GAO-06-543R IRS Management Report 

United States Government Accountability Office

Washington, DC 20548 

May 12, 2006 

The Honorable Mark W. Everson 

Commissioner of Internal Revenue 

Subject: Management Report: Improvements Needed in IRS’s Internal Controls 

Dear Mr. Everson: 

In November 2005, we issued our report on the results of our audit of the Internal 

Revenue Service’s (IRS) financial statements as of, and for the fiscal years ending, 

September 30, 2005 and 2004, and on the effectiveness of its internal controls as of 

September 30, 2005.1

 We also reported our conclusions on IRS’s compliance with 

significant provisions of selected laws and regulations and on whether IRS’s financial 

management systems substantially comply with requirements of the Federal 

Financial Management Improvement Act of 1996. A separate report on the 

implementation status of recommendations from our prior IRS financial audits and 

related financial management reports, including this one, will be issued shortly. 

The purpose of this report is to discuss issues identified during our audit of IRS’s 

financial statements as of, and for the fiscal year ending September 30, 2005, 

regarding internal controls that could be improved for which we do not currently 

have any recommendations outstanding. Although not all of these issues were 

discussed in our fiscal year 2005 audit report, they all warrant management’s 

consideration. This report contains 22 recommendations that we are proposing IRS 

implement to improve its internal controls. We conducted our audit in accordance 

with U.S. generally accepted government auditing standards. 

Results in Brief 

During our fiscal year 2005 audit, we identified a number of internal control issues 

that adversely affected safeguarding of tax receipts and information, and the 

reliability of expense, and property & equipment (P&E) records. These issues 

concern (1) taxpayer receipts and data transmittal documents, (2) physical security 

controls at taxpayer assistance centers, (3) the roles and responsibilities of security 

guards, (4) candling procedures, (5) timely processing of large remittances at lockbox 

banks, (6) access to tax return processing facilities, (7) juvenile hiring policy, (8) 

 

1

GAO, Financial Audit: IRS’s Fiscal Years 2005 and 2004 Financial Statements, GAO-06-137 

(Washington, D.C.: Nov. 10, 2005). 
Page 2 GAO-06-543R IRS Management Report

 

classification of procurement transactions as P&E or expense, and (9) recording P&E 

disposals. 

Specifically, we found the following: 

• At three of the four service center campuses (SCCs), seven of the eight 

Taxpayer Assistance Centers (TACs),2

 and two of the six field offices we 

visited, we found no evidence of managerial review of the transmittal 

documents and acknowledgment forms used to transmit and monitor 

taxpayer receipts and information shipped from one IRS location to 

another. Additionally, at five TACs and both field offices, we found no 

evidence of follow-up on the overdue unacknowledged transmittals we 

reviewed. 

• At four TAC sites, physical security controls were not adequate to preclude 

individuals from entering controlled areas and gaining access to taxpayer 

receipts and information. At three of these TACs, we found that 

individuals were able to enter controlled areas3

 of the TAC or other IRS 

office space unnoticed. In addition, one of the four TACs did not have an 

operable emergency alarm and at another of the four TACs, the door 

separating the customer area from the controlled area was not locked nor 

marked with a sign alerting customers that they were not permitted to 

enter unescorted. 

• At one SCC, one TAC, and one lockbox bank4

 we visited, we found that 

security guard personnel did not always effectively fulfill their 

responsibilities in (1) controlling access to IRS tax return facilities, (2) 

responding to intrusion alarms, and (3) recording, maintaining, and 

reporting security incidents or violations. 

• At three SCCs we visited, we found that IRS did not always ensure that 

envelopes were opened and candled5

 twice before destruction, as required 

2

 TACs are field assistance units designed to serve taxpayers who choose to seek help from the IRS in 

person. Services provided include interpreting tax laws and regulations, preparing some tax returns, 

resolving inquiries on taxpayer accounts, receiving payments and forwarding those payments to their 

respective SCC for deposit and further processing, and performing other services designed to minimize 

the burden on taxpayers in satisfying their tax obligations. These offices are typically much smaller 

facilities than SCCs or lockbox banks with staff sizes ranging from 1 to about 35 employees. 3

IRS defines controlled areas as space to which access is limited to IRS employees with a valid 

business purpose. Within such controlled space, certain areas are designated as restricted and are 

subject to a further elevated level of security to safeguard such sensitive assets as hardcopy taxpayer 

receipts and computer facilities. 

4

 Lockbox banks are financial institutions designated as depositories and financial agents of the U.S. 

government to perform certain financial services, including processing tax documents, depositing the 

receipts, and then forwarding the documents and data to their respective SCC, which update 

taxpayers’ accounts. 

5

 Candling is a process used by IRS to determine if any contents remain in open envelopes, which is 

often achieved by passing the envelopes over a light source. 
Page 3 GAO-06-543R IRS Management Report

 

by its procedures, to provide assurance that all contents have been 

extracted. 

• At two lockbox banks, we found that large dollar checks were not always 

immediately processed and deposited according to IRS’s guidelines. 

• At two SCCs and one lockbox bank, controls over access to facilities were 

not adequate to provide reasonable assurance that unauthorized personnel 

would not be admitted. Credentials of persons entering one SCC and one 

lockbox bank were not always validated before admission and, at one SCC, 

(1) alarms were not always functional and (2) gaps existed in perimeter 

security. 

• Limitations in IRS’s juvenile6

 hiring policy increased the risk of unsuitable 

candidates being hired and permitted access to taxpayer receipts and data. 

For juvenile employee candidates, IRS (1) only required references for 

those individuals hired to work in receipt processing functions although 

taxpayer receipts and data are also accessible in other functions, and (2) 

accepted written references that were hand delivered to IRS by the 

candidates themselves without independently verifying their source. 

• IRS did not always ensure that it properly classified its procurement 

transactions as P&E and recognized assets when they met its capitalization 

criteria or classified these transactions as expense when they did not. Of 

267 sample transactions we tested from IRS’s non-payroll expenses and 

P&E acquisitions recorded during the first 9 months of fiscal year 2005 and 

accounts payable as of September 30, 2005, six were incorrectly classified 

and reported. 

• Disposals of property and equipment were not recorded in a timely manner 

at five IRS locations, resulting in inventory records that were inaccurate 

and out-of-date.

The issues noted above increase the risk that (1) taxpayer receipts and information 

could be lost, stolen, misused, or destroyed, and (2) physical assets could be stolen or 

valued incorrectly. 

At the end of our discussion of each of these issues in the following sections, we 

make recommendations for strengthening IRS’s internal controls. These 

recommendations are intended to bring IRS into conformance with its own policies 

and with the internal control standards that all federal agencies are required to 

follow.7

6

IRS defines juvenile as a person who is not yet eighteen years of age. 7

GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, 

D.C.: November 1999). 
Page 4 GAO-06-543R IRS Management Report

 

 

In its comments, IRS agreed with our recommendations and described actions it had 

taken or planned to take to address the control weaknesses described in this report. 

