Senate Banking, Housing and Urban Affairs Committee

Field Hearing
The Implications of the Year 2000 Computer Problem

Introduction

The Year 2000 Problem - Aetna Inc. ("Aetna") has recognized for some time the seriousness of the potential impact of the transition to the Year 2000. Deceptively simple to describe, the Year 2000, or "Millennium Bug," issue is a significant global challenge for all public and private sector entities that use computers to do their work or include them in their products. Any computer calculation that involves a date could yield incorrect answers with potentially devastating results. Year 2000 is a management problem and not just a technological problem. Clear direction from leaders in industry and government on a global basis is required if the problem is to be solved in time. Aetna is committed to managing its transition to the Year 2000 comprehensively, prudently and without adverse effect on our customers or business partners.

Aetna's Year 2000 Program Office - Aetna, along with many other leading companies, has established an overall Year 2000 Program Office to direct the efforts of its individual business segments in addressing Year 2000 risk. As the leader of the Year 2000 Program Office at Aetna, I report directly to our CEO. Aetna's Program Office comprises expertise from a variety of disciplines, among them Legal, Financial, Audit, Program Management, Technology, and Communications. We are addressing the problem in partnership with leaders in every Aetna line of business, including Aetna U.S. Healthcare, Aetna Retirement Services, and Aetna International. Our effort includes Aetna's 22 affiliates in 16 countries primarily in the Americas and Asia. I report on our progress on a regular basis to the CEO, the Board of Directors, and senior management.

As leader of our Program Office, I am responsible for management of the overall risk to Aetna of the Year 2000 problem. This includes oversight of our progress regarding:

• Assessment, remediation and testing of our internal systems and computer hardware
• Assessment, remediation and testing of interfaces to other entities' computer systems
• Our business areas' assessment and actions to ensure that trading partners and other external relationships also are addressing Year 2000 risk
• Actions to mitigate risk associated with buildings, office equipment, and other sites or products with embedded chip technology, and
• All external and internal communications on Year 2000 issues.

Assessment of the Magnitude of the Year 2000 Problem

The Year 2000 problem is a global one and, while it has been characterized as a technology problem, this greatly understates its magnitude. We believe that the Year 2000 problem poses a comprehensive project management challenge to businesses and governments world-wide. The sheer size of the effort, coupled with the fact that the deadline cannot be moved, is a test of our collective management skills requiring planning, resource management, and communications, on a scale not often encountered. The task of accounting for and addressing the vast web of technologically interconnected relationships that characterize business in a "wired society" adds an additional complicating dimension. The global cost to fix the Year 2000 problem is estimated by Gartner Group to range between $300 and $600 billion whereas the litigation cost is estimated by some to be between $1.5 and $3 trillion. There have been statements that downplay or trivialize the Year 2000 issue. That is clearly not Aetna's view.

Associated Business Risks

The certainty of the century change, the magnitude of the effort and the complexity of the interrelationships means that all required Year 2000 remediation and testing may not get done by everyone. Aetna, like all businesses, would be affected by the failure of others, however well we achieve our own Year 2000 objectives. The risks we face fall into the following three categories: Operational, Market and Regulatory.

Operational Risks - Aetna is one of the country's largest health care benefits and financial services organizations. Aetna U.S. Healthcare is the largest provider of managed health care benefits. We provide health care benefits, specialty health, and group life and disability products and services to 13.7 million members. More than 320,000 providers and 2,500 hospitals comprise our health networks. The subsidiaries of Aetna Retirement Services serve more than 2 million members and 30,000 plan sponsors. Aetna International has more than 13 million customers, primarily in Latin America and the Pacific Rim.

For Aetna as well as other large financial institutions, the impact of computer, telecommunications, or utility failures because of Year 2000 on our world-wide operations could be devastating. If there were telecommunications and computer failures, we could not transfer funds (benefits claim and premium payments; investments; commissions; etc.) to and from our health and retirement services customers, medical providers, plan sponsors or third party administrators. We could not determine member eligibility. If our printing companies' computers failed, we could not print checks, policies or periodic healthcare and retirement services statements. If utility companies failed, it could be difficult if not impossible for us to operate our physical premises.

Market Risks - As with all other insurance companies, Aetna's primary product across all our businesses is customer service. Any Year 2000 failures which impact our ability to serve our customers could damage our reputation for quality service and our competitive position. We have recently seen how sensitive the market is to the ability of health care companies to process claims promptly. In our pharmacy business alone, we process over 44 million annual claims transactions electronically. That means millions of healthcare insurance consumers could be negatively affected by Year 2000 problems. The implications for healthcare diagnostic and delivery procedures that are computer dependent are potentially much more serious.

In our retirement services business, we serve mostly customers who have tax-favored asset accumulation and retirement savings funds invested with us through state, municipal, or non-profit plan sponsors. More than $5 billion of these assets are invested by Aetna's retirement services products in unaffiliated mutual funds such as Fidelity, Janus, etc. Aetna supports 34 mutual fund families and approximately 200 individual funds. We process 840,000 electronic collections and payments annually and I 0,000 annual wire transfers through the Federal Reserve's wire transfer system. An inability to transfer funds because of Year 2000 failures could cause us and our customers serious financial harm.

Aetna also has substantial investments in real estate. Building systems and utility company failures could subject Aetna to business interruption claims diminishing the value of our holdings.

Regulatory Risks - Many of Aetna's products are regulated at a state and/or federal level. It would be extremely difficult in the face of internal and external Year 2000 failures for any length of time to meet the stringent reporting and transactional information requirements required of our products. For example, most of our retirement services product customers contribute to their accounts monthly and we are required to process their contributions promptly. Similarly, SEC regulations require us to send our customers account statements and confirmations under stringent time deadlines. Year 2000 failures would jeopardize our ability to meet these regulatory requirements.

Adequacy of Remediation and Risk Management Efforts Being Undertaken by Aetna

Program Management - Aetna has been working on a company-wide solution to the Year 2000 issue since early 1996 and is actively implementing a plan for a transition to the next millennium with little or no disruption to our customers or other trading partners. We are well along in identifying and implementing the critical changes necessary for Year 2000 compliance across all areas of the company's operations and are confident we will have systems and business funnctionality into and beyond the Year 2000.

The Year 2000 Program Office provides management oversight to the technical process of repairing and testing code to make Aetna's systems Year 2000 compliant. We use a risk management and reporting tool for assessment of progress against our Year 2000 plan. This tool was developed by a nationally known consulting firm with a specialized practice in the Year 2000. Progress reports from this tool are regularly reviewed by senior management. The reach of the Year 2000 Program Office is further extended by including people from all of our business lines, domestic and international, to address issues and establish priorities for the Year 2000 project.

Methodology - In a company as large as Aetna, there are thousands of computer systems, running millions of lines of code. To keep systems in operation through the Year 2000 and beyond, all this code must be reviewed and assessed to identify the need for remediation, the appropriate code must be modified, and then the modifications must be tested and implemented in order of business priority. The methodology we are using to prepare our systems to operate in the Year 2000 is as follows:

• Assessment - Planning and scoping prior to implementing changes
  
  
• Modification - Performing coding changes and unit testing to make inventory items Year 2000 ready
  
  
• Testing - Testing the code modifications with other associated systems
  
  
• Implementation - Migrating code to the production environment and running it there
  
  
• Year 2000 Readiness - Successful operation in a millennium compliant environment.

Millennium Test Environment - Aetna's millennium test environment is used for readiness testing after initial testing is completed in our quality assurance environment. The system date in the millennium test environment is changed several times to make sure both software and hardware work with a particular application. The fact that the Year 2000 is a leap year also is accounted for in our millennium date testing. A dedicated testing staff is in place to manage this stand-alone millennium test environment for Year 2000 readiness.

Code Remediation Services - Since sufficient programming resources are essential to a successful outcome, we have augmented our staff with Year 2000 code remediation services of four widely known technology firms. As these companies are in great demand, we have assessed our needs and have each firm under contract. We are orchestrating the remediation effort company-wide and that includes helping our businesses deal with their internal and external technology exposure.

External Relationships - Year 2000 is much more than an internal systems issue. It impacts our facilities as well as those of critical third parties (e.g., providers, hospitals, pharmacies, banks, printers, telephone and mail services) with whom we interact in the conduct of our business. No business can address its Year 2000 issues in a vacuum. Aetna has hundreds of business partners on which it depends to varying degrees to conduct its business. We have to be certain that these critical external interfaces are taking this issue as seriously as we are and that they have appropriate action plans in place to address their Year 2000 experience. We will monitor closely the progress of our critical external relationships towards Year 2000 compliance. Accordingly, we have developed a model for assessing our external relationships. The model determines the degree of dependence we have with each of our business partners and assigns a level of criticality to each. A Year 2000 action plan is then established for critical relationships that is monitored on an ongoing basis.

Progress to Date - Aetna's Year 2000 progress has been significant.

• The Year 2000 Program Office has been established, staffed and is in full operation.
  
  
• We have created and are using a risk management and reporting tool for rigorous project management.
  
  
• Our technical infrastructure (i.e., mainframe, mid-range, and client-server computers plus telecommunications networks) has been undergoing renewal since early 1996 and is approaching Year 2000 readiness.
  
  
• All of our business and technical applications are being assessed and prioritized and we are proceeding with code remediation and testing.
  
  
• We have established a "millennium box," a separate mainframe on which all code that has been remediated and tested must undergo final testing prior to Year 2000 Approval.
  
  
• We have developed an evaluation model for external relationships, including real estate. We are in the process of inventorying and prioritizing our external relationships and are devising action plans for critical relationships which monitor the adequacy of their own internal Year 2000 plans and progress.
  
  
• Progress reporting to senior management is ongoing.
  
  
• An Intranet website keeps project team members and other employees informed and aware of Year 2000 tasks and progress.

Contingency Plans - Aetna is developing a wide range of contingency plans which cover all operational areas. As part of our contingency planning, we have reviewed all of our operations, and are assessing our risks and prioritizing our needs. In addition, we are taking appropriate steps to identify potential problems that may exist with the readiness of our most important business partners and to monitor their progress in resolving them.

Financial Impact - Management is committed to providing whatever resources are necessary to

make certain Aetna's systems and operations are uninterrupted due to system malfimction or inability of critical vendors to perform as contracted. Our Form 10-K will be available next month and will provide additional detail on Aetna's Year 2000 cost estimates.

Aetna's Commitment - Aetna is committed to addressing our Year 2000 issues and risks in a prudent, comprehensive and time-sensitive fashion and will dedicate the resources necessary to achieve success in resolving those Year 2000 issues which impact our ability to serve our customers.

Home | Menu | Links | Info | Chairman's Page