Regulators tell financials why the industry beat Y2K

WASHINGTON -Most people involved with squashing the Y2K bug are tired of the success stories and tales of dedicated people overcoming a mammoth programming flaw, but federal financial regulators are still mulling over it. The Federal Financial Institutions Examination Council-which includes bank, thrift and credit union regulators-recently released "Lessons Learned from the Year 2000 Project." In it, the regulators explain what worked and what didn't work with Y2K. According to the study the financials that were best prepared possessed some or all of the following 10 characteristics: * Senior management and director involvement to ensure that the project plans were clearly defined, supported and monitored; * Consolidation, elimination or integration of technology on an enterprise-wide basis by developing current inventories of information technology systems and applications; * Improved oversight of service providers, software vendors and consultants; * More formalized and effective strategies and standards for testing information technology systems; * Detailed contingency plans that analyzed the effect of potential system failures on core business processes (e.g., deposit taking, lending, fiduciary services, etc.); * Better safeguards to detect fraudulent, malicious, and negligent acts from both internal and external sources; * Review of testing and contingency planning processes by internal auditors; * Open information sharing for developing strategies and to respond to media reports or perceptions that could reduce public confidence in the financial services industry; * Improved public relations with customers; and * Thorough legal review to assist in vendor management, documentation retention, and legal defense. Interestingly, the study said some byproducts of Y2K may help financials deal with future crises. "Many financial institutions reported significant benefits from the development of Year 2000 contingency and `event management' plans. Contingency planning evolved from a largely theoretical exercise to a problem solving and training tool to help organizations respond promptly to operational failures and natural disasters," stated the report. Contingency planning also helped financials learn how to operate their core businesses (deposit taking, lending, etc.) if their primary IT systems fail. Yet contingency planning wasn't even required by regulators in the early days of Y2K preparedness. Another positive post-Y2K effect cited by the FFIEC was improved public relations. "The Year 2000 project afforded financial institutions many opportunities to communicate with customers, building on previously established relationships and establishing new ones," stated FFIEC. Key PR tools included Y2K info on monthly and quarterly statements; displayed on Y2K posters in lobbies; on ATMs; advertised in local newspapers and on radio and television; and via special Y2K Web site messages. The monster tech project also helped unite tech and legal departments. "In-house counsel also benefited from working closely with the Chief Technology Officer and Chief Information Officer on a project that cut across a range of disciplines." One other significant benefit of Y2K the FFIEC cited and which is being echoed by many credit union IT professionals is the comprehensive IT inventory Y2K forced them to do. "Financial institutions developed current inventories of information technology systems and applications. This enabled many institutions to consolidate, eliminate, or integrate technology projects on an enterprise-wide basis." The FFIEC will send a copy of the Y2K Lessons study to the CEOs and directors of all financials. -pgentile@cutimes.com