CHAPTER 300 - AUDITING

(300)-40 [Audit Products and Services]{.underline}

## 40.1 [Overview]{.underline}.  {#overview. .unnumbered}

The Treasury Inspector General for Tax Administration (TIGTA) is
required to conduct, supervise, and coordinate all audits and
investigations relating to the Internal Revenue Service's (IRS) programs
and operations and to keep the Congress, the Secretary of the Treasury,
and the IRS Commissioner informed about problems and remedies in the
administration of IRS programs and operations. The TIGTA policy is to
conduct audits of IRS programs and operations in accordance with various
statutory requirements and standards. These statutory requirements and
standards appear in [**Section
(300)-10**](../../300-10/chapter300-10.doc) of this manual.

The IRS Restructuring and Reform Act of 1998 (RRA 98) also established
specific mandatory review and reporting requirements for the TIGTA, as
follows:

-   *Use of Enforcement Statistics* - The TIGTA shall include in one of
    the semiannual reports (i.e., annually) an evaluation of the
    compliance of the IRS with restrictions under RRA 98 § 1204 on the
    use of enforcement statistics to evaluate IRS employees.

```{=html}
<!-- -->
```
-   *Direct Contact with Taxpayers in Lieu of Representatives* - The
    TIGTA shall include in one of the semiannual reports (i.e.,
    annually) an evaluation of the compliance of the IRS with
    restrictions under Internal Revenue Code (I.R.C.)\
    § 7521(b)(2) regarding directly contacting taxpayers who have
    indicated that they prefer their representatives be contacted.

```{=html}
<!-- -->
```
-   *Taxpayer Designations* - The TIGTA shall include in one of the
    semiannual reports (i.e., annually) an evaluation of the compliance
    of the IRS with restrictions under RRA 98 § 3707 on designation of
    taxpayers.

```{=html}
<!-- -->
```
-   *Filing of a Notice of Lien* - The TIGTA shall include in one of the
    semiannual reports (i.e., annually) an evaluation of the compliance
    of the IRS with required procedures under I.R.C. § 6320.

-   *Seizures* - The TIGTA shall include in one of the semiannual
    reports\
    (i.e., annually) an evaluation of the compliance of the IRS with
    required procedures under subchapter D of chapter 64 for seizure of
    property for collection of taxes, including procedures under I.R.C.
    § 6330 regarding levies. The TIGTA has divided this area into two
    reviews: seizures and levies.

```{=html}
<!-- -->
```
-   *Disclosure of Collection Activities with Respect to Joint
    Returns* - The TIGTA shall include in one of the semiannual reports
    (i.e., annually) a review and certification of whether the Secretary
    is complying with the requirements of I.R.C.\
    § 6103(e)(8) to disclose information to an individual filing a joint
    return on collection activity involving the other individual filing
    the return.

```{=html}
<!-- -->
```
-   *Extensions of Statute of Limitations* - The TIGTA shall include in
    one of the semiannual reports (i.e., annually) information regarding
    extensions of the statute of limitations for assessment of tax under
    I.R.C. § 6501 and the provision of notice to taxpayers regarding
    requests for such extensions.

```{=html}
<!-- -->
```
-   *Employee Misconduct and Employee Terminations and Mitigations* -
    The TIGTA shall include in each semiannual report the following
    information:

```{=html}
<!-- -->
```
-   The number of taxpayer complaints during the reporting period.

-   The number of "serious" employee misconduct and taxpayer abuse
    allegations received by the IRS or the Inspector General (IG) during
    the period from taxpayers, IRS employees, and other sources.

-   A summary of the status of such complaints and allegations.

-   A summary of the disposition of such complaints and allegations,
    including the outcome of any Department of Justice action and any
    monies paid as a settlement of such complaints and allegations.

> Additionally, the TIGTA must include in the annual report any
> termination or mitigation under RRA 98 § 1203.

-   *Denial of Requests for Information on the Basis of the Freedom of
    Information Act (FOIA) or I.R.C. § 6103* - The TIGTA shall conduct
    periodic audits of a statistically valid sample of the total number
    of determinations made by the IRS to deny written requests to
    disclose information on the basis of the FOIA or\
    I.R.C. § 6103. The TIGTA shall include in one of the semiannual
    reports (i.e., annually) information regarding the improper denial
    of requests for information from the IRS identified during these
    periodic audits.

```{=html}
<!-- -->
```
-   *Fair Debt Collection Provision* - The TIGTA shall include in one of
    the semiannual reports (i.e., annually) information regarding any
    administrative or civil actions with respect to violations of the
    fair debt collection provisions of I.R.C. § 6304, including a
    summary of:

```{=html}
<!-- -->
```
-   Such actions initiated since the date of the last report.

-   Any judgments or awards granted as a result of such actions.

```{=html}
<!-- -->
```
-   *Adequacy and Security of IRS Technology* - The TIGTA must provide
    an evaluation (i.e., annually) of IRS technology as to whether it is
    adequate and secure.

Audits of these areas will be assigned to audit teams who will be
responsible for conducting tests, issuing reports, and preparing input
for the semiannual report.

40.2 [Audit Products and Services]{.underline}.

The Office of Audit (OA) conducts comprehensive, independent audits and
other reviews to provide oversight and to improve tax administration. It
provides many types of products and services, such as:

-   Performance Audits.

```{=html}
<!-- -->
```
-   Program Audits.

-   Economy and Efficiency Audits.

-   Information Technology Audits.

-   Electronic Data Processing Audits.

```{=html}
<!-- -->
```
-   Financial Audits.

```{=html}
<!-- -->
```
-   Financial Statement Audits.

-   Financial Related Audits.

-   Government Performance and Results Act of 1993 (GPRA) Audits.

```{=html}
<!-- -->
```
-   Contract Oversight.

-   Integrity Program.

```{=html}
<!-- -->
```
-   Integrity Projects.

-   Audit Tests (designed to identify fraud, waste, and abuse).

-   Assistance to the TIGTA Office of Investigations (OI).

-   Deterrence Presentations.

```{=html}
<!-- -->
```
-   Management Advisory Services.

```{=html}
<!-- -->
```
-   Requests for Reviews/Analyses (may result in an audit report).

The OA may also conduct or support reviews of non-IRS programs if
specifically requested by another IG Office, depending on the
availability of resources.

40.3 [Performance Audits]{.underline}.

Performance audits include program, economy and efficiency, information
technology, and electronic data processing audits. These reviews are
conducted to evaluate internal controls and to satisfy one or more of
the following objectives:

-   Program objectives are proper, suitable, and relevant to the IRS
    mission.

-   Desired results or benefits established for an IRS program are
    achieved.

-   Management systems for measuring effectiveness are adequate.

-   Programs, activities, or functions are managed effectively.

-   The entity has complied with significant laws and regulations
    applicable to the program.

