Y2K: The Demand for Evidentiary Records.

Information management in the 21st century will assume an importance in every enterprise that extends beyond today's afterthought stature. Rather than being cost centers or overhead functions to be contained, successful information management programs with vision will be critical to documenting organizational business processes. A major reason for this change in perspective is that vital documentation will be required to answer two questions for many enterprises on January 1, 2000:

1. What went wrong?

2. Did we do what we were supposed to do?

Suddenly, a particular class of records known as Year 2000 (Y2K) Program Records becomes mission critical documents. How those records are created, stored, and managed today could very well determine the success or failure of many organizations on the first day of the new century.

Y2K computer system problems are due to the common practice of using only two digits rather than four to record a year in a computer software date field. Thus, a computer system recorded February 15, 1998, in month/day/year format as 02/15/98. However, once the year 2000 becomes a reality, such computer systems may not be able to differentiate between February 15, 1900, and February 15, 2000, because both get recorded as 02/15/00.

Using only two digits for dates was prudent when computer memory, disk storage, and processor costs were relatively expensive and needed to be conserved. However, this short-sighted practice will now result in computational errors within arithmetic operations and cause a variety of difficulties in data field comparisons, data sorting, and the recording of accurate electronic records in databases that require dates for the year 2000 and beyond.

Business records will help to determine what went wrong so that organizations can immediately begin fixing computer system problems. Without adequate documentation of Y2K program conduct and computer systems testing, determining the root cause of problems could be very difficult. Y2K-related records could enable business analysts and software engineers to locate a date anomaly and prepare a software fix that rectifies the problem. "Did we do what we were supposed to do?" questions will come later as management, stockholders, regulatory authorities, system auditors, judges, attorneys, and others question the nature and degree of Y2K program efforts.

The ability to provide records as evidence of sincere and professional efforts to prevent Y2K-related disasters, injuries, or other calamities could be the critical difference for organizations and individuals that survive the year 2000. Demands for these records will come from both internal and external entities. The life cycle perspective for managing Y2K records should extend beyond the year 2000, as Y2K-related business challenges could affect internal operations, customer relations, litigation, and organizational credibility for many years.

Y2K at a Glance

Most computer software created in the past few years avoids the Y2K problem by declaring dates in at least a MM/DD/YYYY format, where 1900 and 2000 can be differentiated. However, many older "legacy" computer systems still have software or databases without this capability. These systems must have their data structures, computer software code, and all supporting utility and operating system software searched to correct Y2K-related date anomalies. For this reason, Y2K issues can affect an entire information technology infrastructure, including mainframe computers, personal computers, laptops, network servers, communications routers, telephone systems, office automation software, financial databases, manufacturing processes, and business partners.

Some untested computer software may survive until it records a full date field (e.g., October 10, 2000) or until it encounters a leap year (e.g., February 29, 2000) and it will need to record 366 days. However, any non-Y2K compliant software that attempts to store or process information with a date that exceeds December 31, 1999, will either fail, make incorrect calculations, or record erroneous data. Computer systems that continue to operate quietly while making incorrect calculations and storing incorrect data will make their owners wish that the system had simply failed, enabling an immediate problem address. Attempting to find and correct the effects of erroneous financial calculations, for instance, could certainly become an expensive nightmare.

Software-based aids to help find Y2K system problems include development tools, code testers, and a variety of debugging utilities. Considerable Y2K programmatic guidance is available from computer organizations, consulting firms, and government agencies, especially on Internet Web sites (see Bibliography). Books, periodicals, videos, and courses also provide information on addressing Y2K issues.

Organizations need well-defined and adequately funded programs to address Y2K issues. Such programs include phases to assess the organization's overall Y2K problem, specific activities to convert existing systems to Y2K compliance, and plans for software testing implementation. Project management, quality assurance, and policies and procedures ensure Y2K program success and show that efforts proceed as expected. Y2K programs can not be delegated entirely to information technology personnel, then left unmanaged and unmonitored. As with all initiatives requiring considerable time and effort, executive management's strong support and involvement are critical to project success. Evidence of sincere management support and interest in project activities may be requested should a Y2K failure result in litigation. Well-documented records regarding the entire Y2K program will be needed.

