Page 1 GAO-07-692R IRS A-123 Management Report 

United States Government Accountability Office

Washington, DC 20548 

May 18, 2007 

The Honorable Mark W. Everson 

Commissioner of Internal Revenue 

Subject: Management Report: IRS’s First-Year Implementation of the Requirements 

of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 

Dear Mr. Everson: 

This letter summarizes our review of the Internal Revenue Service’s (IRS) 

implementation of the requirements of the Office of Management and Budget’s 

(OMB) revised Circular No. A-123, Management’s Responsibility for Internal 

Control (A-123) during fiscal year 2006. These requirements are applicable to the 24 

Chief Financial Officer (CFO) Act agencies, including the Department of the Treasury 

(Treasury), of which IRS is a significant component. The objectives of our review, 

which was conducted as part of our audit of IRS’s fiscal year 2006 financial 

statements,1

 were to determine whether (1) IRS appropriately planned and 

implemented its assessment of internal controls over financial reporting in 

accordance with the requirements of OMB Circular No. A-123, (2) IRS performed 

sufficient work to support its related assurance statement to Treasury, and (3) IRS’s 

assurance statement appropriately represented the status of IRS’s internal control 

over financial reporting. 

We performed our work from January through October 2006 as part of our audits of 

IRS’s fiscal years 2006 and 2005 financial statements. We conducted our work in 

accordance with U.S. generally accepted government auditing standards. 

Results in Brief 

IRS appropriately planned and implemented its first-year assessment of internal 

controls over financial reporting in accordance with the requirements of OMB 

Circular No. A-123 sufficient to support its assurance statement to Treasury as of 

June 30, 2006. Overall, we were impressed by IRS’s commitment to the successful 

implementation of OMB Circular No. A-123, and its diligent efforts to effectively 

execute the circular’s requirements. IRS’s approach was indicative of management’s 

 

1

GAO, Financial Audit: IRS’s Fiscal Years 2006 and 2005 Financial Statements, GAO-07-136 

(Washington, D.C.: Nov. 9, 2006). 
recognition of its responsibility for the integrity of the organization’s internal control 

structure and its desire to make the most of this process and effectively resolve its 

internal control issues. However, full implementation of the requirements of the 

revised OMB Circular No. A-123 at an agency as large and complex as IRS is a major 

undertaking that will require a significant commitment of resources and several years 

to achieve. 

As we noted in our report on our audit of IRS’s fiscal year 2006 financial statements 

and communicated to IRS during the course of our audit, we identified several areas 

where IRS could enhance its A-123 review process. Specifically, we found that IRS 

did not always clearly document procedures performed or how test results were 

linked to the resultant conclusions. In addition, although IRS was aware of the 

findings of audits performed by GAO and the Treasury Inspector General for Tax 

Administration (TIGTA), we did not always find documentation that these findings 

were consistently utilized by IRS in planning its A-123 reviews. We also did not find 

documentation that in planning its A-123 review, IRS appropriately considered the 

most recent audit of the Department of Agriculture’s National Finance Center, which 

processes IRS’s payroll transactions, or the extent to which its own information 

security work conducted in accordance with the Federal Information Security 

Management Act of 2002 (FISMA),2

 met the objectives of OMB Circular No. A-123. 

Identifying existing reviews and audits related to internal controls over financial 

reporting, determining the extent to which these efforts can be used to complement 

the A-123 work, and assessing how that use might affect the scope and nature of 

procedures to be performed are an important part of the related planning process. 

Clearly documenting procedures conducted and consideration of existing reviews 

and audits reduces the risk that IRS may provide a degree of assurance on the 

effectiveness of its control over financial reporting that is not warranted by existing 

conditions. 

We also found that while the scope and nature of A-123 procedures performed by IRS 

during fiscal year 2006 were appropriate in the circumstances, as IRS’s A-123 process 

moves to the next stage, additional work will be required. We found that (1) the tests 

IRS conducted focused on the execution of controls over individual transaction 

types, and have not yet effectively addressed the design of controls; (2) IRS has not 

yet tested controls over compliance with all significant financial-reporting-related 

laws and regulations; and (3) information security work IRS conducted under FISMA 

did not identify many of the vulnerabilities we identified during our testing of its 

information security as part of our fiscal year 2006 financial audit. Consequently, 

IRS’s A-123 process was not at a point where it would have identified all of IRS’s 

existing control deficiencies nor been sufficient to support an unqualified statement 

of assurance as of June 30, 2006, had that been appropriate in the circumstances. 

