In addressing the Year 2000 problem, financial institutions must also consider the computer systems that interface with, or connect to, their own systems. It also directed them to complete programming changes and to have testing of mission-critical systems underway by December 31, 1998. For example, OTS designated about 170 thrifts as being at high risk due to poor performance in conducting awareness and assessment phase activities. These visits are expected to be completed by the end of June 1998. Regulators Face Problems in Ensuring Institutions Are Ready

As noted in our summary, the regulators must successfully address a number of problems to provide adequate assurance that financial institutions will meet the Year 2000 challenge. First, all were behind in assessing individual institution’s readiness due to the fact that they got a late start. Second, we also found that the FFIEC-developed examination work program and guidance for the initial and follow-on assessments were not designed to collect all the data needed to determine where (i.e., in which phase) the institutions are in the Year 2000 correction process. Third, FFIEC is still developing key Year 2000 guidance. This time lag has increased the risk that institutions have taken little or no action on contingency planning and dealing with servicers, vendors, and corporate customers in anticipation of pending regulator guidance. For example, regulators will soon have to pinpoint which, if any, of the thousands of banks, thrifts, and credit unions are not going to meet their Year 2000 deadline. Thus, the regulators will need to ensure that they have the technical capacity to complete their Year 2000 examinations as well as their routine safety and soundness examinations. They need to take several actions to improve their ability to enhance the ability of financial institutions to meet the century deadline with minimal problems and to enhance their own ability to monitor the industry’s efforts and to take appropriate and swift measures against institutions that are neglecting their Year 2000 responsibilities. Accordingly, we have made recommendations to the regulators individually, and collectively via FFIEC, to work together to, among other things, (1) improve their Year 2000 examination and reporting processes, (2) provide additional guidance to the institutions on contingency planning and the latter phases of the Year 2000 correction process, (3) develop a tactical plan that details the results of their on-site assessments, provides a more explicit road map of the actions to be taken based on those results, and includes an assessment of the adequacy of technical resources to evaluate the Year 2000 efforts of institutions and the servicers and vendors that support them, and (4) improve the regulators’ internal system mitigation programs.
Why GAO Did This Study

GAO discussed the progress of the federal regulatory agencies in ensuring that the thousands of financial institutions they oversee are ready for the upcoming century date change.

What GAO Found

GAO noted that: (1) because financial institutions are heavily dependent on information technology, their viability hinges on whether they can successfully remediate systems before the Year 2000 deadline; (2) given this possibility, regulators must take every measure possible to assist banks, thrifts, and credit unions in their Year 2000 efforts as well as to identify and take swift enforcement measures against those in danger of failing; (3) regulators have recognized this responsibility and have begun an intense effort to raise awareness of the problem, develop guidance to facilitate remediation efforts, and determine where individual institutions stand in correcting their systems; (4) in doing so, regulators have initially identified several hundred institutions at high risk of missing the deadline due to their poor performance in conducting awareness and assessment phase activities; (5) despite aggressive efforts, the regulators still face significant challenges in providing a high level of assurance that individual institutions will be ready; (6) they were late in addressing the problem and consequently, are behind in the Year 2000 schedule recommended by both GAO and the Office of Management and Budget; (7) they are also late in developing key guidance on contingency planning and dealing with servicers, vendors, and corporate customers; (8) this guidance is needed by financial institutions to complete their own preparations; (9) in addition, their follow-on assessments to be completed by June 1998 were not in all cases, designed to collect the data required to be defective about the status of individual institutions; (10) furthermore, it is questionable whether all regulators have an adequate level of technical staff to completely evaluate industry readiness; (11) with regard to their own systems, the regulators have generally done much to mitigate the risk to their mission critical systems; and (12) in some areas such as contingency planning, the regulators can do more to provide added assurance that they will be ready for the century date change and any unexpected problems.