Both are possible, although "comprised of" is more common. Commonly used does not mean correct. "The whole comprises its parts" is correct usage. Awkward, but still correct, is "the parts are comprised by the whole". "The United States comprises fifty states". It is actually considered technically incorrect to say "the United States is comprised of fifty states", even though people commonly say this. It would be better to say "the United States is composed of fifty states". The expression "comprised of" is gaining popularity, and I have no doubt it will become accepted usage someday.