Also, once IRS is in a position to support an unqualified assurance statement, it will 

become necessary for it to conduct follow-up procedures during the last 3 months of 

the year subsequent to the June 30 A-123 reporting date to support an unqualified 

assurance statement as of September 30 to correspond with the date of our opinion 

on the effectiveness of IRS’s internal controls.

 2

FISMA was enacted as Title III of the E-Government Act of 2002, Pub. L. No. 107-347, 116 Stat. 2946

(Dec. 17, 2002). 

Page 2 GAO-07-692R IRS A-123 Management Report 
Because IRS had four material weaknesses in its internal controls in fiscal year 2006, 

the additional procedures that would be needed to support unqualified assurance 

were not necessary. However, IRS is working diligently to resolve its material

weaknesses. As these issues are resolved, the scope and nature of procedures IRS 

will need to perform will gradually increase. As IRS continues to enhance its A-123 

effort, it will need to consider these issues and take appropriate steps to address 

them in order to position it to support statements of unqualified assurance as of June 

30 and September 30 as will become appropriate at such time as IRS fully resolves its 

material weaknesses. 

This report contains seven recommendations intended to assist IRS in strengthening 

its A-123 process as it continues to mature, so that once the process is fully 

developed, IRS will be able to rely on it to identify any existing material weaknesses 

or other significant control deficiencies. In so doing, IRS will also position itself so 

that once its existing material internal control weaknesses are resolved, it will be able 

to rely on its A-123 process to support appropriate unqualified statements of 

assurance as of June 30 and September 30. 

In its comments, IRS agreed with our recommendations and described actions it had 

taken or plans to take to address the issues we raised in this report. At the end of our 

recommendations for executive action, we have summarized IRS’s related comments 

and provided our evaluation. 

Scope and Methodology 

In conducting our review of IRS’s implementation of OMB Circular No. A-123, we 

reviewed documentation and conducted discussions with IRS and Treasury officials 

concerning how the A-123 process was planned, implemented, summarized, and 

reported. Specifically, we reviewed and discussed the following: 

• Treasury’s and IRS’s strategy and overall plans for implementing OMB Circular 

No. A-123 at IRS, including (1) how the process was to be organized, staffed, 

supervised, and conducted, and (2) how the results were to be summarized 

and reported, and appropriate corrective action plans developed and 

implemented; 

• Treasury’s and IRS’s selection of transaction processes considered material to 

IRS; 

• IRS’s workpapers supporting its tests of controls over the 12 of the 45 

transaction processes that we considered to be the most material to IRS’s 

financial statements, including internal controls over tax revenue, tax refunds, 

taxes receivable, expenses, and budgetary transactions; 

• IRS’s evaluation of entitywide controls, such as the overall control 

environment, integrity and ethical values, information and communications, 

and monitoring; and 

• IRS’s A-123 assurance statement to Treasury and its relationship to the 

underlying work and results. 

We also observed IRS’s tests of internal controls over (1) tax revenue at one service 

center campus and one Taxpayer Assistance Center, and (2) tax refunds at one 

Page 3 GAO-07-692R IRS A-123 Management Report
service center campus. Additional details on our scope and methodology are 

included in our fiscal year 2006 financial statement audit report. 

Background 

The passage of the Sarbanes-Oxley Act of 2002 (SOX)3

 served as an impetus for the 

federal government to review its existing internal control requirements.4 SOX 

requires that management of publicly traded companies strengthen their processes 

for assessing and reporting on their internal control over financial reporting. 

Consistent with the intent of SOX, the joint Chief Financial Officers Council (CFOC)5

and President’s Council on Integrity and Efficiency (PCIE)6 committee recommended 

that OMB Circular No. A-123 be strengthened to require a more rigorous assessment 

of federal agencies’ internal control over financial reporting. OMB accepted this 

recommendation and worked with the CFOC/PCIE working group to significantly 

revise its Circular No. A-123. 