-   The entity is acquiring, protecting, and using its resources
    economically and efficiently.

-   Individual programs complement, duplicate, overlap, or conflict with
    other related programs.

-   Any factors that are inhibiting satisfactory performance are
    identified.

-   Management considers alternatives that might yield results at lower
    costs.

-   Taxpayer rights are protected.

Each performance audit is normally conducted in an appropriate number of
offices to ensure audit results represent a complete and comprehensive
analysis of the particular program under review. The objectives of the
review are determined by the macro and micro risk assessment process.

#### 40.4 [Information Technology Audits]{.underline}. {#information-technology-audits. .unnumbered}

Over the past decade, various oversight groups have repeatedly raised
issues regarding the difficulties the IRS has experienced in modernizing
its information systems. Critical information systems programs are
vulnerable to schedule delays, cost over-runs, and failure to meet
mission goals.

The RRA 98 requires the TIGTA to evaluate the adequacy and security of
the IRS' technology on an ongoing basis.

To accomplish this requirement, the OA will focus reviews on significant
information technology topics including, but not limited to, the
following areas:

-   Developing and Monitoring Information Systems Standards.

-   Requirements Management.

-   Information Systems Investment Decision Management.

-   Systems Development.

-   Change Control Management.

-   Systems Software and Programming Maintenance.

-   Information Systems Product Assurance.

-   System Performance Management.

-   Computer Room/Facility Management.

-   Administration and Control of End-User Computing Resources.

-   Effectiveness of the IRS' Privacy and Disclosure Program.

-   IRS Management's Oversight of the Security Program.

-   Systems Security Controls.

An Audit Guide to Configuration Management ([**Exhibit
(300)-40.1**](#ExhibitConfigurationMgt)) has been prepared for auditors
conducting evaluations of projects using the Systems Development Life
Cycle (SLC). While it is most appropriate for the development and
implementation phase, the audit guide can be applied to any stage of the
SLC.

#### 40.4.1 [Electronic Data Processing (EDP) Audits]{.underline}. Advances in automated information processing technology bring new challenges in security and adaptability. EDP audits address these challenges, and all auditors can conduct these reviews. Aspects of EDP auditing can also be found in audit tests for reviews not categorized as EDP. The OA has a staff specifically dedicated to EDP audits.  {#electronic-data-processing-edp-audits.-advances-in-automated-information-processing-technology-bring-new-challenges-in-security-and-adaptability.-edp-audits-address-these-challenges-and-all-auditors-can-conduct-these-reviews.-aspects-of-edp-auditing-can-also-be-found-in-audit-tests-for-reviews-not-categorized-as-edp.-the-oa-has-a-staff-specifically-dedicated-to-edp-audits. .unnumbered}

The mission of the EDP audit group is to conduct reviews of complex
computer systems located throughout the IRS. These reviews determine
whether systems:

-   Contain adequate safeguards to protect data integrity and data
    processing.

-   Consistently support IRS needs.

-   Are effective, efficient, and economical.

-   Are developed and operated in accordance with applicable policies,
    standards, and procedures.

The EDP audit group has an audit strategy of:

-   Selecting audits based upon greater business risk to the IRS.

-   Conducting audits of national and field installations.

-   Supporting Systems Development and Financial audits on technical
    issues.

#### 40.5 [Financial Audits]{.underline}.  {#financial-audits. .unnumbered}

The RRA 98 established that the TIGTA shall audit and report on the
custodial and administrative accounts of the IRS subject to § 3521(g) of
Title 31, United States Code (U.S.C.).

### The Chief Financial Officers (CFO) Act of 1990, as amended, required that each financial statement prepared under § 3515 of the U.S.C by an agency shall be audited in accordance with applicable generally accepted government auditing standards. Audits will be conducted by the agency IG or by an independent external auditor as determined by the agency IG. Further, the Comptroller General (Government Accountability Office (GAO)) may conduct the audit through his or her own discretion or at the request of the Congress. {#the-chief-financial-officers-cfo-act-of-1990-as-amended-required-that-each-financial-statement-prepared-under-3515-of-the-u.s.c-by-an-agency-shall-be-audited-in-accordance-with-applicable-generally-accepted-government-auditing-standards.-audits-will-be-conducted-by-the-agency-ig-or-by-an-independent-external-auditor-as-determined-by-the-agency-ig.-further-the-comptroller-general-government-accountability-office-gao-may-conduct-the-audit-through-his-or-her-own-discretion-or-at-the-request-of-the-congress. .unnumbered}

### The Government Management Reform Act (GMRA) amended the CFO Act to expand the requirements for audited financial statements to all 24 CFO agencies. The Act also established that the Director of the Office of Management and Budget (OMB) identify components of executive agencies that should have audited financial statements. The IRS is identified as one such component in OMB Bulletin 98-08, Appendix B. {#the-government-management-reform-act-gmra-amended-the-cfo-act-to-expand-the-requirements-for-audited-financial-statements-to-all-24-cfo-agencies.-the-act-also-established-that-the-director-of-the-office-of-management-and-budget-omb-identify-components-of-executive-agencies-that-should-have-audited-financial-statements.-the-irs-is-identified-as-one-such-component-in-omb-bulletin-98-08-appendix-b. .unnumbered}

### The Federal Financial Management Improvement Act of 1996 established that each audit of the financial statements shall report whether the agency financial management systems comply with (1) Federal financial management systems requirements, (2) applicable Federal accounting standards, and (3) the United States Government Standard General Ledger at the transaction level. The Act also established that each IG who prepares a financial statement report shall report to the Congress instances and reasons when an agency has not met the intermediate target dates established in the remedial plan for non-compliant financial management systems. {#the-federal-financial-management-improvement-act-of-1996-established-that-each-audit-of-the-financial-statements-shall-report-whether-the-agency-financial-management-systems-comply-with-1-federal-financial-management-systems-requirements-2-applicable-federal-accounting-standards-and-3-the-united-states-government-standard-general-ledger-at-the-transaction-level.-the-act-also-established-that-each-ig-who-prepares-a-financial-statement-report-shall-report-to-the-congress-instances-and-reasons-when-an-agency-has-not-met-the-intermediate-target-dates-established-in-the-remedial-plan-for-non-compliant-financial-management-systems. .unnumbered}

### The extent of OA involvement in Financial Statement audits depends upon the role selected by the GAO and Treasury Inspector General, who have responsibility for the Department--wide statements.  {#the-extent-of-oa-involvement-in-financial-statement-audits-depends-upon-the-role-selected-by-the-gao-and-treasury-inspector-general-who-have-responsibility-for-the-departmentwide-statements. .unnumbered}

40.5.1 [Financial Statement Audits]{.underline}. The TIGTA will audit
the annual IRS financial statements, contract for audit services with an
independent external auditor, or defer audit responsibilities to the
GAO, if so opted by the Comptroller General.

