Jacob J. Lew Statement to Senate Appropriations Committee and Senate Special Committee on the Year 2000 Technology Problem, 06/22/1999

STATEMENT OF
JACOB J. LEW
DIRECTOR
OFFICE OF MANAGEMENT AND BUDGET
BEFORE THE
COMMITTEE ON APPROPRIATIONS
AND THE SENATE SPECIAL COMMITTEE ON THE
YEAR 2000 TECHNOLOGY PROBLEM

June 22, 1999

Good morning, Chairman Stevens, Chairman Bennett, Senator Byrd, and Senator Dodd. I am pleased to appear before the Committees to discuss the Federal Government's progress in addressing one of the most complex management challenges it has ever faced, the year 2000 problem. The Federal Government is not alone in addressing this challenge, as the Senate wisely recognized last year when it formed the Senate Special Committee on the Year 2000 Technology Problem. This is a problem with potentially enormous implications for our Nation. Every sector of our economy and all organizations large and small must work together so that we can, as the President said in his State of the Union Address, make sure that the Y2K computer bug will be remembered as the last headache of the 20th century, not the first crisis of the 21^st.

Today, I would like to address three topics. First, I will describe Federal progress in addressing the Y2K challenge. Second, I will discuss Federal agency costs and funding for these efforts. Third, I will describe our next steps to assure that Federal programs that people depend upon will not be disrupted. These next steps include focusing on completion of individual systems, ensuring the readiness of Federal programs, and completion of business continuity and contingency plans.

FEDERAL PROGRESS

As you know, the Federal Government has been working for more than three years on this problem. Last week I sent to Congress OMB's ninth quarterly report on Federal agency progress in addressing the Year 2000 problem. That report shows that Federal agencies continue to make excellent progress in addressing this challenge. In particular, it shows that 93 percent of the Federal Government's mission critical systems are now compliant, an increase from 79 percent reported in February.

Fourteen of the 24 major Federal departments and agencies now report that 100 percent of their mission critical systems are Y2K compliant. These agencies are: the Departments of Education, Housing and Urban Development, Interior, Labor, State, and Veterans Affairs; the Environmental Protection Agency, the Federal Emergency Management Agency, the General Services Administration, the National Science Foundation, the Nuclear Regulatory Commission, the Office of Personnel Management, the Social Security Administration, and the Small Business Administration.

In addition, two agencies, Commerce and NASA, report that 99 percent of their mission critical systems are compliant and that they expect to be finished soon. Three agencies, the Departments of Agriculture, Energy, and Health and Human Services, are between 96 and 97 percent compliant. Four agencies report that between 90 and 94 percent of their mission critical systems are compliant, including the Departments of Justice and Transportation at 92 percent. The Department of Defense reports that 87 percent of its systems are compliant, while the U.S. Agency for International Development has completed implementation of three of its seven mission critical systems.

From a base of 6,190 mission critical systems at this time, 410 mission critical systems remain to be finished, down from 1,354 in the last report. The compliant systems include those that have been repaired or replaced as well as systems that were already compliant. Of the mission critical systems that remain to be finished, 87 (82 percent) are being repaired, 35 (10 percent) are being replaced, and 24 (eight percent) are being retired. We are monitoring the completion of each remaining system through monthly reports from the agencies.

This progress is a tribute to the hard, skillful, and dedicated work of thousands of Federal employees and contractors. Moreover, the rapid availability of funds through the contingent emergency reserve has been key to ensuring progress. I would like to thank the Committees for ensuring that Federal agencies will not fail to meet the Year 2000 deadline because of lack of adequate funding.

While much work remains to be done, we fully expect that all of the Government's mission critical systems will be Y2K compliant before January 1, 2000. For some time, fixing the Year 2000 problem has been the agencies' number one information technology (IT) priority, as other IT projects are being delayed until the Y2K work is done. This action has been managed throughout OMB's budget process.

Additionally, agencies are minimizing any kind of changes to their systems unrelated to Y2K in order to ensure that they will be able to maintain the schedules they have set for completion of their work. Changes not only divert resources from fixing the Y2K problem, but may also undo Y2K fixes. Based on guidance I issued on May 14, 1999, "Minimizing Regulatory and Information Technology Requirements," (M-99-17), agencies are using change management processes to ensure that new IT requirements or changes to IT systems are minimized.

