[Federal Register Volume 65, Number 40 (Tuesday, February 29, 2000)]
[Rules and Regulations]
[Pages 10675-10678]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 00-4763]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF AGRICULTURE

Food and Nutrition Service

7 CFR Parts 272 and 274

RIN 0584-AC71


Food Stamp Program: Electronic Benefits Transfer (EBT) Systems--
Statement on Auditing Standards No. 70 (SAS No. 70) Examination 
Requirements

AGENCY: Food and Nutrition Service, USDA.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The purpose of this final rule is to require an annual 
examination of the transaction processing of organizations that provide 
Electronic Benefits Transfer (EBT) systems or services for the Food 
Stamp Program. The examinations are to provide an independent 
assessment of the controls in place and the effectiveness of such 
controls over EBT transaction processing. State agencies will have to 
obtain the examinations, retain the examination reports, and provide 
examination reports to the Food and Nutrition Service upon request.

EFFECTIVE DATES: The amendments in this rule are effective March 30, 
2000.

FOR FURTHER INFORMATION CONTACT: Questions regarding this final rule 
should be addressed to Jeffrey N. Cohen, Chief, Electronic Benefit 
Transfer Branch, Benefit Redemption Division, Food and Nutrition 
Service, USDA, 3101 Park Center Drive, Alexandria, Virginia 22302, or 
by telephone at (703) 305-2517.

SUPPLEMENTARY INFORMATION:

Executive Order 12866

    This rule has been determined to be not significant for purposes of 
Executive Order 12866.

Executive Order 12372

    The Food Stamp Program (FSP) is listed in the Catalog of Federal 
Domestic Assistance under No. 10.551. For the reasons set forth in the 
final rule in 7 CFR 3015, Subpart V and related Notice (48 FR 29115), 
this program is excluded from the scope of Executive Order 12372 which 
requires intergovernmental consultation with State and local officials.

Regulatory Flexibility Act

    This final rule has been reviewed with regard to the requirements 
of the Regulatory Flexibility Act of 1980 (5 U.S.C. 601-612). Samuel 
Chambers, Jr., the Administrator of the Food and Nutrition Service, has 
certified that this final rule will not have a significant economic 
impact on a substantial number of small entities. State agencies and 
their EBT service providers will be the most affected to the extent 
that they administer or operate EBT services for FSP benefit delivery.

Paperwork Reduction Act

    On February 23, 1999, when this rule was proposed (64 FR 8733), FNS 
inadvertently stated that the Office of Management and Budget (OMB) 
control number 0584-0083 already covered the information collection 
burden which would result from the proposed requirements. On October 
12, 1999, a notice was published in the Federal Register (64 FR 55225) 
to correct this error and inform the public of the new burden being 
added. A new OMB control number 0584-0500 has been assigned to this 
regulation and has an expiration date of February 28, 2003.

Executive Order 12988

    This rule has been reviewed under Executive Order 12988, Civil 
Justice Reform. This rule is intended to have preemptive effect with 
respect to any State or local laws, regulations or policies which 
conflict with its provisions or which would otherwise impede its full 
implementation. This

[[Page 10676]]

rule is not intended to have retroactive effect unless so specified in 
the ``Dates'' paragraph of this preamble. Prior to any judicial 
challenge to the provisions of this rule or the application of its 
provisions, all applicable administrative procedures must be exhausted. 
In the FSP, the administrative procedures are as follows: (1) For 
Program benefit recipients--State administrative procedures issued 
pursuant to 7 U.S.C. 2020(e)(1) and 7 CFR 273.15; (2) for State 
agencies--administrative procedures issued pursuant to 7 USC 2023 set 
out at 7 CFR 276.7 for rules related to non-quality control (QC) 
liabilities or 7 CFR Part 283 for rules related to QC liabilities; (3) 
for Program retailers and wholesalers--administrative procedures issued 
pursuant to 7 U.S.C. 2023 set out at 7 CFR 278.8.

Unfunded Mandate Reform Act of 1996

    Title II of the Unfunded Mandates Reform Act of 1995 (UMRA), Pub. 
L. 104-4, establishes requirements for Federal agencies to assess the 
effects of their regulatory actions on State, local, and tribal 
governments and the private sector. Under section 202 of the UMRA, the 
Food and Nutrition Service (FNS) generally must prepare a written 
statement, including a cost-benefit analysis, for proposed and final 
rules with Federal mandates that may result in expenditures to State, 
local or tribal governments, in the aggregate, or to the private 
sector, of $100 million or more in any one year. When such a statement 
is needed for a rule, Section 205 of the UMRA generally requires the 
Food and Nutrition Service to identify and consider a reasonable number 
of regulatory alternatives and adopt the least costly, more cost-
effective or least burdensome alternative that achieves the objectives 
of the rule.
    This rule contains no Federal mandates (under the regulatory 
provisions of Title II of UMRA) for State, local and tribal governments 
or the private sector of $100 million or more in any one year. Thus 
this rule is not subject to the requirements of sections 202 and 205 of 
the UMRA.