If the financial statement audit is contracted with an independent
external auditor, the TIGTA will designate representatives as
Co-Contracting Officer's Technical Representatives, as well as necessary
staff support, for overseeing that audit performance complies with the
standards established by the Comptroller General as directed by the
Inspector General Act of 1978.

If the Comptroller General exercises his or her option to audit the
financial statements of the IRS, as provided in the CFO Act, the TIGTA
will provide audit support as mutually agreed upon.

In addition to applicable laws, regulations, and departmental guidance,
the TIGTA will conduct financial statement audits following the guidance
and methodology as established by the following:

-   Comptroller General of the United States, *[**Government Auditing
    Standards**](http://www.gao.gov/cgi-bin/getrpt?GAO-07-731G)*
    (*GAGAS*), July 2007 Revision, ("Yellow Book")***.***

-   OMB Bulletin 98-08, *Audit Requirements for Federal Financial
    Statements*, or its successors.

-   President's Council on Integrity and Efficiency (PCIE) Policy
    Manual, *Federal Financial Statement Audit Manual*.

-   American Institute of Certified Public Accountants standards of
    *fieldwork* and *reporting* as incorporated in their entirety in the
    *GAGAS* by reference.

The TIGTA will adhere to the risk-based methodology as defined in the
PCIE Policy Manual.

40.5.2 [GPRA Reviews]{.underline}. The TIGTA will annually develop and
implement review plans to assess the IRS' implementation of the GPRA
provisions.

If the Comptroller General exercises his or her option to audit the
financial statements of the IRS, as provided in the CFO Act, the TIGTA
will determine the extent of the IRS' GPRA planning, measuring, and
reporting included in the financial statement audit and plan accordingly
to meet the review and reporting requirements.

The reviews will be performed in accordance with the *GAGAS* and
guidance as provided in OMB Bulletin 98-08, or its successors, as they
pertain to the reporting of performance measures.

The reviews will also follow the guidance provided in the *Managerial
Cost Accounting Standards of the Federal Financial Accounting Standards*
in determining whether the IRS has complied with the standard of
reporting performance indicators at full cost.

The reviews will include:

-   An examination of the IRS' efforts to develop and use performance
    measures for determining progress toward achieving planned
    performance goals and program outcomes, and performance reports.

-   The verification and validation of selected data sources and
    information collection and accounting systems that support agency
    performance plans, performance reports, and strategic plans.

The TIGTA will consult with appropriate Congressional committees and the
Secretary of the Treasury in determining the scope and course of the
review.

In determining the scope of the review, the TIGTA shall emphasize those
performance measures associated with programs or activities for which:

-   There is a reason to believe there exists a high risk of waste,
    fraud, or mismanagement.

-   A review of the controls applied in developing the performance data
    is needed to ensure the accuracy of those data.

40.5.3 [GPRA Reporting Requirements]{.underline}. The TIGTA shall submit
the review plan to the Secretary of the Treasury at least annually as
part of the semiannual reports required by the IG Act of 1978.

The TIGTA shall submit findings, results, and recommendations of the
reviews to the Secretary of the Treasury as part of the semiannual
reports required by the IG Act of 1978.

#### 40.6 [Follow-up Audits]{.underline}. {#follow-up-audits. .unnumbered}

Follow-up audits provide an opportunity for the OA to assess the
effectiveness of prior recommendations and the corrective actions of IRS
management. The Joint Audit Management Enterprise System (JAMES) will be
used to ensure that IRS management takes actions on audit
recommendations. The Office of Management Controls is responsible for
inputting report information into the JAMES.

IRS management is responsible for completing a plan for tracking and
ensuring the effectiveness of corrective actions taken in response to an
OA report. Since the OA does not have the resources to follow up on
every audit, auditors will use this plan to identify any corrective
actions needing follow-up. The appropriate Assistant Inspector General
for Audit will periodically follow up to ensure that JAMES closing
documents agree with the actions described in management's action plan.

The only other type of follow-up activity will be when outcomes could
not be measured at the time of final report issuance and/or for highly
significant issues. Auditors will make such recommendation at the
conclusion of the audit. If a follow-up is recommended, the auditors
will prepare a plan showing when follow-up action should be taken for
each corrective action and what audit steps need to be taken.

See [**Section
90.19**](../../300-90/chapter300-90.doc#PreparingITCSForms)**,**
Preparing Joint Audit Management Enterprise System Corrective Action
Forms, for more information on the use of JAMES documents.

#### 40.7 [Contract Oversight]{.underline}. {#contract-oversight. .unnumbered}

The RRA 98 and IG Act of 1978, as amended, require the TIGTA to conduct
audits relating to programs and operations. The DIGA must coordinate
with other Federal agencies relating to the audit activity of the
agency. The role of the DIGA in contract auditing is to assist in
achieving prudent contracting by:

-   Promoting the economic, efficient, and effective administration of
    IRS contracting operations.

-   Detecting and deterring fraud, waste, and abuse in IRS contract
    award and administration.

```{=html}
<!-- -->
```
-   Protecting the IRS against attempts to conspire or collude with IRS
    employees in the award and administration of contracts.

The contract audit responsibility includes audits of both the IRS'
management of the procurement function and audits of contractors'
performance. Audit responsibility for contractors has been established
with the Defense Contract Audit Agency or cognizant audit organizations
in other Federal agencies. The DIGA is responsible for coordinating
audit coverage with the cognizant audit organization or providing needed
audit coverage when contract audit assistance cannot be or is not
provided. If the TIGTA has been designated the cognizant audit agency,
the DIGA may elect to use TIGTA staff, independent public accountants,
or other Federal auditors to perform the audits.

Contract audit activities include providing professional advice to those
responsible for government procurement on accounting and financial
matters to assist in the negotiation, award, administration, re-pricing,
and settlement of contracts. The Federal Acquisition Regulation (FAR)
15.404-2 presumes that contracting officers will obtain field pricing
assistance when information available at the buying activity is
inadequate to determine a fair and reasonable price. Field pricing
assistance is directed at obtaining technical, audit, and special
reports associated with the cost elements of a proposal. Audit interest
encompasses the totality of the contractor's operations, and reviews are
performed to assure the existence of adequate controls, which will
prevent or avoid wasteful, careless, and inefficient practices by
contractors. These reviews include the evaluation of a contractor's
policies, procedures, controls, and actual performance, as well as
identifying and evaluating all activities, which contribute to, or have
an impact on, proposed or incurred costs of government contracts. Areas
of concern include:

-   The adequacy of the contractor's policies, procedures, practices,
    and internal controls relating to accounting, estimating, and
    procurement.

```{=html}
<!-- -->
```
-   The evaluation of the contractor's management policies and decisions
    affecting costs.

