**GAO-11-308**                      Published: Mar 15, 2011. Publicly Released: Mar 15, 2011.                  

-   
-   
-   
-   

    Jump To:  
-  Elder Abuse 
-  Services for Older Adults 
-  State and Local-Level Drivers and Trends 
-  State and Local Fiscal Projections 
-  Federal Borrowing 
-  Managing the Debt 
-  Summary of Funding Provisions 
-  Auditing the Government's Books 
-  Unpacking the Financial Report 
-  Highlights 
-  Recommendations 
-  Background 
-  About This Work 
-  About This Work 
-  Trends 
-  About the Center 
-  Why It's High Risk 
-  What Remains To Be Done 
-  Key Reports 
-  Newest COVID-Related Reports 
-  AI Use Cases 
-  Flood Insurance 
-  Past Pandemic-Related Reports 
-  CARES Act Oversight Reports 
-  All COVID-19 Reports 
-  Report Suspected Fraud 
-  Subjects 
-  How to Get Notified 
-  Past Reports 
-  Public Health Threats 
-  Explore the FY 2022 and 2023 Funds 
-  Lessons Learned 
-  Agency Reports 
-  Recent Reports 
-  Recommendations 
-  Supplemental Material 
-  Full Report 
-  Additional Data 
-  View Decision 
-  Downloads 
-  Previously Identified Actions 
-  Related Pages 
-  Associated Agencies 
-  Tough Choices and Opportunities Ahead 
-  Americas Fiscal Future Key Areas 
-  Retirement Security Key Areas 
-  Current List 
-  About The High Risk List 
-  Area Ratings 
-  Previous High Risk Products 
-  Search Federal Vacancies 
-  Past Federal Vacancies 
-  Violation Letters 
-  About the Yellow Book 
-  Advisory Council 
-  Related Resources 
-  Comment Letters 
-  Related Publications 
-  Contacts and Resources 
-  Major Issues Facing the Nation 
-  Meeting Strategic Challenges 
-  Additional Resources 
-  Resources 
-  GAO Contacts 
-  Mission Teams 
-  Operations and Staff Offices  
-  Organization Chart  
-  Why a Career at GAO? 
-  Am I Qualified? 
-  Company Culture 
-  Reasonable Accommodations 
-  Video Gallery 
-  Paid Internships 
-  Student Volunteers 
-  Professional Development Program 
-  Advancement 
-  Executive Candidate Program 
-  Summer Associates 
-  Externships 
-  Benefits 
-  Contacts 

Skip to Highlights

## Highlights

The Internal Revenue Service (IRS) has a demanding responsibility in collecting taxes, processing tax returns, and enforcing the nation's tax laws. It relies extensively on computerized systems to support its financial and mission-related operations and on information security controls to protect financial and sensitive taxpayer information that resides on those systems. As part of its audit of IRS's fiscal years 2010 and 2009 financial statements, GAO assessed whether controls over key financial and tax processing systems are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. To do this, GAO examined IRS information security policies, plans, and procedures; tested controls over key financial applications; and interviewed key agency officials at four sites.

Although IRS made progress in correcting previously reported information security weaknesses, control weaknesses over key financial and tax processing systems continue to jeopardize the confidentiality, integrity, and availability of financial and sensitive taxpayer information. Specifically, IRS did not consistently implement controls that were intended to prevent, limit, and detect unauthorized access to its financial systems and information. For example, the agency did not sufficiently (1) restrict users' access to databases to only the access needed to perform their jobs; (2) secure the system it uses to support and manage its computer access request, approval, and review processes; (3) update database software residing on servers that support its general ledger system; and (4) enable certain auditing features on databases supporting several key systems. In addition, 65 of 88--about 74 percent--of previously reported weaknesses remain unresolved or unmitigated. An underlying reason for these weaknesses is that IRS has not yet fully implemented key components of its comprehensive information security program. Although IRS has processes in place intended to monitor and assess its internal controls, these processes were not always effective. For example, IRS's testing did not detect many of the vulnerabilities GAO identified during this audit and did not assess a key application in its current environment. Further, the agency had not effectively validated corrective actions reported to resolve previously identified weaknesses. Although IRS had a process in place for verifying whether each weakness had been corrected, this process was not always working as intended. For example, the agency reported that it had resolved 39 of the 88 previously identified weaknesses; however, 16 of the 39 weaknesses had not been mitigated. IRS has various initiatives underway to bolster security over its networks and systems; however, until the agency corrects the identified weaknesses, its financial systems and information remain unnecessarily vulnerable to insider threats, including errors or mistakes and fraudulent or malevolent acts by insiders. As a result, financial and taxpayer information are at increased risk of unauthorized disclosure, modification, or destruction; financial data is at increased risk of errors that result in misstatement; and the agency's management decisions may be based on unreliable or inaccurate financial information. These weaknesses, considered collectively, are the basis for GAO's determination that IRS had a material weakness in internal control over financial reporting related to information security in fiscal year 2010. GAO recommends that IRS take eight actions to fully implement key components of its comprehensive information security program. In a separate report with limited distribution, GAO is recommending 32 specific actions for correcting newly identified control weaknesses. In commenting on a draft of this report, IRS agreed to develop a detailed corrective action plan to address each recommendation.

## Recommendations

## Recommendations for Executive Action

See All 8 Recommendations

## Full Report

Highlights

Full Report (32 pages)

Accessible Text 

## GAO Contacts

Gregory C. Wilshusen
wilshuseng@gao.gov

(202) 512-4800

## Office of Public Affairs

Sarah Kaczmarek
kaczmareks@gao.gov

(202) 512-4800

## Topics

Tax Policy and Administration

Access controlComputer securityComputer systemsData integrityDatabasesFinancial disclosureFinancial statement auditsFinancial statementsFraudInformation disclosureInformation securityInformation security managementInformation security regulationsInternal controlsReporting requirementsSecurity policiesSecurity threatsSystem vulnerabilitiesTax administration systemsTax information confidentialityCorrective actionFinancial reportingPolicies and procedures

## Multimedia

## Podcasts

##### The Security of Financial & Taxpayer Data at IRS

Transcript