United States GAO General Accounting Offfice Washington, D.C. 20548 Accounting and Information Management Division B-282525 April 23,1999 The Honorable John M. McHugh Chairman The Honorable Chaka Fattah Ranking Minority Member Subcommitteeon the Postal Service Committee on GovernmentReform House of Representatives Subject: U.S. Postal Service: SubcommitteeQuestions Concerning Year 2000 ChallengesFacing the Service In responseto your March 16,1999, request,this letter provides answersto questions rela,ing to our February 23,1999, testimony on challenges facing the U.S. Postal Service in addressingthe Year 2000 problem.’ As we noted in our testimony, the Service has been working hard to addressits Year 2000 problem and has recently revamped its management approach. If successfullyimplemented,its approach can provide significant support and oversight to Year 2000 efforts. However, the Postal Service has been running behind the Office of Managementand Budget’s (OMB) schedulefor system renovation and still must addressmajor issuesto correct and test system and mail processing equipment, ensure the readinessof thousandsof local facilities, and determine whether and when its key suppliers and interface partnerswill be Year 2000 compliant. The questions and our responsesfollow. l Year 2000ComrmtinzzCrisis Challenves Still Facine the U.S. Postal Service (GAO!I’-AlMD99-86, February 23,1999). /6&U& GAO,MMD!39-15ORPostal Service Year 2000 B282525 I. What is the 1999 problem ? Will this impact the Postal Service? Will the Postal Service be impacted by other dates? Please explain. The Year 2000 problem, which is rooted in the way dates are recorded and computed in automatedinformation systems, is primarijy associatedwith dates on or after January I, 2000. However, computer systems using two digits to denote the year may be vulnerable to “special dates”in 1999 as well. For example, April 9, 1999, when written in the Julian calendar, and September 9, 1999, when written in the Gregorian calendar, are representedas 9999. This could cause systems to malfunction because9999 is often assigneda special meaning, such as invalid date or end file. As noted in our testimony, these problems could disrupt the delivery of mail or other critical Postal Service business processessuch as financial and personnel management. To our knowledge, April 9,1999, however, did not prove to be problematic for the service. In addition, because2000 is a leap year, some computer systemsmay incorrectly process the last day of February 2000 (February 29,2000), and the first day following the last day in February 2000 (March I, 2000). The Postal Service has determined that its systemsare susceptibleto September 9, 1999, as well as 25 other “special dates,” and it is testing its “critical and severe”systems2to ensure that they can correctly handle these dates. 2. At what point should the Postal Service plan to make permanentfies to its systems? What sort of timeframes should be considered? What might it cost to make permanent repairs? Is the Postal Service looking at this issue? Like many orgar5zations with older computer systems,the Postal Service is currently pursuing a “windowing” approach to date conversion rather than expanding date fields from two to four characters. Under this approach, software is written to associatea fixed or sliding period of years with either the 20th or the 21st centuries. Many organizations with older computer systemsare pursuing this approach because,in some cases,especially where data sets are large and date dense and available storage is limited, it presents a quicker and less costly solution to the Year 2000 problem. Also, becauseas much as several decadescan be covered by the fixed or sliding window. permanent system fixes or replacementsmay not be immediately required. The Postal Service Year 2000 officials have advised us that windowing fixes will remain viable beyond the year 2048 for all but two systems,which will remain viable until the year 2These are systems the Postal Service has determined that it must assess, correct, and verify to ensure acceptable service to the public. They include, for example, the Postal Metering System, Money Order System, Mail Diibution Requirements system, and Air Contracting Support System. Page 2 GAO/AIMD-99-150R Postal Service Year 2000 B-282525 2019. According to the Postal Service, replacement scheduleshave already been developed for permanent fixes for thesetwo systems. 3. What happens to the Postal Service and its systems beyond the Year 20&I? Will they suffer from increased vulnerabilities of patched systems? Or will they benefit from strengthened and updated infrastructures? If the Postal Service is able to effectively correct its systems,then the systems should continue to operate without Year 2000-related problems until the period covered by the sliding of fixed windows expires. As we testified, if these fixes are not done effectively, then systemscould malfunction and disrupt critical postal operations. According to the Postal Service Year 2000 program manager, the Postal Service has realized significant benefits from their Year 2000 efforts. These include the elimination of unnecessary software code; replacement of antiquated, locally developed software applications; and modernization of information technology equipment, including mainframe computer systems,mid-range computer systems,and desktop workstations. In addition, according to Postal Service officials, the Service is implementing improved processesfor documenting software, testing, quality control, and configuration management. We did not assessthe Service’s implementation of these actions. However, while these steps should enhance information technology management well beyond 2000, they represent fundamental management practices that should have been in place long before the Year 2OQOproblem was identified. 