CHAPTER 300 - AUDITING

(300)-130 [Retention, Control, and Security of Audit
Documents]{.underline}

130.1 [Office of Audit Records Overview]{.underline}.

The Office of Audit (OA) is responsible, in varying degrees, for the
record keeping and control of audit documents, including adequate
security over electronic and manual reports, memoranda, workpapers, and
other documents. [**Exhibit (300)-130.1**](#retention) contains excerpts
from the Treasury Inspector General for Tax Administration (TIGTA)
Records Control Schedule covering the maintenance/storage of (paper)
audit files.

130.2 [Workpaper Files]{.underline}.

**Paper workpaper files** will be maintained for 3 years after the
fiscal year in which the final report was issued. OA audit workpapers
should be retained on-site for 1 full year after the end of the fiscal
year in which the final report was issued. After 1 year the workpapers
may be transferred to the Federal Records Center (FRC) where they will
be maintained for 2 additional years before being destroyed. (For
specific guidance on actual records transfer procedures, please refer to
the TIGTA Operations Manual, [**Chapter
500-130**](../../../chapter500-info-tech/500-130/chapter500-130.doc).)

**Electronic TeamMate workpapers** will be maintained on the auditor's
respective network server share(s) and moved to the Closed share one
year after the final report is issued. We are working with the National
Archives and Records Administration (NARA) to establish a final
retention period for closed/issued project workpaper files. Until the
official retention period is established by NARA, all TeamMate
electronic workpaper project files will have an indefinite retention
period. The OA staff should not delete or archive TeamMate electronic
workpaper files to CD/DVD media. Any projects previously moved to CD/DVD
or other electronic media should be moved back to the respective server.
All TeamMate Master Audit files should be retained on the auditor's
local file server share(s) indefinitely.

The OA may keep permanent workpaper files that contain information of
recurring usefulness accumulated and arranged in logical order for use
in planning new audits and as a knowledge management resource for future
audit staff. These are particularly useful in conducting financial
audits. These files may contain basic organization and operating
information, such as:

-   Functional organizational charts.

-   Office locations.

-   Names and titles of key officials.

-   Flowcharts of key operations.

-   Other pertinent information.

```{=html}
<!-- -->
```
-   Indexed audit plans.

-   A record of findings and other matters for which follow‑up action is
    required during succeeding audits.

130.3 [Audit Project Control Files]{.underline}.

The TeamMate audit project files should include summary information of
closed projects and audits. This information is useful to management in
tracking assignments from planning to the issuance of the final report
or memorandum. These files also provide ready reference to assist
management in carrying out quality reviews.

TeamMate audit project control files should include the following
documents:

-   Internal Control Assessment.

-   Initiation document.

-   Audit methodology, milestones, and approval (the audit plan).

-   Audit Lead.

-   Audit Log.

-   Engagement Letter.

-   Record of opening and closing conferences.

-   Audit briefing papers and memoranda.

-   Draft and final reports and related transmittals.

-   Outcome Measures.

-   Status reports.

-   Follow-up audit methodology document.

130.4 [Document Control in the Office of Management and
Policy]{.underline}.

The Office of Management and Policy (OMP) will retain paper copies of
final audit reports issued by the TIGTA and the former Inspection
Service for 5 years or until no longer needed. Paper copies of final
reports for local audits issued by the former Inspection Service will
also be retained for 5 years or until no longer needed.

The OMP also maintains electronic files related to audits and projects
on the Integrity Data System (IDS) located on the TIGTA computer
network. The IDS is a research tool that aids in locating past and
current audit documents. To keep this folder current, audit offices
should forward the required documents to the OMP timely and use the
prescribed naming conventions. Electronic files for each closed audit
are required to be forwarded to the **\*TIGTA Audit PGP1** email address
for entry onto the IDS. The OMP will monitor document submissions to
maintain integrity. The documents required to be submitted to the OMP
and standard naming conventions are identified in\
[**Exhibit
(300)-130.2**](../chapter300-130.doc#ExhibitNamingConventions).

The OMP files are write-protected, kept in multiple directories, and
continually updated. For example, one file contains data on all National
Audit Program projects and audits in TeamCentral Management Information
System (TCMIS) status codes (Planned/Not Started (0) through Draft
Issued (4)); another tracks National Audit final reports issued since
1984. Files can also be accessed by TCMIS number and type of document,
such as Audit Leads, audit plans, etc.

Electronic files, except those associated with final reports, should be
sent to the OMP "zipped" into one file using the TCMIS number as the
file name. Final report files should be "zipped" using the report
reference number as the file name.

