TREASURY INSPECTOR GENERAL

FOR TAX ADMINISTRATION

THE INTERNAL REVENUE SERVICE CAN IMPROVE MANAGEMENT CONTROLS OVER THE YEAR 2000 END-TO-END SYSTEMS INTEGRATION TEST

November 1999

Reference No. 2000-20-008

Executive Summary

The primary goal of the Internal Revenue Service’s (IRS) End-to-End (E2E) Systems Integration Test is to demonstrate that tax processing systems will perform correctly on or after January 1, 2000. The E2E test environment, herein referred to as "testbed," replicates the IRS’ environment for processing tax returns, and for providing on-line access to taxpayer accounts, electronic tax filing, and the supporting hardware and telecommunications infrastructure. The Year 2000 E2E Systems Integration Test is being controlled by the IRS’ Information Systems Product Assurance function, with significant levels of contractor support. Planning for the E2E Systems Integration Test began in May 1998, and testing will run through December 1999.

The E2E test consists of three segments.1 The overall objective of this review was to assess the IRS’ planning efforts for the E2E System Integration Test II and Test III, and the execution of Test II. Another audit is currently underway to assess the execution of Test III.

Results

During our monitoring of the Test II execution and Test III planning, we found that the Product Assurance test team and the contractors supporting the IRS’ E2E testing effort were working diligently to reduce problems with the testbed and to coordinate the work of a large numbers of resources in various sites to deliver the testing effort. However, we identified the following issues, which need management’s attention:

Product Assurance Should Perform Quality Checks of the Contractors’ Deliverables to Assure They Meet the Internal Revenue Service’s Intended Objectives

The IRS is heavily dependent on contractor support for successful completion of its E2E testing efforts. Since the IRS has a relatively low number of employees assigned to the E2E effort in relation to the number of contractors, the IRS has found it difficult to review the large number of contractor deliverables. In addition, the fast-paced schedule of the E2E Systems Integration Test has contributed to the difficulty in timely reviewing and analyzing all contractor products.

Without regular quality reviews of contractor deliverables, the IRS cannot be assured that information provided by the contractor is useful and advances the goals of the E2E test.

Configuration Management Controls Over the Year 2000 End-to-End Systems Integration Test Should Be Improved

One objective of configuration management is to account for all information technology components and provide a basis for sound change management. 2 However, no single organization in the IRS has control over the configuration management of the E2E Systems Integration Test testbed. Portions of the E2E testbed have not been inventoried and only fragmented efforts for documenting the testbed were identified. Our requests for inventory information on the E2E testbed revealed two of the four sites used for the E2E Systems Integration Test were not inventoried. Without a complete and accurate inventory of the hardware and software to be included in the E2E test, the IRS cannot be assured a smooth transition from the testing environment to production before January 1, 2000.

Summary of Recommendations

We recommended that:

· Product Assurance management provide for a quality review of all contractor deliverables and assure the work completed by those contractors is consistent with the objectives of the E2E Systems Integration Test.

· IRS management assign responsibility for configuration management of the E2E testbed to one controlling organization.

· Product Assurance ensure a complete inventory of the entire E2E testbed be completed prior to the completion of additional tests.

We initially reported these findings and recommendations in a memorandum dated March 8, 1999.

Management’s Response: IRS management agreed to better monitor the activities of the contractors. Management also will ensure the testbed for Test III is baselined prior to the start of the next test and will determine the means by which it can ensure the likeness of the testbed and the production environment. On September 30, 1999, Information Systems informed us verbally and through electronic mail that the IRS has met its dates, as indicated in the management response, except for one item that addresses the issue of implementing procedures for ensuring the likeness of the E2E testbeds and the production environment. The original memorandum and management’s complete response are included as Appendices IV and V, respectively.

1 The E2E System Integration Test is separated into the following three phases:

Test I - Using 1998 System Acceptability Testing (SAT) data, the test ensured that the IRS’ systems software components, application components, and Commercial-off-the-Shelf products worked through the year 2000. This test used a limited set of dates from the year 2000.

Test II - Using copies of live taxpayer data, this test ensured that tax processing systems performed correctly through the year 2000. This test used a limited set of dates from the year 2000.

Test III - Using controlled data with pre-determined test results, the test will ensure that tax processing applications, including 2000 Filing Season applications, will perform correctly during and after the year 2000. This test will use a full range of dates from the year 2000 and beyond.

2 According to the Information Systems Audit and Control Foundation’s Control Objectives for Information and Related Technology (COBIT), configuration management satisfies the business requirement to account for all information technology components, prevent unauthorized alterations, verify physical existence and provide a basis for sound change management. This requirement is enabled by controls which identify and record all information technology assets and their physical location and a regular verification program which confirms their existence and takes into consideration configuration change management and unauthorized software checking.