At the end of our discussion of each of the issues in this report, we have summarized 

IRS’s related comments and provide our evaluation. 

Scope and Methodology 

As part of our audit of IRS’s fiscal years 2005 and 2004 financial statements, we tested 

IRS’s internal controls and its compliance with selected provisions of laws and 

regulations. We designed our audit procedures to test relevant controls, including 

those for proper authorization, execution, accounting, and reporting of transactions. 

This report addresses issues we observed during our fiscal year 2005 audit. For 

issues related to safeguarding taxpayer receipts and information, we visited four 

SCCs, four lockbox banks, eight TACs, and six other IRS field offices; and for issues 

related to procurement and property and equipment (P&E), we performed our testing 

at 22 IRS offices and at the IRS Finance Center. 

Further details on our audit scope and methodology are included in our report on the 

results of our audits of IRS’s fiscal years 2005 and 2004 financial statements8

 and are 

reproduced in enclosure II. We requested comments on a draft of this report from the 

Commissioner of IRS or his designee. We received written comments from the 

Commissioner, which we have incorporated as appropriate and have reprinted them 

as Enclosure 1. 

Transmission of Taxpayer Receipts and Information 

IRS’s controls over transmissions of taxpayer receipts and information between 

offices did not always ensure that transmissions were reviewed to make certain that 

potential errors were promptly identified and corrected and that transmissions were 

timely received and acknowledged. When IRS transmits taxpayer receipts and/or 

information between locations, IRS personnel are required to use either a Daily 

Report of Collection Activity (form 795) or a Document Transmittal (form 3210) to 

record and document the items being transmitted.9

 However, during our fiscal year 

2005 audit, we found that these forms were not always (1) subject to a documented 

supervisory review prior to submitting the documents for final processing, or (2) 

tracked to ensure that recipients timely acknowledged receipt of the transmitted 

documents. Specifically, we found: 

• at three of the four SCCs we visited, managers or supervisors within the 

Refund Inquiry Unit did not document their review of forms used to record 

8

GAO-06-137. 

9

 The Daily Report of Collection Activity is generally used to transmit taxpayer receipts from an IRS 

facility to a SCC. A Document Transmittal is used interchangeably to transmit (1) taxpayer receipts or 

several form 795s from an IRS facility to a SCC for final processing or (2) non-payment related 

taxpayer information (e.g., case files and other sensitive tax related data) between IRS facilities. 
Page 5 GAO-06-543R IRS Management Report

and transmit returned refund checks before they were mailed to the Austin 

Regional Finance Center for final processing. 

• at five of the eight TACs and at three Large and Mid-Size Business (LMSB) and 

three Tax-Exempt and Government Entities (TEGE) field units, 10 document 

transmittals were not always acknowledged by the recipient within the 

timeframe required by IRS. In addition, there was no evidence that the 

originators of the transmittals contacted the recipient to follow-up on the 

status of the unacknowledged transmittals. 

• at seven of the eight TACs, four LMSB units, and one TEGE unit, there was no 

evidence that managers periodically reviewed the logbooks used to track 

acknowledged transmittals. 

GAO’s Standards for Internal Control in the Federal Government11 require agencies 

to establish controls to enforce adherence to management policies and procedural 

requirements, such as management reviews, to create and maintain records providing 

evidence that these controls are executed, and to appropriately safeguard assets. 

Additionally, the Internal Revenue Manual (IRM)12 requires that area offices take 

responsibility for the security and accountability of taxpayer receipts and information 

during transit. Specifically, the IRM requires senders to establish a control to ensure 

timely delivery of taxpayer receipts and information and to follow up with the 

recipient if the acknowledgement has not been received within 10 workdays. The 

lack of documentation of review and follow-up on overdue acknowledgements 

increases the risk that these procedures are not in place and operating effectively and 

that, consequently, errors, theft, or loss of taxpayer receipts and information may 

occur and not be timely detected. 

Recommendations

We recommend that IRS 

• require that Refund Inquiry Unit managers or supervisors document their 

review of all forms used to record and transmit returned refund checks prior 

to sending them for final processing; 

 

10 LMSB units are field office units charged with administering taxes for corporations and partnerships 

with assets over $10 million. TEGE units are field office units that serve a wide range of customers 

including small local community organizations, municipalities, major universities, pension funds, state 

governments, Indian tribal governments, and tax exempt bond issuers. All other corporations, 

partnerships, small businesses, and individuals with certain types of non-salary income with assets 

under $10 million are serviced by IRS’s Small Business and Self-Employed (SB/SE) units. We 

addressed similar monitoring weaknesses within several SB/SE units in our management report from 

our fiscal year 2004 audit, see GAO, Management Report: Improvements Needed in IRS’s Internal 

Controls, GAO-05-247R (Washington, D.C.: April 2005). 11GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, 

D.C.: November 1999). 

12The IRM outlines business rules and administrative procedures and guidelines IRS uses to conduct its 

operations and contains policy, direction, and delegations of authority necessary to carry out IRS’s 

responsibilities to administer tax law and other legal provisions. 
Page 6 GAO-06-543R IRS Management Report

• enforce compliance with existing requirements that all IRS units transmitting 

taxpayer receipts and information from one IRS facility to another, including 

SCCs, TACs, and units within LMSB and TEGE, establish a system to track 

acknowledged copies of document transmittals; 

• provide instructions to document the follow-up procedures performed in those 

cases where transmittals have not been timely acknowledged; and 

• require that managers or supervisors document their reviews of document 

transmittals to ensure that taxpayer receipts and/or taxpayer information 

mailed between IRS locations are tracked according to guidelines. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations concerning its documentation of controls over 

transmission of taxpayer receipts and information between offices. IRS indicated it 

will remind all SCCs of the requirement to conduct periodic reviews of the document 

transmittal form and that verifying this will be included as part of the site review 

process by March 2007. IRS also indicated it had conducted an education effort to 

ensure that all managers in Examination are familiar with existing IRMs related to 

check processing procedures and provided their personnel additional instruction on 

requirements for transmitting taxpayer receipts, checks, and taxpayer information in 

order to ensure their personnel comply with policy. Specifically, IRS stated that it 

had conducted an information presentation for Examination managers, developed a 

flowchart to document the process, and developed a quick reference guide for 

processing checks in TEGE. IRS stated it also developed training materials to provide 

additional guidance on handling transmittals and will perform periodic reviews to 

ensure transmittals are handled appropriately. IRS also indicated that it will revise 

the IRM to require documentation of follow-up actions with SCCs when transmittal 

documents are not acknowledged timely. We will evaluate the effectiveness of IRS’s 

efforts during our fiscal year 2006 financial audit. 