All e-mails forwarding audit reports to the \*TIGTA Audit Reports e-mail
address should use a standard naming convention. This naming convention
should consist of the TCMIS audit/project number followed by "Draft
Report" or "Final Report" (e.g. 200710001 Draft Report, 200710002 Final
Report). Titles of the reports should not be included in the e-mail
subject line; however, they may be included in the body of the message.

130.5 [Administrative Files]{.underline}.

Disposition of administrative and housekeeping records and files, such
as time sheets, travel vouchers, and other types of records that are
common to all Federal agencies and are not agency mission specific, are
covered by the General Records Schedules. These schedules can be
accessed at
<http://www.archives.gov/records_management/records_schedules.html>.

130.6 [Security of Audit Work Areas]{.underline}.

Responsibility for maintaining security over audit work areas and
records is shared by all OA employees. For our purposes, "records"
encompass material containing tax data, taxpayer information,
workpapers, audit reports, proprietary data, and information concerning
Internal Revenue Service (IRS) operations, acquired in connection with
an audit or other official use. The Department of the Treasury Security
Manual (TD P 71-10) provides uniform security policies and general
procedures for the Department of the Treasury. The following procedures
apply to all OA offices and local sites where auditors are performing
their duties:

-   Lockable desks and filing cabinets should remain locked when not in
    use.

-   Audit reports, records, and keys to cabinets should not be
    maintained in unlockable desks or cabinets.

-   Employees should be assigned keys for the desks they occupy and are
    responsible for locking their desks each evening.

```{=html}
<!-- -->
```
-   Employees must safeguard the privacy, confidentiality, and
    sensitivity of internal communications, such as facsimiles,
    electronic files, email, and the Voice Management System to protect
    against unauthorized disclosures.

The IRS Law Enforcement Manual (LEM) materials and other materials
administratively classified for IRS internal use will not be included in
OA memoranda and reports -- see
[**Section**](../../300-90/chapter300-90.doc#DisclosureofInformation)
**(300)-90.16**. In addition, access to highly sensitive information
such as informant identities and examination scoring formulae (e.g., the
Discriminant Index Function) should be restricted to approved managers
or auditors. Administrative classified materials include, but are not
limited to:

-   Informant names.

-   Names of individual and business taxpayers.

-   Names of IRS employees (titles are acceptable).

-   Social Security Numbers.

-   Employer Identification Numbers.

-   Document Locator Numbers.

-   All other statements that might compromise the anonymity of
    informants, taxpayers, or IRS employees.

If necessary, certain administratively classified information may be
presented in attachments to OA memoranda and reports to provide an
understanding of the audit issues. This information may also be
associated with corresponding document transmittals. However,
information concerning the identity of confidential informants will not
be included, and specific taxpayer identifying information will rarely
be needed. Very general, non-classified statements relating to
classified materials may be included in these OA documents.

[Exhibit
(300)-90.2](../../300-90/chapter300-90.doc#ExhibitInforNotinReports)
contains additional examples of information that should not be contained
in audit reports.

130.7 [Annual Review of Physical, Computer, Document Security, and
Disposition of Records.]{.underline}

Managers and employees are responsible for providing reasonable security
for all information, documents, and property with which they are
entrusted; for complying with all security requirements; and, for
reporting any significant violations to the respective AIGA or DIGA, as
warranted.

Among other requirements, the Federal Managers Financial Integrity Act
of 1982 (FMFIA) requires agencies to provide "reasonable assurance" that
funds, property, and other assets are safeguarded against waste, loss,
unauthorized use, or misappropriation. These requirements are
implemented by the Office of Management and Budget (OMB), in Circular
A-123, Management Accountability and Control.

At the end of the fiscal year, each agency is required to prepare an
annual assurance letter regarding the adequacy of its internal controls
over physical security. Within TIGTA, the OMS requests this information
at the beginning of the subsequent fiscal year and consolidates the
functional responses into TIGTA's annual assurance letter.

To be able to address annually the state of physical security within
business units, each AIGA must ensure that at least one security review
is conducted annually at each of the business unit's posts of duty (POD)
(including their Headquarters space). Each security review is to be
unannounced, conducted on an irregular basis (i.e., not just prior to
September 30), and completed no later than September 30. Each AIGA has
the discretion to decide who will conduct the security review and, also,
to determine if additional security reviews should be conducted during
the fiscal year.

To save staff resources, AIGAs of co-located business unit staffs may
consider using a single security review for the particular POD to cover
a shared office. Results of these reviews should address the separate
business unit staff to the extent practicable, e.g., sensitive files on
a specific employee's desk.