Does Failure Mean Disaster?

What consequences can a Y2K-related computer system disaster have? Business, safety, and health problems could be simply annoying or completely devastating. Business implications range from inability to track a few purchase orders to tremendous financial losses as computer systems are reprogrammed; the effects could even lead to chief executive officer and board member resignations as their company's stock plummets.

Safety problems could include airplanes unable to land before running out of fuel due to air traffic control problems, or emergency services unavailable as phone lines or other communications services become ineffective. Health-care crises could occur if life-support equipment fails or blood, drugs, or other medical supplies are not dispensed in a timely manner. Theoretically, any activity that relies on a computer system could be affected.

It is important to distinguish between a Y2K software problem and a Y2K business problem. Although Y2K is a software issue in the beginning, its impact on business and organizational activities have far reaching significance. Even software that is fixed immediately can leave lingering problems with suppliers, business partners, customers, and regulatory agencies. A computer system difficulty that starts as a technical/operational issue can rapidly create crises in confidence, credibility, and good business relations.

Whether or not these are disasters remains to be seen for each Y2K problem. In either case -- technical or business -- good records and documentation could save enterprises, careers, or even lives. Systematically recorded and well-managed documentation about Y2K will make the difference between addressing Y2K challenges and simply reacting to unfolding events.

Y2K Records Critical Documentation

Y2K business activities must be documented thoroughly, and the records placed within the information management program's sphere of influence; otherwise, Y2K challenges and problems become difficult to address.

When business partners and government regulators ask for assurance that an organization is addressing Y2K issues, they will expect to see documentation such as project charters, business impact analyses, contingency plans, and testing records. All such records need to be identified, classified, stored, and retained so they can be retrieved and produced in a timely manner upon request. Business records perceived as computer documentation traditionally have not been within the purview of information management, but Y2K records should be identified as formal evidence of company actions, and retained for specific periods of time, most likely several years after the arrival of the new century.

Y2K records affect an organization's response to litigation, with defendants and plaintiffs requesting documents that prove or disprove the program's overall quality. Software development and testing plans -- typically methodology, results, data, and other documentation -- can show that a company made sincere efforts to address potential problems. Investigators or injured parties may question the Y2K program's initiation, support, and conduct to determine whether it was a high quality program, had adequate funding, used qualified personnel, and had realistic deadlines. Project reports may be requested as evidence in court cases to determine if tests were properly analyzed, deadlines were met, test data was validated, and the overall program was investigated for defects. How did the organization address any problems found? Did senior management outsource the overall program, giving it little or no interest? (Outsourcing also raises questions regarding accountability.)

A major issue, as in all information management activities, will be determining what records to retain for what length of time. This decision-making process will be the first opportunity for information managers to participate in defining records series and to concur with Y2K program management and legal staff on the types and quantities of records to retain.

The compulsion to keep too much will result in a gold mine for adversaries during litigation and discovery. A worse impulse will be to keep only positive test results, thus making possible allegations of coverups or falsification of project documentation. Balanced documentation that shows how an organization discovered and addressed problems will be a great asset, and will reduce the overall need to keep records while ensuring that sufficient records are retained.

Retention periods for identified Y2K documents will vary with the type of documentation and its expected use. Y2K records are a great opportunity for information managers to work with a firm's legal staff to build consensus on records retention issues, laying the groundwork for a successful defense should any legal disputes arise.

"If your lawyers are called upon to explain some aspect of the project, they will need sufficient evidence to support the position that the test plan, as implemented, and the resulting conduct were reasonable under the circumstances," wrote Scott J. Nathan in an October 1998 article in Software Magazine.

An explanation of the project developed from test data and informative summary-level reports may be needed for a successful defense. This will not be possible unless there is an understanding between the legal department and the information management staff regarding the types of records to be retained and the appropriate duration.