Background

    All States must change from paper coupon systems to EBT systems for 
the issuance of FSP benefits by October 1, 2002. Currently, forty-one 
States have implemented EBT systems and most others are in some stage 
of planning. The total amount of FSP benefit funds issued to recipients 
each month is about $1.27 billion. The amount being moved through EBT 
systems is about $889,000,000 or 70 per cent of the total.
    For the FSP, EBT systems move money from Federal accounts held in 
the name of each State to accounts at banks and other financial 
institutions held by or for food retailers. Food retailers must first 
be authorized to accept FSP benefits by the FNS and then must be 
equipped to accept benefits via EBT. States determine the eligibility 
and the monthly FSP allotments for recipients. States give each 
recipient household a plastic EBT card and a Personal Identification 
Number (PIN). Recipients use the cards in authorized food stores for 
food purchases and may use them at Automated Teller Machines (ATMs) if 
the recipient is eligible for a cash program.
    EBT systems operate like debit card systems with immediate 
decrements to a household account number. Household accounts have 
associated cards and PINs which are used for food purchases. The amount 
of the purchase is credited to the food retailer's account and funds 
are settled each bank working day through the Automated Clearinghouse 
(ACH) process.
    States contract individually for EBT systems with EBT service 
providers. Usually States contract for EBT systems that deliver the 
benefits of several cash programs, such as Temporary Assistance for 
Needy Families (TANF) and State cash benefit programs, in addition to 
food stamp benefits. One State also uses EBT for the delivery of 
benefits of the Special Supplemental Nutrition Program for Women, 
Infants, and Children (WIC). Among State-administered benefit programs, 
only the FSP requires that States change from paper to EBT systems and 
only the FSP has regulations about EBT.
    Data from EBT systems are reported to State and Federal financial 
and reporting systems and are used in financial statements of many 
agencies. In particular, State EBT systems report data on about 70 per 
cent of food stamp benefit funds to FNS financial systems which in turn 
provide data used in annual FNS financial statements.
    On February 23, 1999, the Department proposed, and this final rule 
now requires, at least annual examinations of the transaction 
processing of EBT service providers by independent auditors. The 
examinations must follow the American Institute of Certified Public 
Accountants (AICPA) Statement on Auditing Standards No. 70, Service 
Organizations (SAS No. 70). Specific EBT guidance for the examinations 
is provided in the OMB Circular A-133 Compliance Supplement. The 
objective of these examinations is to determine whether there are 
controls in place and operating effectively over the security and 
accuracy of EBT transaction processing. These are typically referred to 
as ``type 2'' examinations. These examinations will provide an 
independent assessment of the controls over transaction processing by 
EBT service providers.

Proposed Rule Comments

    The Department asked for public comment in a proposed rule on 
February 23, 1999. Eleven comments were received. Eight were from State 
agencies or counties, including two EBT managers and three State 
auditors. Four of the States represented by those commentors do not 
currently operate EBT systems. Two Federal agencies and one EBT service 
provider also made comments.
    The major concern was cost. FSP EBT cost neutrality regulations 
require States to compare EBT system costs to coupon system costs. 
States will not receive more in Federal reimbursement from the FSP for 
the costs of their EBT systems than they would have received for the 
coupon systems EBT replaced. State legislatures also want EBT costs to 
remain the same or become lower than paper costs. Several commentors 
stated that the benefits of the SAS No. 70 examinations were for the 
FSP and the USDA Office of the Inspector General (OIG) and that all 
costs should be paid by FNS. Some noted that there were no such 
examinations in the coupon world and fewer reviews of coupon issuance 
systems. Some wanted FNS or OIG to hire the auditors or complete the 
audits themselves and to handle the resolution of findings. One pointed 
out that until EBT, FNS managed and paid for all work related to coupon 
redemption and financial settlement to retailers and now these duties 
and costs were forced onto States entirely. The EBT service provider 
asked that we make clear that additional costs caused by the 
examinations are State responsibilities.
    State arguments on the issue of cost neutrality are persuasive. The 
driving force behind this rule is to ensure the accuracy and 
dependability EBT financial information. State auditors are also 
concerned with the impact of EBT data on State financial statements. 
SAS No. 70 examination costs are not operational or start-up costs as 
described in 7 CFR 274.12(c)(5) and may be excluded from cost 
neutrality calculations, because they are not costs inherent in the 
development or operation of the EBT system itself. Although SAS NO.70 
examination costs will not be included in cost neutrality calculations, 
they remain State administrative costs which should be reported through 
the usual process and

