Year 2000 report card.

The millenium bug is an unprecedented technical and project management challenge. Some degree of failure is inevitable in all industries. based on progress to date, some sectors are more vulnerable than others, some work well with others and some show improvement. But some are just plain flunking.

The two most remarkable things about the year 2000 problem are the amount of uncertainty surrounding it and the misinformation, both positive and negative, propagated in the media (including the Internet).

Apocryphal and anecdotal information abounds - testimonials, rumors, surveys and outright guesses - yet little hard data exists about the extent of the problem and the progress of U.S. industries in solving it. Most U.S. companies are understandably reluctant to talk about their Y2K status for fear of litigation and possible legal liability. Witness the plight of Intuit, Inc. After publishing information about the Y2K-readiness of its various software products, the company was promptly named in no less than six class action suits across the country.

Despite the dearth of hard data, it's possible to assess progress in various industries by analyzing and comparing information from several sources. These include federal securities reports made by publicly traded companies to the United States Securities and Exchange Commission; reports by federal and state agencies monitoring year 2000 progress in regulated industries; surveys by reputable research organizations using adequate sample populations and bias controls; and published findings by reputable experts with adequate experience "in the trenches" of the Y2K fight.

Before evaluating specific industries, however, several cross-industry observations are useful to set the stage:

* Most companies started their readiness efforts too late. The average Fortune 500 company didn't begin until 1997.

* Many year 2000 projects floundered, and some continue to flounder, due to lack of strong senior management support.

* As work on the problem progresses, its scope increases. It was originally seen as a mainframe/COBOL problem. Later it became clear that it affects many distributed and desktop systems. Most recently, the realization dawned that it also involves "embedded systems" (processors performing date-sensitive functions in buildings, plants, equipment, industrial and consumer products and the like).

* Y2K compliance represents most companies' largest information technology project ever. The deadline is non-negotiable. Many systems' failure dates kick in before January 1, 2000. And the record of the IT industry (including outside vendors and service providers as well as in-house departments) for on-time delivery of major projects is abysmal.

* Testing is the most important and time-consuming phase of any Y2K plan. In a well-run project, it should be about 60 percent of the work. Given the status of most projects as of this date, though, it appears inevitable that thorough testing will not be completed in time.

In short, some degree of failure is certain on a cross-industry basis. The key questions are how extensive and where those failures will be.

Insurance

A As a whole, the insurance industry stands out. It has made good progress for two reasons. First, companies grasped the importance of the problem and started earlier on conversion work. This is because certain of their systems hit their "time horizon of failure" (the time when date-dependent calculations extending into or beyond 2000 would yield erroneous results or cause system failures) before systems did in other industries.

Second, the U.S. insurance industry is comprised primarily of huge companies with vast resources. Unlike, for example, banking - which includes not only mega-banks but thousands of smaller community-based institutions - the U.S. insurance industry has few small carriers of limited resources. As a result, it's been able to devote the huge sums of money necessary to come to grips with the problem. Therefore, most firms have progressed beyond "remediation" (code conversion, system replacement, etc.) and are well into testing.

However, the insurance industry remains at risk from another angle: indemnity claims. Conversion costs and failures are certain to provoke a variety of claims for indemnity under comprehensive general liability, director and officer liability, fiduciary liability and other common policy forms. Some will be meritorious and others not, depending on the policy language and the facts of each case. But an avalanche of claims is certain, and will threaten the adequacy of insurance company reserves for year 2000-related coverage, defense and indemnity costs.

Financial Services 

B The largest commercial and investment banks, securities firms, electronic funds transfer organizations and other companies comprising the financial services sector have made good progress, though not as much as the insurance industry. Most large entities started their conversions well before 1997, have devoted vast resources and are in, or are about to enter, the testing phase. They have also "benefited" from constant prodding from federal regulatory authorities (for example the FFIEC and the SEC).

The financial sector as a whole, however, still faces at least two primary challenges. First, it has a surfeit of small- to medium-sized participants - community banks, credit unions, brokerage houses and others. Many of these smaller fish appreciated the seriousness of the problem late in the game, were slow to begin work (or have yet to start) and are stretched to come up with adequate resources. For example, Gov. Kelley of the Federal Reserve Board recently announced as many as 10 percent of U.S. banks - primarily smaller institutions - are not "on track" to achieve year 2000 compliance. If, as is possible, these banks were to fail, it would not only shake public confidence but have a significant impact on the financial sector as a whole.

Second, this sector, more than any other industry, relies on millions of data interchanges among the systems of companies, financial exchanges, governmental agencies and others. Failure of this vast electronic web poses a serious threat. Erroneous data could easily pass from system to system or, worse yet, could "recontaminate" systems previously made Y2K-ready.

The popular media recently seized on the results of a small data interchange test conducted by a handful of large institutions under the auspices of the Securities Industry Association (SIA) to declare that the financial services industry has a clean bill of health on year 2000. The truth, however, is that the "test" in question was merely a tiny "test of a test" (to use the SIA's own term). Large-scale testing of data interchanges isn't even scheduled until 1999. Only then, hard by New Year's Eve, 1999, will we begin to have a reliable idea of the seriousness of financial services data interchange problems.

Manufacturing

C Based on the misperception that the manufacturing industry had little exposure, the industry was relatively late in addressing the problem. In fact, many of the largest U.S. firms waited until 1997; few are near the testing phase.

The industry faces two major threats. First, in manufacturing environments, innumerable embedded systems facilitate many processes, including (but not limited to) process control, automated factories and assembly lines, environmental safety, robotic equipment and quality control. Not all perform date-sensitive functions, but many do.

