See comment 12. Now on p. 13. See comment 11. Now on p. 13. See comment 12. Now on p. 13. See comment 13. Now on p. 14. See comment 14. Page 33 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs Now on p. 14. See comment 15. Now on p. 15. See comment 7. Now on p. 15. See comment 2. Now on pp. 15 and 16. See comments 3 and 9. Now on p. 17. See comment 16. Now on p. 18. See comment 17. Now on p. 18. See comment 18. Now on p. 18. See comment 19. Page 34 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs The following are GAO’s comments on the Department of Veterans Affairs’ letter dated May 16, 1997. 1. Discussed in agency comments section of report. GAO Comments 2. No change to report needed. As stated in our report, VBA has not completed key year-2000 readiness assessment processes. Specifically, VBA has not performed an assessment of how its major business areas would be affected if the year-2000 problem is not corrected in time. Similarly, Decision Systems Technology, Inc.’s Office of Information Resources Management Readiness Review did not assess how VBA’s major business areas would be affected if the year-2000 problem is not corrected. For example, veterans could receive inaccurate and/or delayed compensation and pension benefits or receive debt-collection letters when they do not actually owe money. In addition, VBA’s inventory of systems applications is incomplete because it does not include locally developed applications. Lastly, VBA has not developed contingency plans for three of its major business areas—loan guaranty, vocational rehabilitation and counseling, and insurance. 3. VBA’s initial strategy of replacing and/or converting existing noncompliant benefits payment systems was risky. As stated in our report, VBA’s strategy did not contain sufficient information on the costs or potential problems associated with its approach to making its systems year-2000 compliant. We have acknowledged in this report that VBA recently redirected its year-2000 strategy by focusing on converting the existing noncompliant benefits payment systems rather than replacing them, and that this effort is expected to be completed in December 1998. In light of these developments, VBA must reevaluate the costs and risks associated with its new strategy. The results of this evaluation are especially important since VBA has decided only to exclude replacement of noncompliant benefits payment systems from its year-2000 strategy rather than discontinue these efforts. As a result, VBA’s new year-2000 strategy and replacement project effort continue to be dependent upon limited financial and personnel resources. 4. Report changed to add “as with other federal agencies.” 5. Report changed to include reference to VBA’s 1991 year-2000 study. 6. Report changed to include “draft guide.” Page 35 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs 7. No change to report needed. See Recent Developments section of report. 8. Report changed. See Recent Developments section of report. 9. No change to report needed. The report section relating to VBA’s “technical and program management deficiencies” was a critical part of our analysis of VBA’s initial strategy for correcting its year-2000 problem. Although VBA recently decided to make year-2000 changes to existing systems its top priority and to no longer rely on replacement of the noncompliant systems as a year-2000 solution, this does not take away the fact that these deficiencies exist, and VBA continues to devote limited financial and personnel resources to the replacement projects. 10. Report changed to include VBA’s 1991 year-2000 study. The report already noted that VBA has begun to develop inventories of its systems applications, internal/external interfaces, and third-party products. However, these inventories were not completed by the end of our audit work on April 11, 1997. Also, as stated in our report, until each regional office has developed an inventory of regional applications and provided the year-2000 program management office with a listing of these applications in terms of their criticality, there is no assurance that critical applications that require year-2000 compliance do not exist in the regions. 11. Report changed to replace “systems” with “applications.” 12. No change to report needed. According to the chart in our draft and final report, the 32 noncompliant applications have not been addressed (fixed, replaced, or retired) because 10 are awaiting resources, 11 are awaiting completion of an analysis, and 11 have not been scheduled for correction. 13. Report changed to delete the word “internal.” 14. Report changed to reflect VBA’s plans to complete its inventory of interfaces by June 30, 1997, and that “VBA has begun to assess whether its data exchange interfaces contain date information.” 15. Report changed to reflect issuance of OMB’s guidance recommending a standard date format for agencies to use when exchanging electronic data with date information. We encourage VBA to make appropriate use of the Page 36 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix I Comments From the Department of Veterans Affairs OMB guidance, since VA did not indicate in its comments whether VBA plans to use this guidance. 16. Report changed to replace the word “assessed” with “reviewed” and to explain how the 633 modules in the compensation and pension system relate to 4 of the 153 applications. 17. Report changed to explain why VBA did not perform year-2000 repairs to its insurance application. 18. Report changed to define “feeder” and “crosscutting” systems. 19. Report changed to add “support the current system.” Page 37 GAO/AIMD-97-79 Veterans Benefits Computer Systems Appendix II Major Contributors to This Report Helen Lew, Assistant Director Accounting and Leonard J. Latham, Technical Assistant Director Information Mary J. Dorsey, Senior Information Systems Analyst Management Division, Tonia L. Johnson, Senior Information Systems Analyst Michael P. Fruitman, Communications Analyst Washington, D.C. (511208) Page 38 GAO/AIMD-97-79 Veterans Benefits Computer Systems Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with "info" in the body to: firstname.lastname@example.org or visit GAO’s World Wide Web Home Page at: http://www.gao.gov PRINTED ON RECYCLED PAPER United States Bulk Rate General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. G100 Official Business Penalty for Private Use $300 Address Correction Requested
Veterans Benefits Computer Systems: Risks of VBA's Year-2000 Efforts
Published by the Government Accountability Office on 1997-05-30.
Below is a raw (and likely hideous) rendition of the original report. (PDF)