[[Page 10677]]

will be reimbursed at the usual FSP Federal Financial Participation 
rate. When examination costs are shared among programs, they must be 
allocated and charged as appropriate.
    Several commentors noted that, since there are few EBT service 
providers, the most efficient and inexpensive way to arrange 
examinations and resolve findings would be for FNS or OIG to handle 
them directly. This would be a change in the approach to EBT as a State 
responsibility. However, the idea merits consideration and FNS intends 
to explore this approach. However, unless or until such a change is 
made, States must comply with these requirements.
    Several State commentors believe the regulation is ill-advised 
because it will drive up costs, keep down competition for the business, 
or because States already obtain SAS No.70 reports without such a 
requirement. Although we are sympathetic on each issue, this regulation 
is necessary. As mentioned elsewhere, both State and Federal financial 
systems and statements are fed by EBT system data. In addition, not all 
States receive SAS No. 70 reports and not all EBT transaction 
processing providers undergo such examinations.
    There were several technical comments about the period to be 
examined, when the report must be available, subcontractors, single 
examinations of the service provider, and platforms or control 
environments. The intention is that the SAS No. 70 examinations be at 
least annual with the examination period end date to be determined by 
the EBT service provider after considering the needs of user auditors 
of the States covered by the examinations. Once started, subsequent 
examinations must cover the entire period since the previous 
examination. If the EBT service provider obtains audits every six 
months, that is acceptable also. If the provider serves several States 
on the same platform with the same control environment, then one 
examination may be done covering all States and a list of all States 
sharing the control environment must be included in the examination 
report. The report must be completed ninety days after the examination 
period ends. Once reports are completed, the Food and Nutrition Service 
(FNS), USDA Office of the Inspector General (OIG), or the General 
Accounting Office (GAO) may wish to obtain a copy of the report. If a 
written request for the report is made to a State, it must be answered 
with a copy of the report within thirty days of the written request. 
FNS or others may find it necessary to have access to an auditor's work 
papers also. A written request for access to work papers must also be 
responded to within thirty days and by initiating or completing 
appropriate arrangements for access. Typically, work papers remain 
under the control of the auditor and arrangements for access will need 
to be coordinated among the parties involved.
    Some commentors noted that the language of the rule should reflect 
the technical language used in SAS No.70 and commonly used by auditors. 
We agree, therefore, terms such as examination, control environment, 
type 2 examinations, and platform have been used in this preamble and 
the regulation amendment.
    Many commentors agreed that it is efficient and desirable to have a 
single examination of each service provider that would cover all the 
States for whom the service is provided. The service provider commentor 
asked that this become an explicit requirement. Since some States may 
differ in their own needs or requirements, we are not requiring this. 
However, we very strongly recommend that States coordinate and 
cooperate to obtain one examination (with appropriately allocated 
costs) as long as each State has the same control environment. All 
service providers are expected to want this less costly and disruptive 
arrangement.
    Some commentors asked which subcontractors were subject to 
examination. States make varied arrangements for EBT services. Many 
States contract with a single provider for all EBT services. That EBT 
primary contractor may provide all the services or may hire 
subcontractors to provide some or all of the services which together 
constitute an EBT system. The intention is to ensure controls exist for 
secure, accurate, and complete transaction processing of FSP accounts 
for recipient use in authorized stores subsequently paid with Federal 
funds. Therefore, the contractor or subcontractor that maintains the 
account information, authorizes debits and credits on the accounts, and 
provides the basic data for settlement among the parties is subject to 
SAS No. 70 examinations. Subcontractors providing other services, such 
as EBT Help Desk services, Point of Sale installation, or plastic cards 
are not subject.
    Another complication is that States sometimes do EBT work 
themselves. For example, one State is producing and distributing EBT 
cards and another is considering doing transaction processing. Only the 
work of contractors is covered by this rule and the SAS No. 70 
examinations requirements. State work is exempt from this proposed SAS 
No. 70 examination requirement but subject to requirements already 
existing in OMB Circular A-133.

Other Issues

Statement on Auditing Standards No. 70

    The proposed regulations referred to AICPA SAS No. 70, Reports on 
the Processing of Transactions by Service Organizations. Since the 
proposed regulation was published, the title of SAS No. 70 was changed 
to Service Organizations. The intention is to refer to this standard 
regardless of numerical or name changes or revisions. The kind of 
report required is now commonly referred to by auditors as a SAS No. 
70, type 2 report or a type 2 service auditor's report. The intention 
is to obtain that kind of report regardless of future name changes.

