Our objective was to evaluate FRS’ efforts to date to ensure that the institutions it oversees have adequately mitigated the risks associated with the Year 2000 date change. We compared these efforts to criteria detailed in our Year 2000 Assessment Guide. This guide advocates a structured approach to planning and managing an effective Year 2000 program through five phases: (1) raising awareness of the problem, (2) assessing the extent and severity of the problem, and identifying and prioritizing remediation efforts, (3) renovating or correcting systems, (4) validating, or testing, corrections, and (5) implementing corrected systems. The guide also identifies other facets involved in solving the Year 2000 problem, such as identifying interfaces with outside organizations; specifying how data will be exchanged in the Year 2000 and beyond; remediating, validating, and implementing the interfaces; and developing contingency plans to ensure that core business functions can continue to be performed even if systems have not been made Year 2000 compliant. The Office of Management and Budget (OMB) established a schedule for completing each of the five phases, including requiring agencies to complete the assessment phase in the summer of 1997 and the renovation phase by mid-to late 1998. We also compared FRS’ efforts against Year 2000 guidance and procedures set forth by the Federal Financial Institutions Examination Council (FFIEC). FRS and the federal bank, credit union, and thrift institution regulators have been coordinating their efforts through FFIEC to ensure consistent and uniform supervision on Year 2000 issues. In addition, we reviewed correspondence FRS sent to its examiners and to the institutions it supervises. In conjunction with the Federal Reserve’s Office of Inspector General (IG), we interviewed examiners and reviewed examination work papers at the Federal Reserve Banks of New York, Atlanta, Kansas City, Chicago, Cleveland, and San Francisco. In addition, we obtained and reviewed the IG’s March 31, 1998, and July 1, 1998, reports on its interim assessment of FRS’ progress on Year 2000 activities. We also interviewed Federal Reserve Board officials in Washington, D.C., responsible for developing and overseeing the implementation of FRS’ Year 2000 supervision program, policies, and procedures. Our audit work was performed between December 1997 and July 1998 in accordance with generally accepted government auditing standards. On August 4, 1998, we provided the Chairman of the Board of Governors of the Federal Reserve System with a draft of this report for review and comment. On August 7, 1998, and August 26, 1998, we met with the Federal Reserve Board Assistant Director who is the Year 2000 Program Officer to discuss the Board’s comments, which are discussed in the “Agency Comments” section of this report. Established by the Federal Reserve Act of 1913, FRS is responsible for conducting monetary policy, maintaining the stability of financial markets, providing services to financial institutions and government agencies, and supervising and regulating banks and bank-holding companies. FRS is headed by a seven-member Board of Governors and is comprised of 12 federally chartered corporations, located throughout the United States, which are known as federal reserve banks. FRS is responsible for overseeing the Year 2000 activities of 1,618 institutions, including 990 state member banks, 349 bank holding companies, 221 foreign bank offices, and 9 Edge Act corporations. According to FRS, these organizations held assets totaling over $7.7 trillion and deposits of about $3.6 trillion as of June 30, 1998. FRS also oversees 49 service providers and software vendors. As part of its goal of maintaining the safety and soundness of financial institutions, FRS is responsible for examining and monitoring these institutions’ efforts to address the Year 2000 problem. Addressing the Year 2000 problem in time will be a tremendous challenge for financial institutions and FRS. Nearly all of FRS-regulated financial institutions rely on computers—either their own or those of a third-party contractor—to process and update records and for a variety of other functions. To complicate matters, most institutions have computer systems that interface with systems belonging to payment system partners, such as wire transfer systems, automated clearinghouses, check clearing providers, credit card merchant and issuing systems, automated teller machine networks, electronic data interchange systems, and electronic benefits transfer systems. Because of these interdependencies, bank systems are also vulnerable to failure caused by incorrectly formatted data provided by other systems that are not Year 2000 compliant. Financial institutions and their regulators cannot afford to neglect any of these issues. If they do, the impact of Year 2000 failures could be potentially disruptive to vital bank operations and harmful to customers, as the following examples illustrate. Loan systems could make errors in calculating interest and amortization schedules. In turn, these miscalculations may expose institutions and data centers to financial liability and loss of customer confidence. Automated teller machines may malfunction, performing erroneous transactions or refusing to process transactions. Telephone