Again, this effort will ensure that agencies set realistic goals for the completion of their work and will enable them -- and us -- to measure their progress against their own goals. Agencies are working hard to finish fixing their systems, and we are confident that every mission critical system will be ready for the year 2000.

Y2K COSTS AND FUNDING

First and foremost, I want to recognize that the transition into the Year 2000 has posed a unique challenge. Formulating the Federal response has required a great deal of attention, hard work, and flexibility. In advance of my more detailed comments on this subject, let me thank you for all of your work and leadership in helping to ensure that sufficient funds are available in a timely manner to address Y2K remediation. As we have scrutinized agency requests and funded the most critical ones, the utility of this funding mechanism has been proven many times. Simply put, without such a fund, many Federal agencies would not be nearly as far along in their efforts as they are today.

I would also like to emphasize that the Administration's strategy for monitoring Government-wide progress on Y2K has been predicated on agency accountability. We have systematically monitored agency progress using a range of performance measures -- compliance of mission critical systems, status of mission critical systems being repaired, progress on high impact programs, etc., as well as agency Y2K cost estimates. These measures are linked, and together provide the most accurate picture of the Government's overall readiness. On a quarterly basis (or more frequently, if needed), agencies have been required to update OMB on their Y2K progress and to explain all significant changes in these measures.

We have tried to strike the appropriate balance to ensure agency accountability without diverting vital resources from Y2K compliance activities to reporting requirements. In addition, the Administration has tried to be as forthright as possible in sharing information about Y2K readiness. OMB has directed that agency quarterly reports and detailed spending plans be forwarded to Congress, and we have appreciated your input as we have worked together to address the challenge posed by Y2K.

As you know, last September the Administration requested an FY 1998 supplemental appropriation for $3.25 billion in contingent emergency funding to address urgent, emerging needs associated with Y2K conversion activities. This request was consistent with Senate action to that point. The Omnibus bill provided contingent emergency funding of $2.25 billion for non-defense activities and $1.1 billion for defense-related activities for Y2K computer conversion. As you also know, OMB is responsible for allocating the non-defense contingent emergency reserve. To date, $1.768 billion has been allocated from the non-defense reserve, and $14 million has been returned to the reserve at the request of the House Appropriations Committee. Therefore, $496 remains in reserve for unforeseen requirements. Of the $1.1 billion provided for defense-related activities, $935 million has been released and $165 remains in reserve.

In order to determine how to best utilize all available non-defense funding for Y2K -- both base appropriations and emergency funding -- OMB has worked with agencies on an ongoing basis to evaluate total Y2K requirements. First, OMB made certain that agencies received funding for activities that were requested in the President's FY 1999 Budget, but were directed to be funded from the contingent emergency reserve. Since then, agencies have been asked to forward requests for contingent emergency funding on an as-needed basis. These requests are then reviewed by OMB examiners from both the Resource Management Offices (RMOs) - liaisons to the individual agencies - and analysts from our Information Policy and Technology Branch. In combination, they review these requests to ensure that requested funding is:

Y2K-related and is the most cost-effective option to facilitate compliance.

Addresses an unforeseen need, not one accounted for within existing agency plans.

Cannot be accommodated within appropriated levels for FY 1999.

Cannot be addressed using unobligated balances of Y2K emergency funding.

In some cases, funds have also been requested to support outreach to non-Federal entities in support of the efforts of the President's Council on Year 2000 Conversion.

Once reviewed and discussed with the affected agency, OMB staff make recommendations to OMB policy officials. These levels are then finalized and included in an emergency release. As you know, pursuant to last Omnibus Act, detailed information on each affected agency's spending plan, as well as an account-by-account breakdown of the request as a whole, is provided to your and other Committees. The funds in the release are not made available to the agencies until 15 days after the transmittal.

