United States General Accounting Office GAO Testimony Before the Subcommittee on Government Management, Information and Technology and the Subcommittee on the Postal Service, Committee on Government Reform, and the Subcommittee on Technology, Committee on Science, House of Representatives For Release on Delivery Expected at 10 a.m. YEAR 2000 COMPUTING Tuesday, February 23, 1999 CRISIS Challenges Still Facing the U.S. Postal Service Statement of Jack L. Brock, Jr. Director, Governmentwide and Defense Information Systems Accounting and Information Management Division GAO/T-AIMD-99-86 Ms. Chairwoman, Mr. Chairmen, and Members of the Subcommittees: Thank you for inviting me to participate in today’s hearing on the challenges facing the U.S. Postal Service in addressing the Year 2000 problem.1 Although the Postal Service’s main mission is to provide postal services to all communities, the processes it must employ to meet that mission make it among the most complex of the public entities we have examined. The service employs nearly one-third of the federal civilian workforce and provides delivery services for 650 million pieces of mail a day to over 130 million households and businesses. Its national network encompasses 174 processing and distribution centers, hundreds of smaller facilities, 34 air mail centers, 21 bulk mail centers, and nearly 38,000 local post offices, stations, and branches. Moreover, information technology is integral to every facet of postal operations--from sorting, processing, and distributing the mail to dealing with customers, accounting for and managing cash flows, communicating with business partners and other government agencies, and modernizing its facilities. Clearly, the service faces a mammoth task in fixing not only its nationwide business systems and related interfaces but the systems and equipment residing in its facilities. The service has been working hard to address its Year 2000 problem and has recently revamped its management approach, which, if successfully implemented, can provide significant support and oversight to its Year 2000 efforts. However, the service has been running somewhat behind the Office of Management and Budget’s (OMB) schedule for system renovation and still must address major issues to complete system and mail processing equipment correction and testing, ensure the readiness of hundreds of local facilities, and determine the ability of key suppliers and interface partners to be Year 2000 ready. Further, the service needs to complete the “simulation” testing of its business process areas as well as complete the development and testing of its business continuity and contingency plans. These challenges are further exacerbated by the fact that the service anticipates a surge in workload beginning in September due to the holiday business rush, which typically requires greater management attention. 1 The Year 2000 problem is rooted in the way dates are recorded and computed in automated information systems. For the past several decades, systems have typically used two digits to represent the year, such as “97” representing 1997, in order to conserve on electronic data storage and reduce operating costs. With this two-digit format, however, the year 2000 is indistinguishable from 1900, or 2001 from 1901. As a result of this ambiguity, system or application programs that use dates to perform calculations, comparisons, or sorting may generate incorrect results. Page 1 GAO/T-AIMD-99-86 It is critical that these challenges be adequately addressed before next January 1. In many respects, the Postal Service provides critical services that are as ubiquitous as telecommunications or electrical power. A Year 2000-based disruption in mail delivery would have a serious impact across every sector of the American economy. Further, reliance on the Postal Service is part of the contingency plans for many organizations that require a backup process to electronically delivered transactions and services. Our testimony is based on our review of the service’s conversion strategy and other Year 2000 planning documents and the service’s Year 2000 guidance and internal development standards as well as our discussions with U.S. Postal Service officials responsible for overseeing the Year 2000 effort. We compared the service’s efforts to criteria detailed in our Year 2000 Assessment Guide,2 Business Continuity and Contingency Planning Guide,3 and Testing Guide.4 This guidance offers a structured and disciplined approach to managing the risk of potential Year 2000-induced disruptions to operations. We conducted our work in cooperation with the service’s Inspector General and in accordance with generally accepted government auditing standards from September 1998 through February 1999. Postal Service Relies For the Postal Service to ensure continuity of operations after the century date change, it must assess, remediate, and validate several interlocking Extensively on components of its operating and support infrastructure. These include Automated Systems “severe and critical” (mission-critical) business systems that provide essential support for postal operations; “important” business systems that are necessary for continued operations but where failure would not have an immediate, significant impact on business continuity; mail processing equipment; facilities and other infrastructure support activities; and vendors who provide essential goods and services to the Postal Service. 2 Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14). Published as an exposure draft in February 1997 and finalized in September 1997. 