00-4763. Food Stamp Program: Electronic Benefits Transfer (EBT) Systems-Statement on Auditing Standards No. 70 (SAS No. 70) Examination Requirements

AGENCY:

Food and Nutrition Service, USDA.

ACTION:

Final rule.

SUMMARY:

The purpose of this final rule is to require an annual examination of the transaction processing of organizations that provide Electronic Benefits Transfer (EBT) systems or services for the Food Stamp Program. The examinations are to provide an independent assessment of the controls in place and the effectiveness of such controls over EBT transaction processing. State agencies will have to obtain the examinations, retain the examination reports, and provide examination reports to the Food and Nutrition Service upon request.

EFFECTIVE DATES:

The amendments in this rule are effective March 30, 2000.

FOR FURTHER INFORMATION CONTACT:

Questions regarding this final rule should be addressed to Jeffrey N. Cohen, Chief, Electronic Benefit Transfer Branch, Benefit Redemption Division, Food and Nutrition Service, USDA, 3101 Park Center Drive, Alexandria, Virginia 22302, or by telephone at [phone].

SUPPLEMENTARY INFORMATION:

Executive Order 12866

This rule has been determined to be not significant for purposes of Executive Order 12866.

Executive Order 12372

The Food Stamp Program (FSP) is listed in the Catalog of Federal Domestic Assistance under No. 10.551. For the reasons set forth in the final rule in 7 CFR 3015, Subpart V and related Notice (48 FR 29115), this program is excluded from the scope of Executive Order 12372 which requires intergovernmental consultation with State and local officials.

Regulatory Flexibility Act

This final rule has been reviewed with regard to the requirements of the Regulatory Flexibility Act of 1980 (5 U.S.C. 601-612). Samuel Chambers, Jr., the Administrator of the Food and Nutrition Service, has certified that this final rule will not have a significant economic impact on a substantial number of small entities. State agencies and their EBT service providers will be the most affected to the extent that they administer or operate EBT services for FSP benefit delivery.

Paperwork Reduction Act

On February 23, 1999, when this rule was proposed (64 FR 8733), FNS inadvertently stated that the Office of Management and Budget (OMB) control number 0584-0083 already covered the information collection burden which would result from the proposed requirements. On October 12, 1999, a notice was published in the Federal Register (64 FR 55225) to correct this error and inform the public of the new burden being added. A new OMB control number 0584-0500 has been assigned to this regulation and has an expiration date of February 28, 2003.

Executive Order 12988

This rule has been reviewed under Executive Order 12988, Civil Justice Reform. This rule is intended to have preemptive effect with respect to any State or local laws, regulations or policies which conflict with its provisions or which would otherwise impede its full implementation. This rule is not intended to have retroactive effect unless so specified in the “Dates” paragraph of this preamble. Prior to any judicial challenge to the provisions of this rule or the application of its provisions, all applicable administrative procedures must be exhausted. In the FSP, the administrative procedures are as follows: (1) For Program benefit recipients—State administrative procedures issued pursuant to 7 U.S.C. 2020(e)(1) and 7 CFR 273.15; (2) for State agencies—administrative procedures issued pursuant to 7 USC 2023 set out at 7 CFR 276.7 for rules related to non-quality control (QC) liabilities or 7 CFR Part 283 for rules related to QC liabilities; (3) for Program retailers and wholesalers—administrative procedures issued pursuant to 7 U.S.C. 2023 set out at 7 CFR 278.8.

Unfunded Mandate Reform Act of 1996

Title II of the Unfunded Mandates Reform Act of 1995 (UMRA), Pub. L. 104-4, establishes requirements for Federal agencies to assess the effects of their regulatory actions on State, local, and tribal governments and the private sector. Under section 202 of the UMRA, the Food and Nutrition Service (FNS) generally must prepare a written statement, including a cost-benefit analysis, for proposed and final rules with Federal mandates that may result in expenditures to State, local or tribal governments, in the aggregate, or to the private sector, of $100 million or more in any one year. When such a statement is needed for a rule, Section 205 of the UMRA generally requires the Food and Nutrition Service to identify and consider a reasonable number of regulatory alternatives and adopt the least costly, more cost-effective or least burdensome alternative that achieves the objectives of the rule.