Once the funds are allocated, each Resource Management Office has been tasked with tracking the Y2K-related expenditures for the agencies it oversees, including emergency expenditures. At a minimum, the RMOs review the agency quarterly report to confirm that appropriate progress is being made and that the each agency can cogently explain its cost levels and cost changes. Then, depending on an agency's status, RMOs have used different methods to track Y2K-related spending. All agencies that have received emergency funding have forwarded data on obligations to date to their RMOs. This data has informed our consideration of subsequent emergency requests, and has resulted in several reprogramming requests rather than additional releases. For example, in the Department of Health and Human Services, we recently reprogrammed funds from HCFA to the Administration for Children and Families. More reprogramming actions may be forthcoming as agencies further refine their estimates for FY 1999 and 2000.

In addition, some RMOs monitor Y2K-related obligations and/or outlays on a more regular basis, and require detailed information on the expenditure of both base and emergency resources. Finally, because of their unique period of availability (FY 1999 - FY 2001), emergency funds are very transparent in terms of budget execution. The RMOs have been given discretion in terms of treatment of both base and emergency funds in the apportionment process, as is OMB's general policy.

Your Committees have asked me to focus on the cost increases since the 1^st OMB Y2K Quarterly Report, which was issued February 1997. In that report, the five year (FYs 1996 - 2000) Federal cost of Y2K was reported estimated at $2.3 billion. However, it is now clear that in the first quarterly report, we were not fully aware of the magnitude of the year 2000 problem. Initially, it was thought that fixing the problem would primarily involve mainframe computers and legacy applications.

However, as we and others learned in the course or remediation, the problem was far more complex, involving desktop personal computers, embedded chips, and telecommunications components. Cost increases from the 1^st to 4^th OMB Quarterly Report (through March 1998), totaling $2.4 billion, resulted from a better understanding of the scope of the problem and increasing agency attention on the cost estimates. It is important to note that until FY 1999 agencies funded their year 2000 costs exclusively out of base appropriations. Prior to the availability of emergency funding, all costs increases were absorbed within agency operating budgets.

Since the broader universe of Y2K remediation was clearly established, costs have remained within a more predictable band. From the 4^th OMB Quarterly Report (March 1998) to the 9^th OMB Quarterly Report (June 1999), costs reported for FYs 1996 - 1998 changed by $164 million, or 4.7 percent of the three-year total. Of this, estimates for Defense have changed by $128 million, or 3.6 percent of the three-year total. Since last March, then, cost estimates for non-defense agencies for FYs 1996 - 1998 for have changed by a little more than one percent.

The increase in FY 1999 funding, $2.8 billion between the 4^th and 9^th OMB Quarterly Reports, has supported activities that have been subjected to the rigorous policy review that I have discussed. Most of the cost increases can be attributed to specific activities: remediation for information technology systems, testing to ensure that systems are Y2K compliant, replacement of embedded computer chips, and creation and verification of BCCPs. I am confident that this funding has helped to ensure that important Federal programs will have a smooth transition into the year 2000. FY 2000 costs, which have increased by $509 million over the same period, are primarily for Y2K project offices to manage and monitor the transition into 2000, as well as for retesting and recertifying contingency plans. The details of agency spending plans continue to be made available for your review as this process moves forward.

I would now like to turn to another issue that I have been asked to address: the difference between agency estimates and actual costs. I believe that this question stems from the cost table in each OMB Quarterly Report. In that table, past years (FYs 1996 - 1998) are characterized as estimates even though, as you know, the budgetary data for those years reflects actual expenditures. With OMB's approval, agencies have refined the universe of Y2K-related costs since FY 1996. As an activity is added to the Y2K universe, we want to make certain that we are capturing the five-year cost of that activity. For example, a Department may not have reported embedded chip replacement as part of their initial Y2K estimate. However, they later received guidance to so. In such a case, OMB has worked with the Department to verify that the multi-year cost of embedded chip replacement was being reported. If this required changing an estimate in a past fiscal year, agencies did so with OMB approval. At the same time, future year estimates may have been adjusted to account for newly recognized activities. Thus, although the budget data for FYs 1996 - 1998 are actuals, since recognition of the scope of the Y2K problem has changed over time, OMB has not asked for or characterized costs for those years as actuals.

Another component of this issue is that Y2K-related expenses can be aggregated at a level below or above budget accounts. Y2K-related expenses are embedded in broader operating budgets. We have worked to ensure that we are capturing Y2K-related costs and that agencies are making defensible and standardized assumptions about these costs. Conversely, we are trying to filter out activities that were wholly planned for and would have been implemented regardless of Y2K.