OMB’s revised Circular No. A-123, along with its related implementation guide,7

 were 

effective for fiscal year 2006. OMB Circular No. A-123 provides specific requirements 

for the 24 major departments and agencies covered under the Chief Financial Officers 

Act of 1990 (CFO Act)8 to follow in conducting management’s assessment of the 

effectiveness of internal control over financial reporting. The assessment process 

requires (1) understanding the control environment including the financial reporting 

process, (2) understanding the design of internal controls, (3) identifying and 

evaluating significant classes of transactions and assessing risks, and (4) testing 

controls to assess compliance. Based on the results of the assessment process, each 

CFO Act agency is required to prepare a statement asserting the effectiveness of its 

internal control over financial reporting as of June 30 of each fiscal year, which is to 

be included in the agency’s Performance and Accountability Report (PAR). 

 3

Pub. L. No. 107-204, 116 Stat. 745 (July 30, 2002). 4

OMB Circular No. A-123, at App. A, Part 1, at p. 20 (rev. Dec 21, 2004). 5

The CFOC, established pursuant to the CFO Act of 1990 (Pub. L. No. 101-576, § 302, 104 Stat. 2838, 

2848 [Nov. 15, 1990]), is an organization of Chief Financial Officers (CFO) and Deputy CFOs of the 

largest Federal agencies and senior officials of OMB and Treasury. The purpose of the council is to

advise and coordinate the activities of the agencies of its members on such matters as consolidation 

and modernization of financial systems, improved quality of financial information, financial data and 

information standards, internal controls, legislation affecting financial operations and organizations, 

and any other financial management matter. The Deputy Director for Management of OMB is the

CFOC’s chair. 6

The PCIE—which is governed by Executive Order No. 12805 of May 11, 1992—was established to (1) 

address integrity, economy, and effectiveness issues that transcend individual government agencies 

and (2) increase the professionalism and effectiveness of inspectors general personnel throughout the 

government. The PCIE is composed primarily of the presidentially appointed inspectors general. 

Officials from OMB, the Federal Bureau of Investigation, Office of Government Ethics, Office of

Special Counsel, and Office of Personnel Management serve on the PCIE as well. The PCIE acts as a 

liaison with the CFOs by attending the CFOC meetings and participating and planning joint meetings, 

sessions, and task forces. 7

OMB, Implementation Guide for OMB Circular A-123, Management's Responsibility for Internal 

Control. Appendix A, Internal Control Over Financial Reporting (Washington, D.C.: July 2005). 8

Pub. L. No. 101-576, 104 Stat. 2838 (Nov. 5, 1990). The 24 CFO Act agencies are listed at 31 U.S.C. § 

901(b). 

Page 4 GAO-07-692R IRS A-123 Management Report 
IRS does not produce its own PAR. As a bureau of Treasury, however, IRS’s 

assurance statement is used by Treasury as a basis for its own assurance statement, 

which is included in the department’s PAR. The assurance provided in this statement 

can take one of three forms: (1) unqualified assurance, indicating that no material 

weaknesses were found, (2) qualified assurance, indicating that one or more material 

weaknesses were identified, or (3) a statement of no assurance, indicating that no 

internal control process was in place or that pervasive material weaknesses were 

found. Based on their A-123 assessment, agencies are required to develop an 

appropriate corrective action plan to address any control deficiencies identified.

OMB Circular No. A-123 requires that agencies document their control over financial 

reporting and the related assessment process, including key decisions, the 

assessment methodology and its implementation, the testing of controls and related 

results, and any corrective action plan. 

In fiscal year 2006, Treasury established the framework for the implementation of the 

revised OMB Circular No. A-123 for all of its bureaus, including IRS. This included 

establishing an overall departmentwide implementation plan, identifying and 

documenting controls significant to Treasury and assessing related risks, and 

establishing milestones for implementation and completion of the A-123 process. 

Treasury also established a threshold to determine which of the bureaus’ transactions 

were considered material to the department’s consolidated financial statements.9

 

Based on this threshold, Treasury required its bureaus to test controls over certain 

specific financial transactions. 