-   The accuracy and reasonableness of the contractor's cost
    representations.

-   The adequacy and reliability of the contractor's records for
    government-owned property.

-   The financial capabilities of the contractor.

-   The appropriateness of contractual provisions having accounting or
    financial significance.

To assist the IRS in awarding and administering contracts, the contract
auditor provides the Contracting Officer (CO) with financial advice and
recommendations. For example, before the IRS awards a contract, the CO
can request a proposal audit where the auditor provides an evaluation of
the allowability and reasonableness of the cost proposed by the
prospective contractor (offeror). In addition, upon request by the CO,
the auditor can provide advice and recommendations on financial-related
issues such as the adequacy of the offeror's cost accounting system and
the offeror's financial capability to perform the contract work. After a
contract is awarded, the auditor can assist the CO in administering the
contract through various audits. Specifically, the auditor can provide
an opinion on the allowability of the actual costs claimed by the
contractor, the contractor's compliance with contract terms and
applicable laws and regulations, and the adequacy of the contractor's
cost accounting system. Because TIGTA auditors are independent of the
procurement organization, they are able to offer objective advice and
recommendations to the CO and the procurement team.

TIGTA auditors may provide technical assistance in contract audit
matters during the course of a fraud investigation or inquiry.

Additional guidance on auditing contracts and grant agreements is
included under GAGAS paragraphs 7.28-7.29. Auditors should design and
perform procedures to provide reasonable assurance of detecting
instances of violations or contracts or grant agreements that are
significant within the context of the audit objectives. Section (300)-70
is reserved for future detailed procedures for conducting contract
audits and contract oversight assignments.

40.7.1 [OA Contract Audit Policy]{.underline}. The OA's overall policy
regarding contract audits of the IRS is:

-   IRS management is responsible for requesting contract audits.

-   The OA will coordinate with IRS Procurement to provide oversight to
    ensure that contract audits are made and reports are received as
    required.

-   The OA will coordinate with the cognizant audit agency.

-   The OA will review audit reports and make quality control reviews of
    selected audits to ensure they are conducted in accordance with
    generally accepted government auditing standards.

-   The OA will advise non-Federal auditors of audits that do not meet
    required standards and provide assistance to enable the non‑Federal
    auditors to correct deficiencies.

-   The OA will issue audit reports to appropriate agency officials and
    require OA approval before releasing the report, except to an agency
    requesting the report for use in negotiating or administering a
    contract with the contractor.

-   The OA will oversee the resolution of audit findings.

#### The principal types of contract audits are the proposal audits and the incurred cost audits. In addition, contract auditing includes audits of cost accounting systems, financial capability, forward pricing rates, termination claims, defective pricing, and progress payments.  {#the-principal-types-of-contract-audits-are-the-proposal-audits-and-the-incurred-cost-audits.-in-addition-contract-auditing-includes-audits-of-cost-accounting-systems-financial-capability-forward-pricing-rates-termination-claims-defective-pricing-and-progress-payments. .unnumbered}

40.8 [Fraud, Waste, and Abuse Awareness During the Audit
Process]{.underline}.

As part of its mission, the OA is responsible for conducting
comprehensive, independent performance and financial audits of IRS
programs and operations to prevent, detect, and deter fraud, waste, and
abuse. In exercising due professional care, auditors should be alert
specifically to the possibilities of intentional wrongdoing, errors and
omissions, inefficiency, waste, ineffectiveness, and conflicts of
interest on every audit assignment.

Fraud specifically deals with illegal acts involving the obtaining of
something of value through willful misrepresentation. Abuse is distinct
from illegal acts and other noncompliance and occurs when no law,
regulation, contract provision, or grant agreement is violated. Instead,
the conduct of the government program falls far short of societal
expectations for prudent behavior. Vulnerabilities to fraud, waste, and
abuse should be considered during the planning process and are based
upon an assessment of management controls, management information
systems, and the risk of financial gain by program users, beneficiaries,
providers, contractors, or others.

IRS employees who commit fraud seek out ways and means to circumvent
management and operating controls. Many employee schemes are discovered
by alert, imaginative auditors. These auditors approach auditing
assignments with the belief that no system is perfect or completely
foolproof and that procedures which appear highly reliable may, in fact,
be highly unreliable.

In conducting audit tests, auditors are responsible for making
reasonable assurances that widespread or large-scale improprieties do
not exist. However, auditors are not expected to identify all isolated
breaches of integrity or guarantee that employee improprieties have not
occurred. The extent of testing depends upon the control environment and
risk vulnerabilities of the area being audited. GAGAS paragraphs
7.30-7.32 contain additional guidance on fraud. During the audit
planning process, auditors should assess the risks of fraud occurring
that are significant within the context of the audit objectives. This
assessment process should be documented in the workpapers.

Third-party sources can help in detecting fraud, waste, and abuse. These
sources can be accessed by:

-   Confirmation letters.

-   Telephone and personal interviews.

-   Reviews of public records, such as telephone books, street
    directories, county tax assessments, records of deed and mortgage
    documents, and vehicle registration records.

Other audit techniques that can be used to detect fraud, waste, and
abuse include:

-   Creating computer programs to identify pre-determined suspect items.

-   Analyzing transaction files to identify specific transaction codes
    or combinations of transaction codes that indicate potential
    breaches of integrity.

-   Reviewing closed cases and identified trends in the Problem
    Resolution Program.

-   Observing the physical security practices of offices under review.

-   Reviewing management reports and processes designed to provide audit
    trails, such as Collection's Delinquent Investigation/Account
    Listings.

Discovery sampling is recommended for detecting fraud, waste, and abuse.
However, required sample sizes are often too large to make this
technique feasible. Scanning techniques are used to identify suspect
items during fraud detection tests.

When control weaknesses or questionable work practices create the
climate for potential integrity breaches, auditors should recommend the
initiation of integrity projects.

When employee fraud is detected, audit results are developed and
referred to the OI for review and evaluation. Subsequent OA reports will
include the OI's results but are not delayed solely to report these
results. Reports issued with pending OI actions will contain the
disclaimer: "Our audit tests identified potential integrity breaches
that have been referred to the OI for review and evaluation."

40.8.1 [Referrals to the OI]{.underline}. Auditors should evaluate all
potential integrity breaches, whether they are made by IRS employees or
non-IRS persons, for possible referral to the OI.

Auditors should immediately discuss possible integrity breaches with
their Audit Managers. Audit Managers, in conjunction with their
Director, decide whether a referral is warranted. The Audit Manager will
meet with the appropriate Special Agent-in-Charge (SAC) to discuss any
referred breaches. The appropriate SAC will evaluate the referral and
determine if an investigation is warranted.