A suggested checklist is included in [**Exhibit
(300)-130.3**](../chapter300-130.doc#exhibitannualreview) for use in
each security review. The checklist is on the network located under
**File/New/Audit Forms/Annual Office Security Checklist.dot**. The
checklist also includes the physical security interim guidelines as
required in [**TIGTA Memorandum No.
01-21**](../chapter300-130.doc#tigta0121). Documentation for each
physical security review, including co-joined reviews, should be
submitted to the respective AIGA(s).

In addition to managing a business unit's physical security review, each
AIGA is responsible for ensuring completion of an annual review of the
maintenance/storage of audit files to ascertain proper retention in
accordance with [**Exhibit
(300)-130.1**](../chapter300-130.doc#retention) requirements. The
retention of any records in excess of the specified period must be
explained in a memorandum and approved by the AIGA.

Each AIGA also will ensure that, at least annually, or whenever an
employee leaves the business unit, combination locks have been changed
on all office doors and combination locks for containers containing
sensitive or confidential information have been changed. Form SF 700,
Security Container Information [**Exhibit
(300)-130.4**](../chapter300-130.doc#FORM700), will be completed and
maintained by each AIGA as documentation.

130.8 [Requests for Inspector General Documents]{.underline}.

Final audit reports and the Annual Audit Plan will be published on the
TIGTA Internet website. Requesters of these documents should be directed
to the TIGTA Internet website. Requests for audit documents that are not
publicly available on the TIGTA Internet website should be directed to
the Office of Chief Counsel for the Inspector General Disclosure
Section.

It is the TIGTA's policy that auditors will not discuss or provide
written documentation concerning audit information that has not been
fully developed and/or has not been discussed with appropriate IRS
management, including issues addressed in memoranda and draft reports.

Information can be shared on audit activities in which a final report
has been issued. If requests for final reports or workpapers are
received, the OMP will be responsible for guidance and issuance to the
respective recipient. This process should be used to ensure that the
redacted version of the report is provided. In all instances, good
professional judgment should be exercised when information is discussed
or released.

To minimize duplication of audit coverage, Government Accountability
Office (GAO) personnel may request information from audit teams. If GAO
personnel request access to audit workpapers or memoranda/draft reports,
the following procedures should be followed:

-   ***Open Audits*** -- Written requests to review workpapers,
    memoranda, discussion draft, or draft reports must be submitted to
    the Deputy Inspector General for Audit (DIGA). The DIGA will
    determine the action to be taken on these requests on a case-by-case
    basis.

```{=html}
<!-- -->
```
-   ***Closed Audits*** -- When an audit office receives a request from
    the GAO to review the supporting workpapers to an audit report, it
    will notify the DIGA. All requests will be evaluated before
    documents are released. Workpapers retained by the participating
    field offices will be requested by the OMP. An inventory of all of
    the workpapers will be taken. The inventory listing will contain a
    general description of each file folder, the number of pages, and
    any other documents or information that may be relevant to ensure
    the proper identification of the workpapers.

All GAO auditors assigned to a review should be listed on an approved
Internal Revenue Code § 6103 disclosure list so their audit discussions
concerning tax information should not pose any legal disclosure
concerns.

[]{#retention .anchor}**[Exhibit (300)-130.1]{.underline}**

[TIGTA Records Control Schedule Excerpts]{.underline}

**[TIGTA RECORDS CONTROL SCHEDULE]{.underline}**

**[(N1-056-01-05) EXCERPTS]{.underline}**

# ITEM 3

**Audit Reports and related correspondence, memoranda, and other related
documents** issued to Internal Revenue Service (IRS) executives on the
efficiency, effectiveness, and economy of IRS programs and operations\
(formerly job No. N1-58-87-7, Item 26).

[Disposition]{.underline}

-   Temporary. Cutoff files annually end of December. Transfer to the
    FRC 1 year after cutoff. The FRC will destroy 5 years after cutoff.

[ITEM 4]{.underline}

**Carry-forward audit workpaper files** consisting of reference
information that has continuing value after the audit work has been
completed. Information has been accumulated in current and past audits
and will be used in future audits. Additions of new material and
deletions of unessential items are made as the audit progresses
(formerly job No. N1-58-87-7, Item 28).

[Disposition]{.underline}

-   Temporary. Destroy on-site when information is no longer needed.

[ITEM 5]{.underline}

**Audit workpapers and related correspondence** include taxpayer
confirmation letter replies, which relate to audits of particular office
or function for a specific period, special studies, and/or
investigations conducted jointly with other organizations\
(formerly job No. N1-58-87-7, Item 29).