Within this overall framework, IRS established a management structure under the 

direction of the CFO to organize and oversee IRS’s implementation of OMB Circular 

No. A-123. Major elements of IRS’s A-123 process included 

• developing an IRS’s specific implementation guide for the implementation of 

OMB Circular No. A-123; 

• identifying transaction processes considered material to IRS that had not been 

identified by Treasury; 

• planning and conducting tests of controls over 45 transaction processes 

considered material to Treasury or IRS; 

• reviewing the effectiveness of entitywide controls, including the overall 

control environment, integrity and ethical values, information and 

communications, and monitoring; and 

• reviewing compliance with certain laws and regulations pertinent to financial 

reporting and internal control, including the Federal Financial Management 

Improvement Act of 1996 (FFMIA);10 31 U.S.C. § 3512(c), (d), commonly 

referred to as the Financial Managers’ Financial Integrity Act of 1982 (FIA); the 

CFO Act; and FISMA. 

 9

Treasury determined that every Treasury’s consolidated financial statement line item greater than 1.5 

percent of the section total is material to Treasury. Further, if a bureau contributed 10 percent or

more of the balance of one of these material line items, Treasury directed that the bureau must test the 

applicable process transaction controls for A-123 purposes. 10Pub. L. No. 104-208, div. A, §101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 10996). 

Page 5 GAO-07-692R IRS A-123 Management Report
Based on the results of these procedures and considering the material weaknesses 

reported by us in our previous audit of IRS’s financial statements,11 IRS provided 

Treasury qualified assurance that its controls over financial reporting were effective 

as of June 30, 2006. 

IRS Successfully Implemented the Revised OMB Circular No. A-123 in Fiscal 

Year 2006 

IRS appropriately planned and implemented its assessments of internal controls over 

financial reporting in accordance with the requirements of OMB Circular No. A-123 

sufficient to support its assurance statement to Treasury as of June 30, 2006. We also 

noted that IRS elected to implement this process using its own staff rather than 

contractors, thereby taking advantage of the opportunity for IRS staff and 

management to gain a better understanding of the intricacies of, and issues 

associated with, the agency’s complex internal control structure. This, in turn, better 

positioned management and staff to benefit from the lessons learned through this 

first year of implementation. This approach was indicative of management’s 

recognition of its responsibility for the integrity of the organization’s internal control 

structure and its desire to make the most of this process and effectively resolve its 

internal control issues. 

We also found that we were able to use some of the procedures performed by IRS, 

such as its tests of entitywide controls and compliance with the statutory 

requirement regarding the timing of tax lien releases, to supplement or reduce the 

scope of our internal control testing conducted as part of our audit of IRS’s fiscal 

years’ 2006 and 2005 financial statements. 

Full implementation of the requirements of the revised OMB Circular No. A-123 at an 

agency as large and complex as IRS is a major undertaking that will require a

significant commitment of resources and several years to achieve. Additionally, due 

to the presence of four material weaknesses in internal controls as of September 30, 

2005,12 the scope and nature of the A-123 work IRS needed to perform in fiscal year 

2006 was significantly less than would have been necessary had these reported 

weaknesses not existed. In this context, we found that (1) IRS appropriately planned 

and implemented its assessment of internal controls in accordance with the 

requirements of OMB Circular No. A-123, (2) IRS performed sufficient work to

support its related assurance statement to Treasury, and (3) IRS’s assurance 

statement appropriately represented the status of IRS’s internal control over financial 

reporting. 

Opportunities for IRS to Enhance the A-123 Process

While we found that IRS’s first-year implementation of the revised OMB Circular No. 

A-123 enabled it to fully support its June 30, 2006, assurance statement, our review 

identified several opportunities to enhance the process to better ensure that future 

reviews will fully address the requirements of the revised OMB Circular No. A-123 as 

 11GAO, Financial Audit: IRS’s Fiscal Years 2005 and 2004 Financial Statements, GAO-06-137

(Washington, D.C.: Nov. 10, 2005). 12GAO-06-137. 

Page 6 GAO-07-692R IRS A-123 Management Report 
IRS’s implementation process continues to develop. Specifically, we identified 

opportunities with respect to (1) the documentation of completed test procedures 

and (2) the scope and nature of test procedures conducted. 