systems, vaults, and security and alarm systems could malfunction. FRS has taken important steps to alert financial institutions to the risks associated with the Year 2000 problem and to assess what these institutions are doing to mitigate the risks. In June 1996, FRS began its Year 2000 efforts by issuing, with the other FFIEC members, an awareness letter to financial institutions pointing out the potential dangers of the Year 2000 problem. The letter described the Year 2000 problem and highlighted concerns about the industry’s Year 2000 readiness. It also called on institutions to perform a risk assessment of how their systems are affected by the Year 2000 problem and develop a detailed action plan, delineating how to fix their systems. In February 1997, FRS began devoting a full-time effort to the Year 2000 problem, and in May 1997, issued a second, more detailed awareness letter in conjunction with the other FFIEC members. This letter described the five-phase approach to planning and managing an effective Year 2000 program and highlighted external issues—reliance on vendors, risks posed by exchanging data with external parties, and the potential effect of Year 2000 noncompliance on corporate borrowers—requiring management attention. The letter also addressed FFIEC’s plans to facilitate Year 2000 evaluations by using uniform examination guidance and procedures. Additionally, it (1) directed banks to inventory core computer functions and set priorities for Year 2000 goals by September 30, 1997, and (2) strongly encouraged that programming changes be completed and testing of mission-critical systems be well underway by December 31, 1998. After making its financial institutions aware of the Year 2000 problem, FRS began assessing whether these institutions were taking appropriate Year 2000 mitigation steps. This assessment—which consisted of administering FFIEC’s high-level Year 2000 questionnaire via telephone or on-site visit to about 1,000 organizations—covered all large banks in the U.S., both domestic and foreign, a sample of smaller organizations, and some third party providers of data processing services used by banks, including software vendors. FRS completed this initial assessment in mid-1997 and determined that about 40 percent of the organizations contacted had yet to complete awareness phase activities, although most had initiated some assessment phase work. Following this initial assessment, FRS undertook more detailed Year 2000 examinations at the 1,618 institutions. These examinations were completed in June 1998. To its credit, FRS made the FFIEC Year 2000 examination procedures more specific to alleviate shortcomings reported in our previous testimonies. These shortcomings included using vague terms (such as well into, largely, and well underway) to describe Year 2000 progress and not collecting all the data needed to determine where banks are in the Year 2000 correction process. According to FRS, the results of its on-site Year 2000 examinations show that, as of June 30, 1998, 96 percent of the 1,618 institutions examined are performing satisfactorily. This does not mean that these institutions are Year 2000 ready, but rather that they are proceeding on schedule in accordance with the five-phase Year 2000 approach described in FFIEC’s May 5, 1997, guidance. FRS also reported that 4 percent of the institutions examined needed to improve their Year 2000 programs, while less than 1 percent was performing unsatisfactorily. Banks needing improvement were generally behind schedule, not fully aware of the status of Year 2000 efforts, and insufficiently committed to the effort. Banks performing unsatisfactorily were seriously behind schedule, did not understand or recognize the impact of the Year 2000 problem, and were only minimally committed to the effort. FRS is taking actions to deal with institutions in these latter two categories. For example, as of June 30, 1998, FRS had issued notification letters to these institutions requiring that they take formal corrective actions to address Year 2000 deficiencies. FRS is also requiring these institutions to report monthly on how they are progressing in correcting identified deficiencies. FRS and the other FFIEC members are planning to conduct another round of examinations, which will end on March 31, 1999. To accomplish this, they recently developed detailed examination procedures that focus primarily on an institution’s plans and processes for achieving Year 2000 readiness, with particular emphasis placed on the final phases of the Year 2000 project—testing and implementation—and on the institution’s contingency plans. On June 23, 1998, FRS also issued guidance directing each reserve bank to develop a plan—referred to as a Year 2000 Supervisory Review Plan—by July 15, 1998, to ensure that these follow-on examinations are completed on time. In addition to assessing the status of financial institution Year 2000 readiness, FRS has issued guidance to assist in other critical Year 2000 tasks. For example, in May 1998, FRS issued guidance in conjunction with FFIEC on contingency planning. This guidance was modeled on our business continuity and contingency planning guide, which provides a conceptual framework for helping large agencies manage the risk of potential Year 2000-induced disruptions to their operations.