4. Is GAO specifically !ooking at the extent to which federal agencies are hiring contractors for Y2K and the amount of money being paid out for services? Are you monitoring contractors performing Y2K efforts to ensure that the agencies are receiving timely and quality services? If not, why not? We are not monitoring or assessingcontractor efforts at federal agencies. We are reviewing agency progress in achieving Year 2000 compliance based on self-reported data provided to OMB and discussions with agency Year 2000 program management officials. The Inspector General of the Postal Service, however, is planning a Year 2000 conversion contract examination as part of the IG’s continuing audits of Year 2000 issues within the Postal Service. Page 3 GAO/AIMD99-15OR Postal Service Year 2000 5. What types of parameters are needed by the Postal Service in devising a national-based contingency plan ? What items must it consider as part of a contingency plan? What happens ifit runs into something it didn’t anticipate? The Postal Service is following our BusinessContinuitv and Contingency Planning guide, which provides a conceptualframework for managing the risk of potential Year 2000- induced disruptions to operationsand incorporatesbest practices in contingency planning and disasterrecovery. Our guide describesa structured approach for (1) initiating a business continuity project, (2) assessingthe potential impact of mission-critical failures on agency core businessprocesses,(3) identifying and documenting contingency plans and implementation modes, and (4) validating the businesscontinuity strategy. It recommends that agenciesdevelop a businesscontinuity plan consisting of a set of contingency plans- with a single plan for each core businessprocessand infrastructure component (e.g., power and telecommunicationsservices). Each plan should provide a description of the resources, staff roles, procedures,and timetables neededfor its implementation. The Postal Service’s Chief Operating Officer has recently started to work with individual businessareamanagersto develop contingency and business continuity plans. In developing these plans, Postal Service officials have told us that they intend to follow our guidance. However, we also testified that this planning did not begin until December 1998, whereas our Year 2000 AssessmentGuide recommendsthat it begin before August 1997, toward the end of the assessmentphase, Further, contingency plans are not scheduled to be completed and tested until June 30, 1999, and continuity plans are not scheduled to be completed and tested until August 1999 and tested again in November 1999. This schedule will leave the Service with little room for slippage or for making adjustmentsto ensure that contingency and continuity plans are practical and cost ,:ffective. And, as we testified, this challenge is further exacerbatedby the fact that the Service anticipates a surge in workload beginning in Septemberdue to the holiday businessrush, which typically requires greatel management attention. 6. Can the Postal Service control the external supplier problem? If so, how? As noted in our testimony, the Postal Service is heavily dependent on 271 key vendors and suppliers, such as airlines, which provide goods and services necessaryto mail delivery. If their systemsare not Year 2000 compliant in time, postal operations could be severely disrupted. However, the Postal Service’s ability to control its suppliers is limited and, therefore, it must rely on statementsof assuranceof Year 2000 compliance by its suppliers. As of April 23, 1999, according to the Service, 265 suppliers had reported that they are or 4 Year 2ooOCo D tinp crisis: Business Continuitvand Contingencv Pkmninq (GAO/A&ID-10.1.19). Issued as an eG0:ux-e draft in February 1998;issued in final in August 1998. Page 4 GAO/AIMD-9915OR Postal Service Year 2000 will be compliant by January 1,200O. The Service is pursuing the readinessstatus of the remaining 6 suppliers. According to the Service, any critical suppliers assessedas non- compliant or for which the readinessstatushas not been determinedwill be part of Postal Service contingency planning activities. 7. What can you tell us about the Postal Service “core business processes?” What are they and why are they important? According to the Postal Service’s Year 2000 Initiative Proiect Plan, the primary objective of its Year 2ooOeffort is to enable the continuous delivery of mail. To meet this objective, it is placing particular emphasis on four core businessprocesses: (1) collecting, processing,and delivering the mail, (2) paying employeesand suppliers, (3) collecting revenue,and (4) protecting the safety and well-being of postal employees. Some of these are clearly more Year 2000 dependentthan others, and, as such, will require greaterattention from Postal Service management. As we noted in our testimony, in many respects,the Postal Service provides critical services that are as ubiquitous as telecommunicationsor electrical power. A Year 2000-baseddisruption in mail delivery would have a serious impact acrossevery sector of the American economy. Further, reliance on the Postal Service is part of the contingency plans for many organizations that require a backup processfor electronically delivered transactionsand services. Therefore, it is essentialthat the Service maintain continuity in its core businessprocesses. To respondto these questions, we reviewed and analyzed documentsdescribing the Postal Service’s Year 2000 compliance efforts as well as its annual report. We conductedour work from March 1999 through April 1999 in accordancewith generally acceptedgovernment auditing standards. In developing this report, we discussedour findings with and obtained commentson a draft of this letter from the Postal Service’s Year 2000 program manager. Page 5 GAOMMD-9Sl5OR Postal Service Year 2000 B-282525 We are sending copies of this letter to Representative Steven Horn, Chairman, and RepresentativeJim Turner, Ranking Minority Member, Subcommittee on Government Management, Repreie;Gili$ Information, and Technology, y?fg &f;i;iia; cptri;z.hg, House Com.m@eeon j-Ges .A& jytiisk;ltative Gcvemment Barcia,Reform; Ranking.and Minority Member, Subcommittee on Technology, House Committee on Science. We are also sending copies of this report to William J. Henderson, PostmasterGeneral, as well as other interested parties. If you have any questions regarding this report, please contact me or Carl Urie, Assistant Director, at (202) 512-6240. Director, Govkmmentwide and Defense Jnf9rmation Systems (511148) Page 6 GAOMMD-99-15OR Postal Service Year 2000 Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and Mastercard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by caiiing (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “info” in the body to: infoQwww.gao.gov or visit GAO’s World Wide Web Home Page at: http:/ti.gao.gov United States Bulk Rate General Accounting Office Postage & Fees Paid Washiugton, D.C. 20548-0001 GAO Permit No. GlOO OffMal Business Penalty for Private Use $300 Address Correction Requested
U.S. Postal Service: Subcommittee Questions Concerning Year 2000 Challenges Facing the Service
Published by the Government Accountability Office on 1999-04-23.
Below is a raw (and likely hideous) rendition of the original report. (PDF)