Documentation of Test Procedures Conducted 

We found that the conclusions IRS reached concerning the effectiveness of its 

controls were appropriate. Nevertheless, IRS’s documentation of the results of

certain specific transaction tests did not always clearly indicate what internal control 

test procedures were performed or how conclusions were reached. For example, 

IRS’s summary of work on its tests of invoice or voucher payment and approval noted 

that there were no errors found, and concluded that controls were effective. 

However, the summary also noted that IRS personnel found 3 errors in testing 45 

sample items, which appeared to indicate that controls were not effective.13 Based on 

discussions with IRS staff, we determined that although it was not apparent from the 

documentation in the workpapers, the 3 errors noted were actually not related to the 

control attributes being tested and hence, did not affect the conclusion. However, 

such ambiguity and lack of clarity in test documentation and its relationship to the 

related conclusions increases the risk that conclusions may not reflect actual existing 

control conditions. 

As provided for in OMB Circular No. A-123, and in accordance with the overall 

approach defined by Treasury, IRS used the results of existing audits and reviews to 

supplement its testing. We found that, in its remediation plans prepared in 

accordance with FIA, IRS considered the findings of the audits of GAO and TIGTA. 

Also, we noted that several of IRS’s A-123 test plans incorporated procedures for 

consideration of prior audits and reviews relevant to the controls being tested. 

However, IRS did not always document how it considered these audits and reviews in 

determining the nature, scope, and timing of procedures it planned to conduct under 

OMB Circular No. A-123. For example, the IRS planning documents and workpapers 

did not always document how it considered the results of the following audits and 

reviews in formulating the nature, scope, and timing of its test procedures: (1) GAO 

audits, such as our prior audits of IRS’s financial statements, (2) TIGTA audits or 

reviews that may have been relevant to IRS’s internal control over financial reporting, 

or (3) its own information security work conducted under FISMA. We also did not see 

documentation of IRS’s consideration of the results of the most recent audit of the 

controls over the Department of Agriculture’s National Finance Center, which IRS 

relies on to process its payroll transactions. By consistently documenting how it 

considered these prior audits and reviews, IRS would reduce the risk that it may (1) 

not appropriately consider issues significant to IRS’s internal control over financial 

reporting, (2) place undue reliance on reviews whose scope and methodology is not 

well suited to the objectives set out in OMB Circular No. A-123, or (3) perform 

unnecessary duplicative work. 

 13With a sample size of 45 items, the auditor concludes that if more than one deviation is found, the 

controls being tested are not operating effectively. GAO/PCIE, Financial Audit Manual, section 

450.13, GAO-01-765G (Washington, D.C.: July 2001).

Page 7 GAO-07-692R IRS A-123 Management Report
Scope and Nature of Test Procedures Conducted 

As noted above, the procedures conducted by IRS were adequate to support the 

qualified assurance it provided as of June 30, 2006. However, as IRS moves to an 

unqualified opinion on its internal control in the future, its procedures will need to 

further evolve. 

IRS’s control testing approach was not yet at the stage that it fully considered the 

design of control over financial reporting. Rather, the approach was largely 

transaction based. Consequently, IRS’s tests would not likely have identified some of 

the significant systemic control design deficiencies that we have reported in our 

audits of IRS’s financial statements, including IRS’s lack of (1) a subsidiary ledger for 

taxes receivable, (2) cost accounting capabilities necessary to readily determine the 

costs of its activities and programs in multiple business units, or (3) a U.S. Standard 

General Ledger–compliant general ledger for its tax-related transactions. Because 

IRS had not yet fully considered the design of internal control over financial 

reporting, the risk is increased that in the absence of our annual audit of IRS’s 

financial statements, it may not identify all deficiencies in the design of its related 

controls. 

As noted above, IRS reviewed compliance with FFMIA, FIA, the CFO Act, and FISMA. 

IRS also tested compliance with the legal requirement that liens on taxpayer property 

be released within 30 days of the satisfaction of the debt.14 However, IRS had not yet 

tested controls over compliance with other significant financial-related laws and 

regulations. For example, its testing did not address controls over compliance with 

the Anti-Deficiency Act, as amended15 or the Prompt Payment Act.16 OMB Circular 

No. A-123 defines the scope of assessing and documenting internal control over 

financial reporting to include compliance with laws and regulations. However, since 

IRS did not test controls over compliance with several laws and regulations 

significant to financial reporting, its management could not have provided unqualified 

assurance regarding the design and operating effectiveness of controls in this area, 

had that been warranted. 