[Disposition]{.underline}

-   Temporary. Cutoff files at end of fiscal year. Transfer to the FRC 1
    year after cutoff. The FRC will destroy 3 years after the end of the
    fiscal year in which the final report was issued.

**[Exhibit (300)-130.1 (cont'd)]{.underline}**

[TIGTA Records Control Schedule Excerpts]{.underline}

[ITEM 6]{.underline}

**Annual Audit Plans, Internal Peer Reviews, and Peer Reviews of other
Inspector General Offices**, including related paper and correspondence\
(formerly job No. N1-58-87-7, Item 27).

[Disposition]{.underline}

-   Temporary. Cutoff files at end of the fiscal year. Destroy on-site 3
    years after the end of the relevant fiscal year. However, for
    external peer review workpapers, please retain them for 4 years
    after the cutoff date. Frequently, these are requested by the next
    team doing the subsequent review.

[ITEM 7]{.underline}

**Project files dealing with the establishment, maintenance, and
oversight of the audit program**, including OA Operations Manual
instructions and training activities (formerly job No. N1-58-87-7, Item
30).

[Disposition]{.underline}

-   Temporary. Cutoff files at the end of the fiscal year. Destroy
    on-site 3 years after the end of the relevant fiscal year.

**[Exhibit (300)-130.2]{.underline}**

[Audit Document Naming Conventions]{.underline}

  ----------------------- ---------------------- -------------------------
  Required Document Name  Description            Due to \*TIGTA Audit PGP1
                                                 email address

  TCMIS                   Project/Audit          When approved by
  Number-Audit_Lead.doc   idea/lead document     designated official

  TCMIS                   Project/Audit          When approved by
  Number-Initiation.doc   initiation document    designated official
  ----------------------- ---------------------- -------------------------

Due at Start of Fieldwork

  ------------------------------ ---------------------- -------------------------
  Required Document Name         Description            Due to \*TIGTA Audit PGP1
                                                        email address

  TCMIS Number-Audit_Plan.doc    Project/Audit approved When approved by
                                 work plan              designated official

  TCMIS                          Engagement letter      When signed by the DIGA
  Number-Engagement_Letter.doc                          
  ------------------------------ ---------------------- -------------------------

Due During the Audit/Project

  ------------------------------ ---------------------- -------------------------
  Required Document Name         Description            Due to \*TIGTA Audit PGP1
                                                        email address

  TCMIS Number-Briefing_date.doc Briefing papers issued When approved
                                 to IRS management      

  TCMIS Number-Memo_date.doc     Audit memos issued to  When signed
                                 IRS management         

  TCMIS                          Document explaining    When approved by
  Number-Suspended_date.doc      suspension of project  designated official

  TCMIS                          Document explaining    When approved by
  Number-Cancellation_date.doc   cancellation of        designated official
                                 project                

  TCMIS Number-Closing_date.doc  Document explaining    When approved by
                                 closing of project     designated official

  TCMIS                          Document explaining    When approved by
  Number-Postponed_date.doc      postponement of        designated official
                                 project                
  ------------------------------ ---------------------- -------------------------

Due When Draft Report Is Issued

  ---------------------------------- ---------------------- -------------------------
  Required Document Name             Description            Due to \*TIGTA Audit PGP1
                                                            email address

  TCMIS Number-Draft_Report.doc      Complete draft report  When signed by the DIGA
                                     in one document,       
                                     including transmittal  
                                     letter, title page,    
                                     table of contents,     
                                     report body, and       
                                     appendices             

  TCMIS                              Final audit plan or    When approved
  Number-Audit_Plan_Adden_date.doc   approved addendum      

  Please enter highlighted                                  
  information and do not include                            
  symbols, such as parentheses or \#                        
  signs, in file names.                                     
  ---------------------------------- ---------------------- -------------------------

**[Exhibit (300)-130.2 (cont'd)]{.underline}**

[Audit Document Naming Conventions]{.underline}

Due When Final Report Is Issued

  --------------------------------- ---------------------- -------------------------
  Required Document Name            Description            Due to \*TIGTA Audit PGP1
                                                           email address

  TCMIS Number-Final_Report.doc     Complete final report  When signed by the DIGA
                                    in one document,       
                                    including title page,  
                                    transmittal letter,    
                                    table of contents,     
                                    report body, and       
                                    appendices (including  
                                    IRS response)          

  TCMIS Number-OMS date.doc         Updated Outcome        Within 2 workdays after
                                    Measure Summary        final report issuance
                                    document               