NEXT STEPS

As I stated earlier, now that most of the work on fixing mission critical systems is completed, OMB will shift its focus from aggregate figures for system readiness to ensuring the readiness of individual systems. In addition, OMB and the agencies are beginning to focus on two new priorities.

Ensuring the readiness of Federal programs, particularly 43 high impact programs that we have identified.

Planning for business continuity and contingencies.

Ensuring the Readiness of Federal Programs

While we have made excellent progress in preparing our systems, we are not yet done. We must make sure that Federal programs, particularly those that have a direct and immediate affect on the health, safety, and well-being of the public, function smoothly. As I have just related to you, we are confident that critical systems will be ready. But because Federal programs partner with other entities, including other Federal agencies; State, Tribal, and local governments; banks; contractors; vendors; and other entities; it is critically important to ensure that all partners are working together to ensure that the program they support will be ready. The critical task is to make sure that not just systems, but the programs they support, will be ready.

Accordingly, on March 26, 1999, I asked agencies to take this next step. I also identified 42 "high impact" Federally supported programs and directed Federal agencies to take the lead on working with other Federal agencies, State, Tribal, and local governments, contractors, banks, and others to ensure that programs critical to public health, safety, and well-being will provide uninterrupted services. Examples include Medicare and Unemployment Insurance. The list was subsequently revised to include the National Crime Information Center at the Department of Justice, bringing the total to 43.

Agencies have also been asked to help partners develop year 2000 plans if they have not already done so to ensure that these programs will operate effectively. Such plans are to include end-to-end testing, developing complementary business continuity and contingency plans, and sharing key information on readiness with partner organizations and with the public. Agencies are reporting to us monthly and will demonstrate the readiness of each program by September 30, 1999. A table of the programs, including the partners agencies are working with is included last week's quarterly report.

Business Continuity and Contingency Planning

Although we expect all Federal mission critical systems to be ready by January 1, 2000, and although we are prepared to demonstrate the readiness of a number of critical programs, it is still important that every agency, no matter how well prepared, have a business continuity and contingency plan (BCCP) in place.

Agencies have identified their core business functions and are using these as a basis for developing business continuity and contingency plans, which will ensure that these core business functions will operate smoothly, no matter what glitch may occur in an agencies' systems or with an agencies' partners. While we are confident that the measures taken for Y2K compliance are sound, the chance remains that, despite testing, a bug may still slip through. Furthermore, elements beyond an agency's control are at risk from the Y2K problem as well. For example, bad data from a data exchange partner or the inability of a vendor to provide key supplies could disrupt work at an agency.

Let me make it clear that we do not anticipate any disastrous consequences as a result of year 2000 computer problems in Federal systems. It is possible, and even likely in some situations, that there will be glitches in systems that result in minor disruptions to the ways that agencies operate. Accordingly, for each core business function and its associated systems, agencies have identified risk factors, and assigned them a probability rating as well as an impact rating. The agencies use these ratings to prioritize functions and systems. Work-arounds and back-up plans are established as contingencies.

Although we do not expect any disasters, it is always wise to prepare for the worst. Since the 1970s, agencies have been required to have in place Continuity of Operations plans (COOP plans), to address such emergencies. In the event of a disaster, whether related to Y2K or to a national emergency, such as a terrorist attack or regional weather emergency such as a tornado or violent snowstorm, agencies are using their COOP plans to ensure that the agency will continue to function. I also asked agencies to ensure that the development of their BCCP was coordinated with pending revisions to each agency's COOP plan. Again, although we do not expect any kind of Y2K disaster, agencies are developing plans, in coordination with their BCCPs, to address this contingency.

On May 13, 1999, I issued guidance on this subject, "Business Continuity and Contingency Planning for the Year 2000," (M99-16). This memorandum asked all agencies, including small and independent agencies, to submit to OMB by June 15 their business continuity and contingency plans (BCCPs). This memorandum also identified a number of infrastructure areas for which agencies should make common assumptions, such as electric power, financial services, and public voice and data communications. This common assumption is that there will be no nation-wide disruptions within these infrastructure services.

