GovernmentExecutive.com

When the Postal Service decided to add functions to employees' Blackberrys, it turned to Peg Weir to make sure it was properly securing the wireless devices. As a result, when the new gadgets are rolled out next month, they will have internal controls in place, including password requirements and automatic timing out.

As manager of the USPS Internal Control Group, Weir works on developing efficient and secure agencywide processes. She viewed the fact that her group was asked to collaborate on the Blackberry project as a sign of success. "We're starting to get more and more business," she said of her group, which consists of 500 managers and analysts.

While most agencies have beefed up their internal controls, or checks and balances, since the 2002 Sarbanes-Oxley Act, none has gone as far as the Postal Service. The Internal Control Group, which was created as part of the 2002 Transformation Plan, is responsible for the Postal Service's voluntary compliance to Sarbanes-Oxley, which requires documenting and testing internal controls.

"Given the unique status [of USPS], it makes sense that they would want to monitor financial statements in a more similar way to the private sector," said Drew Crockett, spokesman for Rep. Tom Davis, R-Va., chairman of the House Government Reform Committee, which oversees the Postal Service. Sarbanes-Oxley applies to the private sector, but the Office of Management and Budget recently instructed agencies to strengthen their internal controls in line with that regulation.

To prioritize her group's focus, Weir ranked programs according to a risk assessment model based on their dollar value. Among the potential trouble areas identified were bulk mail, stamp retail, money order processes and contracts with the private sector.

The group already has made improvements: At their peak, paper and electronic systems that track the eFleet card, a credit card that links to a Web-based tracking system, were off by almost $11.7 million out of a total of $63 million in expenditures. Weir's group helped bring that number down to $1.3 million.

More changes are expected. The Postal Service currently relies on a customized internal control system, which Weir would like to change. She is reviewing the options and looking at the systems used by private sector companies, including General Motors. OMB is considering issuing a new rule on customized products.

Weir, an energetic woman who grew up on a dairy farm in upstate New York, said she worries that there are too many controls in place. Some processes that previously required signatures now involve only a scan - but some postal workers still ask for a signature. "We need to build confidence that scanning is the new control point, and we need to be more efficient and not require a signature, as well," she said.

"Risk is good, you just have to manage it," she said. "You can have 10 locks on the door, or you can have one really good one." And that's the one Weir wants.

COMMENTS

• Weir sounds like she is still on the farm. She worries that there are too many controls in place??? Hello? Is this IC czar not familiar with the term "defense in depth" - something all security pros practice daily? She says that they need to build confidence that scanning is the new control point. Scanning is a process dear, its not a "control point". Apparently the Postal big wigs don't understand "risk". They do know how to spell it. They don't know how to manage it. She says also "Risk is good, you just have to manage it,". No dear, risk, is not good, risk is bad. Compensating controls mitigate risk. Residual risk (very bad) has to be managed. It's scary to me that Postal has people in sensitive positions that really are not professionals. This is very clear from the interview. Please - hire a consultant. Hire many consultants. And listen to what the pros say. Frank Hooper Posted September 9, 2007 12:01 AM
• It's too bad they do not have controls on the mail and rates. Please stop my junk mail - it takes my time and is filling our landfills. Also, my first class stamps are subsidizing this crap I don't want to receive. They worry about stopping crap on the computers but never stop the physical mail crap that is very costly to society. taxpayer Posted March 25, 2005 6:21 AM
• Before they start worrying about internal programs, they better start worrying about where their managers are most of the time. You can't walk off your job anytime you want as a manager and turn your responsibilities over to junior clerks or whoever else is available, and expect the postal service to operate the way it should. The scanning system is a complete failure because the managers don't know enough to properly train their employees. Total disaster as is most things in the postal service when left to people who seem to be accountable to none - neither their time nor funds expended by them. GovExec.com reader Posted February 15, 2005 7:20 PM