IRS’s use of work it performed under FISMA to meet the requirements of OMB 

Circular No. A-123 as it relates to information technology security controls was 

permitted by A-123 and was in accordance with Treasury’s overall approach. Such 

use requires that the work be conducted in a manner sufficient to meet the 

requirements of OMB Circular No. A-123, as well as FISMA. However, we did not see 

evidence that IRS assessed whether the work being conducted under FISMA was 

sufficient to meet the objectives set out in OMB Circular No. A-123, for which the 

FISMA work was not originally designed. Our review of IRS’s information security 

conducted as part of our fiscal year 2006 financial audit found weaknesses indicating 

that IRS’s FISMA work was not always sufficient to meet the related objectives of the 

OMB circular. For example, as part of IRS’s FISMA work, it tested and evaluated 

security controls for each of the automated systems we reviewed as part of our fiscal 

 1426 U.S.C. § 6325. 15See 31 U.S.C. § 1341(a)(1) and 31 U.S.C. § 1517(a). 16Codified, as amended, in part of at 31 U.S.C. § 3902(a), (b), and (f) and 31 U.S.C. § 3904. 

Page 8 GAO-07-692R IRS A-123 Management Report 
year 2006 financial audit.17 However, we found that IRS’s FISMA testing did not 

address many of the vulnerabilities we reported based on our work. For example, 

IRS’s test and evaluation plan for its procurement system did not include tests for 

password expiration, insecure protocols, or removal of employees’ system access 

after separation from the agency. Consequently, the information security work IRS 

conducted in accordance with FISMA did not identify many of the vulnerabilities we 

identified during our audit of IRS’s fiscal year 2006 financial statements, nor assess 

the risks associated with those vulnerabilities. This increases the risk that IRS’s 

information security work conducted to comply with FISMA may not satisfy the 

related objectives set out in OMB Circular No. A-123. 

IRS did not perform procedures under OMB Circular No. A-123 during the last 3 

months of fiscal year 2006 to verify that the state of its internal controls had not 

significantly changed since the date of its assurance statement, which was June 30. 

OMB Circular No. A-123 does not require such procedures, but does permit agencies 

to adjust the “as of” date of their assurance statement if the agency is receiving a 

separate audit opinion on its internal controls as of September 30. Given the four 

material weaknesses in IRS’s internal control that we had identified during our audit 

of IRS’s financial statements,18 not testing internal control during the fourth quarter 

did not affect IRS’s assurance statement for internal controls as of September 30, 

2006.19 In future years, at such time as IRS has effectively resolved its existing 

material internal control deficiencies, follow-up procedures to test controls during 

the last 3 months of the fiscal year will become necessary in order for IRS to assert 

that its internal controls are effective as of September 30. 

As noted above, fiscal year 2006 was the first year IRS implemented the requirements 

of the revised OMB Circular No. A-123, and this process will likely take several more 

years to fully mature. As the process continues to develop, IRS will need to 

overcome a number of significant challenges, such as balancing the significant 

resource needs of this process with the ongoing demands of its daily operations. In 

addition, many of the related tasks, such as documenting internal controls, assessing 

related risks, evaluating the design of controls, conducting appropriate tests of the 

operating effectiveness of controls, evaluating and reporting the results of these tests, 

and appropriately documenting these internal control procedures, are skills typically 

associated with financial auditors. Implementing OMB Circular No. A-123 has 

required IRS’s staff to assume responsibilities for which their prior training and 

operational experience had typically not prepared them. As it continues to implement 

 17GAO, Information Security: Further Efforts Needed to Address Significant Weaknesses at the

