Revisions to the Requirements for Authority To Manufacture and Distribute Postage Evidencing Systems, 30309-30310 [2010-12883]

Agencies

• Postal Service

[Federal Register Volume 75, Number 104 (Tuesday, June 1, 2010)]
[Proposed Rules]
[Pages 30309-30310]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2010-12883]


=======================================================================
-----------------------------------------------------------------------

POSTAL SERVICE

39 CFR Part 501


Revisions to the Requirements for Authority To Manufacture and 
Distribute Postage Evidencing Systems

AGENCY: Postal Service\TM\.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: In this proposed rule, the Postal Service proposes to amend 
regulations on Authorization to Manufacture and Distribute Postage 
Evidencing Systems. This proposed revision clarifies the requirement 
for examination by an independent audit firm of a Postage Evidencing 
System Provider's Computerized Meter Resetting System (CMRS) or PC 
Postage[supreg] system internal controls.

DATES: Submit comments on or before July 1, 2010.

ADDRESSES: Mail or deliver written comments to the Manager, Postage 
Technology Management, U.S. Postal Service, 475 L'Enfant Plaza SW., 
Suite 4200 NB, Washington, DC 20260-4200. Copies of all written 
comments will be available for inspection and photocopying between 9 
a.m. and 4 p.m., Monday through Friday, at the Postage Technology 
Management office.

FOR FURTHER INFORMATION CONTACT: Marlo Kay Ivey, Marketing Specialist, 
Postage Technology Management, U.S. Postal Service, at 202-268-7613.

SUPPLEMENTARY INFORMATION: Postage Evidencing Systems are devices or 
systems of components that a customer uses to print evidence that the 
prepaid postage required for mailing has been paid. They include, but 
are not limited to, postage meters and PC Postage systems. The Postal 
Service regulates these systems and their use in order to protect 
postal revenue. Only Postal Service-authorized product service 
providers may design, produce, and distribute Postage Evidencing 
Systems. This proposed revision clarifies the internal controls 
required in 39 CFR 501.15(i), Computerized Meter Resetting system, and 
501.16(f), PC Postage Payment Methodology. This requirement was added 
as part of a final rule published in the Federal Register on November 
9, 2006, at 71 FR 65732.
    Although exempt from the notice and comment requirements of the 
Administrative Procedure Act [39 U.S.C. 410(a)], the Postal Service 
invites public comment on the following proposed revisions to the Code 
of Federal Regulations (see 39 CFR part 501).

List of Subjects in 39 CFR Part 501

    Postal Service.

    Accordingly, 39 CFR part 501 is proposed to be amended as follows:

PART 501--AUTHORIZATION TO MANUFACTURE AND DISTRIBUTE POSTAGE 
EVIDENCING SYSTEMS

    1. The authority citation for 39 CFR part 501 continues to read as 
follows:

    Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 410, 
2601, 2605, Inspector General Act of 1978, as amended (Pub. L. 95-
452, as amended); 5 U.S.C. App. 3.

    2. Section 501.15 is amended by revising paragraph (i) to read as 
follows:


Sec.  501.15  Computerized Meter Resetting System.

* * * * *
    (i) Security and Revenue Protection. To receive Postal Service 
approval to continue to operate systems in the CMRS environment, the RC 
must submit to a periodic examination of its CMRS system and any other 
applications and technology infrastructure that may have a material 
impact on Postal Service revenues, as determined by the Postal Service. 
The examination shall be performed by a qualified, independent audit 
firm and conducted in accordance with the Statement on Auditing 
Standards (SAS) No. 70, Service Organizations, developed by the 
American Institute of Certified Public Accountants (AICPA), as amended 
or superseded. The examination shall include testing of the operating 
effectiveness of relevant RC internal controls (Type II SAS 70 Report). 
If the service organization uses another service organization (sub-
service provider), Postal Service management should consider the nature 
and materiality of the transactions processed by the sub-service 
organization and the contribution of the sub-service organization's 
processes and controls in the achievement of the Postal Service's 
information processing objectives. The Postal Service should have 
access to the sub-service organization's SAS 70 report. The control 
objectives to be covered by the SAS 70 report are subject to Postal 
Service review and approval and are to be provided to the Postal 
Service 30 days prior to the initiation of each examination period. As 
a result of the examination, the auditor shall provide the RC and the 
Postal Service with an opinion on the design and operating 
effectiveness of the RC's internal controls related to the CMRS system 
and any other applications and technology infrastructure considered 
material to the services provided to the Postal Service by the RC. Such

