On 12 February, 1999, General Government Sector budget dependant agencies were advised by the Treasury of the arrangements to be applied regarding losses arising from the Year 2000 (Millennium Bug) issue. That advice flagged discussions with OIT on seeking independent assessments of each agency's remediation efforts.

At a meeting held 8 March, 1999 between OIT, Treasury, the Crown Solicitor's Office and DPWS, it was agreed that the following would apply for budget dependent agencies. At the CEOs' Y2K Task Force meeting of 24 March, 1999, it was agreed that the requirements would apply to all agencies covered by the Government's Y2K strategy, ie general departments and state owned corporations

1. What is required?
Agencies are now required to obtain an independent assessment of the reasonableness of process of their remediation effort.

The assessment should be undertaken as near as possible to the completion of the agency's Year 2000 project, the deadline for which is 15th October, 1999. In this regard, it is recognised that some elements, particularly in relation to less critical matters, may be ongoing. The timing of the assessment and inclusion of statements as to any limiting factors are a matter for the agency to resolve with the person (or organisation, as the case might be) undertaking the assessment (eg this assessment does not include …….)

2. For what purpose?
Agencies have already undertaken a business risk analysis. From that analysis they prepared a rectification plan, a high level estimate of rectification costs and contingency and disaster recovery plans. They were then required to obtain a certification that the analysis and the subsequent planning process was reasonable in the circumstances. They are now implementing the rectification plan and testing the results to ensure that they are Year 2000 ready.

The assessment now required is for the purpose of ensuring that remedial action, as required by the rectification plan, was carried out. Like the certification process, the test is "reasonableness of process".

The assessment tests remedial action against the rectification plan. There is no expectation that the assessment will review the risk analysis, the planning or the certification already undertaken. OIT will rely on the certification already obtained from the agency as the statement of completion of the analysis and planning phases.

Of course, where the original certified rectification plan has changed as a consequence of further inquiries, the assessment will be based on the amended plan. In that case, some reference should be made to the changes made and the reason why.

3. By whom?
The assessment may be undertaken by a business analyst identified in Contract ITS 2060, a remediation Contractor offering Business Services as defined in Contract ITS 2061 or an external auditor appointed by the agency in accordance with normal purchasing requirements.

Agencies will recall that a contractor who carried out the certification for an agency was prevented from carrying out the remedial action for the same agency. The same rule will apply to the assessments which may be undertaken by the person who performed the original certification or by another person but not by the person who carried out the remediation.

Although, the assessment of remedial action is not meant to cover the analysis/planning certification phases, it is clear that, if the person undertaking the assessment is different to the person who undertook the certification, some inquiries as to the certification process may be necessary to allow assessment to proceed.

4. Other assurances?
OIT will keep Treasury advised of the receipt of assessments as part of the normal reporting process. In that regard, it is noted that monthly reports provided by agencies are now submitted electronically. The requirement, that they are provided by the CEO, remains.

Both OIT and Treasury will continue to assume that reports submitted monthly by the agency are submitted with the knowledge and agreement of the CEO and amount to an assurance by the CEO that the agency has complied with all Government requirements to the extent indicated in the report.

The process of assessment will provide the CEO with high level of confidence that all aspects of the project have been addressed and fits in with what a number of agencies are already doing.

Finally, I am advised that some budget dependent agencies are reporting that their high level cost estimates exceed the available Year 2000 budget. Agencies seeking supplementary funding in 1998/99 should submit a business case as soon as possible and certainly before the end of April. 

Col Gellatly
Director General