**Enclosure 4: Supplemental Instructions**

**For Safeguard Procedures Report (SPR)**

Outlined below are comments, which clarify the preparation instructions
in IRS Publication 1075 as they pertain to educational institutions. The
numbers referred to below are the same as numbered in this publication.

The SPR [must]{.underline} be on the institution's letterhead, signed by
the head of the agency or delegate, dated, and include the following
information:

1.  Responsible official

The name, title, and telephone number of the agency official authorized
to request FTI from the IRS. You must include the name of a contact
person if the day-to-day operation of the program is performed by
someone other than the named official.

2.  Location of the data

An organizational chart or narrative description of the receiving
agency, that includes all functions within the agency where FTI will be
processed or maintained. (Be sure to indicate which office will actually
receive and utilize the FTI.)

-   Board of Trustees

-   President

-   Executive Assistant to President

-   Director

-   Office of Vice President for Academic Affairs

-   Office of Vice President for Research

-   Office of Vice President for Business and Finance

-   Director of Financial Affairs \*\* (**\*\* indicates where data are
    used**)

-   Director of Purchasing

-   Director of Financial Aid

3.  Flow of data

A chart or narrative describing the flow of FTI through the agency from
receipt to its destruction, how it is used or processed, and how it is
protected. Indicate if the FTI is commingled or transcribed into data
kept by the agency.

4.  System of records

Agencies are expected to be able to provide an "audit trail" for
information requested

and received.

5.  Secure storage of the data

A description of the security measures employed to provide secure
storage for the data when it is not in current use. Secure storage
includes such diverse considerations as locked files or containers,
secured facilities, key or combination controls, off-site storage, and
restricted areas.

6.  Limiting access to the data

A description of the procedures or safeguards employed to ensure access
to the FTI is limited to those individuals who are authorized access and
have a need-to-know. Describe how the information will be protected from
unauthorized access when in use by the authorized recipient(s).

The physical barriers to unauthorized access should be described
(including the security features of the facilities where FTI is used or
processed) and systemic or procedural barriers.

7.  Disposal

A description of the method(s) of disposal of the different types of FTI
provided by the IRS when not returned to the IRS. Approved methods of
destruction include:

-   Burning --Burn in an incinerator that produces enough heat to burn
    the entire bundle or separate the bundle to ensure all pages are
    consumed.

```{=html}
<!-- -->
```
-   Shredding -- Paper should be shredded to effect 5/16 inch wide or
    smaller and microfilm should be shredded to effect 1/35 inch by 3/8
    inch strips.

```{=html}
<!-- -->
```
-   Pulping -- Should be accomplished so that all material is reduced to
    particles of one inch or smaller.

**Note:** Tearing data in half several times and placing in office trash
containers or burying in a landfill are not acceptable methods of
destruction.

8.  Computer security

All computer systems processing, storing, and transmitting FTI must have
computer access protection controls. (This includes microprocessors and
mainframe systems, LANs, WANs, or Internets, and personal
computers/notebooks/laptops. If used, personal computers, etc. must
include instructions on what security precautions are in place to
prevent unauthorized disclosure or access to include disks, etc.)

9.  Agency disclosure awareness program

Each agency receiving FTI must have an awareness program that annually
notifies all employees having access to FTI of the confidentiality
provisions of the IRS, a definition of what returns and return
information is, and the civil and criminal sanctions for unauthorized
inspection or disclosure.