Plans Were Inconsistent and Incomplete

The refund plan and the paper submissions plan were inconsistent and incomplete in two key areas of IRS’ guidance. These areas were performance goals and mitigating actions. These weaknesses raise questions about whether these two plans provide sufficient assurance that IRS has taken all the necessary steps to reduce the impact of a potential Year 2000 failure. IRS officials agreed to make changes to these two plans to improve their consistency and completeness in these areas. Although this business contingency plan includes a specific performance goal as required by IRS’ guidance, that goal is inconsistent with the recommended contingency actions. The inconsistency between the performance goal and the business contingency plan procedures raises questions about the goal that IRS is trying to achieve with its contingency plan. With respect to mitigating actions, this plan did not include dates for completing them before a potential Year 2000 failure. Moreover, the plan did not specify which individuals were to be responsible for completing the mitigating actions. Although IRS’ guidance does not require that the plan identify specific individuals, without identifying responsible individuals and dates for completing the mitigating actions, IRS has little assurance that these actions will be completed before a potential Year 2000 failure. The paper submissions plan focuses on the contingency actions to be implemented in the event that SCAMPS experiences a Year 2000 system failure. Although IRS’ guidance calls for plans to contain a performance goal, the paper submissions plan did not include one. Also, we told IRS officials that we had questions about the viability of one of the plan’s mitigating actions. Actions Are Under Way to Help Ensure Consistency and Completeness of All Plans

In addition to agreeing to make changes to the two plans, IRS officials said that actions are under way to help ensure that other business contingency plans are consistent and complete. If properly implemented in a timely fashion, these actions should provide IRS with a higher level of assurance that its business contingency plans will help reduce the impact in the event of a Year 2000–related system failure. 1, 1999); and (3) Internal Revenue Service Century Date Change Business Continuity and Contingency Plan, (Version 1.0, Nov. 24, 1998); interviewed officials from the Century Date Change Project Office; interviewed members of the submission processing contingency plan working group, the executive that was responsible for the two plans we reviewed, the Business Year 2000 Executive, and other BSRO staff; toured the Atlanta Service Center to learn more about how tax returns are processed through IRS’ information systems; and reviewed 6 of the 10 sections of the two business contingency plans to determine whether they were consistent with IRS’ guidance.
Why GAO Did This Study

GAO reviewed two Internal Revenue Service (IRS) year 2000 business continuity and contingency plans for their consistency and completeness on the basis of IRS' guidance for such plans.

What GAO Found

GAO noted that: (1) two IRS business continuity and contingency plans--one for processing paper tax returns that result in a refund (refund plan) and the other for receiving paper submissions (paper submissions plan)--were inconsistent and incomplete in two key areas included in IRS' guidance: (a) performance goals; and (b) mitigating actions; (2) these weaknesses raise questions about whether these two plans provide sufficient assurance that IRS has taken all the necessary steps to reduce the impact of a potential year 2000 failure; (3) IRS' guidance requires that plans specify a desirable performance goal; (4) the performance goal for the refund plan was inconsistent with the plan's contingency actions; (5) this inconsistency raises questions about the goal that IRS is trying to achieve with the refund plan; (6) the paper submissions plan did not include a performance goal; (7) without appropriate performance goals, IRS has little assurance that the contingency actions specified in the plan are appropriate for reducing the impact of a potential year 2000 failure; (8) in addition, neither plan specified the completion dates for the mitigating actions, which IRS' guidance defines as the steps that are to be completed in advance of a potential year 2000-related failure, to help reduce its impact; (9) moreover, neither plan specified which individuals were to be responsible for completing the mitigating actions; (10) IRS' guidance requires that the plans include mitigating actions and completion dates, but does not require that responsible individuals be identified for completing mitigating actions; (11) however, without assigning actions to specific individuals and identifying completion dates, IRS has little assurance that these actions will be completed before a potential year 2000 failure; (12) in June 1999, GAO informed IRS officials of its concerns regarding these two plans; (13) GAO also told them that its concerns raise questions about the extent to which other plans may have similar weaknesses; (14) in response to GAO's concerns, IRS officials agreed to make changes to improve the completeness and consistency of these two plans; (15) they also said they have designated an individual that is to determine the extent to which other plans may have similar weaknesses and revise the plans as needed; and (16) in addition, IRS assigned one of its year 2000 contractors to set up a mechanism by which IRS could track the implementation of business continuity and contingency plan actions.