2010-23031. Revisions to the Requirements for Authority To Manufacture and Distribute Postage Evidencing Systems

AGENCY:

Postal Service^TM.

ACTION:

Final rule.

SUMMARY:

The Postal Service is revising its regulations to require that companies that manufacture and distribute postage evidencing systems (“Company or Companies”) engage a qualified, independent audit firm to perform an examination of and provide an opinion on the design and operating effectiveness of relevant internal control activities performed by the Companies as service providers to the Postal Service under the Statement on Auditing Standards (SAS) No. 70 (“SAS 70”).

DATES:

Effective Date: September 16, 2010.

FOR FURTHER INFORMATION CONTACT:

Marlo Kay Ivey, Marketing Specialist, Postage Technology Management, U.S. Postal Service, at 202-268-7613.

SUPPLEMENTARY INFORMATION:

Postage Evidencing Systems are devices or systems of components that a customer uses to print evidence that the prepaid postage required for mailing has been paid. They include, but are not limited to, postage meters and PC Postage systems. The Postal Service regulates these systems and their use in order to protect postal revenue. Only Postal Service-authorized product service providers may design, produce, and distribute Postage Evidencing Systems. The Postal Service published a proposed rule in the Federal Register on June 1, 2010 at 73 FR 30309-30310 to amend the requirements for authority to manufacture and distribute postage evidencing systems. This revision clarifies the internal controls required in 39 CFR 501.15(i), Computerized Meter Resetting System, and 501.16(f), PC Postage Payment Methodology. The internal controls requirement was added as part of a final rule published in the Federal Register on November 9, 2006, at 71 FR 65732.

Comments: Two comments were received from the Companies (that manufacture or distribute postage evidencing systems). The first was notification of intent to comply. The second requested that the proposed amendment be modified to allow a Company with qualified internal audit departments, which meets the independence requirements under the Standards for the Professional Practice of the Institute of Internal Auditors (“IIA”), to utilize its internal audit department to perform the internal controls examination in lieu of engaging an independent audit firm.

The Postal Service gave thorough consideration to this comment. While the Postal Service recognizes the IIA as the authoritative body over internal audit activities, SAS 70 (Type II) examinations are subject to the American Institute of Certified Public Accountants (“AICPA”) professional standards, which impose more stringent independence requirements and a requirement that the examination be performed by a licensed CPA. Therefore, the Postal Service will not modify the proposed amendments as requested and will require the Companies to annually obtain an SAS 70 (Type II) examination of relevant internal controls by a qualified, independent, external audit firm. The Postal Service gave through consideration to the comments it received, and now announces the adoption of the final rule.

List of Subjects in 39 CFR Part 501

• Postal Service

Accordingly, 39 CFR part 501 is amended as follows:

PART 501—[AMENDED]

1. The authority citation for 39 CFR part 501 continues to read as follows:

Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 410, 2601, 2605, Inspector General Act of 1978, as amended (Pub. L. 95-452, as amended); 5 U.S.C. App. 3.

2. Section 501.15 is amended by revising paragraph (i) to read as follows:

§ 501.15

Computerized Meter Resetting System.

* * * * *

(i) Security and Revenue Protection. To receive Postal Service approval to continue to operate systems in the CMRS environment, the RC must submit to a periodic examination of its CMRS system and any other applications and technology infrastructure that may have a material impact on Postal Service revenues, as determined by the Postal Service. The examination shall be performed by a qualified, independent audit firm and shall be conducted in accordance with the Statement on Auditing Standards (SAS) No. 70, Service Organizations, developed by the American Institute of Certified Public Accountants (AICPA), as amended or superseded. The examination shall include testing of the operating effectiveness of relevant RC internal controls (Type II SAS70 Report). If the service organization uses another service organization (sub-service provider), Postal Service Management should consider the nature and materiality of the transactions processed by the sub-service organization and the contribution of the sub-service organization's processes and controls in the achievement of the Postal Service's information processing objectives. The Postal Service should have access to the sub-service organization's SAS 70 report. The control objectives to be covered by the SAS 70 report are subject to Postal Service review and approval and are to be provided to the Postal Service 30 days prior to the initiation of each examination period. As a result of the examination, the auditor shall provide the RC and the Postal Service with an opinion on the design and operating effectiveness of the RC's internal controls related to the CMRS system and any other applications and technology infrastructure considered material to the services provided to the Postal Service by the RC. Such examinations are to be conducted on no less than an annual basis, and are to be as of and for the twelve months ended June 30 of each year (except for the period ending June 30, 2010, for which the period of coverage will be no less than six months, and except for new contracts for which the examination period will be no less than the period from the contract date to the following June 30, unless otherwise agreed to by the Postal Service). The examination reports are to be provided to the Postal Service by August 15 of each year. To the extent that internal control weaknesses are identified in a Type II SAS 70 report, the Postal Service may require the remediation of such weaknesses and review working papers and engage in discussions about the work performed with the auditor. Postal Service requires that all remediation efforts (if applicable) are completed and reported by the RC prior to the Postal Service's fiscal year end (September 30). The RC will be responsible for all costs to conduct these examinations.

* * * * *

3. Section 501.16 is amended by revising paragraph (f) to read as follows:

§ 501.16

PC postage payment methodology.

* * * * *

(f) Security and revenue protection. To receive Postal Service approval to continue to operate PC Postage systems, the provider must submit to a periodic examination of its PC Postage system and any other applications and technology infrastructure that may have a material impact on Postal Service revenues, as determined by the Postal Service. The examination shall be performed by a qualified, independent audit firm and shall be conducted in accordance with the Statement on Auditing Standards (SAS) No. 70, Service Organizations, developed by the American Institute of Certified Public Accountants (AICPA), as amended or superseded. The examination shall include testing of the operating effectiveness of relevant provider internal controls (Type II SAS 70 Report). If the service organization uses another service organization (sub-service provider), Postal Service Management should consider the nature and materiality of the transactions processed by the sub-service organization and the contribution of the sub-service organization's processes and controls in the achievement of the Postal Service's information processing objectives. The Postal Service should have access to the sub-service organization's SAS 70 report. The control objectives to be covered by the SAS 70 report are subject to Postal Service review and approval and are to be provided to the Postal Service 30 days prior to the initiation of each examination period. As a result of the examination, the auditor shall provide the provider, and the Postal Service, with an opinion on the design and operating effectiveness of the internal controls related to the PC Postage system and any other applications and technology infrastructure considered material to the services provided to the Postal Service by the provider. Such examinations are to be conducted on no less than an annual basis, and are to be as of and for the twelve months ended June 30 of each year (except for the period ending June 30, 2010 for which the period of coverage will be no less than six months, and except for new contracts for which the examination period will be no less than the period from the contract date to the following June 30, unless otherwise agreed to by the Postal Service). The examination reports are to be provided to the Postal Service by August 15 of each year. To the extent that internal control weaknesses are identified in a Type II SAS 70 report, the Postal Service may require the remediation of such weaknesses and review working papers and engage in discussions about the work performed with the auditor. The provider will be responsible for all costs to conduct these examinations.

* * * * *

Neva R. Watson,

Attorney, Legislative.