2010-12883. Revisions to the Requirements for Authority To Manufacture and Distribute Postage Evidencing Systems

AGENCY:

Postal Service^TM.

ACTION:

Proposed rule.

SUMMARY:

In this proposed rule, the Postal Service proposes to amend regulations on Authorization to Manufacture and Distribute Postage Evidencing Systems. This proposed revision clarifies the requirement for examination by an independent audit firm of a Postage Evidencing System Provider's Computerized Meter Resetting System (CMRS) or PC Postage® system internal controls.

DATES:

Submit comments on or before July 1, 2010.

ADDRESSES:

Mail or deliver written comments to the Manager, Postage Technology Management, U.S. Postal Service, 475 L'Enfant Plaza SW., Suite 4200 NB, Washington, DC 20260-4200. Copies of all written comments will be available for inspection and photocopying between 9 a.m. and 4 p.m., Monday through Friday, at the Postage Technology Management office.

FOR FURTHER INFORMATION CONTACT:

Marlo Kay Ivey, Marketing Specialist, Postage Technology Management, U.S. Postal Service, at 202-268-7613.

SUPPLEMENTARY INFORMATION:

Postage Evidencing Systems are devices or systems of components that a customer uses to print evidence that the prepaid postage required for mailing has been paid. They include, but are not limited to, postage meters and PC Postage systems. The Postal Service regulates these systems and their use in order to protect postal revenue. Only Postal Service-authorized product service providers may design, produce, and distribute Postage Evidencing Systems. This proposed revision clarifies the internal controls required in 39 CFR 501.15(i), Computerized Meter Resetting system, and 501.16(f), PC Postage Payment Methodology. This requirement was added as part of a final rule published in the Federal Register on November 9, 2006, at 71 FR 65732.

Although exempt from the notice and comment requirements of the Administrative Procedure Act [39 U.S.C. 410(a)], the Postal Service invites public comment on the following proposed revisions to the Code of Federal Regulations (see 39 CFR part 501).

List of Subjects in 39 CFR Part 501

• Postal Service

Accordingly, 39 CFR part 501 is proposed to be amended as follows:

PART 501—AUTHORIZATION TO MANUFACTURE AND DISTRIBUTE POSTAGE EVIDENCING SYSTEMS

1. The authority citation for 39 CFR part 501 continues to read as follows:

Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 410, 2601, 2605, Inspector General Act of 1978, as amended (Pub. L. 95-452, as amended); 5 U.S.C. App. 3.

2. Section 501.15 is amended by revising paragraph (i) to read as follows:

§ 501.15

Computerized Meter Resetting System.

* * * * *

(i) Security and Revenue Protection. To receive Postal Service approval to continue to operate systems in the CMRS environment, the RC must submit to a periodic examination of its CMRS system and any other applications and technology infrastructure that may have a material impact on Postal Service revenues, as determined by the Postal Service. The examination shall be performed by a qualified, independent audit firm and conducted in accordance with the Statement on Auditing Standards (SAS) No. 70, Service Organizations, developed by the American Institute of Certified Public Accountants (AICPA), as amended or superseded. The examination shall include testing of the operating effectiveness of relevant RC internal controls (Type II SAS 70 Report). If the service organization uses another service organization (sub-service provider), Postal Service management should consider the nature and materiality of the transactions processed by the sub-service organization and the contribution of the sub-service organization's processes and controls in the achievement of the Postal Service's information processing objectives. The Postal Service should have access to the sub-service organization's SAS 70 report. The control objectives to be covered by the SAS 70 report are subject to Postal Service review and approval and are to be provided to the Postal Service 30 days prior to the initiation of each examination period. As a result of the examination, the auditor shall provide the RC and the Postal Service with an opinion on the design and operating effectiveness of the RC's internal controls related to the CMRS system and any other applications and technology infrastructure considered material to the services provided to the Postal Service by the RC. Such examinations are to be conducted on no less than an annual basis, and are to be as of and for the 12 months ended June 30 of each year (except for the period ending June 30, 2010, for which the period of coverage will be no less than 6 months, and except for new contracts for which the examination period will be no less than the period from the contract date to the following June 30, unless otherwise agreed to by the Postal Service). The examination reports are to be provided to the Postal Service by August 15 of each year. To the extent that internal control weaknesses are identified in a Type II SAS 70 report, the Postal Service may require the remediation of such weaknesses, review working papers, and engage in discussions about the work performed with the auditor. The Postal Service requires that all remediation efforts (if applicable) are completed and reported by the RC prior to the Postal Service's fiscal year end (September 30). The RC will be responsible for all costs to conduct these examinations.

* * * * *

3. Section 501.16 is amended by revising paragraph (f) to read as follows:

§ 501.16

PC Postage Payment Methodology.

* * * * *

(f) Security and Revenue Protection. To receive Postal Service approval to continue to operate PC Postage systems, the provider must submit to a periodic examination of its PC Postage system and any other applications and technology infrastructure that may have a material impact on Postal Service revenues, as determined by the Postal Service. The examination shall be performed by a qualified, independent audit firm and conducted in accordance with the Statement on Auditing Standards (SAS) No. 70, Service Organizations, developed by the American Institute of Certified Public Accountants (AICPA), as amended or superseded. The examination shall include testing of the operating effectiveness of relevant provider internal controls (Type II SAS 70 Report). If the service organization uses another service organization (sub-service provider), Postal Service management should consider the nature and materiality of the transactions processed by the sub-service organization and the contribution of the sub-service organization's processes and controls in the achievement of the Postal Service's information processing objectives. The Postal Service should have access to the sub-service organization's SAS 70 report. The control objectives to be covered by the SAS 70 report are subject to Postal Service review and approval and are to be provided to the Postal Service 30 days prior to the initiation of each examination period. As a result of the examination, the auditor shall provide the provider, and the Postal Service, with an opinion on the design and operating effectiveness of the internal controls related to the PC Postage system and any other applications and technology infrastructure considered material to the services provided to the Postal Service by the provider. Such examinations are to be conducted on no less than an annual basis, and are to be as of and for the 12 months ended June 30 of each year (except for the period ending June 30, 2010, for which the period of coverage will be no less than 6 months, and except for new contracts for which the examination period will be no less than the period from the contract date to the following June 30, unless otherwise agreed to by the Postal Service). The examination reports are to be provided to the Postal Service by August 15 of each year. To the extent that internal control weaknesses are identified in a Type II SAS 70 report, the Postal Service may require the remediation of such weaknesses, review working papers, and engage in discussions about the work performed with the auditor. The provider will be responsible for all costs to conduct these examinations.

* * * * *

Neva R. Watson,

Attorney, Legislative.