NCUA Has Developed a Strategy and Has Initiated Action to Address the Year 2000 Problem

NCUA has developed a three-pronged approach for ensuring that credit unions are aggressively addressing the Year 2000 problem, which encompasses (1) incorporating the Year 2000 issue into its examination and supervision program, (2) disseminating information about the problem to credit unions, and (3) assessing Year 2000 compliance on the part of credit union data processing vendors. Concerns With NCUA’s Year 2000 Efforts

While NCUA has initiated actions to build the Year 2000 issue into examinations and to raise awareness about the issue among credit unions and their vendors, our work to date has identified four issues that must be addressed to provide greater assurance that NCUA efforts will be successful. First and foremost of our concerns is that NCUA still does not have a complete picture of where credit unions and their vendors stand in resolving the Year 2000 problem, and current efforts to determine credit union compliance are behind the schedule established by OMB and GAO. However, as of the time of our work, NCUA had not yet queried 20 percent of the credit unions and had only received 29 of the 87 vendor responses. In addition, of the credit union and vendor responses received, NCUA has not yet analyzed the information to determine which credit unions and vendors are at high risk of not correcting their systems on time. The questionnaires also did not include system interface issues. A second concern we have with NCUA’s efforts is that the agency does not yet have a formal contingency plan. NCUA guidance directs credit unions to conduct contingency planning, and NCUA officials told us that they have developed numerous contingency options and have discussed among the staff what steps to take should a credit union not be compliant by January 1, 2000. Audits are an integral management control and expanding their scope to include important and high-risk Year 2000 issues is critical since it would provide credit union management with greater assurance and understanding about where their institution stands in addressing the problem. Our fourth concern is that NCUA does not have enough staff qualified to conduct examination work in complex technical areas. At present, NCUA is the process of hiring one EDP auditor to help examine thousands of credit unions. However, these personnel additions may still not suffice given the tremendous workload and the short time frame for getting it done.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the National Credit Union Administration's (NCUA) progress in making sure that the automated information systems belonging to the thousands of credit unions it oversees have adequately mitigated the risks associated with the year 2000 date change.

What GAO Found

GAO noted that: (1) NCUA has taken steps to address the Year 2000 problem; (2) these involve incorporating the Year 2000 issue into its examination and supervision program, disseminating information about the problem, and assessing Year 2000 compliance on the part of data processing vendors; (3) concerns exist that must be resolved if the NCUA is to achieve greater certainty that credit unions will meet their Year 2000 deadline; (4) NCUA still does not have a complete picture of where credit unions and their vendors stand in resolving the Year 2000 problem, and current efforts to determine credit union compliance are behind the schedule established by GAO and the Office of Management and Budget (OMB); (5) while NCUA sent questionnaires to credit unions and data processing vendors about the problem, it has not yet queried 20 percent of credit unions and has only received 29 of 87 vendor responses; (6) of the credit union and vendor responses received, NCUA has not yet analyzed this information to identify high-risk credit unions and vendors; (7) further, the surveys did not specifically ask about the status of corrective efforts and whether interface issues were appropriately being addressed; (8) NCUA has directed credit unions to conduct contingency planning and its staff have discussed what steps they should take should a credit union not be compliant by January 1, 2000; (9) however, the agency still lacks a formal contingency plan; (10) NCUA must take prompt action to ensure that these discussions are formally documented so that it will be well-positioned to handle unforeseen problems; (11) as potentially damaging as the Year 2000 problem is, NCUA has not yet ensured that the issue is addressed by credit union auditors; (12) doing so would provide credit union management with a greater assurance and understanding about where their institution stands in addressing the problem; (13) NCUA does not have enough staff qualified to conduct examination work in complex system areas; (14) at present, NCUA is in the process of hiring an electronic data processing (EDP) auditor and is requesting authority to hire 2 more; and (15) these personnel additions may not suffice given the tremendous workload and short time frame for getting it done.