Date: 4 March, 1999

Speaker: Carol White

Affiliation: Commercial Federal Bank - www.comfedbank.com

Topic: The 'Y2K Readiness Process' at Commercial Federal Bank.

Introduction

With all the focus on Y2K problem identification, remediation, due diligence and contingency planning, a change of pace was in order. Commercial Federal's primary strategy for Year 2000 compliance was to purchase compliant upgrades and to replace non-compliant systems with new, compliant systems. This strategy and environment provides a wealth of information about managing the complexity of Y2K validation testing and readiness. Banking must deal with both the internal demands of a Y2K project and the regulatory requirements of the industry.

Ms. White proposed to cover the testing methodology, environment, critical test dates, resource requirements, problem-tracking/retest/resolution, signoff process, and the role of the Bank regulators. The Y2K project at Commercial Federal is but one example of similar projects going on in banks across the nation.

Presentation

The regulatory environment of banking and securities has helped assure that these two industries are at the top in terms of Y2K readiness. Several regulatory agency (external) driven project compliance dates or milestones help drive the Y2K project for Commercial Federal as well as any other bank. Many of these milestone dates have already passed or will have passed before January 1, 2000.

Given the Commercial Federal strategy to replace rather than remediate, the core system testing for mission critical applications becomes especially critical. A mirror environment of both hardware and software has been established for testing. Each change made to the system is tested in the mirror environment first. The testing phases applied for each system includes a rigorous test, in isolation, at all levels of the hardware, from network layers and data link layers through the application layer and handling of the data. Passing the effectiveness test in isolation merely means, the system is eligible to pass on to the Y2K readiness integration-testing phase.

A tremendous need for internal and external communications and continuous planning and contingency planning is present in the banking environment. Key milestones were recently completed in third and fourth quarter of last year. Coordination of testing with partners in transactions (for example VISA and MasterCard) adds to the complexity as different systems and different event dates drive the testing program for each transaction and system area. This is just one example of the components in the validation testing process.

Embedded chip testing (usually thought of as a manufacturer's rather than a banker's Y2K issue) does provide some challenges for Ms. White's project as well. The banking industry has wisely used the vendor's testing results for general compliance issues. These embedded chips are then part of the hardware that the isolated and integrated testing process mentioned earlier must use. Most manufacturing concerns take advantage of large databases of Y2K embedded chip data for determining readiness in this area.

Another consideration is contamination testing otherwise known as "Clean Management." Commercial Federal follows a highly advisable plan of performing Y2K testing any new upgrades or changes added to previously Y2K compliant systems. To avoid testing pressure, these types of changes will be minimized during the later part of this year.

There are over 100 people involved in the testing and readiness project. Progress reports, both verbal and written, are provided to senior management at a minimum of twice weekly. The Board actively monitors and is involved in the entire process and assure timely execution of plans.

Open Discussion

It was noted that Nebraska is among the top three states in terms of Y2K readiness.

There are many regulatory agencies involved in the banking industry. The FFIEC (Federal Financial Institutions Examination Council) was organized in 1979 and is a combined agency representing the OCC, FDIC, Federal Reserve Board of Governors, OTS, and NCUA. The FFIEC requires, for example, that a bank provide the Y2K compliance plan prior to approval for any acquisition. An acquisition is out of the question, if that bank is not on schedule to be ready for Y2K. Another industry player helping to organize Y2K preparatory efforts is the Mortgage Bankers Association with 3000 members including bankers, brokers, sources of funds and guarantors of mortgages.

Several references were made concerning what lawyers recommend and what disclosure laws allow regarding disclosure and the FFIEC ratings on Y2K testing. Banks can talk about what they are doing to assure Y2K readiness and safety, but they are not allowed to disclose the exact rating, nor can the FFIEC release those ratings.

However, all is not grim seriousness in this Y2K readiness and contingency planning. Even banks can have fun working through contingency planning scenarios. Imaginative folks can provide some creative, "what if" food for thought for the banking planning and contingency teams.

All banks are in the same boat for Y2K as any other industry. Several of these groups have had speakers at ITC meetings. Many have the ability to operate nearly self-sufficiently for a month or more without taxing the rest of the infrastructure in case of any disaster. This is a great boon to the people in this region. They can do all they can for the things within their power to control. They can provide information and education for the customer base. They can collaborate with government, businesses and "infrastructure" to help in joint contingency planning. Within Omaha, a "summit" type meeting is in the works. This meeting is (rumored?) to be called by the mayor's office. Many businesses, utilities, banks, and volunteer agencies are working on coordinating contingency planning.

Upcoming meetings

The next meeting will be on March 18, 1999 at the One Pacific Place Garden Cafe. Justin Stolen from the University of Nebraska at Omaha will provide a presentation on the Ph.D. degree in the planning stages for the Department of Information Science and Quantitative Analysis. They are in the research process. He will include information about their efforts for public input into the degree offering.

Other topics for future meetings

Y2K awareness planning at the personal family level is an April meeting topic.

Member suggestions for future meetings

There was interest expressed by the Federal Reserve Bank in Kansas City to present this testing and Y2K in banking at later date if the ITC wants additional information.

• "Telecom on Y2K"
• "Global impact of Y2K";
• Wireless technology (DTN): Innovative future.
• Distance learning labs and growth. Facilities and programs in Nebraska.
• Net meetings.
• Y2K project planner for small businesses. Joint effort of SBA, NIST and USDA to help small business sector of the U.S.

Respectfully submitted by Gisele Olney