[Federal Register Volume 75, Number 104 (Tuesday, June 1, 2010)]
[Proposed Rules]
[Pages 30309-30310]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-12883]
=======================================================================
-----------------------------------------------------------------------
POSTAL SERVICE
39 CFR Part 501
Revisions to the Requirements for Authority To Manufacture and
Distribute Postage Evidencing Systems
AGENCY: Postal Service\TM\.
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: In this proposed rule, the Postal Service proposes to amend
regulations on Authorization to Manufacture and Distribute Postage
Evidencing Systems. This proposed revision clarifies the requirement
for examination by an independent audit firm of a Postage Evidencing
System Provider's Computerized Meter Resetting System (CMRS) or PC
Postage[supreg] system internal controls.
DATES: Submit comments on or before July 1, 2010.
ADDRESSES: Mail or deliver written comments to the Manager, Postage
Technology Management, U.S. Postal Service, 475 L'Enfant Plaza SW.,
Suite 4200 NB, Washington, DC 20260-4200. Copies of all written
comments will be available for inspection and photocopying between 9
a.m. and 4 p.m., Monday through Friday, at the Postage Technology
Management office.
FOR FURTHER INFORMATION CONTACT: Marlo Kay Ivey, Marketing Specialist,
Postage Technology Management, U.S. Postal Service, at 202-268-7613.
SUPPLEMENTARY INFORMATION: Postage Evidencing Systems are devices or
systems of components that a customer uses to print evidence that the
prepaid postage required for mailing has been paid. They include, but
are not limited to, postage meters and PC Postage systems. The Postal
Service regulates these systems and their use in order to protect
postal revenue. Only Postal Service-authorized product service
providers may design, produce, and distribute Postage Evidencing
Systems. This proposed revision clarifies the internal controls
required in 39 CFR 501.15(i), Computerized Meter Resetting system, and
501.16(f), PC Postage Payment Methodology. This requirement was added
as part of a final rule published in the Federal Register on November
9, 2006, at 71 FR 65732.
Although exempt from the notice and comment requirements of the
Administrative Procedure Act [39 U.S.C. 410(a)], the Postal Service
invites public comment on the following proposed revisions to the Code
of Federal Regulations (see 39 CFR part 501).
List of Subjects in 39 CFR Part 501
Postal Service.
Accordingly, 39 CFR part 501 is proposed to be amended as follows:
PART 501--AUTHORIZATION TO MANUFACTURE AND DISTRIBUTE POSTAGE
EVIDENCING SYSTEMS
1. The authority citation for 39 CFR part 501 continues to read as
follows:
Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 410,
2601, 2605, Inspector General Act of 1978, as amended (Pub. L. 95-
452, as amended); 5 U.S.C. App. 3.
2. Section 501.15 is amended by revising paragraph (i) to read as
follows:
Sec. 501.15 Computerized Meter Resetting System.
* * * * *
(i) Security and Revenue Protection. To receive Postal Service
approval to continue to operate systems in the CMRS environment, the RC
must submit to a periodic examination of its CMRS system and any other
applications and technology infrastructure that may have a material
impact on Postal Service revenues, as determined by the Postal Service.
The examination shall be performed by a qualified, independent audit
firm and conducted in accordance with the Statement on Auditing
Standards (SAS) No. 70, Service Organizations, developed by the
American Institute of Certified Public Accountants (AICPA), as amended
or superseded. The examination shall include testing of the operating
effectiveness of relevant RC internal controls (Type II SAS 70 Report).
If the service organization uses another service organization (sub-
service provider), Postal Service management should consider the nature
and materiality of the transactions processed by the sub-service
organization and the contribution of the sub-service organization's
processes and controls in the achievement of the Postal Service's
information processing objectives. The Postal Service should have
access to the sub-service organization's SAS 70 report. The control
objectives to be covered by the SAS 70 report are subject to Postal
Service review and approval and are to be provided to the Postal
Service 30 days prior to the initiation of each examination period. As
a result of the examination, the auditor shall provide the RC and the
Postal Service with an opinion on the design and operating
effectiveness of the RC's internal controls related to the CMRS system
and any other applications and technology infrastructure considered
material to the services provided to the Postal Service by the RC. Such
[[Page 30310]]
examinations are to be conducted on no less than an annual basis, and
are to be as of and for the 12 months ended June 30 of each year
(except for the period ending June 30, 2010, for which the period of
coverage will be no less than 6 months, and except for new contracts
for which the examination period will be no less than the period from
the contract date to the following June 30, unless otherwise agreed to
by the Postal Service). The examination reports are to be provided to
the Postal Service by August 15 of each year. To the extent that
internal control weaknesses are identified in a Type II SAS 70 report,
the Postal Service may require the remediation of such weaknesses,
review working papers, and engage in discussions about the work
performed with the auditor. The Postal Service requires that all
remediation efforts (if applicable) are completed and reported by the
RC prior to the Postal Service's fiscal year end (September 30). The RC
will be responsible for all costs to conduct these examinations.
* * * * *
3. Section 501.16 is amended by revising paragraph (f) to read as
follows:
Sec. 501.16 PC Postage Payment Methodology.
* * * * *
(f) Security and Revenue Protection. To receive Postal Service
approval to continue to operate PC Postage systems, the provider must
submit to a periodic examination of its PC Postage system and any other
applications and technology infrastructure that may have a material
impact on Postal Service revenues, as determined by the Postal Service.
The examination shall be performed by a qualified, independent audit
firm and conducted in accordance with the Statement on Auditing
Standards (SAS) No. 70, Service Organizations, developed by the
American Institute of Certified Public Accountants (AICPA), as amended
or superseded. The examination shall include testing of the operating
effectiveness of relevant provider internal controls (Type II SAS 70
Report). If the service organization uses another service organization
(sub-service provider), Postal Service management should consider the
nature and materiality of the transactions processed by the sub-service
organization and the contribution of the sub-service organization's
processes and controls in the achievement of the Postal Service's
information processing objectives. The Postal Service should have
access to the sub-service organization's SAS 70 report. The control
objectives to be covered by the SAS 70 report are subject to Postal
Service review and approval and are to be provided to the Postal
Service 30 days prior to the initiation of each examination period. As
a result of the examination, the auditor shall provide the provider,
and the Postal Service, with an opinion on the design and operating
effectiveness of the internal controls related to the PC Postage system
and any other applications and technology infrastructure considered
material to the services provided to the Postal Service by the
provider. Such examinations are to be conducted on no less than an
annual basis, and are to be as of and for the 12 months ended June 30
of each year (except for the period ending June 30, 2010, for which the
period of coverage will be no less than 6 months, and except for new
contracts for which the examination period will be no less than the
period from the contract date to the following June 30, unless
otherwise agreed to by the Postal Service). The examination reports are
to be provided to the Postal Service by August 15 of each year. To the
extent that internal control weaknesses are identified in a Type II SAS
70 report, the Postal Service may require the remediation of such
weaknesses, review working papers, and engage in discussions about the
work performed with the auditor. The provider will be responsible for
all costs to conduct these examinations.
* * * * *
Neva R. Watson,
Attorney, Legislative.
[FR Doc. 2010-12883 Filed 5-28-10; 8:45 am]
BILLING CODE 7710-12-P