"Retention periods usually involve a storage period equal to or greater than the length of the longest relevant statute of limitations for claims that may arise for which the information may be useful," explained Nathan. Legal staff should make these decisions and information management staff should implement them.

Y2K: A Future Opportunity Unfolding Today

There is considerable evidence that many organizations are scrambling to battle expected Y2K problems. Even some personal computers with new Pentium-based processors are not immune to Y2K bugs due to some system-level software (Murray 1998).

Many organizations, having finally faced up to the issues, are "declaring war" on Y2K's expected problems (Brewin 1998; Hoffman 1998). However, many government agencies that have been aware of Y2K business issues for some time are not making adequate progress and are missing project deadlines (De Bruse 1998). The Y2K problem in general has assumed sufficient magnitude to merit the creation of a Special Committee on the Year 2000 Technology Problem in the U.S. Senate.

The impact of Y2K problems is widening. According to the GartnerGroup consulting firm's expert testimony to the Senate Committee, "Even if we were to miraculously fix every one of these domestic issues and make certain all U.S. companies and government agencies will get themselves Year 2000 compliant before 2000, the absolute largest risk to the U.S. and to U.S. citizens is the impact from companies and governments outside the U.S."

Apparently, there will be Y2K problems despite the best efforts of organizations and individuals working feverishly to address the problems.

Conclusion

Records generated in the "regular course of business" are important in efforts to establish programmatic credibility because they provide a foundation for good evidence during litigation. Documenting the nature of such records, and the business processes used to create them, is important to programs that must meet regulatory, statutory, or other business requirements. Y2K programs generating documentation that certifies compliance with established procedures must also ensure that such records are preserved and organized in a way that facilitates retrieving them in the future. Y2K program management, computer systems staff, and information management personnel should plan the overall life cycle of Y2K documentation.

Y2K program records will be one of the most requested items related to information technology activities in the 21st century. These records will present a remarkable opportunity for expanding the information manager's role regarding electronic records, as well as documentation generated about and within computer systems. Information managers should take the initiative to offer assistance in managing Y2K-related documentation and records -- NOW!

Some Common Dates That Are A Danger For Y2K Crises

* January 1, 1999: a problem for any software that looks one year ahead requiring a valid date of 2000 to be available

* July 1, 1999 and October 1, 1999: new fiscal year rollover dates for software that will require a valid date extending to the year 2000 to record and post transactions

* December 31, 1999: the limitation date for all transactions in systems that can not use any date larger

* January 1, 2000: the date that many systems will lock up, fail, or begin to record bad data

EDITOR'S NOTE: An excerpt of this article appeared in the March 1999 issue of InfroPro.

BIBLIOGRAPHY

Computerworld Year 2000 Resources available from http://www.COMPUTERWORLD.COM/res/year_2000.html.

Brewin, Bob. "DOD Stages Year 2000 War Game." Federal Computer Week. November 23, 1998.

De Bruse, Orlando. "Y2K: 4 Agencies Critical." Federal Computer Week. November 23, 1998.

GartnerGroup Web Site available at http://gartner5.gartnerweb.com/public/ static/aboutgg/pressrel/testimony1098.html.

Hoffman, Thomas. "To the Y2K Ramparts!" Computerworld. November 23, 1998.

Murray, Bill. "Agencies Face Decision on Year 2000: Fix or Cut Bait." Government Computer News. November 23, 1998.

Nathan, Scott J. "Paper-Trail Priorities." Software Magazine. Special Issue. October 15, 1998.

United States Senate Web Site available at http://www.senate.gov/~y2k/index.html.

Year 2000 Home Page list of vendor products available from http://www.year2000.com/y2kvendors.html.

Year 2000 Home Page list of reference products available from http://www.year2000.com/y2kproducts.html.

The Disaster Center Year 2000 Page available from http://www.disastercenter.com/year2000.htm.

John T. Phillips, CRM, is the owner of Information Technology Decisions, a management consulting firm. He has more than 20 years of experience in information resources management, specializing in automated records management systems and other technology-related areas. Phillips has authored two publications related to information management and technology, and has presented at international conferences on related subjects. He can be contacted at [e-mail].