By setting these risk areas aside from agencies' business continuity and contingency planning, agencies are able to focus on ensuring that their core business functions and affiliated systems will work. In the extremely unlikely event that a catastrophic emergency occurs that damages local infrastructure, communications, or the agency building itself -- whether caused by Y2K, or by a natural disaste

On the international side, the State Department is leading a working group of those agencies with employees overseas in order to develop risk assumptions and appropriate responses, to be used in the development and refinement of those programs' BCCPs.

BCCPs are an increasingly important component of agency progress. Like a good insurance policy, a sound plan is important, no matter how well you have taken care of your systems. To ensure quality and consistency, I have directed agencies to use the General Accounting Office's (GAO) guidance on this subject in preparing their plans. Additionally, many agencies are working closely with their Inspectors General and/or expert contractors in the development and testing of these plans. Finally, OMB is reviewing the high-level BCCPs of agencies, which were due June 15, and will provide feedback and guidance to the agencies on an individual basis.

Prepayment

As part of their contingency planning, some agencies have explored the possibility of making some payments in December that would otherwise be due in January to beneficiaries, contractors, and others. However, the Administration has determined that such actions are not necessary at this time, given the level of readiness of agency payment systems and agency business continuity and contingency plans. Moreover, the extensive downside risk to prepayment mitigates strongly against implementing this contingency plan in all but the most exceptional circumstances.

First, and most importantly, issuing such payments early would require reprogramming of payroll and other financial management systems. I have previously stated that any changes to systems should be minimized as they not only divert resources from fixing the Y2K problem, but also may undo Y2K fixes. It would be highly irresponsible to implement a contingency plan that could worsen the year 2000 problem.

Second, making early payments would have tax implications for individuals and businesses. Undoing any tax implications would require legislative changes for the Internal Revenue Service, which in turn would be required to make changes to the tax code and to their systems. All of these actions would be both costly and time-consuming.

Third, such actions could easily be interpreted by the public as an overall sign of lack of confidence in the ability of the Government to make its payments after January 1. Such a signal could prove disastrous for the national economy as panicked citizens turn to withdrawing their currency in anticipation of a currency shortage. This sort of panic is a self-fulfilling prophecy. Public panic and overreaction is a problem far larger than the technology problem and something we are very concerned about.

Finally, even allowing prepayment in extremely limited areas increases pressure to provide early payment for everyone.

Any uncertainty about the readiness of agencies to make benefits payments should be mitigated by continuing to focus on fixing and testing systems. Agencies should also consider alternative contingency plans that do not introduce such high levels of Y2K risk into systems or that could propagate public panic.

Despite these concerns, however, there may be a few rare instances in which early payment is the best option. In any such instances, agencies may request authority from OMB to pay certain benefits early if certain criteria are met. These include demonstration that there will be substantial harm to individuals from not getting a timely payment, a high likelihood that timely payments (either by normal program operation or through a contingency) will not be made, assurance that early payments made will be targeted only to those recipients who would be harmed, and that early payment will substantially mitigate the harm. The agency must also be willing to make a public announcement of these decisions and to work with the Department of Treasury so that adequate cash management practices are maintained. Throughout the remainder of the year, we will continue to review this matter with agencies.

CONCLUSIONS

In conclusion, during the 192 days remaining before the year 2000, we plan to:

Complete work on remaining mission critical systems and on other Federal systems.

Conduct end-to-end testing with the States and other key partners, placing special emphasis on ensuring the readiness of programs that have a direct and immediate impact on public health, safety, and well-being.

Complete and test business continuity and contingency plans as insurance against any disruptions related to Y2K failures.

Promote Y2K awareness with State, local, and Tribal governments, with the private sector, and with other Nations.

Thank you for the opportunity to allow me to share information with you on the Administration's progress. The Administration continues to treat this challenge with the direct, high-level attention it deserves. The additional focus on the year 2000 problem by the President, Congress, and the public has resulted in agencies focusing management attention on the issue and taking a close look at their resource needs. The Year 2000 contingent emergency reserve has helped ensure that agencies have access to funds to facilitate their work. OMB remains committed to working with the Committees and Congress on this critical issue. I would be pleased to answer any questions you may have.