Physical Security at Taxpayer Assistance Centers 

During our fiscal year 2005 audit, we found that physical security controls at several 

TAC sites we visited were not adequate to prevent unauthorized individuals from 

accessing areas which contained taxpayer receipts and information. For example: 

• At one TAC, upon entering the facility at the time of our audit, we were able to 

repeatedly walk from the public entrance to a controlled area without being 

noticed or challenged. The only obstacle was a door which was not locked nor 

marked with a sign alerting individuals that they were not permitted to enter 

unescorted. This area was also accessible through a separate door that was 

also not locked nor marked. 
Page 7 GAO-06-543R IRS Management Report

 

• Another TAC was staffed by two Technical Research Representatives (TRRs),13

whose responsibilities included monitoring the public reception area of the 

TAC and preventing customers from venturing into controlled areas of the 

office that were shared by other IRS business units. However, TRRs 

sometimes found it necessary to leave their desks and the public reception 

area to perform their other duties, thereby leaving the area unattended and 

potentially allowing individuals to enter controlled areas of the TAC 

unchallenged. We were informed that individuals had on occasion been found 

in the other business units’ office space seeking assistance. Additionally, there 

were no signs posted in the TAC informing individuals that access within the 

office beyond a certain point was not permitted unless escorted by an 

employee. 

IRS is currently in the process of reconfiguring the space at several of its TACs, and 

refers to the reconfigured TAC sites as the “new TAC” models.14 The IRM requires that 

layouts of the new TACs should incorporate certain security features to meet a 

controlled area requirement to protect taxpayer receipts and information from 

disclosure and prevent unauthorized access to both information and property. 

However, during our visits to two of the new TAC models, we found similar security 

problems as discussed above. For example, at one new TAC that was often staffed by 

1 or 2 TRRs, the TRRs responsible for monitoring the entrance of the TAC at times 

would leave their workstations to perform other duties. Based on our observations 

and inquiries, we found that unauthorized individuals could access and had 

occasionally been found to have entered the controlled area of the TAC and offices 

shared by other IRS business units. At the same TAC, we noted that emergency 

alarms (known as duress alarms) were not connected to a central monitoring station 

or the local police department. We were informed that the contractor had not 

completed installing the duress alarm at the time the new TAC was opened to the 

public. At another new TAC, we found that a door separating the customer waiting 

area from the secured area was not equipped with a locking device nor marked with a 

sign to inform customers that they were not permitted to enter unescorted. We also 

found that three of the TAC sites discussed above were not supervised by an on-site 

manager. IRS policy requires that in such cases, designated responsible offsite TAC 

managers are required to make routine supervisory visits to ensure that operations 

are performed according to standards. However, IRS did not have documentation to 

demonstrate if or how often such supervisory visits to these locations actually 

occurred or what was accomplished during these visits. Without appropriate 

supervisory oversight, the risk is significantly increased that the physical security 

issues we identified may not be timely detected and corrected. 

The IRM requires that access to assets be limited to those employees with a valid 

business need to access the information. GAO’s Standards for Internal Control in 

the Federal Government requires physical controls to limit access to vulnerable 

assets and records to authorized individuals. Such controls may include an 

appropriate combination of locks, duress alarms, warning signs, and other measures. 

13One of the TRRs at this location worked a part-time schedule. 

14As of March 2006, IRS had reconfigured 115 of its 400 TACs located throughout the United States, has 

an additional 29 such projects underway, and plans on reconfiguring the remaining TACs by 2014. 
Page 8 GAO-06-543R IRS Management Report

Not adequately implementing such measures to restrict access to taxpayer receipts 

and information increases the risk that loss, theft, and/or misuse of taxpayer receipts 

and information may occur and not be timely detected. 

Recommendations

We recommend that IRS 

• equip all TACs with adequate physical security controls to deter and prevent 

unauthorized access to controlled areas or office space occupied by other IRS 

units, including those TACs that are not scheduled to be reconfigured to the 

“new TAC” model in the near future . This includes appropriately separating 

customer service waiting areas from controlled areas by physical barriers such 

as locked doors marked with signs barring entrance by unescorted customers; 

• connect duress alarms to a central monitoring station or local police 

department or institute appropriate compensating controls when these alarm 

systems are not operable or in place; and 

• document supervisory visits by offsite managers to TACS not having a 

manager permanently onsite. This documentation should be signed by the 

manager and should (1) record the time and date of the visit, (2) identify the 

manager performing the visit, (3) indicate the tasks performed during the visit, 

(4) note any problems identified, and (5) describe corrective actions planned. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations concerning physical security at the TACs. IRS 

indicated that it will identify those TACs that lack adequate physical barriers, 

evaluate this issue, and determine corrective actions by June 2006. IRS noted that its 

Field Assistance staff have developed procedures to canvass TACs twice a year for 

security, safety, health, and space concerns. IRS also stated that its Field Assistance 

staff have developed testing requirements to ensure that the alarms are appropriately 

monitored and working properly. In addition, IRS indicated that it will connect duress 

alarms to a central monitoring station or local police departments in TACs based on 

criticality and funding availability, and implement compensating controls when alarm 

systems are inoperable. IRS also stated that it had developed a checklist for managers 

to use to document their visits to TACs, which is scheduled to be added to the IRM by 

June 2006. We will evaluate the effectiveness of IRS’s efforts during our fiscal year 

2006 financial audit. 

Security Guards’ Roles and Responsibilities 

IRS relies heavily on security guards to (1) control access to IRS facilities and 

lockbox banks to safeguard taxpayer receipts and information from theft, loss, or 

abuse; (2) respond to intrusion alarms and other emergencies as needed; and (3) 

record, maintain, and report security incidents or violations to IRS for review or, 

when necessary, for corrective action. However, during our fiscal year 2005 audit, we 
Page 9 GAO-06-543R IRS Management Report

 

found that security guards did not always effectively fulfill these responsibilities. 

Specifically, we found the following: 

• Security guard personnel at one SCC and one lockbox bank did not document 

a tripped door alarm in their respective security logs. At the SCC, it took 

security guard personnel nearly 10 minutes to respond to an alarm and they 

later did not deem it necessary to document the incident as required by IRS 

policy because the door was malfunctioning and there was an “understanding” 

that such documentation was not necessary. The security personnel at the 

lockbox bank did not provide an explanation for why they did not record the 

tripped alarm. 

• Security guards stationed at one TAC often left their assigned post of duty to 

escort customers to the workstations of IRS representatives. While the guards 

were absent from their post, customers were, at times, left unsupervised in the 

customer/visitor waiting area that was accessible to controlled space through 

a door that was unlocked at the time of our visit. 