3 Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD-10.1.19). Published as an exposure draft in March 1998 and finalized in August 1998. 4 Year 2000 Computing Crisis: A Testing Guide (GAO/AIMD-10.1.21). Published an exposure draft in June 1998 and finalized in November 1998. Page 2 GAO/T-AIMD-99-86 • The service has 152 “severe and critical” business systems that it must assess, correct, and verify to ensure Year 2000 compliance. These include the Postal Metering System, Money Order System, Mail Distribution Requirements System, Air Contracting Support System, Vehicle Tracking and Performance System, as well as critical financial management systems. Many of these systems have no workarounds and their failure would significantly disrupt postal operations. The service has reported that it has finished renovation work on 106 of its 152 severe and critical business information systems, and it expects to implement all but 11 systems by OMB’s target March 31, 1999, deadline. Ten of the 11 remaining systems are expected to be done by July 1999 and the 11th by mid-November 1999. • The service also owns 349 “important” business systems—systems for which workarounds exist and whose failure will result in an inconvenience, but not significantly affect core business activities. These include the Worker Compensation Information System, the Resource Management System, the Customer Satisfaction Measurement System, the Consumer Affairs Tracking System, and the Relocation Payment System. The service reports that 215 of these systems have been renovated with most of these scheduled for completion this quarter. Unlike the “severe and critical” systems, the “important” systems are not required to undergo independent validation and verification to provide additional assurances of Year 2000 compliance. However, a number of these systems will go through such a process upon the request of business process owners. • In addition to business systems, the service relies on a broad range of equipment to sort, deliver, and process mail. This equipment includes small parcel and bundle sorter equipment, flat mail sorters and optical character readers, and priority mail and bulk mail processing equipment. The service has 43 types of equipment that are deployed in various locations across the country. It reports, as of December 31, that 37 types had been renovated and the remainder are on schedule for remediation by August 1999. • The service has estimated that it has over 100,000 pieces of hardware and software to assess and correct when necessary, including mainframe computers, personal computers, networks, and operating systems. It also must assess and fix a wide range of infrastructure- related assets installed in hundreds of its facilities and tens of thousands of post offices. This includes building access control systems, safety systems, air conditioning and heating systems, as well as elevators. The service is still in the process of assessing this equipment. Page 3 GAO/T-AIMD-99-86 • Service systems interface with computer systems belonging to federal, state, and local governments and hundreds of private businesses. Because of these interdependencies, postal systems are also vulnerable to failure caused by incorrectly formatted data provided by other systems that are noncompliant. According to the service, about 1,600 external interfaces have been identified to date. Of that number, over 800 are considered to be severe and critical. The service is in the process of contacting each external interface partner to assess the work that needs to be done with these interfaces. • The service is heavily dependent on almost 600 key vendors and suppliers (such as airlines and railroads) that provide goods and services necessary to mail delivery. If key supplier systems are not Year 2000 compliant in time, postal operations could be severely disrupted. In late 1998, the service surveyed critical suppliers as to their Year 2000 readiness. Sixty percent of the suppliers responded. Of these, only 31 percent affirmed that they would be Year 2000 compliant in time. • The service, like most organizations, depends on public infrastructure systems, such as those that provide power, water, transportation, and voice and data telecommunications. Given the scope and intricate nature of the service’s national network, even localized disruptions in infrastructure-related services could seriously affect postal business operations. While the Postal Service’s progress in renovating its systems has picked up in recent months, the service has lagged behind OMB- and GAO- recommended milestones for assessment,5 renovation,6 and validation.7 For example, the service reported that as of the OMB renovation deadline of September 1998, about 22 percent of its mission-critical systems had not been corrected. As of the OMB validation deadline of January 1999, only 27 percent of its mission-critical systems had been validated. Moreover, the service has been late in undertaking important related tasks. For example, the service’s testing strategy was not completed until November 1998 and 5 During the assessment phase, organizations determine the Year 2000 impact on the enterprise, identify core business areas and processes, inventory systems supporting core business areas, and prioritize their conversion or replacement. They should also develop contingency plans and identify data exchange issues. This lays the groundwork for the ensuing phases of the program. 6During the renovation phase, organizations convert, replace, or eliminate selected platforms, applications, databases, and utilities as well as modify interfaces. 