[[Page 30310]]

examinations are to be conducted on no less than an annual basis, and 
are to be as of and for the 12 months ended June 30 of each year 
(except for the period ending June 30, 2010, for which the period of 
coverage will be no less than 6 months, and except for new contracts 
for which the examination period will be no less than the period from 
the contract date to the following June 30, unless otherwise agreed to 
by the Postal Service). The examination reports are to be provided to 
the Postal Service by August 15 of each year. To the extent that 
internal control weaknesses are identified in a Type II SAS 70 report, 
the Postal Service may require the remediation of such weaknesses, 
review working papers, and engage in discussions about the work 
performed with the auditor. The Postal Service requires that all 
remediation efforts (if applicable) are completed and reported by the 
RC prior to the Postal Service's fiscal year end (September 30). The RC 
will be responsible for all costs to conduct these examinations.
* * * * *
    3. Section 501.16 is amended by revising paragraph (f) to read as 
follows:


Sec.  501.16  PC Postage Payment Methodology.

* * * * *
    (f) Security and Revenue Protection. To receive Postal Service 
approval to continue to operate PC Postage systems, the provider must 
submit to a periodic examination of its PC Postage system and any other 
applications and technology infrastructure that may have a material 
impact on Postal Service revenues, as determined by the Postal Service. 
The examination shall be performed by a qualified, independent audit 
firm and conducted in accordance with the Statement on Auditing 
Standards (SAS) No. 70, Service Organizations, developed by the 
American Institute of Certified Public Accountants (AICPA), as amended 
or superseded. The examination shall include testing of the operating 
effectiveness of relevant provider internal controls (Type II SAS 70 
Report). If the service organization uses another service organization 
(sub-service provider), Postal Service management should consider the 
nature and materiality of the transactions processed by the sub-service 
organization and the contribution of the sub-service organization's 
processes and controls in the achievement of the Postal Service's 
information processing objectives. The Postal Service should have 
access to the sub-service organization's SAS 70 report. The control 
objectives to be covered by the SAS 70 report are subject to Postal 
Service review and approval and are to be provided to the Postal 
Service 30 days prior to the initiation of each examination period. As 
a result of the examination, the auditor shall provide the provider, 
and the Postal Service, with an opinion on the design and operating 
effectiveness of the internal controls related to the PC Postage system 
and any other applications and technology infrastructure considered 
material to the services provided to the Postal Service by the 
provider. Such examinations are to be conducted on no less than an 
annual basis, and are to be as of and for the 12 months ended June 30 
of each year (except for the period ending June 30, 2010, for which the 
period of coverage will be no less than 6 months, and except for new 
contracts for which the examination period will be no less than the 
period from the contract date to the following June 30, unless 
otherwise agreed to by the Postal Service). The examination reports are 
to be provided to the Postal Service by August 15 of each year. To the 
extent that internal control weaknesses are identified in a Type II SAS 
70 report, the Postal Service may require the remediation of such 
weaknesses, review working papers, and engage in discussions about the 
work performed with the auditor. The provider will be responsible for 
all costs to conduct these examinations.
* * * * *

Neva R. Watson,
Attorney, Legislative.
[FR Doc. 2010-12883 Filed 5-28-10; 8:45 am]
BILLING CODE 7710-12-P