As part of its goal of maintaining safety and soundness, OTS is responsible for examining and monitoring thrifts’ efforts to adequately mitigate the risks associated with the century date change. The letter, which included a statement from the interagency Federal Financial Institutions Examination Council, described the Year 2000 problem and highlighted concerns about the industry’s Year 2000 readiness. In May 1997, OTS, along with the other regulators, issued a more detailed awareness letter that described the five-phase approach to planning and managing an effective highlighted external issues requiring management attention, such as reliance on vendors, risks posed by exchanging data with external parties, and the potential effect of Year 2000 noncompliance on corporate borrowers; discussed operational issues that should be considered in Year 2000 planning, such as whether to replace or repair systems; related its plans to facilitate Year 2000 evaluations by using uniform examination guidance and procedures; and directed thrifts to (1) inventory core computer functions and set priorities for Year 2000 goals by September 30, 1997, and (2) to complete programming changes and to have testing of mission-critical systems underway by December 31, 1998. In conducting this assessment, OTS performed off-site examinations of the thrifts that addressed whether (1) their systems were ready to handle Year 2000 processing, (2) they had established a structured process for correcting Year 2000 problems, (3) they prioritized systems for correction, (4) they had determined the Year 2000 impact on other internal systems’ important to day-to-day operations, such as vaults, security and alarm systems, elevators, and telephones, (5) they had estimated Year 2000 project costs and targeted sufficient resources, (6) their milestones for renovating and testing mission-critical systems were consistent with those recommended by FFIEC, and (7) they had been closely tracking the progress of service bureau and vendor Year 2000 remediation efforts. First, like the other regulators, OTS is behind in assessing individual institution’s readiness. As with NCUA and FDIC, OTS got off to a late start assessing the readiness of the institutions it oversees and, consequently, was late in completing assessment phase activities. In their May 1997 letter to thrifts, banks, and credit unions, the financial regulators recommended that institutions begin (1) developing contingency plans to mitigate the risk that Year 2000-related problems will disrupt operations and (2) ensuring that their data processing services, software vendors, and large corporate customers are making adequate Year 2000 progress. Third, although OTS has been working hard to assess industrywide compliance, it has yet to determine the level of technical resources needed to adequately evaluate the Year 2000 conversion efforts of the thrifts and vendors who service them. That is, how many institutions are at high risk of not being ready for the millennium and require immediate attention and which service providers are likely to be problematic. We also found that OTS was making substantial progress in remediating its systems. For example, 13 of OTS’ 15 mission-critical systems have already been renovated, tested, and implemented. It was still developing these plans to ensure continuity of operations in the event its remediated systems fail or the two systems being renovated are not fixed in time. However, OTS did not develop a single plan providing a clear understanding of the interrelationships and dependencies among the automated systems that support its business operations, such as thrift supervision, office equipment, payroll, and facilities. This increases the risk that systems will not operate as intended in the year 2000 and beyond. Additionally, a combination of factors—including starting the thrift assessment process late and issuing more specific guidance to thrifts at a relatively late date—are hindering OTS’ and the other regulators’ ability to develop more positive assurance that their institutions will be ready for the year 2000.
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the progress being made by the Office of Thrift Supervision (OTS) in ensuring that the more than 1,200 thrifts it oversees have adequately mitigated the risks associated with the year 2000 date change.

What GAO Found

GAO noted that: (1) the year 2000 problem poses a serious dilemma for thrifts due to their heavy reliance on information systems; (2) regulators have a monumental task in making sure that financial institutions have adequate guidance in preparing for the year 2000 and in providing a level of assurance that such guidance is being followed; (3) further, regulators will likely face some tough decisions on the readiness of individual institutions as the millennium approaches; (4) GAO found that OTS is taking the problem very seriously and is devoting considerable effort and resources to ensure the thrifts it oversees mitigate the year 2000 risks; (5) despite aggressive efforts, OTS still faces significant challenges in providing a high level of assurance that individual thrifts will be ready; (6) in fact, the problems GAO found at OTS are generally the same as those found at the other regulators reviewed; (7) OTS was late in addressing the problem and consequently, is behind the year 2000 schedule recommended by both GAO and the Office of Management and Budget; (8) in addition, key guidance--being developed under the auspices of the Federal Financial Institutions Examination Council (FFIEC)--needed by thrifts and other financial institutions to complete their own preparations is also late which, in turn, could potentially hurt individual institutions' abilities to address year 2000 issues; (9) OTS needs to better assess whether it has an adequate level of technical resources to evaluate the industry's year 2000 efforts; (10) these problems hinder the regulators' ability to develop more positive assurance that institutions will be ready for the century date change; (11) consequently, the challenge for them at this point is how can they use their resources from here to the millennium to ensure that thrifts, banks, and credit unions mitigate year 2000 risks; (12) OTS has done much to mitigate the risk to its mission-critical internal systems and has already renovated, tested, and implemented 13 of its 15 mission-critical systems; (13) however, it has not yet completed contingency plans necessary to ensure business continuity in case system renovations or replacements are not completed in time or do not work as intended; (14) compounding this problem is the fact that OTS has not developed a comprehensive year 2000 conversion program plan providing a clear understanding of the interrelationships and dependencies among the automated systems that support, for example, its supervisory functions, office equipment, and facilities; and (15) such a plan provides added assurance that all systems are assessed.