• Incident reports15 prepared by security guards at one lockbox bank did not 

include corrective follow-up actions as required by the lockbox processing 

guidelines (LPG).16 Additionally, we found that the lockbox bank security 

review checklist used by IRS to periodically monitor whether all incidents and 

alarms are recorded and reported does not ask whether corrective actions 

were included in the incident reports. Without documentation of the corrective 

action taken on each incident, IRS management does not have a record of 

what, if any, corrective actions the bank took and, consequently, will be 

unable to evaluate the appropriateness of these actions or analyze whether 

other actions are needed to minimize the incident from occuring at other 

lockbox banks. 

GAO’s Standards for Internal Control in the Federal Government require that 

management establish physical controls to secure and safeguard vulnerable assets 

and that access to resources and records, such as IRS receipts and taxpayer 

information, be limited to authorized individuals to reduce the risk of 

unauthorized use or loss to the government. Further, the IRM requires that access 

to assets be limited to those employees with a need due to their official duties 

and/or responsibilities. The IRM and LPG also require security guards to report 

and record significant conditions or situations to appropriate authorities. IRS 

relies heavily on security guards to control entry into all of its SCCs and lockbox 

banks and several of the TACs we visited, and to protect taxpayer receipts and 

information from theft, loss, or abuse. However, when they do not perform their 

duties in accordance with IRS policy, their effectiveness in achieving these 

15Incident reports are used by security guards to document and record their response to suspicious 

events, incidents, and activities. In addition, lockbox banks are required to maintain a log of incident 

reports, noting the action that the lockbox bank took to correct the incident. 

16Internal Revenue Service, “2005 Lockbox Processing Guidelines” (Washington, D.C.: January 2005), 

and subsequent 2005 updates. The 2005 LPG provides guidelines for processing work at lockbox banks 

serving IRS for the 2005 filing season. 
Page 10 GAO-06-543R IRS Management Report

objectives is impaired, thus increasing the risk that unauthorized individuals may 

access IRS offices and compromise taxpayer records and data and/or disrupt 

operations. 

Recommendations

We recommend that IRS 

• enforce the requirement that all security or other responsible personnel at 

SCCs and lockbox banks record all instances involving the activation of 

intrusion alarms regardless of the circumstances that may have caused the 

activation; 

• reemphasize the need for the security guards at all TACs to ensure that key 

posts of duty, such as entrances to facilities, are not left unattended; and 

• revise its lockbox bank’s security review checklist to ensure that it 

encompasses reviewing security incident reports to validate whether security 

personnel are providing corrective actions related to the incidents cited. 

IRS Comments and Our Evaluation

IRS substantially agreed with our recommendations concerning security guards’ roles 

and responsibilities. Regarding our recommendation that IRS enforce the 

requirement that personnel responsible for security at SCCs and lockbox banks 

record all instances of activation of intrusion alarms, IRS stated that it had revised 

the Lockbox Security Guidelines in January 2006 to require documentation of such 

events. IRS also noted that field security analysts were advised to enforce this 

requirement. In addition, IRS indicated that it would prepare a memorandum to 

reemphasize security guards’ duties and responsibilities and the importance of 

meeting security requirements, and provide it to all TACs by October 2006. IRS also 

stated that it would revise its physical security review checklist to ensure that it 

encompasses reviewing security incident reports to validate whether security 

personnel are providing corrective actions related to the incidents cited. We will 

evaluate the effectiveness of IRS’s efforts during our fiscal year 2006 financial audit. 

Candling Reviews 

In previous audits, we found weaknesses in IRS’s controls over candling and made 

several recommendations to IRS for improving its candling procedures at SCCs and 

lockbox banks.17 Generally, we recommended that IRS revise candling procedures to 

specify the precise candling methods to be used for various types of envelopes 

received, require management to ensure that envelopes are properly candled, and 

monitor adherence to these requirements. In response, IRS revised its candling 

procedures to (1) specify the precise candling method to be used for the first and 

final candling based on the dimensions of envelopes received, (2) require that all 

envelopes, including those manually extracted (e.g., non letter-size envelopes), be 

 

17GAO-05-247R. 
Page 11 GAO-06-543R IRS Management Report

 

subject to initial and final candling prior to destruction, (3) require that non letter-size 

envelopes be sliced on three sides and opened flat to assure no contents are left 

inside the envelope, (4) require that envelopes opened on three or more sides 

manually or by machine still be candled, and (5) require that managers review and 

document evidence of their review of items found during candling every day for each 

work shift. Additionally, IRS modified the LPG and IRM, as applicable, to (1) require 

recording of receipts discovered during candling in a control log, (2) prohibit a single, 

isolated employee from performing candling, and (3) require that all envelopes 

opened on three or more sides including those opened by machine, be candled one 

more time on a candling table. 

Despite these actions, during our fiscal year 2005 audit, we continued to find 

deficiencies in IRS’s oversight and implementation of candling procedures at three of 

the four SCCs we visited. At these SCCs, IRS management did not always enforce the 

requirement that opened envelopes receive at least two candlings before they are 

made available for destruction. Specifically, we found the following: 

• At one SCC, we observed that an extractor did not perform initial candling of 

regular letter-size envelopes by placing the envelope over a light source. The 

employee indicated that there was no need to place the envelope over the light 

source because they “knew” the envelope was empty. We also found several 

non letter-size envelopes18 that were not slit open on all three sides as required 

by IRS policy. In each instance, the envelopes had not received initial candling 

or been properly candled before being made available for destruction. 

• At another SCC, we observed extractors splitting non letter-size envelopes on 

three sides and placing them in the bin for shredding without the benefit of a 

final candling. Also, we observed that employees performing final candling did 

not immediately record the items found upon discovery. After further inquiry, 

we found that there was no candling log available at the candling table for 

employees to record the discovered items. 

• At two SCCs, we found non letter-size envelopes that had been slit only once 

in a bin scheduled for final destruction. This indicates that these envelopes 

were either only candled once or not properly candled before being made 

available for destruction. 

Over the past several years IRS has conducted monthly security reviews of its receipt 

and control function responsible for opening and candling envelopes. While these 

reviews address various controls designed to safeguard taxpayer receipts and 

information, including candling, they do not address the effectiveness of the candling 

procedures performed. For example, there are no questions on the checklist designed 

to test the usefulness of the candling procedures or discussions and observations 

with employees performing initial and final candling to assess their awareness of the 

18Non letter-size envelopes refer to envelopes that are either larger or smaller than the standard white 

business-size envelopes that are used for mailing such items as personal or business mail (e.g., utility 

bills, tax returns, general correspondences). 
Page 12 GAO-06-543R IRS Management Report

required candling procedures. GAO’s Standards for Internal Control in the Federal 

Government requires that management establish physical controls to secure and 

safeguard vulnerable assets and provide qualified and continuous supervision to 

ensure that control objectives are achieved.19 Candling is a key control employed by 

IRS to ensure that taxpayer receipts are not inadvertently overlooked and destroyed. 