Audit Managers should prepare formal referral memoranda and send them to
their Directors for review and submission to their AIGAs. The AIGA will
send the referral memorandum to the appropriate Assistant Inspector
General for Investigations (AIGI). When a critical issue is involved
that needs to be addressed immediately, a copy of the referral may be
sent simultaneously to the appropriate Special Agent-in-Charge.
Memoranda to the OI should include:

-   Specific details on what was found and why an investigation is
    warranted by the OI.

-   Background information on questioned items. Auditors should describe
    controls currently in use to detect integrity breakdowns and whether
    they were bypassed in the items referred.

-   Comments on discussions previously held with the OI and the results
    of these discussions. Whenever possible, investigative steps should
    be suggested.

Audit Managers should consider discussing key issues of referrals not
warranting investigation with operational management since these issues
may warrant corrective action. Regardless, case dispositions should be
documented in audit workpapers.

A new process was implemented in March 2006 to better track and report
OA's activities involving both referrals from the OA to the OI and
referrals from the OI to the OA. A centralized process that incorporates
procedures for fixed periodic updates on referrals was implemented to
facilitate development of the OA Performance Report. This process will
also assist in tracking the overall inventory of referrals and help
ensure referrals are appropriately worked.

The Business Units were provided with a spreadsheet showing the baseline
inventory and status of referrals. Each worksheet will be updated
quarterly (December, March, June, and September) to include new
referrals received and issued and the status of existing referrals. The
updated worksheets will be submitted to OMP by the person designated by
their business unit. The time frames for submission will follow the
established dates for submitting updated TeamCentral Management
Information System data. The completed worksheet should show if the OI
referral will be addressed in a planned audit, the audit number, and the
planned start date. If the referral was closed by an audit, the report
title and number should be entered on the worksheet. To facilitate
obtaining status data on referrals made to the OI, the relevant referral
memoranda issued to AIGI must request that the SAC provide quarterly
updates to the OA on the status of the OA referral.

Auditors may also identify potential unauthorized accesses to taxpayer
records (UNAX) leads from audits or receive reports of potential leads
from management or other sources. The potential UNAX leads should be
referred to the SAC responsible for the geographical area or employee
category as outlined in the OI's [**Section
(400)-370**](../../../chapter400-inv/400-370/chapter400-370.doc).

40.8.2 [Providing Assistance to the OI]{.underline}. The objective of
providing OA assistance to the OI is to lend technical support, when
needed, to investigations of employees suspected of, or alleged to have
committed, breaches of integrity.

Assistance to the OI could include the following:

-   Providing computer assistance.

-   Reviewing IRS records or other documentation involving potential
    integrity violations.

-   Participating with OI special agents in interviews of employees or
    third parties.

-   Testifying in criminal and administrative courts, as needed.

Audit Managers should ensure experienced auditors are available to
assist OI special agents with information about IRS functions and
controls.

When case reviews or in-depth research is needed to assist the OI, Audit
Managers should determine which of their auditors is available and best
qualified to provide assistance.

Assistance provided to the OI that does not exceed 10 staff days should
be charged to the general Investigation Collaterals (200x0910) project
number in Inspector General Audit Management Information System. For
requests exceeding 10 staff days, Audit Managers should obtain an
individual project number.

For requests estimated to last more than 10 days, Audit Managers should
ask that the OI prepare formal memoranda requesting OA assistance. These
memoranda should be addressed from the requesting AIGI to the
appropriate AIGA with a copy provided to the appropriate OA Director.

When the assistance is completed, a memorandum should be prepared
outlining the results of the OA's assistance. The memorandum should
contain a statement describing what internal controls were reviewed and
any control weaknesses found. If no internal control review was
performed, the closing memorandum should have a statement that no review
was performed. The closing memorandum should be:

-   Forwarded by the Director for the AIGA's signature.

-   Transmitted to the requesting AIGI.

-   Cross-referenced to the original OI memorandum control number.

```{=html}
<!-- -->
```
-   Maintained in the OA offices with copies of the formal OI request.

### 40.9 [Review of Investigative Imprest Funds]{.underline}.  {#review-of-investigative-imprest-funds. .unnumbered}

The responsibility for Investigative Imprest Fund reviews belongs to the
Office of Investigations (OI) Operations Division. The OA conducts
bi-annual financial reviews of the OI's eight investigative Imprest
Funds in support of OI's efforts. The OA's reviews will alternate with
the OI's reviews. As such, four funds will generally be reviewed each
fiscal year. All four OA Business Units will conduct these reviews with
coverage based on the post of duty location of the imprest funds. The
DIGA will issue the bi-annual review schedule.

Audits of the Investigative Imprest Funds will be conducted in
accordance with applicable auditing standards. To ensure the quality of
the work supporting the Investigative Imprest Fund report, Audit
Managers must review all workpapers before the report is issued.
Referencing may be conducted on a case-by-case basis at the discretion
of management.

The review of the funds will **not** include reviewing OI's records
regarding seized moneys and property, the projects on which OI incurred
fund expenditures (that is, reviews of the reasonableness of
expenditures, timing of expenditures, transfers of funds between agents,
etc.). The objectives of an audit of Investigative Imprest Funds will be
limited to the financial aspects of the fund and will include:

-   Fund status.

-   Fund maintenance.

-   Fund level.

-   Authorization for Advances.

-   Investigative Imprest Fund Cashier Preparation and Processing of
    Claims for Reimbursement and Reimbursement Vouchers.

-   Fund verification.

-   Bank account reconciliation.

-   Security review.

-   Verification of unannounced quarterly reviews.

The Investigative Imprest Fund Checklist should be used for these
reviews. The Checklist can be found in **File/New/Audit
Forms/Investigative Imprest Fund Checklist.dot** and in TeamMate. Also,
a form for reconciling the fund is contained in [**Exhibit
(300)-40.2**](../chapter300-40.doc#imprestreconciliation),
Reconciliation of Investigative Imprest Fund. This form is patterned
after the IRS' Form 2844, Reconciliation of Imprest Fund.

Audit reports on Investigative Imprest Funds will be prepared and
provided to the appropriate Assistant Inspector General for
Investigations (AIGI) for response. These reports will be prepared in a
PowerPoint format. The AIGI will prepare a response to the draft report
and issue the response to the Deputy Inspector General for
Investigations (DIGI). The response will include the AIGI's assessment
of the causes and corrective actions proposed and taken for any findings
reported and an explanation for all unusual or questionable transactions
identified by the audit.

Additional information on Investigative Imprest Funds may be found in
TIGTA Operations Manual [**Chapter
(400)-30.5.2**](../../../chapter400-inv/400-30/chapter400-30.doc) (OI
responsibilities) and in **[Chapter
(600)-50.11.2](../../../chapter600-ms/600-50/600-50-11.doc#FM11_2)**
(Office of Management Services responsibilities).

40.10 [OA Responsibilities Concerning Foreign Intelligence
Activities]{.underline}.

