Maurice Williamson - Report of the Y2K Task Force

Appendices

The State of Readiness

3.0 The State of Readiness

3.1 We were asked to undertake an assessment of New Zealand's current state of readiness for the Year 2000 and to identify its likely readiness as this date approaches.

3.2 We assessed the readiness of New Zealand's public sector, of local authorities and of critical infrastructure sectors - those key elements of the social and economic infrastructure where failure could have serious social or economic consequences, or could compromise the health and safety of the general public. We also assessed the readiness of a separate sample of small, medium and large New Zealand organisations

3.3 Our assessment is based on information from a number of sources, including:

our surveys of public sector and other organisations;
consultations with people who are working on these problems now;
existing research in New Zealand and overseas; and
best practice benchmarks for managing Year 2000 issues.

3.4 The information from these sources has been tempered by the knowledge and experience of individual Task Force members which ranges across the public sector, the private sector, local government and large and small organisations.

What is readiness? 3.5 Full readiness has been achieved when:

all Year 2000 problems in internal systems and other equipment have been identified and fixed, and the fixes have been tested;
contingency plans are in place to manage internal failures and those in suppliers and customers; and
systems are in place to ensure that no new problems are introduced prior to the Year 2000.

3.6 We assessed the current state of readiness by measuring the number of organisations which state that they are "currently Year 2000 ready". Survey respondents were asked to identify the date on which they expect to have resolved all Year 2000 problems in their mission-critical¹⁹ systems and equipment to provide the basis for an assessment of when they are likely to be ready. We also used information about the level of completed Year 2000 planning by each survey respondent to make an assessment of the likely future state of readiness over the next 16 months.

Summary and conclusions 3.7 Our main conclusions on the current readiness and likely future readiness are:

Organisations which are currently Year 2000 ready

3.8 Only 1 per cent of organisations that responded to our mail survey claim to be currently ready, even when readiness is measured only in terms of their mission-critical systems and equipment.
Organisations which are likely to be ready by a specific date

3.9 Just over one-half of the organisations that responded to our mail survey indicated they expect to be Year 2000 ready by 1 January 2000 for mission-critical systems and equipment. The balance gave no indication of when they expected to be ready. Fewer than one-third expect to be Year 2000 ready for mission-critical systems and equipment by 1 April 1999.

3.10 The banking sector expects to be ready by the end of 1998, while most SOEs and government departments expect to be ready by 1 July 1999.

The likely level of readiness

3.11 Fewer than one-third of organisations that responded to the mail survey appear well placed to manage their Year 2000 risks effectively. The limited progress in planning, coupled with the possibility of a significant shortage of skilled people, does not give confidence that all public sector organisations, infrastructure service providers and local authorities will be able to identify and fix all their Year 2000 problems, and test their solutions. They may begin the Year 2000 with significant failures.

3.12 Some important sectors - including banking and finance, the oil industry, rail, and some government departments and state owned enterprises - appear to be managing their Year 2000 problems very well. However, a significant number of organisations engaged in important areas of infrastructure do not appear to be effectively managing their Year 2000 problems. These include the majority of public hospitals, many local authority utilities and some electricity suppliers.

3.13 About one-third of public sector organisations have not yet committed the funding or secured the skilled personnel needed to manage their Year 2000 problems effectively.

The approach 3.14 We developed a simple generic model of a risk-based approach to Year 2000 decision-making, and gathered information which allowed us to assess how well public sector organisations and private businesses are planning their Year 2000 projects. The model was driven by our observations of best practice in planning Year 2000 projects. Best practice guidelines indicate that 3 planning steps should have been completed by now:

understanding the problem and setting priorities - by preparing an inventory of all equipment which could be affected by Year 2000 problems, identifying what will be affected, and setting work priorities to resolve problems in equipment and systems which are mission-critical;
planning a remediation programme - by completing a plan to determine how problems in mission-critical systems will be identified and addressed and what financial, technical and other resources are required; and
securing commitment - by gaining commitment from the highest levels of the organisation, including the commitment of sufficient funds and other necessary resources.

3.15 For the purpose of our analysis, we applied this model to planning for the identification and addressing of Year 2000 problems only in mission-critical systems and equipment. For an organisation to successfully identify and address Year 2000 problems, planning will also need to encompass external data exchanges, supply chain issues, and non mission-critical systems and equipment, as well as contingency planning.
3.16 This test does not include any measure of progress in implementing a Year 2000 remediation project. We have focused on planning as this activity largely should be complete by now. We believe that without adequate planning, any implementation is likely to be less than optimal.

3.17 This model was the basis for a survey questionnaire mailed to 466 public sector organisations and suppliers of infrastructure services. Some 379 usable responses were received, an overall response rate of more than 80 per cent. (Details of the response rates for various categories of respondent are given in Appendix III.) The model also was the basis for a telephone survey questionnaire to 600 private sector organisations, including 500 small and medium-sized businesses with fewer than 50 employees.

3.18 In addition to surveying organisations and businesses, we consulted with a range of organisations which either act as regulatory bodies for key sectors of the economy or represent the members of those sectors. We also consulted with people who organise Year 2000 remediation programmes for their organisations or provide advice to business clients.

Overall assessment of confidence 3.19 Mail survey respondents were asked how likely or unlikely they thought it was that they would be seriously affected by Year 2000 problems given all they have done and intend to do to identify and address their Year 2000 problems. Eighty five per cent said it was unlikely there would be serious consequences.

3.20 The results of the mail survey varied little across various sub-groupings of respondents, defined either by ownership (central government, local government, or other) or by sector of operation (human services, energy, finance, communications, transport).

FOOTNOTES

Something a business cannot do without if it is to remain viable. return

MINISTER'S HOME PAGE || EXECUTIVE HOME PAGE

	3.1	We were asked to undertake an assessment of New Zealand's current state of readiness for the Year 2000 and to identify its likely readiness as this date approaches.
	3.2	We assessed the readiness of New Zealand's public sector, of local authorities and of critical infrastructure sectors - those key elements of the social and economic infrastructure where failure could have serious social or economic consequences, or could compromise the health and safety of the general public. We also assessed the readiness of a separate sample of small, medium and large New Zealand organisations
	3.3	Our assessment is based on information from a number of sources, including: our surveys of public sector and other organisations; consultations with people who are working on these problems now; existing research in New Zealand and overseas; and best practice benchmarks for managing Year 2000 issues.
	3.4	The information from these sources has been tempered by the knowledge and experience of individual Task Force members which ranges across the public sector, the private sector, local government and large and small organisations.
What is readiness?	3.5	Full readiness has been achieved when: all Year 2000 problems in internal systems and other equipment have been identified and fixed, and the fixes have been tested; contingency plans are in place to manage internal failures and those in suppliers and customers; and systems are in place to ensure that no new problems are introduced prior to the Year 2000.
	3.6	We assessed the current state of readiness by measuring the number of organisations which state that they are "currently Year 2000 ready". Survey respondents were asked to identify the date on which they expect to have resolved all Year 2000 problems in their mission-critical¹⁹ systems and equipment to provide the basis for an assessment of when they are likely to be ready. We also used information about the level of completed Year 2000 planning by each survey respondent to make an assessment of the likely future state of readiness over the next 16 months.
Summary and conclusions	3.7	Our main conclusions on the current readiness and likely future readiness are:
	Organisations which are currently Year 2000 ready
	3.8	Only 1 per cent of organisations that responded to our mail survey claim to be currently ready, even when readiness is measured only in terms of their mission-critical systems and equipment.
	Organisations which are likely to be ready by a specific date
	3.9	Just over one-half of the organisations that responded to our mail survey indicated they expect to be Year 2000 ready by 1 January 2000 for mission-critical systems and equipment. The balance gave no indication of when they expected to be ready. Fewer than one-third expect to be Year 2000 ready for mission-critical systems and equipment by 1 April 1999.
	3.10	The banking sector expects to be ready by the end of 1998, while most SOEs and government departments expect to be ready by 1 July 1999.
	The likely level of readiness
	3.11	Fewer than one-third of organisations that responded to the mail survey appear well placed to manage their Year 2000 risks effectively. The limited progress in planning, coupled with the possibility of a significant shortage of skilled people, does not give confidence that all public sector organisations, infrastructure service providers and local authorities will be able to identify and fix all their Year 2000 problems, and test their solutions. They may begin the Year 2000 with significant failures.
	3.12	Some important sectors - including banking and finance, the oil industry, rail, and some government departments and state owned enterprises - appear to be managing their Year 2000 problems very well. However, a significant number of organisations engaged in important areas of infrastructure do not appear to be effectively managing their Year 2000 problems. These include the majority of public hospitals, many local authority utilities and some electricity suppliers.
	3.13	About one-third of public sector organisations have not yet committed the funding or secured the skilled personnel needed to manage their Year 2000 problems effectively.
The approach	3.14	We developed a simple generic model of a risk-based approach to Year 2000 decision-making, and gathered information which allowed us to assess how well public sector organisations and private businesses are planning their Year 2000 projects. The model was driven by our observations of best practice in planning Year 2000 projects. Best practice guidelines indicate that 3 planning steps should have been completed by now: understanding the problem and setting priorities - by preparing an inventory of all equipment which could be affected by Year 2000 problems, identifying what will be affected, and setting work priorities to resolve problems in equipment and systems which are mission-critical; planning a remediation programme - by completing a plan to determine how problems in mission-critical systems will be identified and addressed and what financial, technical and other resources are required; and securing commitment - by gaining commitment from the highest levels of the organisation, including the commitment of sufficient funds and other necessary resources.
	3.15	For the purpose of our analysis, we applied this model to planning for the identification and addressing of Year 2000 problems only in mission-critical systems and equipment. For an organisation to successfully identify and address Year 2000 problems, planning will also need to encompass external data exchanges, supply chain issues, and non mission-critical systems and equipment, as well as contingency planning.
	3.16	This test does not include any measure of progress in implementing a Year 2000 remediation project. We have focused on planning as this activity largely should be complete by now. We believe that without adequate planning, any implementation is likely to be less than optimal.
	3.17	This model was the basis for a survey questionnaire mailed to 466 public sector organisations and suppliers of infrastructure services. Some 379 usable responses were received, an overall response rate of more than 80 per cent. (Details of the response rates for various categories of respondent are given in Appendix III.) The model also was the basis for a telephone survey questionnaire to 600 private sector organisations, including 500 small and medium-sized businesses with fewer than 50 employees.
	3.18	In addition to surveying organisations and businesses, we consulted with a range of organisations which either act as regulatory bodies for key sectors of the economy or represent the members of those sectors. We also consulted with people who organise Year 2000 remediation programmes for their organisations or provide advice to business clients.
Overall assessment of confidence	3.19	Mail survey respondents were asked how likely or unlikely they thought it was that they would be seriously affected by Year 2000 problems given all they have done and intend to do to identify and address their Year 2000 problems. Eighty five per cent said it was unlikely there would be serious consequences.
	3.20	The results of the mail survey varied little across various sub-groupings of respondents, defined either by ownership (central government, local government, or other) or by sector of operation (human services, energy, finance, communications, transport).