EBT Review Guidelines

    The proposed rule referred to the Review Guidelines for Service 
Organizations Providing EBT Services for Government Programs 
(guidelines). The guidelines were endorsed by the National State 
Auditors Association on March 9, 1999 and available as interim 
guidelines for SAS No. 70 audits. These guidelines are now replaced by 
this rule which requires a SAS No. 70 examination to determine whether 
there are controls in place and operating effectively over the security 
and accuracy of EBT transaction processing. As mentioned above, these 
examinations are referred to as type 2 examinations. The OMB Circular 
A-133 Compliance Supplement will be revised to include guidance to 
assist service providers and their auditors in meeting this 
requirement.

Additional Audits or Reviews

    USDA's OIG and FNS have always reserved the right to conduct other 
audits or reviews of EBT if they find they are needed. This is not a 
change but has always existed as stated in 7 U.S.C. 2020, 7 CFR 
277.17(a) and is generally reflected in EBT Requests for Proposal or in 
State EBT contracts. This right is being specified here to avoid doubt 
or confusion on the issue.

Implementation

    This rule will be effective 30 days from the date of publication in 
the Federal Register. States must ensure that the initial period 
examined includes the date this rule becomes effective.

List of Subjects

7 CFR Part 272

    Alaska, Civil Rights, Food Stamps, Grant Programs--social programs,

[[Page 10678]]

Reporting and recordkeeping requirements.

7 CFR Part 274

    Administrative procedures and practices, Food Stamps, Grant 
programs--social programs, Reporting and recordkeeping requirements.

    Accordingly, for the reasons set forth in the preamble, 7 CFR Parts 
272 and 274 shall be amended as follows:
    1. The authority citation for 7 CFR Parts 272 and 274 continues to 
read as follows:

    Authority: 7 U.S.C. 2011-2036.

PART 272--REQUIREMENTS FOR PARTICIPATING STATE AGENCIES

    2. In Sec. 272.1, paragraph (g)(158)is added to read as follows:


Sec. 272.1  General Terms and Conditions.

* * * * *
    (g) Implementation. * * *
    (158) Amendment No. 382. The provisions of Amendment No.379 are 
effective and must be implemented March 30, 2000.

PART 274--ISSUANCE AND USE OF COUPONS

    3. In Sec. 274.12:
    a. Revise the heading of paragraph (j); and
    b. Add new paragraph (j)(5).
    The revision and addition read as follows:


Sec. 274.12  Electronic Benefit Transfer Issuance System approval 
standards.

* * * * *
    (j) Reconciliation, Management Reporting, Examinations and Audits.  
 * * *
    (5) Examinations and Audits.
    (i) The state agency must obtain an examination by an independent 
auditor of the transaction processing of the State EBT service provider 
regarding the issuance, redemption, and settlement of Food Stamp 
Program benefits. The examination must be done at least annually and 
the report must be completed ninety days after the examination period 
ends. Subsequent examinations must cover the entire period since the 
previous examination. Examinations must follow the American Institute 
of Certified Public Accountants (AICPA) Statement on Auditing Standards 
No. 70, Service Organizations (SAS No. 70), requirements for reports on 
controls placed in operation and tests of the operating effectiveness 
of the controls.
    (ii) The examination report must include a list of all States whose 
systems operate under the same control environment. Auditors conducting 
the examination must follow EBT guidance contained in the Office of 
Management and Budget (OMB) Circular A-133 Compliance Supplement to the 
extent the guidelines refer to FSP benefits. (For availability of OMB 
Circulars referenced in this section, see 5 CFR 1310.3.)
    (iii) The State agency must retain a copy of the SAS No.70 
examination report.
    (iv) The State agency shall respond to written requests from the 
Food and Nutrition Service (FNS), USDA Office of the Inspector General 
(OIG), or the General Accounting Office (GAO) for completed SAS No.70 
examination reports by providing the report within thirty days of 
receipt of the written request.
    (v) The State agency shall respond to written requests from FNS, 
OIG, or GAO to view auditor's workpapers from SAS No. 70 reports by 
arranging to have workpapers made available within thirty days of 
receipt of the written request.
    (vi) FNS and the USDA OIG shall rely on SAS No. 70 reports on EBT 
transaction processing services provided by contractors to the State. 
FNS and USDA OIG reserve the right to conduct other reviews or audits 
if necessary.
    (vii) EBT services provided directly by the State are not subject 
to SAS No. 70 examination requirements of this section but remain 
subject to the single audit requirements at 7 CFR 277.7 and the Office 
of Management and Budget Circular A-133.
* * * * *

    Dated: February 17, 2000.
Samuel Chambers, Jr.,
Administrator, Food and Nutrition Service.
[FR Doc. 00-4763 Filed 2-28-00; 8:45 am]
BILLING CODE 3410-30-U