Internal Revenue Service, GAO-07-364 (Washington, D.C.: Mar. 30, 2007). 18GAO-06-137. 19In addition to its qualified A-123 statement of assurance on the effectiveness of its internal control 

over financial reporting as of June 30, 2006, IRS also provided a statement of qualified assurance 

concerning the effectiveness of its internal control over financial reporting, compliance with laws and

regulations, and performance reporting as of September 30, 2006, in the management representation

letter it provided to us as part of our audit of IRS’s fiscal year 2006 financial statements. Due to the 

existence of four material weaknesses in IRS’s internal control, we rendered our opinion directly on 

the effectiveness of IRS’s internal control as of September 30, 2006, rather than on its assurance 

statement. However, once our tests of IRS’s internal control, including control over financial 

reporting, determine that IRS has resolved all its material weaknesses and IRS provides the related 

unqualified statement of assurance on its overall internal control as of September 30, we will render 

our opinion on IRS’s internal control based on the appropriateness of IRS’s assurance statement. 

Page 9 GAO-07-692R IRS A-123 Management Report
OMB Circular No. A-123, IRS will need to successfully meet these challenges in order 

to minimize the risk that, in the absence of our annual financial audit, significant 

deficiencies in internal controls might exist and not be identified in this process. 

Should this occur, IRS might provide a level of assurance on the effectiveness of its 

internal controls not warranted by existing conditions. 

Conclusion 

IRS did a commendable job in its first-year implementation of the requirements of the 

revised OMB Circular No. A-123. IRS’s decision to rely on its own staff to conduct 

this work, while presenting challenges in the short term, also has the potential to pay 

significant dividends in the future in terms of IRS’s ability to make effective use of its 

A-123 findings to improve operations. As IRS moves forward, it should work to 

enhance the documentation of the procedures it performs. In addition, while IRS’s A123 process in fiscal year 2006 was adequate to support its June 30, 2006, assurance 

statement to Treasury, it is important to recognize that additional work will be 

needed to provide the unqualified assurance statement that will become appropriate 

once IRS has addressed the long-standing material weaknesses it is currently 

confronting. IRS is working diligently to correct its material weaknesses. It is 

therefore important that as IRS continues to make progress in this regard, it also 

enhance its A-123 process to be better positioned to support an unqualified statement 

of assurance on the effectiveness of its internal control over financial reporting once 

its material weaknesses have been resolved. 

Recommendations for Executive Action 

To assist IRS in strengthening its implementation of A-123 reviews in future years, we 

recommend that IRS 

• document the results of internal control tests conducted in a manner 

sufficiently clear and complete to explain how control procedures were tested, 

what results were achieved, and how conclusions were derived from those 

results, without reliance on supplementary oral explanation; 

• clearly document how it considered existing reviews and audits in determining 

the nature, scope, and timing of procedures it planned to conduct under its A123 process; 

• to the extent that it intends to use the information security work conducted 

under FISMA to meet related A-123 requirements, identify the areas where the 

work conducted under FISMA does not meet the requirements of OMB 

Circular No. A-123 and, considering the findings and recommendations of our 

work on IRS’s information security, expand FISMA procedures or perform 

additional procedures as part of the A-123 reviews to augment FISMA work; 

• revise test plans to include appropriate consideration of the design of internal 

controls in addition to implementation of controls over individual 

transactions; 

Page 10 GAO-07-692R IRS A-123 Management Report 
• work with Treasury to identify laws and regulations that are significant to 

financial reporting, test controls over compliance with those laws and 

regulations, and evaluate and report on the results of such control reviews; 

• begin devising appropriate A-123 follow-up procedures for the last 3 months of 

the fiscal year to be implemented once the material weaknesses identified 

through the annual financial statement audits have been resolved; and 

• provide A-123 review staff appropriate training, such as that available for 

financial auditors, to enhance their skills in workpaper documentation, 

identification and testing of internal controls, and evaluation and 

documentation of results. 

Agency Comments and Our Evaluation 

In commenting on a draft of this report, IRS agreed with our recommendations and 

expressed its appreciation that we acknowledged the agency’s commitment and 

diligence in implementing the revised OMB Circular No. A-123 requirements during 

fiscal year 2006. IRS noted that it had established a credible A-123 program and used 

the results of the tests conducted to improve IRS’s internal control environment. 