The lack of adherence to the prescribed candling procedures limits the effectiveness 

of this control and increases the risk of inadvertent loss or destruction of taxpayer 

receipts. 

Recommendation

We recommend that IRS refine the scope and nature of its periodic reviews of 

candling processes at SCCs to ensure they (1) encompass tests of whether envelopes 

are properly candled through observation of candling in process and inquiry of 

employees who perform initial and final candling, and (2) document the nature and 

scope of the test and observation results. 

IRS Comments and Our Evaluation

IRS agreed with our recommendation and stated it will revise its Internal Control 

Checklist used for the monthly security reviews by January 2007 to address the 

effectiveness of the candling procedures performed. We will evaluate the 

effectiveness of IRS’s efforts during future audits. 

Processing of Remittances 

During our fiscal year 2005 audit, we found that lockbox banks were not always 

timely processing large dollar remittances.20 Specifically, at two of the lockbox banks 

we visited, we found large dollar checks that were not processed immediately. At one 

of the lockbox banks, six large checks totaling $1.25 million had been extracted from 

envelopes but were left in the extraction area; bank management informed us that the 

checks were not immediately processed because they were extracted by an earlier 

shift and that the current shift leaders were not aware of them. At the other bank, we 

found similar large checks in the extraction area that were not immediately 

processed but rather were left in bins while the extraction team went on a break. 

GAO’s Standards for Internal Control in the Federal Government require that 

transactions be promptly recorded to maintain their relevance and value to 

management in controlling operations and making decisions. This includes the 

timely processing of transactions. In addition, the LPG requires that remittances of 

$50,000 or more be immediately processed and deposited as part of the first available 

deposit. IRS conducts periodic performance and operational reviews of lockbox 

banks to ensure compliance with guidelines over processing and securing taxpayer 

receipts and information. However, the review process does not assess controls 

designed to ensure whether large checks are immediately processed and deposited as 

part of the first available deposit, as required by the LPG. By not always processing 

 

19GAO/AIMD-00-21.3.1. 

20In the LPG, IRS defines large dollar remittances as those with amounts $50,000 or greater. 
Page 13 GAO-06-543R IRS Management Report

high dollar remittances immediately, IRS increases the risk of loss, theft, or 

misappropriation of such checks. 

Recommendations

We recommend that IRS 

• enforce its existing policies and procedures at lockbox banks to ensure that all 

remittances of $50,000 or more are processed immediately and deposited at 

the first available opportunity; and 

• refine the scope and nature of its periodic reviews of lockbox banks to include 

high dollar remittances to better monitor adherence to the requirement that 

they are processed immediately and deposited at the first available 

opportunity. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations concerning controls over processing high 

dollar remittances. IRS stated that it will add appropriate language to the LPG to 

enforce its existing policies and procedures at lockbox banks for handling 

remittances of $50,000 or more. IRS also stated that by May 2006, it will add a review 

checkpoint for high dollar remittances to the Processing Internal Controls Data 

Collection Instrument used by Lockbox Field Coordinators during on-site reviews. 

We will evaluate the effectiveness of IRS’s efforts during our fiscal year 2006 financial 

audit. 

Physical Access Controls at Tax Return Processing Facilities 

As the U.S. government’s principal revenue-collecting agency, IRS collects more than 

two trillion dollars in taxes each year, accounting for more than 95 percent of the U.S. 

government’s total revenues. This includes hundreds of millions of dollars in 

hardcopy tax payments and related information which is submitted to IRS tax 

processing facilities by millions of taxpayers. IRS has a responsibility to safeguard 

these payments and the related information entrusted to it by the nation’s taxpayers. 

To fulfill this responsibility, it is essential that IRS have effective physical security 

controls to prevent unauthorized access to its tax return processing facilities. 

However, we found deficiencies in several of these controls during our fiscal year 

2005 audit. Specifically, at two of the SCCs and at one of the lockbox banks we 

visited as part of our audit, we found weaknesses in controls over access to the 

facility and/or surrounding perimeter that increase the risk of penetration by 

unauthorized individuals. For example: 

• At one SCC, we observed flaws in the security over the facility’s perimeter that 

could allow unauthorized individuals to bypass security guards and enter the 

grounds unobserved. These flaws included (1) unguarded entrances to perimeter 

grounds, (2) gaps in the security fence, and (3) overgrown shrubbery which 

obstructed the view of security personnel. 
Page 14 GAO-06-543R IRS Management Report

• At the same SCC, we observed that employees entering the facility were not 

always subject to verification of their credentials. At the SCC, we observed 

employees closely following an employee who had opened a secure door with 

their proximity access card; these individuals were able to enter without 

presenting credentials of their own (a practice known as “piggybacking”). In 

testing another entrance, we found the same weakness by entering via 

piggybacking on IRS employees who had presented access cards. 

• At the second SCC’s annex facility, we found two loading dock door alarms that 

were both inoperable. IRS officials at the facility informed us that they had been 

inoperable since they had been inadvertently deactivated while performing 

maintenance on an adjacent door three weeks earlier. 

• At the lockbox bank, we found that couriers from two different mail delivery 

services were allowed to enter the facility without first presenting proper 

identification. 

GAO’s Standards for Internal Control in the Federal Government requires that 

agencies establish physical controls to limit access to vulnerable assets and records 

to authorized individuals. To help ensure that its physical security controls are 

effective, IRS routinely reviews the security at all SCCs and lockbox banks, identifies 

weaknesses, and pursues corrective actions. However, at SCCs, these reviews do not 

encompass reviewing controls over access to the grounds through the outer 

perimeter. Additionally, at both SCCs and lockbox banks, the reviews do not 

encompass testing the effectiveness of controls intended to prevent individuals 

without proper credentials from entering the facility. Also, while the IRM requires 

that SCC intrusion alarm systems be tested, it only requires that the testing be 

conducted annually. Consequently, an alarm could potentially be dysfunctional for an 

extended period and remain undetected for several months. Also, the IRM does not 

offer guidance as to how these tests should be conducted and the results 

documented. These weaknesses increase the risk that unauthorized individuals may 

enter these tax return processing facilities and potentially disrupt operations or 

compromise the taxpayer receipts or information they process. 