Furthermore, embedded systems can be difficult to locate, much less replace or repair. Typically, they're not tracked in any centralized inventory. Many are highly customized. It's often difficult to diagnose millenium bugs due to obscure microcodes and lack of support by the original vendors (many of whom are out of business). The industry has a long way to go in a short time to find, diagnose, repair or replace, test and certify these systems.

Second, complex supply chains characterize the manufacturing industry. The typical large manufacturer relies on a network of hundreds or thousands of suppliers of parts, raw materials and other resources necessary to produce finished product. A failure of any significant link can halt production (just as the recent strike at certain GM-owned supply facilities brought down vehicle assembly lines). This risk is exacerbated by many manufacturers' reliance on "just in time" inventory systems designed to keep the on-hand stock of parts, raw materials and other assets as low as possible. While these systems lower overhead, they leave manufacturers vulnerable to almost immediate disruption in the event of a significant supplier failure.

These problems are compounded by the fact that many small- to medium-sized manufacturers are key links in the supply chain and are themselves reliant on plants, equipment and processes containing embedded systems. Unfortunately, many smaller companies have so far devoted little, if any, attention to the Y2K problem. Smaller manufacturers tend to operate on thin margins and lack the necessary resources and management support. The industry as a whole must take immediate steps to assure that these relatively small but vital players in the supply chain deal with the problem and develop contingency plans to "work around" their potential failures.

Retailing

C All but the largest retailers got a slow start, but the industry shows progress on point of sale systems and internal IT systems. However, retailers face a supply chain problem similar to that of manufacturers. Note that small- to medium-sized companies, which are integral to the retail supply chain, have done little work on year 2000. Through the National Retail Federation and other organizations, the industry has recognized this Achilles' heel. But much work remains in a short period to avoid disruptions.

Information Technology

C One would expect the vanguard of our new "information society" - high-tech companies that supply computer hardware, software, peripherals, system development, outsourcing and other products and services - to be at the forefront of year 2000 readiness. Ironically, it's not. From large to small, IT companies have made only average progress in remediating year 2000 problems in their own internal systems. Even at this late date, a significant number also continue to struggle with Y2K-readiness in their product lines.

The IT industry also faces a huge legal threat from the year 2000 problem. Already, nearly two dozen lawsuits have been filed against vendors of computer hardware, software and system development services. Claims will multiply exponentially as the magnitude of year 2000 costs sinks in with system users and as system failures accelerate.

Telecommunications

C The telecommunications industry teeters between average and below average progress. The industry as a whole started late - in part due to rapid business changes, including deregulation, new markets, mergers, acquisitions and the emergence of new technologies - all of which made the year 2000 problem pale in comparison. It also underestimated the scope of the problem.

The International Telecommunication Union (ITU), an agency of the United Nations, recently emphasized to its members and others in the industry the extremely high vulnerability of this high-tech sector to year 2000 failures. While the efforts of the ITU and others have increased attention on the problem and accelerated remediation, an enormous amount remains to be done before the century change. It will be a race to the finish. The industry hasn't met a number of challenges, including consistent definition of year 2000 compliance, uniform means of achieving compliance and awareness of related date problems in acquired components.

Utilities

D Utilities also started late, partly because of flux in the business environment following deregulation and partly because of misperceptions about the magnitude of the effects of Y2K issues. Until recently, most were unaware of potential problems with the embedded systems in their generating and transmission facilities and other infrastructure, so many are still in the most preliminary phase of compliance assessment. Some are just inventorying (i.e., trying to find) all their embedded systems. Others are doing some remediation, but few if any are in or near the testing phase.

In short, as with telecommunications, utilities face a long, hard race to the finish.

Health Care

D As of 1997, approximately half of U.S. health care providers hadn't even begun to address the year 2000 problem. Many still haven't.

This abysmal lack of progress is both understandable and highly disturbing. As a result of the trend toward managed care, health care providers - hospitals, special care units, hospices and other facilities - operate on the thinnest possible margins. Given that they simply don't have the funds to undertake serious year 2000 programs, their position is understandable.

Yet the continuity and quality of health care services depend on the reliable functioning of providers' internal IT systems - scheduling, patient admission and discharge, drug prescription and administration, to name a few. Health care services also rely on the integrity of electronic data interchanges between industry participants. On top of this, many diagnostic, monitoring and medical devices contain embedded systems that could malfunction due to date-related errors.

In the face of budget constraints and the dismal progress to date, disruptions in health care services appear inevitable. The only encouraging sign is the recent emergence of community-based volunteer initiatives by project managers, programmers and others to help health care providers achieve compliance.

Federal, State and Local Government

F Based on self-reporting by federal agencies, it appears about one-third of their "mission critical" systems won't be compliant in time. A "mission critical" system is one that directly affects an agency's ability to perform governmental functions or provide services that have a direct impact on the public.

And though there's been publicity about lack of Y2K compliance at the federal level, the progress (or lack thereof) by states, counties and municipalities has not been spotlighted.

Most worrisome is the almost universal lack of preparedness by local agencies - counties and municipalities. Their failure to achieve compliance will have a greater impact on the daily lives and well-being of citizens than failures higher up. Local agencies are responsible for basic social services such as water, sewage disposal and treatment, police and fire protection and emergency response. They depend on reliable functioning of vulnerable hardware, software and embedded systems.

Unfortunately, like health care providers, many local government agencies have been financially strapped, unable to pay for year 2000 projects. In addition, local officials have exhibited a remarkable lack of awareness - even a denial - of the problem. If this pattern continues, disruption of basic social services on a local level seems inevitable. As in health care, the one encouraging sign is the recent emergence of grassroots volunteer efforts by project managers, programmers and others to assist their local communities with year 2000 readiness.

Steven L. Hock is president and CEO of Triaxsys Research LLC, an interdisciplinary think tank. Before founding Triaxsys, he was an attorney specializing in IT issues. He can be reached at [e-mail].