7 During the validation phase, organizations test, verify, and validate converted or replaced platforms, applications, databases, and utilities. Page 4 GAO/T-AIMD-99-86 contingency plans were not begun until December 1998. Our Year 2000 Assessment Guide recommends that both of these tasks be initiated before August 1997, toward the end of the assessment phase. Positive Steps Taken to The delays in the service’s Year 2000 progress were in part attributable to the fact that the service was slow to recognize the severe and pervasive Strengthen impact of the problem and lacked sufficient planning processes and Management of Year corporatewide involvement. Until recently, the burden of ensuring Year 2000 readiness largely resided in a program management office under the 2000 and Ensure general direction of the Vice President of Information Systems. The Continuity of program focus was more directed at systems and processes that supported Operations business operations rather than on the readiness of business processes, which typically involve a number of activities and support mechanisms outside the systems realm. In December 1998, the service reorganized its program management to better reflect Year 2000 efforts in terms of its business operations. The new organizational structure represents a matrix approach to managing ongoing efforts. Senior vice presidents have responsibility within their functional areas (e.g., mail operations, finance, marketing, and national systems) to ensure that individual business processes are decomposed and that each process undergoes “simulation” testing8 and that contingency plans are developed for each process. The Vice President for Information Systems still has responsibility for system remediation across the business areas. To better ensure that these individual business processes will support overall operations, the Service’s Chief Operating Officer will be responsible for developing business continuity plans. The overall management approach is managed by an executive council under the direction of the Deputy Postmaster General. This new management approach offers the Postal Service an improved opportunity for linking business processes to Year 2000 problems and solutions. We recommend this linkage in our Year 2000 guidance. However, as with most new management models, there is little basis for assured success without sustained follow-through to ensure effective 8 The purpose of this testing is to verify that a defined set of interrelated systems, which collectively support a core business area or function, interoperate as intended in a simulated operational environment. Page 5 GAO/T-AIMD-99-86 implementation. Accordingly, this new approach will require close oversight to ensure results. Significant Challenges Even with a stronger management structure now in place, there are substantial challenges still facing the service. If they are not addressed Still Face the Service in adequately, these challenges will threaten the Postal Service’s ability to Months Ahead deliver the mail—on time—next January. The primary challenge, of course, is time. Because the service has been behind schedule, it is now playing catch-up. Exacerbating the time issue is the anticipated holiday business rush, which typically starts in September. This surge in workload will require service management to split its attention and resources. Second, there are still many unknowns about the Postal Service’s core business processes. The service does not yet have complete inventory and status information on its information technology infrastructure, internal and external interfaces, and field equipment and systems. Nor does the service yet know whether the majority of its critical vendors will be ready in time or have assurance that public infrastructure systems, including power, water, transportation, and telecommunications will be compliant in time. Finally, until the simulation testing is complete and contingency plans and business continuity plans are developed and tested, the service will not have reasonable assurance on its readiness. These two factors make it imperative for the service to develop a comprehensive plan to guide existing efforts for testing, contingency planning, quality assurance, risk and issue management, interface management, and certification and validation; provide a master Year 2000 schedule; and identify priorities. They also make it imperative for the service to ensure that attention to the problem is sustained by the Deputy Postmaster General, the senior vice presidents, the Chief Operating Officer, Chief Financial Officer, Chief Management Officer, Chief Technology Officer, and other top executives. That is, these stakeholders should (1) ensure that the overall management plan is developed and followed, (2) participate in making critical decisions in all phases of the project, (3) continue to provide resources and support for the program, and (4) ensure that all components and business areas fully support and participate in the process. Page 6 GAO/T-AIMD-99-86 This concludes my statement. I will be pleased to answer any questions you or Members of the Subcommittees may have. (511132) Leter Page 7 GAO/T-AIMD-99-86 Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary, VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “info” in the body to: email@example.com or visit GAO’s World Wide Web Home Page at: http://www.gao.gov United States Bulk Rate General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. GI00 Official Business Penalty for Private Use $300 Address Correction Requested
Year 2000 Computing Crisis: Challenges Still Facing the U.S. Postal Service
Published by the Government Accountability Office on 1999-02-23.
Below is a raw (and likely hideous) rendition of the original report. (PDF)