  TCMIS Number-Reference            Joint Audit Management Within 2 workdays of
  Number-JAMES CAF.doc              Enterprise System      issuance of final report
                                    Corrective Action Form 
                                    (JAMES CAF) document   

  TCMIS Number-F_Audit_Plan.doc     Final Project/Audit    Within 2 workdays of
                                    work plan              issuance of final report

  TCMIS                             Project/Audit          When approved
  Number-Follow-up_Audit_Plan.doc   follow-up work plan    

  TCMIS Number-Mgmt_Response.doc    Response to draft      Within 2 workdays of
                                    report from management receipt of the response

  TCMIS Number-Audit_Highlights.doc Audit Highlights       When final report is
                                    document               signed by the DIGA

  Please enter highlighted                                 
  information and do not include                           
  symbols, such as parentheses or                          
  \# signs, in file names.                                 
  --------------------------------- ---------------------- -------------------------

Due When a Late Management Response Is Received

  -------------------------- ---------------------- -------------------------
  Required Document Name     Description            Due to both the \*TIGTA
                                                    Audit PGP1 email address
                                                    and to the \*TIGTA Audit
                                                    Reports email address

  TCMIS                      Management response    Within 2 workdays of
  Number-Mgmt_Response.doc   received after the     receipt of the late
                             issuance of the final  response
                             report                 

  TCMIS Number-OMS date.doc  Updated Outcome        When approved
                             Measure Summary        
                             document               

  TCMIS Number-Reference     Updated JAMES CAF      Within 2 workdays of
  Number-JAMES CAF.doc       document               receipt of the late
                                                    response

  TCMIS                      OA's rebuttal to the   When approved
  Number-OA_Rebuttal.doc     management response    
                             (where applicable)     

  Please enter highlighted                          
  information and do not                            
  include symbols, such as                          
  parentheses or \# signs,                          
  in file names.                                    
  -------------------------- ---------------------- -------------------------