Treasury Order 115-01 requires the TIGTA, along with Treasury General
Counsel, to the extent provided by law, to report to the President's
Intelligence Oversight Board intelligence activities of the IRS and
related entities where there is reason to believe the activities may be
unlawful or contrary to Executive Order or Presidential Directive.

40.11 [Professional Services Other Than Audits (Nonaudit
Services)]{.underline}.

The GAGAS do not cover professional services other than audits (nonaudit
services) since such services are not audits or attestation engagements.
Therefore, auditors must not report that the nonaudit services were
conducted in accordance with GAGAS. When performing nonaudit services
for an entity for which the audit organization performs a GAGAS audit or
attestation engagement, audit organizations should communicate, as
appropriate, with requestors and those charged with governance to
clarify that the scope of work performed does not constitute an audit
under GAGAS.

Audit organizations that provide nonaudit services must evaluate whether
providing nonaudit services creates an independence impairment either in
fact or appearance with respect to the entities they audit (GAGAS
1.33-1.34). For more information on independence and nonaudit services,
please see the GAGAS paragraphs 3.20-3.30 in [**Exhibit
(300)-30.1**](../../300-30/chapter300-30.doc#nonauditservices).

IRS management may periodically request that the OA provide technical
assistance or advisory nonaudit services. Examples include IRS efforts
to implement new operational processes, develop new control systems, or
consider new program changes. Usually, these projects would not be
designed to result in significant traditional audit or evaluation
products. All requests of this nature should be communicated from the
IRS Commissioner to the TIGTA for evaluation. Such requests may be
undertaken when they will not affect the delivery of the annual audit
plan and there is significant justification indicating the expertise and
resources are not available from sources within the IRS. An audit report
will be issued to communicate the OA's findings and observations.

IRS management may also ask that OA employees be included in task force
activities. Again, these requests should come from the IRS Commissioner
to the TIGTA and will be filled based upon availability of resources and
the need for such participation. IRS management must be made aware that
such OA participation is advisory in nature and does not prevent the OA
from conducting subsequent reviews.

IRS management may also ask for assistance to obtain computer extracts
or perform data analysis. Likewise, requests must come from the IRS
Commissioner to the TIGTA and will be fulfilled based upon availability
of staff, importance of the request, and ability of the IRS to perform
the same task.

**[Exhibit (300)-40.1]{.underline}**

[]{#ExhibitConfigurationMgt .anchor}[Audit Guide to Configuration
Management]{.underline}

The following questionnaire was designed to provide an assessment of
Configuration Management (CM) controls of any information technology
project. The questions are based upon the IRS' guidelines for
implementing CM processes. The questionnaire can be modified to apply to
a project in any stage of the SLC, but it is most appropriate during the
development and implementation phase.

The IRS [Information Systems Enterprise Configuration Management Plan
(CMP)]{.underline} and the [CM Process Procedures Handbook]{.underline}
provide the IRS' guidelines for implementing standard CM processes to
support the modernization effort. The CMP guidelines establish uniform
policies, provide guidance, and stipulate minimum requirements that are
essential for the implementation of effective CM processes and
procedures. The CMP complies with and implements the IRS' "adopted"
industry standards. In addition, it delineates these standards to allow
for further definition of the requirements as they pertain to individual
development, test, support, or maintenance functions throughout the
Modernization and Information Technology Services (MITS) establishment.
All of the IRS' modernization and related legacy
interfaces/organizations are required to develop detailed process
controls and procedures based upon the CMP.

# Organizational Requirements: {#organizational-requirements .unnumbered}

# *All MITS organizations involved in the analysis, design, development, integration, testing, implementation, and operation of IRS modernization and related legacy systems are responsible for implementing CM controls within their functions.* {#all-mits-organizations-involved-in-the-analysis-design-development-integration-testing-implementation-and-operation-of-irs-modernization-and-related-legacy-systems-are-responsible-for-implementing-cm-controls-within-their-functions. .unnumbered}

## Is the organizational function aware of the CMP guidelines?

### If so, where are the affected organizations and their related functions defined?

## How has the organizational function implemented the IRS' CM requirements?

### If not, why not and what is being used/done?

## Does this function have a "project specific" configuration control board? 

### If so, who are its members?

### If not, who performs this review function?

## Have the major milestone reviews (system requirement review, system design review, critical design review, sub-release test review, pre-implementation review) been completed?

### If so, who conducted the reviews and what were the results of each review covering the systems under control?

### If not, why not?

## Does the function have a current, credible CM activity network/team identified by a work breakdown scheme?

### Who is responsible for the CM process?

### How and when are they carrying out their responsibilities? 

**[Exhibit (300)-40.1 (cont'd)]{.underline}**

[Audit Guide to Configuration Management]{.underline}

##  {#section .unnumbered}

## Has the organizational function identified adequate staff to allocate to the scheduled tasks at the scheduled times?

### Does the staff have sufficient expertise in the system/interface domains?

### Does the function have a current, credible CM schedule and budget?

# CM Processes:  {#cm-processes .unnumbered}

> *CM establishes and maintains the integrity of various products
> throughout a system's life cycle in the long-term modernization of the
> IRS' information systems that support tax processing, tax support
> processing, and management*.

-   **Is there an approved and documented CM process for this
    function?**

```{=html}
<!-- -->
```
-   If so, what classes of information does the CM process control,\
    e.g., computer-aided software engineering tools, budgets and related
    expenditures, hardware items and layouts, software artifacts such as
    original source code?

-   How many items/products are under control?

-   What configuration items/products are under control?

```{=html}
<!-- -->
```
-   **Does the CM process contain procedures to:**

```{=html}
<!-- -->
```
-   Accept information into the configuration control process?

-   Identify the attributes of each configuration product?

-   Update the item/product once it has been baselined?

```{=html}
<!-- -->
```
-   **Do the CM controls cover:**

```{=html}
<!-- -->
```
-   Product history?

-   Product reproducibility?

-   Process verification?

-   Requirement traceability?

-   Work performance assurances?

-   Interface management?

-   Decision making?

-   Product confidence?

```{=html}
<!-- -->
```
-   **Does the organizational function have a Command Center responsible
    for CM activities?**

```{=html}
<!-- -->
```
-   If so, does the Command Center make the decisions to control or not
    to control configuration items/products?

-   When and how are those decisions made?

-   If not, who makes those decisions?

```{=html}
<!-- -->
```
-   **Does the organizational function have a CM process for
    controlling\
    non-product software that is shared?**

**[Exhibit (300)-40.1 (cont'd)]{.underline}**

[Audit Guide to Configuration Management]{.underline}

#  {#section-1 .unnumbered}

# Configuration Plans:  {#configuration-plans .unnumbered}

> *Configuration control is the systematic identification, evaluation,
> disposition, and (if approved) implementation of changes to
> modernization and related legacy interface products after the
> configuration product is formally placed under control.*

-   **Does an approved "configuration control" plan accurately reflect
    the CM process being followed?**

```{=html}
<!-- -->
```
-   Is the "configuration control" plan current and approved?