Recommendations

We recommend that IRS 

• refine the scope and nature of its periodic security reviews to encompass (1) 

testing the effectiveness of controls intended to ensure that only individuals 

with proper credentials are permitted access to SCCs and lockbox banks, and 

(2) reviewing the integrity of perimeter security at SCCs; and 

• revise the physical security procedures contained in the IRM to require that all 

SCCs and any respective annex facilities processing taxpayer receipts and/or 

information perform and document monthly tests of the facility’s intrusion 

detection alarms. At a minimum, these procedures should (1) outline the type 
Page 15 GAO-06-543R IRS Management Report

of test to be conducted, (2) include criteria for assessing whether the controls 

used to respond to the alarm were effective, and (3) require that a logbook be 

maintained to document the test dates, results, and response information. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations concerning physical access controls at tax 

processing facilities. In response to our recommendation that IRS refine the nature 

of its periodic security reviews, IRS stated that the lockbox bank site discussed in the 

audit report that did not restrict access of unauthorized employees was instructed to 

immediately prohibit entry and acceptance of deliveries from these and similar 

unauthorized employees in the loading dock area. IRS stated that its review team will 

add this requirement as a specific review item in their physical security review 

process. Additionally, IRS indicated that it had updated its Security Review 

Procedures and Checklist for SCCs and lockbox banks and conducted quarterly 

reviews with the new procedures/checklist to assess employee piggybacking 

attempts, fence lines, landscaping, and alarm testing. IRS noted that it will update the 

IRM and LPG related to the SCCs alarm testing procedures to include a description of 

the types of tests to be conducted, criteria for assessing controls, and the logging of 

requirements by August 2007. We will evaluate the effectiveness of IRS’s efforts 

during future audits. 

Hiring Juveniles for Access to Taxpayer Receipts and Information 

IRS requires background investigations on every prospective contract or non-contract 

employee prior to granting them access to taxpayer receipts and information. 

However, legal restrictions limit the scope of background investigations for juvenile 

applicants. Specifically, title 18 of the United States Code, section 5038, prevents the 

release of criminal records on juveniles when the request is related to an application 

for employment. To compensate, IRS policy requires that juveniles hired to perform 

receipt and control processing functions submit a Recommendation for Juvenile 

Employment (form 13094) or an equivalent document from an individual 

recommending the juvenile for employment in a position of trust.21 However, during 

our fiscal year 2005 audit, we found limitations in IRS’s design and implementation of 

its policy. Specifically, we found the following: 

• IRS policy requiring the completed form 13094 only applies to juveniles hired 

to perform receipt processing functions. However, access to taxpayer 

information is not limited to staff assigned to receipt processing functions. 

Thus, this policy may allow juveniles access to taxpayer information without 

providing any references. 

• The form 13094s are provided directly to IRS by the juvenile as part of the 

application package, and IRS personnel officials do not verify the source of the 

 

21The Recommendation for Juvenile Employment form asks the reference provider to check off 

whether he or she feels that the juvenile is suitable for a position of trust or to disclaim his/her 

knowledge of the juvenile. Other data captured includes the name of the reference and information 

related to the school and current/former employer of the juvenile. 
Page 16 GAO-06-543R IRS Management Report

information submitted. Consequentially, IRS does not have adequate 

assurance that the individual whose name appears on the form actually exists 

and that they completed the form as represented. 

• The form does not require that the reference describe his or her relationship 

with the juvenile, including the number of years known and the nature of the 

relationship, in order to allow IRS to assess whether the reference has 

sufficient basis to recommend the juvenile for employment. 

• IRS did not obtain form 13094s for three juveniles hired in the receipt and 

control processing function during fiscal year 2005. According to IRS officials, 

they decided not to request the form from these three individuals because they 

graduated from high school prior to attaining the age of 18 and did not have a 

current or former employer or a current teacher, counselor, or principal as 

required by the form’s instructions. As a result, these three juveniles were 

given access to taxpayer receipts and information without an independent 

assessment of their character, as required by IRS policy. 

GAO’s Standards for Internal Control in the Federal Government requires that 

access to resources and records, such as IRS receipts and taxpayer data, be limited to 

authorized individuals to reduce the risk of unauthorized use or loss to the 

government.22 By not (1) always obtaining a character reference for juveniles to be 

permitted access to taxpayer receipts and information and (2) independently 

verifying the source of the information on the form, IRS increases the risk that 

juveniles with inappropriate backgrounds may obtain access to sensitive taxpayer 

receipts and information. 

Recommendations

We recommend that IRS 

• amend its policy to require that a completed form 13094 with a positive 

recommendation be provided for every juvenile hired to any position that will 

allow access to taxpayer receipts and/or taxpayer information; 

• require IRS personnel to verify the information on the form 13094 by 

contacting the reference directly; 

• revise the form 13094 to require the reference to describe his/her relationship 

with the juvenile, including extent of first-hand contact, to allow IRS to review 

the forms and assess whether the referencer has sufficient basis to 

recommend that juvenile to a position of trust; and 

• establish procedures for hiring juveniles who do not have a current teacher, 

principal, counselor, employer or former employer, and clarify that IRS’s 

current policies and procedures should not be interpreted to mean that such 

 

22GAO/AIMD-00-21.3.1. 
Page 17 GAO-06-543R IRS Management Report

juveniles should be allowed access to taxpayer receipts and information 

without a form 13094 or its equivalent. These procedures could include a list of 

acceptable alternatives that may serve as references for juveniles who do not 

have a current teacher, principal, or guidance counselor. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations concerning controls over hiring juveniles. To 

address these recommendations, IRS stated that (1) it will amend its policy to require 

that a completed Recommendation for Juvenile Employment (form 13094) with a 

positive recommendation be provided for every juvenile hired to any position 

allowing access to taxpayer receipts and/or taxpayer information; (2) once the Office 

of Management and Budget (OMB) approves the revised form 13094, it will, by August 

2006, issue a new policy requiring IRS personnel to verify the information on the form 

13094 by contacting the reference directly; (3) it will make appropriate revisions to 

the form 13094 to require the reference to describe his/her relationship with the 

juvenile; and (4) after OMB approves the revised form 13094, it will issue a new policy 

establishing procedures for hiring juveniles who do not have a current teacher, 

principal, counselor, employer or former employer, and clarify that IRS’s current 

policies and procedures should not be interpreted to mean that such juveniles should 

be allowed access to taxpayer receipts and information without a form 13094 or its 

equivalent. We will evaluate the effectiveness of IRS’s efforts during our fiscal year 

2006 financial audit. 

