	Objectives, Scope, and Methodology

Our objectives were to assess (1) the overall status of State’s efforts to identify and correct its date-sensitive systems and (2) the appropriateness of State’s strategy and actions for remediating Year 2000 problems. Inadequate Progress in Remediating Systems

State’s progress in remediating systems has been inadequate. Of the 40 systems State has identified as mission-critical and is either converting or replacing, only 17 (about 42.5 percent) have completed renovation, 11 have completed validation, and only two have completed implementation. If this is not done, the agency will not have a good basis for prioritizing systems for correction or developing contingency plans that focus on the continuity of operations. Until recently, State’s Year 2000 effort lacked a mission-based perspective. For example, at the time of our review, State had not determined its core business functions and linked these functions to its mission or to its support systems. In responding to a draft of this report, State noted that it is currently developing a framework for a mission-based perspective for its Year 2000 problem. It has recently determined its core business functions and linked these functions to its mission. However, it has not yet linked its core business functions to support systems necessary to conduct these operations. But under State’s Year 2000 approach, they rank equally. In responding to a draft of this report, the department stated that it had recently identified its core business functions and planned to link them to the 64 systems previously identified as mission critical, thereby providing a functional basis for prioritizing their efforts. State has not managed the identification and correction of its interfaces effectively. First, it is still in the process of identifying its interfaces, even though our Year 2000 Assessment Guide recommended that this be done during the assessment phase. While State has taken a number of actions to address this issue, its progress in several critical areas has been inadequate: only 17 of 40 systems that State has designated as mission-critical have completed renovation and it has not yet identified all of its interfaces. 2. 3. That is, agencies must first identify their core business processes and assess the Year 2000 risk and impact of these processes. 4.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the Department of State's progress in solving its year 2000 computer systems problem, focusing on the: (1) overall status of State's efforts to identify and correct its date-sensitive systems; and (2) appropriateness of State's strategy and actions to correct its year 2000 problems.

What GAO Found

GAO noted that: (1) State has taken many positive actions to increase awareness, promote sharing of information, and encourage its bureaus to make year 2000 remediation efforts a high priority; (2) however, State's progress in responding to the problem has been slow; (3) for example, of the 40 systems that State identified as mission critical and needing either converting or replacing, only 17 (42.5 percent) have completed renovation; (4) more importantly, until recently, State's year 2000 effort lacked a mission-based perspective, that is, it had not determined its core business functions or linked these functions to its mission or to the support systems necessary to conduct these operations; (5) because the year 2000 problem is primarily a business problem, agencies need to take a business perspective in all aspects of it; that is, they should identify their core business areas and processes and assess the impact of system failures; (6) until it takes these steps, State will not have a good basis for prioritizing its systems for the purposes of correction or developing contingency plans that focus on the continuity of operations; (7) in responding to GAO's draft report, State noted that it has recently determined its core business functions and linked these functions to its mission; (8) it has not yet linked its core business functions to support systems necessary to conduct these operations; (9) State has not been managing the identification and correction of its interfaces effectively; (10) specifically, it is still identifying its interfaces, even though this task should have been completed in the assessment phase, and it has developed written agreements with data exchange partners for only a small portion of its systems; and (11) as a result, State has increased the risk that year 2000 errors will be propagated from one organization's systems to another's.