-   Is the "configuration control" process adequately supported by
    effective tools?

-   Are there sufficient resources and organizational support and
    discipline to support the "configuration control" requirement?

```{=html}
<!-- -->
```
-   **Is there a "process improvement" plan in place to upgrade the
    configuration control process?**

```{=html}
<!-- -->
```
-   If so, is the "process improvement" plan implemented and adequately
    supported?

# Baseline Management: {#baseline-management .unnumbered}

> *The CM process enables an initial baseline to be identified,
> controlled, and updated through the system's life cycle. Baselines,
> plus all approved changes to those baselines, constitute the current
> configuration identification. The identification of configuration
> products is closely coupled with the design process and is determined
> by the need to control a configuration product's inherent
> characteristics and interfaces with other items*.

-   **Does the organizational function have in place a documented
    process for uniquely identifying each "baselined" document, approved
    management action, engineering assurance, or reporting product?**

```{=html}
<!-- -->
```
-   When and how are identifiers assigned to configuration
    items/products?

-   Who assigns the identifiers and where are the assignments made?

-   Are records of these controlled items current (i.e., reflect the
    most recent system release/version)?

-   Who establishes baselines for configuration items/products and how
    are the baselines established?

-   Who manages item/product baselines?

-   When and how are the baselines protected?

```{=html}
<!-- -->
```
-   **How and where are the baselined items/products and related
    documentation maintained?**

```{=html}
<!-- -->
```
-   Has the CM process partitioned this information into designated
    baselines such as Documentation, Hardware, Design, or Product?

-   Does the CM process maintain traceability and control among the
    partitions?

-   Who determines what documentation is needed to support an
    item/product and how are those items controlled?

**[Exhibit (300)-40.1 (cont'd)]{.underline}**

[Audit Guide to Configuration Management]{.underline}

-   Who authorizes the release of configuration products and their
    related documents?

# Configuration Controls:  {#configuration-controls .unnumbered}

> *A Configuration Control Board will evaluate and approve/disapprove
> all changes to baselined products and associated documentation placed
> under configuration control*.

-   **Does the function have in place an approved process for proposing
    changes to baselined information and for evaluating and approving
    these changes prior to implementation?**

```{=html}
<!-- -->
```
-   Who performs this activity and where is this activity accomplished?

-   Who is responsible for managing interface concerns with other
    products?

```{=html}
<!-- -->
```
-   **Does the function have in place a documented process for
    evaluating the management, technical, and assurance impacts of a
    change to baselined information?**

```{=html}
<!-- -->
```
-   Are these impacts resolved to permit compatible interfacing with
    other activities and products?

-   Are resolved/unresolved impacts considered before a change is
    approved?

```{=html}
<!-- -->
```
-   **Does the organizational function maintain records and audit trails
    on the status of proposed changes that are pending or have been
    approved for implementation?**

#  {#section-2 .unnumbered}

# Configuration Changes:  {#configuration-changes .unnumbered}

> *The originator will identify and describe a proposed change to
> products and associated documentation in a manner that permits other
> personnel to assess the impacts that the change may have on other
> products and associated documents under their responsibility. The
> change will be uniquely and permanently identified to readily
> distinguish it from other changes*.

-   **Describe the organization's "change control" process.**

```{=html}
<!-- -->
```
-   Who in the organization is responsible for change control of
    baselined and\
    non-baselined items?

-   What tools are used and how are they controlled?

-   How are artifacts controlled and maintained?

-   Who is responsible for processing change requests?

-   How are change requests identified?

-   How and where are the change requests prioritized?

-   How are the change requests resolved?

> **[Exhibit (300)-40.1 (cont'd)]{.underline}**

[Audit Guide to Configuration Management]{.underline}

-   **Are implemented changes evaluated for effectiveness?**

```{=html}
<!-- -->
```
-   If so, who evaluates the changes and when are they tested?

-   How and where are the changes evaluated?

```{=html}
<!-- -->
```
-   **Who monitors the installation of approved changes and how is this
    done?**

# Configuration Accountability:  {#configuration-accountability .unnumbered}

> *CM status accounting provides accurate recording, storing, and
> reporting of the statuses of configuration products/versions, related
> documentation, and proposed changes throughout the products' life
> cycles. Status accounting includes three distinct processes: data
> recording, data storing, and data reporting. Defining and implementing
> the status accounting structure and process are critical to
> effectively managing information systems configuration products*.

-   **Who performs the status accounting activity to monitor the CM
    process?**

-   **Does the organizational function have in place a means to monitor
    and document the status and currency of all information that it
    controls?**

-   **Does the organization update this status when a change or release
    is made through the configuration control process?**

-   **Does the organization maintain a version description document for
    all prior software versions and new releases?**

-   **Does the "version description" contain a standardized format to
    document:**

```{=html}
<!-- -->
```
-   The superceded versions?

-   The problems closed by the release?

-   The problems still open with this release?

-   Limitations and restrictions of the release?

```{=html}
<!-- -->
```
-   **What reports are generated by the status accounting system?**

```{=html}
<!-- -->
```
-   Can the accounting system generate ad hoc reports?

-   Who uses the accounting reports and how are they used?

# Documentation Library:  {#documentation-library .unnumbered}

> *A library is a controlled area or facility where the physical and
> electronic masters of configuration items, historical records, user
> information, and reference materials such as milestone reviews are
> preserved, archived, and made available to authorized users*.

-   **Has the project established a Documentation Library?**

-   **Who is the project's librarian and what are the librarian's
    responsibilities? Do they include:**

```{=html}
<!-- -->
```
-   The control of all master copies and related documents?

**[Exhibit (300)-40.1 (cont'd)]{.underline}**

> [Audit Guide to Configuration Management]{.underline}

-   Maintaining records of activities, products, and documentation to
    recreate the development history of the products residing in the
    library?

```{=html}
<!-- -->
```
-   **What information is maintained in the project's documentation
    library?**

-   **Does the organizational function have a software library for
    in-house activities?**

```{=html}
<!-- -->
```
-   If so, who is responsible for the operations and for the integrity
    of stored items/products?

-   How do they coordinate the synchronization of software products,
    related versions, and associated documentation?

-   How do they ensure that the library contains the most current
    version of each software product?

-   Are they required to maintain the appropriate documentation for each
    software version?

```{=html}
<!-- -->
```
-   **Does the library activity ensure that releases are made only to
    authorized personnel?**

```{=html}
<!-- -->
```
-   Have "check in" and "check out" procedures been developed,
    implemented, and maintained for baseline documentation and software
    products?

-   Does the library maintain all versions and records related to a
    release?