Classifying and Reporting Expense and P&E Transactions 

During our fiscal year 2005 audit, we found deficiencies in IRS’s controls over the 

classification and reporting of transactions relating to its expenses and property and 

equipment (P&E) acquisitions. Specifically, IRS did not always assure that it properly 

classified its procurement transactions as P&E and recognized assets when they met 

its capitalization criteria, or as expenses when they did not. IRS’s property and 

equipment capitalization policy, which is consistent with Statement of Federal 

Financial Accounting Standards No. 623 and provides criteria on the capitalization of 

P&E, requires the recognition of assets when its capitalization criteria is met and the 

recognition of expense when it is not. To implement this policy, IRS requires its staff 

to classify expense and P&E acquisition transactions at the time orders are placed 

and assign and record the classification and accounting codes in the general ledger 

when they record the obligations. At the end of each month, IRS personnel review 

the entries to expense and P&E accounts considered more susceptible to error to 

determine if any classification errors occurred and, if so, to make the necessary 

corrections to properly classify and record them. We noted that IRS’s established 

policy, if properly implemented, could help its staff differentiate between expense 

and P&E transactions and, through periodic reviews, detect and correct transactions 

improperly recorded in the expense and P&E accounts. However, IRS’s staff did not 

always follow the capitalization policy effectively in fiscal year 2005. 

 

23U.S. Federal Accounting Standards Advisory Board (FASAB), SFFAS No. 6, Accounting for Property, Plant, 

and Equipment.
Page 18 GAO-06-543R IRS Management Report

We tested a total of 267 sampled transactions from IRS’s non-payroll expenses and 

P&E acquisitions recorded during the first 9 months of fiscal year 2005 and accounts 

payable as of September 30, 2005, and found that 6 of the transactions were classified 

and reported incorrectly. Specifically: 

• We found two instances where IRS initially recorded purchases of automated 

data processing equipment with a total cost of $7.8 million correctly as P&E 

acquisitions but subsequently reviewed the initial accounting treatment, 

removed the transactions from P&E, and erroneously included them in the 

expense accounts. In another instance, IRS initially recorded a $266,000 

purchase of information services correctly as an expense but, after one of its 

periodic reviews, removed it from expense and erroneously included it as 

capitalized P&E. 

• In the remaining 3 instances, IRS initially misclassified procurement 

transactions totaling $1.7 million that should have been recorded as expenses 

and incorrectly recorded them as P&E. One transaction involved an operating 

lease payment that IRS capitalized as an asset instead of including it in 

expenses. The other 2 transactions involved charges for support services that 

IRS misclassified and incorrectly recorded as P&E instead of expenses. IRS 

did not detect and correct these misclassified transactions either when they 

were initially recorded or during its periodic review process. 

GAO’s Standards for Internal Control in the Federal Government require that 

transactions and other events be accurately and timely recorded to maintain their 

relevance and value to management in controlling operations and making decisions. 

This applies to the entire process or life cycle of a transaction or event from the 

initiation and authorization through its final classification in summary records. In 

addition, control activities help to ensure that all transactions are completely and 

accurately recorded. 

The errors we found occurred because IRS’s controls over its property and 

equipment capitalization process were not always effective. While these errors did 

not result in a material misstatement to IRS’s fiscal year 2005 financial statements, 

the control weaknesses that gave rise to these errors precludes IRS from having 

assurance that its financial records for expenses and capital assets are capable of 

generating reliable reports on an ongoing basis throughout the year. 

Recommendation

To assure proper accounting treatment of expense and P&E transactions and reliable 

financial reporting, we recommend that IRS enforce its property and equipment 

capitalization policy to ensure that it is properly implemented to fully achieve 

management’s objectives, including recognizing assets when its capitalization criteria 

is met and recognizing expenses when it is not. 

IRS Comments and Our Evaluation
Page 19 GAO-06-543R IRS Management Report

 

IRS agreed with our recommendation. IRS’s stated that its Chief Financial Officer 

and Procurement Office implemented new procedures for reviewing the classification 

of P&E into its accounting system. The Procurement Office will begin reviewing 

classification codes to ensure correctness and will take all necessary steps to ensure 

end users correct errors prior to entering the obligations. IRS expects these new 

procedures to be fully operational for the fourth quarter of fiscal year 2006. IRS also 

stated that it modified the scope of its monthly review of P&E transactions to include 

only obligations above a pre-determined dollar threshold. IRS indicated that these 

procedures were implemented in April 2006 for P&E acquired in March 2006. We will 

evaluate the effectiveness of IRS’s efforts during our fiscal year 2006 financial 

statement audit. 

Recording Disposals of Property and Equipment 

In prior years, we identified deficiencies in IRS’s process for recording property and 

equipment (P&E) transactions in its inventory records. Over the past several years, 

IRS has made substantial progress in improving the accuracy and reliability of its 

inventory records. While we recognize IRS’s progress, our work performed as part of 

our fiscal year 2005 audit indicates that further improvements are needed. During our 

audit, we found that IRS staff did not always follow the agency’s procedures requiring 

the prompt recording of disposals of property and equipment in its inventory records. 

The P&E disposal process is initiated when the function utilizing P&E notifies the 

local Single Point Inventory Function (SPIF) unit that they have P&E to be excessed 

or retired. The local SPIF unit arranges to remove the P&E, prepares the necessary 

paperwork, updates the inventory records to reflect that the asset is pending 

disposal, and turns custody of the P&E over to the Facilities Management Branch 

(FMB). FMB has responsibility for physical disposition of the P&E and updating the 

inventory records to reflect the final disposal. The IRM specifies that P&E inventory 

records must be updated to reflect all disposals within ten days of the action. 

During our fiscal year 2005 audit, we found that eight of 220 items selected from IRS’s 

inventory records could not be located.24 All of these assets had been disposed of, but 

the inventory records reflected the assets as pending disposal. FMB had not updated 

the inventory system to change the disposal status from pending to final. For three of 

the exceptions found at one location, the assets were retired on May 15, 2004, but the 

disposals were still reflected as pending as of July 15, 2005, more than one year after 

the date of disposal. IRS’s property management system does not generate aging 

reports to indicate the length of time assets have remained in pending status. 

GAO’s Standards for Internal Control in the Federal Government require agencies 

to implement internal control procedures to ensure the accurate and timely recording 

of transactions and events. This standard further states that transactions should be 

promptly recorded to maintain their relevance and value to management in 

24For our book-to-floor sample, we selected a two-stage cluster sample of P&E items. In the first stage, 

we selected a sample of 22 buildings in probabilities proportionate to the number of P&E items in each 

building’s inventory records. In the second stage, we randomly selected a sample of 10 assets located 

at each of the 22 buildings. 
Page 20 GAO-06-543R IRS Management Report

controlling operations and making decisions. Property records that are out of date 

impede management’s ability to make sound operating decisions, monitor 

performance, and allocate resources, and can result in undetected theft or loss of 

assets. 

Recommendation

We recommend that IRS 

• generate aging reports when an asset remains in pending disposal status for 

longer than a specified period of time; and 

• direct FMB managers to research and resolve the aging reports. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations concerning recording disposals of property 

and equipment. IRS indicated that issues raised in the fiscal year 2005 financial 

statement audit were being addressed through an IRS re-engineering effort focused 

on the entire asset retirement and disposal process. IRS stated that it currently has 

reports available to monitor aging transactions during the disposal life cycle. IRS also 

indicated that it is (1) developing procedures to require reviews of aging reports to 

streamline the process to ensure timely recording of disposal transactions, and (2) 

modifying software to electronically record such transactions. IRS intends to 

implement these modifications and review procedures by August 2006. We will 

evaluate the effectiveness of IRS’s efforts during our fiscal year 2006 financial 

statement audit. 