**[Exhibit (300)-130.3]{.underline}**

Annual Security and Records Disposition Checklist Physical Security
Guidelines

  ---------------------------- ------------------------------------------

  ---------------------------- ------------------------------------------

+----------------------------+----------------------+------------------+
| **Annual Security and      |                      |                  |
| Records Disposition        |                      |                  |
| Checklist Physical         |                      |                  |
| Security Guidelines**      |                      |                  |
+============================+======================+==================+
| **Business Unit:**         |                      |                  |
+----------------------------+----------------------+------------------+
| **Name of Individual       |                      |                  |
| Conducting Review:**       |                      |                  |
+----------------------------+----------------------+------------------+
| **Office Location/Room     |                      |                  |
| Numbers Checked:**         |                      |                  |
+----------------------------+----------------------+------------------+
| **Date and Time of         |                      |                  |
| Review:**                  |                      |                  |
+----------------------------+----------------------+------------------+
| **TIGTA Memorandum No.     | **Office of Audit    | **Comments**     |
| 01-21**                    | Guidelines**         |                  |
|                            |                      |                  |
| **Interim Physical         | **Items to be        |                  |
| Security Guidelines,       | reviewed during the  |                  |
| August 8, 2001**           | after-hours physical |                  |
|                            | security review**    |                  |
+----------------------------+----------------------+------------------+
| **Managers and/or          |                      |                  |
| Facilities (OI:IG:MS:P)    |                      |                  |
| Responsibilities:**        |                      |                  |
+----------------------------+----------------------+------------------+
| 1\. Cipher lock            | 1\. Has the          |                  |
| combinations must be       | combination for each |                  |
| changed whenever an        | cabinet containing   |                  |
| employee leaves the        | sensitive            |                  |
| organization. If an        | information and for  |                  |
| employee leaves the        | each door lock been  |                  |
| organization under other   | changed in the past  |                  |
| than honorable             | fiscal year or since |                  |
| circumstances, the cipher  | someone from your    |                  |
| lock combination must be   | office left TIGTA?   |                  |
| changed immediately. At    | If no, please        |                  |
| the very least, cipher     | explain.             |                  |
| lock combinations are to   |                      |                  |
| be changed once a year.    |                      |                  |
+----------------------------+----------------------+------------------+
| 2\. Cipher locks are not   | 2\. Has Standard     |                  |
| dead bolt locks. For       | Form 700, [Security  |                  |
| external access doors,     | Container            |                  |
| cipher locks must be used  | Infor                |                  |
| in conjunction with a dead | mation]{.underline}, |                  |
| bolt lock. A separate dead | been completed and a |                  |
| bolt must be installed on  | copy submitted to    |                  |
| outside entry doors.       | the AIGA's office    |                  |
|                            | for safekeeping. If  |                  |
|                            | no, please explain.  |                  |
+----------------------------+----------------------+------------------+
| 3\. Computer screens are   |                      |                  |
| to be positioned to face   |                      |                  |
| away from windows and      |                      |                  |
| doors, whenever possible.  |                      |                  |
| If the physical lay out of |                      |                  |
| the office does not permit |                      |                  |
| this, at a minimum,        |                      |                  |
| blinds, security screens   |                      |                  |
| or shades need to be       |                      |                  |
| installed and closed while |                      |                  |
| using the computer.        |                      |                  |
+----------------------------+----------------------+------------------+
| 4\. Keys for office doors  |                      |                  |
| and locking files must be  |                      |                  |
| secured when not in use    |                      |                  |
| and kept separate from the |                      |                  |
| cabinets.                  |                      |                  |
+----------------------------+----------------------+------------------+
| 5\. TIGTA offices located  |                      |                  |
| in private buildings       |                      |                  |
| should, at a minimum,      |                      |                  |
| conduct a fire             |                      |                  |
| alarm/evacuation drill at  |                      |                  |
| least once a year.         |                      |                  |
+----------------------------+----------------------+------------------+
| 6\. [TIGTA Offices located |                      |                  |
| in Federal                 |                      |                  |
| Buildings]{.underline}:    |                      |                  |
| Managers should assure     |                      |                  |
| that a copy of the         |                      |                  |
| Occupant Emergency Plan    |                      |                  |
| (OEP) is accessible to all |                      |                  |
| office employees. TIGTA    |                      |                  |
| employees are responsible  |                      |                  |
| for familiarizing          |                      |                  |
| themselves with the OEP.   |                      |                  |
| TIGTA employees should     |                      |                  |
| participate in all OEP     |                      |                  |
| activities, including      |                      |                  |
| evacuation drills.         |                      |                  |
+----------------------------+----------------------+------------------+
| 7\. All TIGTA managers     |                      |                  |
| should be familiar with    |                      |                  |
| the letter dated December  |                      |                  |
| 6, 1999, Recall            |                      |                  |
| Procedure". Each manager   |                      |                  |
| should maintain an         |                      |                  |
| up-to-date recall roster   |                      |                  |
| of employees.              |                      |                  |
|                            |                      |                  |
| ![](media/image1.wmf)      |                      |                  |
+----------------------------+----------------------+------------------+

**Exhibit (300)-130.3 (cont'd)**

## Annual Security and Records Disposition Checklist Physical Security Guidelines

+----------------------------+----------------------+------------------+
| # E                        |                      |                  |
| mployee's Responsibilities |                      |                  |
+----------------------------+----------------------+------------------+
| 8\. Sensitive material and | 3\. If your office   |                  |
| taxpayer information must  | has any files or     |                  |
| not be left out at night   | equipment; i.e.,     |                  |
| or when offices are        | audit reports, LEM   |                  |
| unattended. These          | material, tax        |                  |
| materials are to be stored | returns, which       |                  |
| in a secure area (locking  | require more than    |                  |
| file cabinets).            | normal protection,   |                  |
|                            | are they adequately  |                  |
|                            | protected?           |                  |
|                            |                      |                  |
|                            | If no, please        |                  |
|                            | explain.             |                  |
+----------------------------+----------------------+------------------+
|                            | 4\. Were all         |                  |
|                            | containers used for  |                  |
|                            | official records     |                  |
|                            | appropriately        |                  |
|                            | secured with working |                  |
|                            | locks? If no, please |                  |
|                            | explain.             |                  |
+----------------------------+----------------------+------------------+
|                            | 5\. Was all computer |                  |
|                            | software and data    |                  |
|                            | properly             |                  |
|                            | safeguarded? For     |                  |
|                            | example, indication  |                  |
|                            | of unprotected       |                  |
|                            | sensitive            |                  |
|                            | information,         |                  |
|                            | unattended work      |                  |
|                            | stations not in a    |                  |
|                            | log out or lock-up   |                  |
|                            | mode, or computer    |                  |
|                            | equipment exposed to |                  |
|                            | physical hazards? If |                  |
|                            | no, please explain.  |                  |
+----------------------------+----------------------+------------------+
|                            | 6\. Were all         |                  |
|                            | diskettes or compact |                  |
|                            | discs properly       |                  |
|                            | sorted and           |                  |
|                            | protected? If no,    |                  |
|                            | please explain.      |                  |
+----------------------------+----------------------+------------------+
| 9\. During business hours, | 7\. Were all the     |                  |
| office access should be    | doors locked during  |                  |
| limited to authorized      | and after work       |                  |
| personnel and visitors     | hours?\              |                  |
| only. Doors should be      | \                    |                  |
| locked or entry monitored  | If no, please        |                  |
| by a member of TIGTA       | explain.             |                  |
| staff. Persons seeking     |                      |                  |
| access to TIGTA space who  |                      |                  |
| are unknown to staff, such |                      |                  |
| as individuals providing   |                      |                  |
| maintenance and other      |                      |                  |
| services, should be        |                      |                  |
| required to produce        |                      |                  |
| identification. Visitors   |                      |                  |
| should be escorted at all  |                      |                  |
| times.                     |                      |                  |
+----------------------------+----------------------+------------------+
|                            | 8\. Were there any   |                  |
|                            | instances of         |                  |
|                            | burglary, theft,     |                  |
|                            | housebreaking,       |                  |
|                            | larceny, or robbery  |                  |
|                            | during this          |                  |
|                            | reporting period?\   |                  |
|                            | If yes, please       |                  |
|                            | explain.             |                  |
+----------------------------+----------------------+------------------+
|                            | 10\. Were there any  |                  |
|                            | audit reports or     |                  |
|                            | related data (i.e.,  |                  |
|                            | abstracts,           |                  |
|                            | memorandum, etc.) in |                  |
|                            | the office that are  |                  |
|                            | being kept beyond    |                  |
|                            | the required         |                  |
|                            | disposal period      |                  |
|                            | described in Exhibit |                  |
|                            | (300)-130.1, TIGTA   |                  |
|                            | Records Control      |                  |
|                            | Schedule Excerpts?\  |                  |
|                            | If yes, please       |                  |
|                            | explain.             |                  |
+----------------------------+----------------------+------------------+
|                            | 11\. Were there any  |                  |
|                            | potential fire or    |                  |
|                            | safety hazards in    |                  |
|                            | the TIGTA office     |                  |
|                            | space?\              |                  |
|                            | \                    |                  |
|                            | If yes, please       |                  |
|                            | explain. Also advise |                  |
|                            | whether the hazards  |                  |
|                            | were brought to the  |                  |
|                            | attention of the     |                  |
|                            | TIGTA's Safety       |                  |
|                            | Official and what    |                  |
|                            | was done to correct  |                  |
|                            | the hazard.          |                  |
+----------------------------+----------------------+------------------+

**Exhibit (300)-130.3 (cont'd)**

## Annual Security and Records Disposition Checklist Physical Security Guidelines

+----------------------------+----------------------+------------------+
| # Employee's               |                      |                  |
|  Responsibilities (cont'd) |                      |                  |
+----------------------------+----------------------+------------------+
|                            | 12\. Employees       |                  |
|                            | participating in the |                  |
|                            | Virtual Resource     |                  |
|                            | Solution Program are |                  |
|                            | required to complete |                  |
|                            | the                  |                  |
|                            | Self-certification   |                  |
|                            | Safety and Security  |                  |
|                            | Checklist. The       |                  |
|                            | employee and his/her |                  |
|                            | manager should both  |                  |
|                            | sign and date the    |                  |
|                            | checklist. A copy of |                  |
|                            | the checklist should |                  |
|                            | be provided to the   |                  |
|                            | employee, with the   |                  |
|                            | original maintained  |                  |
|                            | in the employee's    |                  |
|                            | Drop File.\          |                  |
|                            | \                    |                  |
|                            | Are signed           |                  |
|                            | checklists           |                  |
|                            | maintained in the    |                  |
|                            | employee's Drop      |                  |
|                            | File? If no, please  |                  |
|                            | explain.             |                  |
+----------------------------+----------------------+------------------+

**[Exhibit (300)-130.4]{.underline}**

## [SF700 -- Security Container Information Form]{.underline}

SF700 -- Security Container Information

<table>
<colgroup>
<col style="width: 2%" />
<col style="width: 22%" />
<col style="width: 12%" />
<col style="width: 4%" />
<col style="width: 4%" />
<col style="width: 11%" />
<col style="width: 2%" />
<col style="width: 8%" />
<col style="width: 9%" />
<col style="width: 7%" />
<col style="width: 14%" />
</colgroup>
<tbody>
<tr class="odd">
<td colspan="7"></td>
<td rowspan="16"><blockquote>
<p>Warning</p>
<p><strong>WHEN COMGINATION ON PART 2A IS ENCLOSED, THIS ENVELOPE MUST
BE SAFGUARDED IN ACCORDANCE WITH APPROPRIATE SECURITY
REQUIREMENTS.</strong></p>
<p>DETACH HERE</p>
</blockquote></td>
<td colspan="3"></td>
</tr>
<tr class="even">
<td rowspan="15"></td>
<td><h2 id="security-container-information">SECURITY CONTAINER
INFORMATION</h2></td>
<td rowspan="3">1. AREA OR POST (If required)</td>
<td colspan="2" rowspan="3">2. BUILDING (If required)</td>
<td rowspan="3">3.ROOM NO.</td>
<td rowspan="15"></td>
<td colspan="3">CONTAINER NUMBER</td>
</tr>
<tr class="odd">
<td>Instructions</td>
<td colspan="3"></td>
</tr>
<tr class="even">
<td rowspan="2">1.COMPLETE PART 1 AND PART 2A (ON END OF FLAP).</td>
<td colspan="3">COMBINATION</td>
</tr>
<tr class="odd">
<td colspan="3" rowspan="2">4. ACTIVITY (DIVISION, BRANCH, SECTION OR
OFFICE)</td>
<td rowspan="2">5.CONTAINER NO.</td>
<td colspan="3"></td>
</tr>
<tr class="even">
<td>2.DETACH PART 1 AND ATTACH TO INSIDE OF CONTAINER.</td>
<td colspan="3">_____Turns to the (Right) (Left) stop at_____</td>
</tr>
<tr class="odd">
<td>3.MARK PARTS 2 AND 2A WITH THE HIGHEST CLASSIFICATION STORED IN THIS
CONTAINER.</td>
<td>6.MFG. &amp; TYPE CONTAINER</td>
<td colspan="2">7.MFG &amp; TYPOE LOCK</td>
<td>8.DATE COMBINATION CHANGED</td>
<td colspan="3">_____Turns to the (Right) (Left) stop at_____</td>
</tr>
<tr class="even">
<td>4.DETACH PART 2A AND INSERT IN ENVELOPE.</td>
<td colspan="4" rowspan="2">9.NAME AND SIGNATURE OF PERSON MAKING
CHANGE</td>
<td colspan="3">_____Turns to the (Right) (Left) stop at_____</td>
</tr>
<tr class="odd">
<td>5.SEE PRIVACY ACT STATEMENT ON REVERSE.</td>
<td colspan="3">_____Turns to the (Right) (Left) stop at_____</td>
</tr>
<tr class="even">
<td colspan="5">10. Immediately notify one of the following persons, if
this container is found open and unattended.</td>
<td colspan="3"></td>
</tr>
<tr class="odd">
<td>EMPLOYEE NAME</td>
<td colspan="3">HOME ADDRESS</td>
<td>HOME PHONE</td>
<td colspan="3"><h1 id="warning">WARNING</h1></td>
</tr>
<tr class="even">
<td></td>
<td colspan="3"></td>
<td></td>
<td colspan="3">THIS COPY CONTAINS CLASSIFIED INFORMATION WHEN
COMBINATION IS ENTERED.</td>
</tr>
<tr class="odd">
<td></td>
<td colspan="3"></td>
<td></td>
<td colspan="3">UNCLASSIFIED UPON CHANGE OF COMBINATION</td>
</tr>
<tr class="even">
<td></td>
<td colspan="3"></td>
<td></td>
<td colspan="3" rowspan="2"></td>
</tr>
<tr class="odd">
<td></td>
<td colspan="3"></td>
<td></td>
</tr>
<tr class="even">
<td>1. <strong>ATTACH TO INSIDE OF CONTAINER</strong></td>
<td colspan="2"><p>700-101</p>
<p>NSAI3540-01-214-5372</p></td>
<td colspan="2"><p>STANDARD FORM 700 (8-85)</p>
<p>Prescribed by GSA/ISOO</p>
<p>32 CFR 2003</p></td>
<td>2A</td>
<td>INSERT IN ENVELOPE</td>
<td>SF700 (8-85) Prescribed by GSA/ISOO 32 CFR 2003</td>
</tr>
</tbody>
</table>

Standard Form 700 is a two-part form consisting of an envelope with a
tear-off tab and cover sheet. The coversheet and face of the envelope
provide space for information about the activity, container, type of
lock, and who to contact if the container is left open.

Once the cover sheet is filled out, attach it to the inside of the
control drawer or on the inside face of the vault door, with either tape
or magnetically-attached holder. The\
tear-off tab with the combination record should be placed in the
envelope, sealed, and turned over to the security manager for storage.