-   When, where, and how are these activities accomplished?

```{=html}
<!-- -->
```
-   **Does the library maintain a current listing of all holdings
    residing in the area/facility?**

-   **Does the library facilitate quality assurance audits and technical
    reviews as appropriate?**

-   **Does the library generate reports listing the current software
    product and document inventory?**

```{=html}
<!-- -->
```
-   If so, who receives these reports and how are they used?

-   Can the library generate ad hoc reports?

# Configuration Management Audits:  {#configuration-management-audits .unnumbered}

> *CM audits provide the framework for verifying that documents are
> accurate and that the development activity has satisfied all of the
> baselined requirements*.

-   **What are the function's audit procedures?**

```{=html}
<!-- -->
```
-   Do these procedures follow the IRS' [CM Audit
    Procedures]{.underline}?

```{=html}
<!-- -->
```
-   **Who is responsible for Physical and Functional Audits of the
    organizational activities?**

```{=html}
<!-- -->
```
-   Has the project scheduled or conducted regular reviews and/or audits
    of information to verify accuracy against approved standards,
    expected delivery content, and/or currency and completeness of
    baselines?

**[Exhibit (300)-40.1 (cont'd)]{.underline}**

> [Audit Guide to Configuration Management]{.underline}

-   Do the CM audits produce written reports maintained in the project's
    documentation library?

-   If not, did the audits determine whether the "configuration control"
    process is an integral part of the project acceptance and release
    process?

-   If not, what was their assessment of the status and integrity of all
    baselined information?

```{=html}
<!-- -->
```
-   **Does the function's Command Center regularly conduct reviews or
    audits to verify the status of items under its control?**

```{=html}
<!-- -->
```
-   If so, what do they verify and where are their reports maintained?

# Product Reviews:  {#product-reviews .unnumbered}

> *Technical reviews, conducted before each baseline is established,
> examine the documentation and configuration products for completeness,
> accuracy, and traceability to provide the basis for moving to the next
> phase of the life cycle*.

-   **Are technical reviews/physical inspections identified and
    implemented to control all baselined items/products and to assess
    their quality before they are introduced or released for business
    use?**

-   **Are reviews conducted to assess the quality of all engineering
    data products before they are released to the next life cycle phase
    or for business use?**

-   **Are reviews/inspections integrated into the project schedule?**

-   **How are the reviews/inspections conducted and structured?**

```{=html}
<!-- -->
```
-   Are CM procedures, standards, and rules for the conduct of the
    inspections established?

-   What are the CM inspection/audit procedures, etc.?

-   Is there a documented process for conducting inspections?

-   Are entrance and exit criteria established for each inspection?

-   Is there a clear rationale for the scheduling of inspections?

-   Are inspections specifically focused on a narrow set of objectives?

-   Do inspections evaluate a fixed set of data?

-   Are metrics used to gauge the effectiveness of inspections?

```{=html}
<!-- -->
```
-   **Are a significant number of defects caught prior to testing?**

-   **Are defects from inspections tracked and catalogued?**

# Contractor Control - Internal CM Process:  {#contractor-control---internal-cm-process .unnumbered}

> *Contractors are expected to have a robust internal configuration
> identification activity to define and baseline lower level documents
> and configuration products which are not subject to MITS configuration
> change control*.

**[Exhibit (300)-40.1 (cont'd)]{.underline}**

> [Audit Guide to Configuration Management]{.underline}

-   **Has the organizational function ensured that the contractor has an
    acceptable CM process in place?**

-   **Has the contractor established a computer program library to be
    used for controlling program materials during development and
    testing?**

-   **Are the contractor's automated tools acceptable?**

```{=html}
<!-- -->
```
-   Does the contractor have available documentation to support the use
    of existing test tools?

-   Are the automated tools and related documents placed under CM
    control?

```{=html}
<!-- -->
```
-   **How does the contractor make releases of "purchased" items to the
    IRS?**

-   **How does the IRS take delivery of items from the
    contractor/developer?**

# Contractor Control - Quality Assurance:  {#contractor-control---quality-assurance .unnumbered}

> *All "Requests For Proposal" will include a requirement to provide, at
> a minimum, a sample CMP from the bidder to indicate CM maturity in
> place. The requirements for a CMP should be proportional to the work
> required in the request*.

-   **Did the IRS accept the contractor's CM plan as part of the
    proposal evaluation process?**

-   **Has the organizational function determined that the contractor has
    identified and defined the system/software engineering techniques
    and methodologies to ensure the most efficient development
    possible?**

-   **Does the project office have a documented and agreed-to
    understanding of the "configuration control" requirements for
    delivery items?**

-   **Is there a CM process in place to implement the understanding of
    the configuration control requirements for delivery?**

```{=html}
<!-- -->
```
-   What is the estimated size/count of the software deliverables?

-   What items/products is the MITS function responsible for handling?

-   How is this service coordinated with the business function?

```{=html}
<!-- -->
```
-   **What CM safeguards have been proposed to assure that unauthorized
    alterations are not made to controlled material?**

-   **Are there CM requirements for the identification of baseline items
    and subsequent contractor revisions or versions?**

-   **Does the contractor perform internal reviews of its CM controls?**

```{=html}
<!-- -->
```
-   If so, do these reviews:

```{=html}
<!-- -->
```
-   Ensure that no unauthorized changes occur to the original
    specifications or supporting documentation?

-   Provide the methodology for configuration management to respond to
    discrepancies found?

**[Exhibit (300)-40.1 (cont'd)]{.underline}**

> [Audit Guide to Configuration Management]{.underline}

-   Require that results of the inspections be documented and made
    available for IRS/Treasury review?

-   Require that the reviews of the CM controls be documented to show
    the date of the inspections, discrepancies found, and completed
    corrective action?

```{=html}
<!-- -->
```
-   **Does the contract allow the IRS to conduct independent reviews of
    the contractor's CM controls? If so:**

```{=html}
<!-- -->
```
-   Is the contractor required to respond to discrepancies found?

-   Have penalties and/or other consequences been adequately defined in
    the contract?

-   Have time frames for the contractor's corrective actions been
    adequately defined in the contract?

**Exhibit (300)-40.2**

> **Reconciliation of Investigative Imprest Fund**
>
> Post Of Duty:
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
>
> [Investigative Imprest Fund]{.underline}
>
> Review
> Period\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
>
> Reconciliation of Fund on
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

  -------------------------------------- --------------- ----------------
  Amount of Fund Authorized                              

                                                         

  Reconciliation:                                        

  Cash                                                   

  Uncashed checks on hand                                

  Interim receipts on hand                               

  Sub-vouchers                                           

  Reimbursement voucher in transit                       

  Cash in bank                                           

  Total                                                  

                                                         

  Difference (if any)                                    
  -------------------------------------- --------------- ----------------