This rule contains no Federal mandates (under the regulatory provisions of Title II of UMRA) for State, local and tribal governments or the private sector of $100 million or more in any one year. Thus this rule is not subject to the requirements of sections 202 and 205 of the UMRA.

Background

All States must change from paper coupon systems to EBT systems for the issuance of FSP benefits by October 1, 2002. Currently, forty-one States have implemented EBT systems and most others are in some stage of planning. The total amount of FSP benefit funds issued to recipients each month is about $1.27 billion. The amount being moved through EBT systems is about $889,000,000 or 70 per cent of the total.

For the FSP, EBT systems move money from Federal accounts held in the name of each State to accounts at banks and other financial institutions held by or for food retailers. Food retailers must first be authorized to accept FSP benefits by the FNS and then must be equipped to accept benefits via EBT. States determine the eligibility and the monthly FSP allotments for recipients. States give each recipient household a plastic EBT card and a Personal Identification Number (PIN). Recipients use the cards in authorized food stores for food purchases and may use them at Automated Teller Machines (ATMs) if the recipient is eligible for a cash program.

EBT systems operate like debit card systems with immediate decrements to a household account number. Household accounts have associated cards and PINs which are used for food purchases. The amount of the purchase is credited to the food retailer's account and funds are settled each bank working day through the Automated Clearinghouse (ACH) process.

States contract individually for EBT systems with EBT service providers. Usually States contract for EBT systems that deliver the benefits of several cash programs, such as Temporary Assistance for Needy Families (TANF) and State cash benefit programs, in addition to food stamp benefits. One State also uses EBT for the delivery of benefits of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC). Among State-administered benefit programs, only the FSP requires that States change from paper to EBT systems and only the FSP has regulations about EBT.

Data from EBT systems are reported to State and Federal financial and reporting systems and are used in financial statements of many agencies. In particular, State EBT systems report data on about 70 per cent of food stamp benefit funds to FNS financial systems which in turn provide data used in annual FNS financial statements.

On February 23, 1999, the Department proposed, and this final rule now requires, at least annual examinations of the transaction processing of EBT service providers by independent auditors. The examinations must follow the American Institute of Certified Public Accountants (AICPA) Statement on Auditing Standards No. 70, Service Organizations (SAS No. 70). Specific EBT guidance for the examinations is provided in the OMB Circular A-133 Compliance Supplement. The objective of these examinations is to determine whether there are controls in place and operating effectively over the security and accuracy of EBT transaction processing. These are typically referred to as “type 2” examinations. These examinations will provide an independent assessment of the controls over transaction processing by EBT service providers.

Proposed Rule Comments

The Department asked for public comment in a proposed rule on February 23, 1999. Eleven comments were received. Eight were from State agencies or counties, including two EBT managers and three State auditors. Four of the States represented by those commentors do not currently operate EBT systems. Two Federal agencies and one EBT service provider also made comments.

The major concern was cost. FSP EBT cost neutrality regulations require States to compare EBT system costs to coupon system costs. States will not receive more in Federal reimbursement from the FSP for the costs of their EBT systems than they would have received for the coupon systems EBT replaced. State legislatures also want EBT costs to remain the same or become lower than paper costs. Several commentors stated that the benefits of the SAS No. 70 examinations were for the FSP and the USDA Office of the Inspector General (OIG) and that all costs should be paid by FNS. Some noted that there were no such examinations in the coupon world and fewer reviews of coupon issuance systems. Some wanted FNS or OIG to hire the auditors or complete the audits themselves and to handle the resolution of findings. One pointed out that until EBT, FNS managed and paid for all work related to coupon redemption and financial settlement to retailers and now these duties and costs were forced onto States entirely. The EBT service provider asked that we make clear that additional costs caused by the examinations are State responsibilities.

State arguments on the issue of cost neutrality are persuasive. The driving force behind this rule is to ensure the accuracy and dependability EBT financial information. State auditors are also concerned with the impact of EBT data on State financial statements. SAS No. 70 examination costs are not operational or start-up costs as described in 7 CFR 274.12(c)(5) and may be excluded from cost neutrality calculations, because they are not costs inherent in the development or operation of the EBT system itself. Although SAS NO.70 examination costs will not be included in cost neutrality calculations, they remain State administrative costs which should be reported through the usual process and will be reimbursed at the usual FSP Federal Financial Participation rate. When examination costs are shared among programs, they must be allocated and charged as appropriate.

Several commentors noted that, since there are few EBT service providers, the most efficient and inexpensive way to arrange examinations and resolve findings would be for FNS or OIG to handle them directly. This would be a change in the approach to EBT as a State responsibility. However, the idea merits consideration and FNS intends to explore this approach. However, unless or until such a change is made, States must comply with these requirements.

Several State commentors believe the regulation is ill-advised because it will drive up costs, keep down competition for the business, or because States already obtain SAS No.70 reports without such a requirement. Although we are sympathetic on each issue, this regulation is necessary. As mentioned elsewhere, both State and Federal financial systems and statements are fed by EBT system data. In addition, not all States receive SAS No. 70 reports and not all EBT transaction processing providers undergo such examinations.

There were several technical comments about the period to be examined, when the report must be available, subcontractors, single examinations of the service provider, and platforms or control environments. The intention is that the SAS No. 70 examinations be at least annual with the examination period end date to be determined by the EBT service provider after considering the needs of user auditors of the States covered by the examinations. Once started, subsequent examinations must cover the entire period since the previous examination. If the EBT service provider obtains audits every six months, that is acceptable also. If the provider serves several States on the same platform with the same control environment, then one examination may be done covering all States and a list of all States sharing the control environment must be included in the examination report. The report must be completed ninety days after the examination period ends. Once reports are completed, the Food and Nutrition Service (FNS), USDA Office of the Inspector General (OIG), or the General Accounting Office (GAO) may wish to obtain a copy of the report. If a written request for the report is made to a State, it must be answered with a copy of the report within thirty days of the written request. FNS or others may find it necessary to have access to an auditor's work papers also. A written request for access to work papers must also be responded to within thirty days and by initiating or completing appropriate arrangements for access. Typically, work papers remain under the control of the auditor and arrangements for access will need to be coordinated among the parties involved.

Some commentors noted that the language of the rule should reflect the technical language used in SAS No.70 and commonly used by auditors. We agree, therefore, terms such as examination, control environment, type 2 examinations, and platform have been used in this preamble and the regulation amendment.

Many commentors agreed that it is efficient and desirable to have a single examination of each service provider that would cover all the States for whom the service is provided. The service provider commentor asked that this become an explicit requirement. Since some States may differ in their own needs or requirements, we are not requiring this. However, we very strongly recommend that States coordinate and cooperate to obtain one examination (with appropriately allocated costs) as long as each State has the same control environment. All service providers are expected to want this less costly and disruptive arrangement.

Some commentors asked which subcontractors were subject to examination. States make varied arrangements for EBT services. Many States contract with a single provider for all EBT services. That EBT primary contractor may provide all the services or may hire subcontractors to provide some or all of the services which together constitute an EBT system. The intention is to ensure controls exist for secure, accurate, and complete transaction processing of FSP accounts for recipient use in authorized stores subsequently paid with Federal funds. Therefore, the contractor or subcontractor that maintains the account information, authorizes debits and credits on the accounts, and provides the basic data for settlement among the parties is subject to SAS No. 70 examinations. Subcontractors providing other services, such as EBT Help Desk services, Point of Sale installation, or plastic cards are not subject.

Another complication is that States sometimes do EBT work themselves. For example, one State is producing and distributing EBT cards and another is considering doing transaction processing. Only the work of contractors is covered by this rule and the SAS No. 70 examinations requirements. State work is exempt from this proposed SAS No. 70 examination requirement but subject to requirements already existing in OMB Circular A-133.

Other Issues

Statement on Auditing Standards No. 70

The proposed regulations referred to AICPA SAS No. 70, Reports on the Processing of Transactions by Service Organizations. Since the proposed regulation was published, the title of SAS No. 70 was changed to Service Organizations. The intention is to refer to this standard regardless of numerical or name changes or revisions. The kind of report required is now commonly referred to by auditors as a SAS No. 70, type 2 report or a type 2 service auditor's report. The intention is to obtain that kind of report regardless of future name changes.

EBT Review Guidelines

The proposed rule referred to the Review Guidelines for Service Organizations Providing EBT Services for Government Programs (guidelines). The guidelines were endorsed by the National State Auditors Association on March 9, 1999 and available as interim guidelines for SAS No. 70 audits. These guidelines are now replaced by this rule which requires a SAS No. 70 examination to determine whether there are controls in place and operating effectively over the security and accuracy of EBT transaction processing. As mentioned above, these examinations are referred to as type 2 examinations. The OMB Circular A-133 Compliance Supplement will be revised to include guidance to assist service providers and their auditors in meeting this requirement.

Additional Audits or Reviews

USDA's OIG and FNS have always reserved the right to conduct other audits or reviews of EBT if they find they are needed. This is not a change but has always existed as stated in 7 U.S.C. 2020, 7 CFR 277.17(a) and is generally reflected in EBT Requests for Proposal or in State EBT contracts. This right is being specified here to avoid doubt or confusion on the issue.

Implementation

This rule will be effective 30 days from the date of publication in the Federal Register. States must ensure that the initial period examined includes the date this rule becomes effective.

List of Subjects

7 CFR Part 272

• Alaska
• Civil Rights
• Food Stamps
• Grant Programs—social programs,

7 CFR Part 274

• Administrative procedures and practices
• Food Stamps
• Grant programs—social programs
• Reporting and recordkeeping requirements

Accordingly, for the reasons set forth in the preamble, 7 CFR Parts 272 and 274 shall be amended as follows:

1. The authority citation for 7 CFR Parts 272 and 274 continues to read as follows:

Authority: 7 U.S.C. 2011-2036.

PART 272—REQUIREMENTS FOR PARTICIPATING STATE AGENCIES

2. In § 272.1, paragraph (g)(158)is added to read as follows:

§ 272.1

General Terms and Conditions.

* * * * *

(g) Implementation. * * *

(158) Amendment No. 382. The provisions of Amendment No.379 are effective and must be implemented March 30, 2000.

PART 274—ISSUANCE AND USE OF COUPONS

3. In § 274.12:

a. Revise the heading of paragraph (j); and

b. Add new paragraph (j)(5).

The revision and addition read as follows:

§ 274.12

Electronic Benefit Transfer Issuance System approval standards.

* * * * *

(j) Reconciliation, Management Reporting, Examinations and Audits. * * *

(5) Examinations and Audits.

(i) The state agency must obtain an examination by an independent auditor of the transaction processing of the State EBT service provider regarding the issuance, redemption, and settlement of Food Stamp Program benefits. The examination must be done at least annually and the report must be completed ninety days after the examination period ends. Subsequent examinations must cover the entire period since the previous examination. Examinations must follow the American Institute of Certified Public Accountants (AICPA) Statement on Auditing Standards No. 70, Service Organizations (SAS No. 70), requirements for reports on controls placed in operation and tests of the operating effectiveness of the controls.

(ii) The examination report must include a list of all States whose systems operate under the same control environment. Auditors conducting the examination must follow EBT guidance contained in the Office of Management and Budget (OMB) Circular A-133 Compliance Supplement to the extent the guidelines refer to FSP benefits. (For availability of OMB Circulars referenced in this section, see 5 CFR 1310.3.)

(iii) The State agency must retain a copy of the SAS No.70 examination report.

(iv) The State agency shall respond to written requests from the Food and Nutrition Service (FNS), USDA Office of the Inspector General (OIG), or the General Accounting Office (GAO) for completed SAS No.70 examination reports by providing the report within thirty days of receipt of the written request.

(v) The State agency shall respond to written requests from FNS, OIG, or GAO to view auditor's workpapers from SAS No. 70 reports by arranging to have workpapers made available within thirty days of receipt of the written request.

(vi) FNS and the USDA OIG shall rely on SAS No. 70 reports on EBT transaction processing services provided by contractors to the State. FNS and USDA OIG reserve the right to conduct other reviews or audits if necessary.

(vii) EBT services provided directly by the State are not subject to SAS No. 70 examination requirements of this section but remain subject to the single audit requirements at 7 CFR 277.7 and the Office of Management and Budget Circular A-133.

* * * * *

Dated: February 17, 2000.

Samuel Chambers, Jr.,

Administrator, Food and Nutrition Service.