- - - - - 

This report contains recommendations to you. The head of a federal agency is 

required by 31 U.S.C. § 720 to submit a written statement on actions taken on these 

recommendations. You should submit your statement to the Senate Committee on 

Homeland Security and Governmental Affairs and the House Committee on 

Government Reform within 60 days of the date of this report. A written statement 

must also be sent to the House and Senate Committees on Appropriations with the 

agency’s first request for appropriations made more than 60 days after the date of the 

report. 

This report is intended for use by the management of IRS. We are sending copies to 

the Chairmen and Ranking Minority Members of the Senate Committee on 

Appropriations; Senate Committee on Finance; Senate Committee on Homeland 

Security and Governmental Affairs; and Subcommittee on Taxation and IRS 

Oversight, Senate Committee on Finance. We are also sending copies to the 

Chairmen and Ranking Minority Members of the House Committee on 

Appropriations; House Committee on Ways and Means; the Chairman and ViceChairman of the Joint Committee on Taxation, the Secretary of the Treasury, the 

Director of the Office of Management and Budget, the Chairman of the IRS Oversight 
Page 21 GAO-06-543R IRS Management Report

Board, and other interested parties. The report is available at no charge on GAO’s 

Web site at http://www.gao.gov. 

We acknowledge and appreciate the cooperation and assistance provided by IRS 

officials and staff during our audits of IRS’s fiscal years 2005 and 2004 financial 

statements. Please contact me at (202) 512-3406 or sebastians@gao.gov if you or your 

staff have any questions concerning this report. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page of this 

report. GAO staff who made major contributions to this report are listed in enclosure 

III. 

Steven J. Sebastian 

Director 

Financial Management and Assurance 

Enclosures – 3 
Page 22 GAO-06-543R IRS Management Report

Enclosure I 

Comments from the Internal Revenue Service 
Page 23 GAO-06-543R IRS Management Report
Page 24 GAO-06-543R IRS Management Report
Page 25 GAO-06-543R IRS Management Report
Page 26 GAO-06-543R IRS Management Report
Page 27 GAO-06-543R IRS Management Report
Page 28 GAO-06-543R IRS Management Report
Page 29 GAO-06-543R IRS Management Report
Page 30 GAO-06-543R IRS Management Report
Page 31 GAO-06-543R IRS Management Report

Enclosure II 

Details on Audit Methodology 

To fulfill our responsibilities as the auditor of the Internal Revenue Service’s (IRS) 

financial statements, we did the following: 

• Examined, on a test basis, evidence supporting the amounts and disclosures in 

the financial statements. This included testing selected statistical samples of 

unpaid assessment, revenue, refund, accrued expenses, payroll, nonpayroll, 

property and equipment, and undelivered order transactions. These statistical 

samples were selected primarily to substantiate balances and activities reported 

in IRS’s financial statements. Consequently, dollar errors or amounts can and 

have been statistically projected to the population of transactions from which 

they were selected. In testing these samples, certain attributes were identified 

that indicated either significant deficiencies in the design or operation of internal 

control or compliance with provisions of laws and regulations. These attributes, 

where applicable, can be and have been statistically projected to the appropriate 

populations. 

• Assessed the accounting principles used and significant estimates made by 

management. 

• Evaluated the overall presentation of the financial statements. 

• Obtained an understanding of internal controls related to financial reporting 

(including safeguarding assets), compliance with laws and regulations (including 

the execution of transactions in accordance with budget authority), and 

performance measures reported in the Management Discussion and Analysis. 

• Tested relevant internal controls over financial reporting (including safeguarding 

assets) and compliance, and evaluated the design and operating effectiveness of 

internal controls. 

• Considered the process for evaluating and reporting on internal controls and 

financial management systems under 31 U.S.C. § 3512 (c), (d), commonly referred 

to as the Federal Managers’ Financial Integrity Act of 1982. 

• Tested compliance with selected provisions of the following laws and regulations: 

Anti-Deficiency Act, as amended (31 U.S.C. § 1341(a)(1) and 31 U.S.C. § 1517(a)); 

Purpose Statute (31 U.S.C. § 1301); Release of lien or discharge of property (26 

U.S.C. § 6325); Interest on underpayment, nonpayment, or extensions of time for 

payment of tax (26 U.S.C. § 6601); Interest on overpayments (26 U.S.C. § 6611); 

Determination of rate of interest (26 U.S.C. § 6621); Failure to file tax return or to 
Page 32 GAO-06-543R IRS Management Report

pay tax (26 U.S.C. § 6651); Failure by individual to pay estimated income tax (26 

U.S.C. § 6654); Failure by corporation to pay estimated income tax (26 U.S.C. § 

6655); Prompt Payment Act (31 U.S.C. § 3902(a), (b), and (f) and 31 U.S.C. § 3904); 

Pay and Allowance System for Civilian Employees (5 U.S.C. §§ 5332 and 5343, and 

29 U.S.C. § 206); Federal Employees’ Retirement System Act of 1986, as amended 

(5 U.S.C. §§ 8422, 8423, and 8432); Social Security Act, as amended (26 U.S.C. §§ 

3101 and 3121 and 42 U.S.C. § 430); Federal Employees Health Benefits Act of 

1959, as amended (5 U.S.C. §§ 8905, 8906, and 8909); Transportation, Treasury, 

and Independent Agencies Appropriations Act, 2004, Pub. L. No. 108- 199, div. F, 

tit. II, 118 Stat. 314 (Jan. 23, 2004); and Transportation, Treasury, Independent 

Agencies, and General Government Appropriations Act, 2005, Pub. L. No. 108-447, 

div. H, tit. II, 118 Stat. 3235 (Dec. 8, 2004). 

• Tested whether IRS’s financial management systems substantially comply with 

the three requirements of the Federal Financial Management Improvement Act of 

1996 (Pub. L. No. 104-208, div. A, § 101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 

30, 1996). 
Page 33 GAO-06-543R IRS Management Report

Enclosure III 

Staff Acknowledgments 

___________________________________________________________________________ 

Acknowledgments The following individuals made major contributions to 

this report: Charles Fox-Assistant Director, Manmei 

Chen, John Davis, Paul Foderaro, Ted Hu, Jerrod 

O’Nelio, Theresa Patrizio, Robert Preshlock, John 

Sawyer, Angel Sharma, Peggy Smith, and Gary

Wiggins. 

(196092) 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately.