The Federal Reserve, as the United States’ central bank, has primary responsibility for maintaining the nation’s cash supply. In carrying out this responsibility, Federal Reserve Banks perform various cash-related functions to meet the needs of the depository institutions served by the Federal Reserve Banks. At the 37 Federal Reserve Banks and Branches which make up the Federal Reserve System, the cash operations function is responsible for shipping cash to meet the needs of depository institutions, receiving shipments of new currency from the Bureau of Engraving and Printing, new coin from the U.S. Mint, and incoming deposits of excess and unfit currency and coin from depository institutions. In addition to maintaining custodial controls over the cash in its possession, each Federal Reserve Bank and Branch processes currency received from circulation and records and summarizes the various accounting transactions associated with these activities. While the 37 Federal Reserve Banks and Branches perform the same cash-related functions, they may use different systems and processes to manage and account for the cash under their control. The Federal Reserve Banks and Branches in three of the System’s 12 districts—Atlanta, Philadelphia, and San Francisco—use the Cash Automation System (CAS) to manage and account for cash under their control. CAS is an electronic inventory system which, among other features, tracks coin and currency activities and balances by denomination and identifies bank operating units with custodial responsibility for cash. Certain data maintained in CAS are used to provide daily updates to the bank’s general ledger system. CAS data are also used by bank officials to prepare monthly currency activity reports. These reports, which track each Federal Reserve Bank’s monthly currency activities and end-of-month vault balance, are used by the Federal Reserve Board to monitor currency activities across the Federal Reserve System. In September 1996, we reported on the results of a review of currency activity reports prepared by the Los Angeles Branch. The review responded to concerns about reported inaccuracies in certain of the bank’s monthly currency activity reports. The review’s objectives were to determine the nature of currency reporting inaccuracies and review actions intended to resolve them. Our review found that certain data needed for the October through December 1995 currency activity reports were forced to ensure that the reports agreed with the Los Angeles Branch’s end-of-month balance sheet. As a result, analysis by a bank analyst showed that receipts from circulation were understated by $5.8 million in October, overstated by $61.8 million in November and understated by $111 million in December. Our review noted problems with the reporting of currency activities which raised concern about the quality of the Los Angeles Reserve Branch’s internal control environment and potential CAS system limitations which could affect currency accounting and reporting. In response to the review’s findings and recommendations, the Federal Reserve Board took a number of immediate actions specific to the Los Angeles Branch including (1) revising policies and procedures for preparing the monthly currency activity report, (2) conducting an unannounced 100-percent count of the Los Angeles Branch’s currency and coin holdings and comparing the results to the bank’s balance sheet, and (3) conducting an internal review of the bank’s cash operations and related financial records. The Federal Reserve Board reported that (1) the results of the physical count confirmed that the Los Angeles Branch’s balance sheet accurately reflected its currency and coin holdings and (2) its examiners found that the accounting for the cash handled by the bank was accurate and that proper safeguards and controls existed to ensure the integrity of the bank’s financial records. In addition to actions addressing the Los Angeles Branch’s currency reporting and controls, the Federal Reserve Board arranged for an external examination of internal control over cash operations at certain banks that use CAS to manage and account for cash operations—the subject of this report. Our September 1996 report recommended that, given the problems in preparing the currency activity report using CAS data in Los Angeles, the Federal Reserve Board require an external review of internal controls. In response to our recommendation, the Federal Reserve Board hired Coopers & Lybrand L.L.P., an independent public accounting firm, to examine and report on managements’ assertions about the effectiveness of the internal control structure over financial reporting and safeguardingfor cash at three banks—the Federal Reserve Bank of Atlanta’s Home Office, the Federal Reserve Bank of San Francisco’s Los Angeles Branch, and the Federal Reserve Bank of Philadelphia. These banks represent 3 of the 12 cash operations located in the Reserve System which use CAS to provide inventory and management control and accounting for cash-related activities. Table 1 provides 1996 currency data on the relative size and volume of currency processing activities at the 3 locations covered by Coopers & Lybrand’s external examinations, the 12 which use CAS, and the entire 37 banks and branches. The objective of Coopers & Lybrand’s examinations was to opine on whether managements’ assertions on the effectiveness of internal controls were fairly stated based on the internal control criteria used by management. In performing its examinations and concluding on the reliability of managements’ assertions, Coopers & Lybrand performed an attest engagement which is governed by the AICPA’s Attestation Standards. The attestation standards provide both general and specific guidance which is intended to enhance the consistency and quality of these engagements. The attestation standards consist of general, fieldwork, and reporting standards which apply to all attestation engagements and individual standards which apply to specific types of attestation engagements. The attestation standards supplement existing auditing standards by reenforcing the need for technical competence, independence in attitude, due professional care, adequate planning and supervision, sufficient evidence, and appropriate reporting. In addition to the general, fieldwork, and reporting attestation standards, Coopers & Lybrand’s examination at the three Reserve Banks was also subject to requirements of a specific attestation standard—Statement on Standards for Attestation Engagements No. 2, Reporting on an Entity’s Internal Control Structure Over Financial Reporting. This standard provides guidance on planning, conducting, and reporting on the engagement, including evaluating the design and operating effectiveness of internal controls. A key provision of the standard is that management use reasonable control criteria which have been established by a recognized body in evaluating the internal control structure’s effectiveness. This requirement ensures that management uses commonly understood and/or accepted control criteria in concluding on the internal control structure’s effectiveness and that the practitioner uses the same criteria in forming an opinion on management’s assertion. Management for each of the Federal Reserve Banks covered by Coopers & Lybrand’s examinations based their assessments of internal control effectiveness on criteria contained in the Internal Control-Integrated Framework issued in September 1992 by the Committee on Sponsoring Organizations of the Treadway Commission (COSO). To develop a broad understanding of internal control and establish standards for assessing its effectiveness, COSO developed a structured approach—the Integrated Framework—which defines internal control and describes how it relates to an entity’s operations. Internal control represents the process, designed and operated by an entity’s management and personnel, to provide reasonable assurance that fundamental organizational objectives are achieved. The Integrated Framework describes internal control in terms of objectives, essential components of internal control, and criteria for assessing internal control effectiveness. Internal control objectives—what internal controls are intended to achieve—fall into three distinct but overlapping categories: operations—relating to effective and efficient use of an entity’s resources; financial reporting—relating to preparing reliable financial statements; and compliance—relating to an entity’s compliance with laws and regulations. Safeguarding controls are a subcategory within each of these control objectives. Safeguarding controls—those designed to prevent or promptly detect unauthorized acquisition, use, or disposition of an entity’s resources—are primarily operations controls. However, certain aspects of safeguarding controls can also be considered compliance and financial reporting controls. When legal or regulatory requirements apply to use of resources, operations controls designed to safeguard the efficient and effective use of resources also address compliance objectives. Similarly, objectives designed to ensure that losses associated with the use or disposition of resources are properly recognized and reflected in the entity’s financial statements also address financial reporting objectives. In May 1994, COSO issued an addendum to its Integrated Framework to provide specific reporting guidance on controls concerning safeguarding of assets. COSO stated that there is a reasonable expectation that a management report will cover not only controls to help ensure that transactions involving an entity’s assets are properly reflected in the financial statements, but also controls to help prevent or promptly detect unauthorized acquisition, use, or disposition of the underlying assets. COSO believes it is important that this expectation be met. The addendum provided suggested wording for management’s report on internal control over financial reporting to also specifically state safeguarding of assets when covered by management’s report. Internal control, as described in the Integrated Framework, consists of five essential and interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring. The control environment represents the control consciousness of an entity, its management, and staff. Risk assessment refers to the awareness and management of relevant internal and external risk associated with achieving established objectives. Control activities represent the operating policies and procedures designed to help ensure that management’s directives—desired actions intended to address risks—are carried out. Information and communication refers to the need for relevant and useful information to be communicated promptly to management and staff for use in carrying out their responsibilities. The monitoring component refers to the need to monitor and assess over time the effectiveness of internal control policies and procedures in achieving their intended objectives. The nature and extent to which an entity’s internal control structure incorporates the five control components represent criteria that can be used in assessing the internal control effectiveness of operating, financial reporting, and compliance controls. Management can assess and report on the effectiveness of any of the three categories of control objectives.