IRS agreed with our recommendations to clearly document the results of tests 

conducted and how it considered existing reviews and audits in determining the 

extent of its test procedures, and to provide staff involved in the A-123 review 

process with appropriate training. IRS indicated that it had provided enhanced 

training to testers and reviewers in preparation for its fiscal year 2007 A-123 process 

covering such aspects as evaluating audit evidence, preparing workpapers, reviewing 

and evaluating internal controls, and evaluating the materiality of errors. IRS also 

agreed with our recommendation that it should revise its test plans to include an 

appropriate consideration of the design of internal controls in addition to 

implementation of controls over individual transactions. IRS stated that it will 

include such analysis of the design for each transaction set tested in its fiscal year 

2008 A-123 process. 

IRS also agreed with our recommendation that it identify the areas where its work 

conducted under FISMA does not meet A-123 requirements, and either expand FISMA 

procedures or perform additional procedures as part of the A-123 reviews to augment 

its FISMA work. IRS stated that it will continue to work with Treasury and us to 

improve its FISMA procedures or A-123 test plans. 

Additionally, IRS agreed with our recommendation that it work with Treasury to 

identify laws and regulations that are significant to financial reporting, test controls 

over compliance with laws and regulations, and evaluate and report on the results of 

such control reviews. IRS indicated that it has performed an initial crosswalk of laws 

and regulations significant to financial reporting during fiscal year 2007 and will 

further refine this linkage in preparation for the fiscal year 2008 A-123 process. 

Finally, IRS agreed with our recommendation that it devise appropriate A-123 followup procedures for the last three months of the fiscal year to be implemented once the 

Page 11 GAO-07-692R IRS A-123 Management Report
material weaknesses identified through the annual financial statement audits have 

been resolved. IRS stated that in fiscal year 2008, it will begin to develop follow-up 

procedures that provide assurance for the last three months of the fiscal year. We 

will evaluate the effectiveness of IRS’s efforts in addressing our recommendations 

during our future audits of IRS financial statements. 

- - - - - 

This report contains recommendations to you. The head of a federal agency is 

required by 31 U.S.C. § 720 to submit a written statement on actions taken on these 

recommendations. You should submit your statement to the Senate Committee on 

Homeland Security and Governmental Affairs and the House Committee on Oversight 

and Government Reform within 60 days of the date of this report. A written statement 

must also be sent to the Senate and House Committees on Appropriations with the 

agency’s first request for appropriations made more than 60 days after the date of the 

report. 

This report is intended for use by the management of IRS. We are sending copies to 

the Chairmen and Ranking Minority Members of the Senate Committee on 

Appropriations; Senate Committee on Finance; Senate Committee on Homeland 

Security and Governmental Affairs; Subcommittee on Taxation and IRS Oversight, 

and Long-Term Growth, Senate Committee on Finance; House Committee on 

Appropriations; House Committee on Ways and Means; and House Committee on

Oversight and Government Reform. We are also sending copies of this report to the 

Chairman and Vice Chairman of the Joint Committee on Taxation, the Secretary of 

the Treasury, the Director of OMB, the Chairman of the IRS Oversight Board, and 

other interested parties. Copies will be made available to others upon request. In 

addition, the report is available at no charge on GAO’s Web site at 

http://www.gao.gov. 

We acknowledge and appreciate the cooperation and assistance provided by IRS 

officials and staff during our review. If you have any questions or need assistance in 

addressing these matters, please contact me at (202) 512-3406 or sebastians@gao.gov. 

GAO staff who made major contributions to this report are listed in enclosure III. 

Sincerely yours, 

Steven J. Sebastian 

Director 

Financial Management and Assurance 

Enclosures 

Page 12 GAO-07-692R IRS A-123 Management Report 
Enclosure I 

Comments from the Department of the Treasury 

Page 13 GAO-07-692R IRS A-123 Management Report 
Enclosure I 

Page 14 GAO-07-692R IRS A-123 Management Report 
Enclosure I 

Page 15 GAO-07-692R IRS A-123 Management Report 
Enclosure II 

Page 16 GAO-07-692R IRS A-123 Management Report 

Staff Acknowledgments 

Acknowledgments 

The following individuals made major contributions to this report: Charles Fox, 

Assistant Director; Charles Ego; Nina Crocker; John Davis; Ted Hu; Jerrod O’Nelio; 

John Sawyer; Angel Sharma; Cynthia Teddleton; and Truc Tuck. 

(196151) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER