One of the most critical issues that the Internal Revenue Service (IRS) faces this year is the need to make all of its computers Year 2000 (Y2K) compliant. The IRS depends on automated systems to process tax returns, issue refunds, deposit payments, and provide employees access to taxpayer account data. Many of the IRS’ mission critical systems have personal computer workstations that enable employees to perform their duties. Several mission critical IRS systems conduct tax processing activities on personal computer workstations and networks. Because the IRS has become increasingly dependent on personal computers for processing, it is important that they be converted for Y2K compliance.

The objective of our review was to determine the status of IRS actions to address the concerns we reported in an audit memorandum issued in April 1999, and again in our draft audit report entitled, Improved Project Management Is Needed To Ready Personal Computers for the Year 2000 (dated November 1999). Our review focused on recommendations in three primary areas: 1) monitoring the conversion progress of mission critical systems, 2) testing of software products, and 3) inventory verification.

In addition, we followed up on two personal computer related recommendations from another audit report entitled, The Internal Revenue Service Needs Additional Emphasis on Computer Component Retirement Decisions To Be Ready For The Year 2000, (Report Reference # 093506, dated September 1999), as follows:

• Track the personal computer Commercial-Off-the-Shelf (COTS) product identification process going on in the Field and Customer Organizations until resolution.
• Finalize the personal computer COTS hardware and software budget.

Although management of the personal computer conversion effort has improved, the IRS is facing various risks associated with conversion of personal computers and related systems. Additional attention and oversight of personal computer system conversion is needed through the end of the calendar year and into the Year 2000 to ensure that any problems resulting from these risks are quickly and effectively addressed.

Our April 1999 memorandum stated that the IRS was not separately tracking the conversion progress of the personal computer portion of some mission critical systems. We found that this condition still exists, but other processes have been implemented that help reduce the risks, such as requiring final testing for all systems, and monitoring the progress of the rollout of Y2K compliant standardized personal computers.

However, much of the testing has been performed in an environment that may not exactly mirror what is in place in the various field locations, and some conversion efforts remain incomplete. As a result, there is still some risk that upgraded systems will not be fully implemented in field locations by the Year 2000.

The goal for completion of software testing was July 31, 1999, according to management’s response to our April 1999 memorandum. However, software testing was not completed by July 31, 1999. As of November 1, 1999, approximately 180 of the 578 (31 percent) software products being monitored had not yet been through a complete systems test. Because so many products have not been through a complete test, we believe that some of this software testing will not be completed by December 31, 1999.

In an effort to accelerate testing measures, a memorandum was issued by the Century Date Change (CDC) Project Office on July 31, 1999, requesting information from the users to identify the COTS products that resided on their machines. A list of COTS software products was prepared as a result. It is important for CDC Project Office management to ensure that any non-compliant COTS software products included on this list are replaced on the corresponding systems to ensure that Y2K problems are not caused by these products.

IRS inventory reports dated October 29, 1999, show that 57,289 items, including both hardware products and software packages, associated with personal computers are scheduled to be retired, but remain on IRS systems. These items have not been made Y2K compliant, and should have been removed from IRS computer systems as well as the inventory system.

Without visiting all field locations, it is virtually impossible to identify the total numbers of these items that actually remain active on the IRS’ computer systems. However, we identified some of these software products scheduled to be retired that are currently installed on eight mission critical systems, including those supporting customer service and payment processing activities.

In response to our previous draft audit report, the IRS stated that it had finalized the budget for personal computer COTS hardware and software at $31 million. However, an additional $41.9 million had to be requested in July 1999 from the Office of Management and Budget (OMB) to supplement original budget estimates. This money was needed to fund purchases of personal computers to replace those that are not compliant. Delays in obtaining this funding resulted in corresponding delays in replacing these computers. As of October 28, 1999, over 7,000 personal computers designated to replace non-compliant machines were still awaiting installation. Most of these computers were from a group of machines purchased with the additional money obtained from the OMB.

Management’s Response: The IRS’ official comments were not available as of the date of this report. However, we summarized comments provided by the CDC Project Director below and incorporated more details in the body of the report.

The CDC Project Director stated that because the inventory system does not identify personal computers as to the system they support, and because personal computers often support multiple systems, tracking personal computer conversion progress by system is not feasible. The CDC Project Office uses several mechanisms to track key elements and tasks associated with the conversion effort. The ability to track progress at this level of detail has allowed responsible executives to prioritize the conversion of their products, greatly reducing the risk of a Y2K failure within the associated mission-critical system.

Although software testing for personal computer software products is still not complete, Information Systems management has implemented a methodology to ensure that software testing is completed before the end of the year. A risk management methodology has been established, and only 89 low-risk products remain to be tested. As of December 10, 1999, 94 percent of the personal computer hardware and COTS software inventory was compliant. The IRS continues to focus on removing products scheduled for retirement from IRS’ systems. As of December 10, 1999, 17,868 devices remain to be retired.

As of December 3, 1999, 10,352 new Pentium personal computers, procured with the additional OMB funds, have been delivered and fewer than 400 remain to be installed.