Millennium change set to catch many firms unprepared

Surveys show New Zealand companies are getting behind in the Y2K-fix department, reports CHRIS BARTON.

Latest surveys from both the Y2K Readiness and State Services Commissions show much of the country is running about three months late in fixing its millennium date-change problems.

A key indicator of the tardiness can be seen in how few sectors have completed the critical testing phase of Y2K compliance. As of April, only the banking sector had passed the halfway mark in testing its electronic date-change fixes.

Testing or verifying Y2K fixes or remediation work is, by far, the most time-consuming and complex part of the Y2K compliance process. Most experts acknowledge it comprises at least 50 per cent of the total time involved.

So it is pleasing to see that the banking and finance industry had 62 per cent of its testing done when the April survey was conducted. That puts it leagues ahead of everyone else and on track to be fully compliant in its computers and other equipment by June - and to have all Y2K preparations done by September.

Paradoxically, the industry with the best track record is scoring worst in perception: 21 per cent are not confident about the continuity of banking services come the millennium dawn. This result has the industry wondering what it takes to convince the doubters and has forced it into a $300,000 print marketing campaign that will run during July and August.

Watch, too, for Y2K compliance messages on bank statements and at automatic teller machines.

But if things are going swimmingly for the banking industry, it has to be said report cards in other sectors look poor in comparison: only 10 per cent of councils, for example - many of which control water, wastewater and traffic services - have completed testing their Y2K fixes. A closer reading of the more detailed responses from local government on water and wastewater readiness reveals an even more alarming situation: that testing of equipment and control systems is slow and that many councils are relying on assurances from suppliers rather than verifying Y2K compliance themselves.

In the Auckland region, for example, Metrowater believes 91 per cent of its equipment is compliant but acknowledges that only 30 per cent of the devices used have been tested - leading to the assessment "that there is a high risk and progress is unsatisfactory".

North Shore City fares a little better, but has 50 per cent of its devices still to test. Waitakere City has tested 90 per cent of its devices but has found 25 per cent non-compliant. It's a similar situation in Manukau City where 95 per cent have been tested but 20 per cent are non-compliant. Watercare services gets the highest score with 90 per cent of its devices compliant and 90 per cent tested.

Testing is the third step of Y2K compliance. The reports cards of the preceding phases - assessment and remediation - provide further insight into how far behind sectors are getting. While most have past the halfway mark of assessment, only two - banking and oil - report that they are 100 per cent complete.

On phase two - getting the fixes in place - hospitals and health services (HHSs) are last, with only 8 per cent in order. Air transport rates 16 per cent. Some of this lack of progress is borne out by the State Services Commission survey which found 10 out of 27 HHSs - including Capital Coast Health and Waitemata Health - had made unsatisfactory progress. None, as of the end of March, had reached "operational sustainability".

It is a similar story with other state sector organisations. Nine including Police, Customs, Department of Work and Income and even the Department of the Prime Minister and Cabinet are deemed to have made unsatisfactory progress. And only four out the 32 "high-impact" agencies have achieved operational sustainability.

State Services believes the others are doing okay but points out the survey is an assessment as of March 31, not a forecast of the readiness anyone will achieve by the end of the year.

The Y2K Readiness Commission has already seen slippage in its survey of when companies and organisation expect to have their Y2K preparations complete. The effect has been most marked in large businesses - many of which have revised their completion timetables out to the third and fourth quarters.

The completion dates cover both computers and other equipment such as air conditioning, phone and security systems, pumps and machinery which uses date aware chips. The slippage trend is a concern - especially if it continues - because completion in the fourth quarter leaves little comfort zone for the unforeseen and for retesting.

The final part of the Y2K equation is putting in place and the testing a business continuity plan. That's what the businesses and organisations will do if, despite all the work, things still go wrong.

But an alarming percentage - mainly in the health, transport, retail and wholesale sectors, plus a few in the state sector, councils and large businesses - do not believe a plan is needed.

Testing the viability of the plan is important too - although in some cases such as in banking and electricity supply it's hard to make such a test without turning off essential services.

The Y2K Readiness Commission surveys plans further surveys at two-month intervals to provide more information about the nation's preparedness to thwart the bug. Most of the country - including listed companies and councils - have no statutory requirement to report on their Y2K progress, so the surveys have been the only way to get public disclosure. However, it has to be pointed out that there is also no obligation to fill in Y2K Readiness surveys and although response rates to date have been good, the information is not as good as a independent third-party audit.

Nevertheless, the surveys should at least serve a short, sharp shock to anyone who still believes the Y2K bug is nothing by a computer industry con. Just read the percentages of those which have already felt the bug's effects - such as banking (62 per cent), electricity (34 per cent) and HHSs (46 per cent).

The State Services Commission reports use a more stringent independent assessment and show just how effective such an approach can be. On the day the report was released, there was a flurry of press releases from agencies such as Police and Waitemata Health which had been given unsatisfactory marks saying how much work they had done since March 31. The only real problem with both the SSC reports and Readiness Commission surveys is that they're always reporting events about two months in the past rather than now. Public disclosure appears to be the only tool capable of sharpening the focus of industry sectors on their Y2K tasks. Delivering that information two months after the event seems to defeat its purpose.

The next report from State Services covers the period to the end of July and will specifically focus on "when agencies Y2K programmes will be in place, the finalisation of business continuity plans and contingency planning, the ongoing availability of resources to deliver these outcomes, and legal liability issues."

Sounds like crunch time.