U.S. GOVERNMENT PUBLISHING OFFICE

33–655 WASHINGTON : 2019

INTERNAL REVENUE SERVICE’S INFORMATION 

TECHNOLOGY MODERNIZATION EFFORTS 

HEARING 

BEFORE THE

SUBCOMMITTEE ON OVERSIGHT 

OF THE

COMMITTEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

OCTOBER 4, 2017 

Serial No. 115–OS08 

Printed for the use of the Committee on Ways and Means 

( 

ii 

COMMITTEE ON WAYS AND MEANS 

KEVIN BRADY, Texas, Chairman 

SAM JOHNSON, Texas 

DEVIN NUNES, California 

PATRICK J. TIBERI, Ohio 

DAVID G. REICHERT, Washington 

PETER J. ROSKAM, Illinois 

VERN BUCHANAN, Florida 

ADRIAN SMITH, Nebraska 

LYNN JENKINS, Kansas 

ERIK PAULSEN, Minnesota 

KENNY MARCHANT, Texas 

DIANE BLACK, Tennessee 

TOM REED, New York 

MIKE KELLY, Pennsylvania 

JIM RENACCI, Ohio 

PAT MEEHAN, Pennsylvania 

KRISTI NOEM, South Dakota 

GEORGE HOLDING, North Carolina 

JASON SMITH, Missouri 

TOM RICE, South Carolina 

DAVID SCHWEIKERT, Arizona 

JACKIE WALORSKI, Indiana 

CARLOS CURBELO, Florida 

MIKE BISHOP, Michigan 

RICHARD E. NEAL, Massachusetts 

SANDER M. LEVIN, Michigan 

JOHN LEWIS, Georgia 

LLOYD DOGGETT, Texas 

MIKE THOMPSON, California 

JOHN B. LARSON, Connecticut 

EARL BLUMENAUER, Oregon 

RON KIND, Wisconsin 

BILL PASCRELL, JR., New Jersey 

JOSEPH CROWLEY, New York 

DANNY DAVIS, Illinois 

LINDA SA ́ NCHEZ, California 

BRIAN HIGGINS, New York 

TERRI SEWELL, Alabama 

SUZAN DELBENE, Washington 

JUDY CHU, California 

DAVID STEWART, Staff Director 

BRANDON CASEY, Minority Chief Counsel 

SUBCOMMITTEE ON OVERSIGHT 

VERN BUCHANAN, Florida, Chairman 

DAVID SCHWEIKERT, Arizona 

JACKIE WALORSKI, Indiana 

CARLOS CURBELO, Florida 

MIKE BISHOP, Michigan 

PAT MEEHAN, Pennsylvania 

GEORGE HOLDING, North Carolina 

JOHN LEWIS, Georgia 

JOSEPH CROWLEY, New York 

SUZAN DELBENE, Washington 

EARL BLUMENAUER, Oregon 

iii 

C O N T E N T S 

Page 

Advisory of October 4, 2017 announcing the hearing ........................................... 2 

WITNESSES 

Jeffrey Tribiano, Deputy Commissioner for Operations Support, IRS ................ 4 

Gina Garza, Chief Information Officer, IRS .......................................................... 4 

Mr. Danny Verneuille, Assistant Inspector General for Security and Information ........................................................................................................................ 13

Technology Services, Treasury Inspector General for Tax Administration 

(TIGTA) ................................................................................................................. 26 

Mr. David Powner, Director, IT Management Issues, Government Accountability Office (GAO) ............................................................................................. 27 

QUESTIONS FOR THE RECORD 

Questions from The Honorable Vern Buchanan, to Jeffrey Tribiano .................. 58 

Questions from The Honorable Jackie Walorski, to Jeffrey Tribiano ................. 87 

Questions from The Honorable Mike Bishop, to Jeffrey Tribiano ....................... 90 

Questions from The Honorable Vern Buchanan, to Danny Verneuille ............... 93 

Questions from The Honorable Vern Buchanan, to David Powner ..................... 98 

PUBLIC SUBMISSIONS FOR THE RECORD 

Citizens Against Government Waste (CAGW) ...................................................... 105 

The National Treasury Employees Union (NTEU) ............................................... 107 

(1) 

IRS REFORM: CHALLENGES TO MODERNIZING 

IT INFRASTRUCTURE 

WEDNESDAY, OCTOBER 4, 2017 

U.S. HOUSE OF REPRESENTATIVES, 

COMMITTEE ON WAYS AND MEANS, 

SUBCOMMITTEE ON OVERSIGHT, 

Washington,DC. 

The Subcommittee met, pursuant to call, at 9:01 a.m., in Room 

2020, Rayburn House Office Building, Hon. Vern Buchanan [Chairman of the Subcommittee] presiding. 

[The advisory announcing the hearing follows:] 

2 


Insert 33655A.001

@) 

WAYS AND MEANS 

CHAIRMAN KEV I N BRADY 

Cit airman Buchanan Announce,s Hearing on the Internal Revenue 

Service's Information Technology Modernization Efforts 

House Ways and Means Oversight Subcommittee Chaim>an Vern Buchanan (R-FL) 

announced today that the Subcommittee will hold a hearing on t1te Internal Revenue 

Service's (IRS) effons to modernize its infommtion technology (IT) infi-astructure. The 

hearing is entitled " IRS Refonn: Challenges to Modernizing IT lnfrastmcture." The 

hearing will focus on the current state of IRS IT, the challenges faced as the IRS seeks to 

modernize its IT infrastructure, and areas where the IRS could further improve its efforts. 

The hearing will take place on Wednesday, October 4, 2017 in 1100 Longworth 

House Office Building, beginning at 10:00 AM. 

ln view of 1he limited time to hear witnesses. oral testimony at this hearing will be from 

invited witnesses only. However, any individual or organization may submit a written 

statement for consideration by the Committee and for inclusion in the printed record of 

the hearing. 

DETAILS FOR SUBMISSION OF WRJTI.EN COMMENTS: 

Please Note: Any person(s) and/or organization(s) wishing to submit written comments 

for the hearing record must follow che appropriate link on the hearing page of the 

Commiuee website and complete the infonnational forms. From the Committee 

homepage. http·l/waysandmeans.house gov, select "Hearings." Select the hearing for 

whic-h you would like to make a submission, and click on the link entitled. "Click here to 

provide a submission for the record ... Once you have followed the online instructions. 

submit all requested infonnation. ATTACH your submission as a \Vord document, in 

compliance with the formatting requirements listed below, by the close of business on 

Wednesday, October 18,2017. For questions, or if you encounter technical problems, 

please call (202) 225-3625. 

FORMATTING REQUIREMENTS: 

The Committee relies on elec1ronic s·ubmissio11S for printing the official hearing record. 

As always. submissions will be included in the record according to the discre1ion of the 

Conuninee. The Con1minee will not alter the content of your submission, but we reserve 
3 

f 

Chairman BUCHANAN. The Subcommittee will come to order. 

We have Members that are running late, but I thought we would 

get started with this. Welcome to the Ways and Means Oversight 

Subcommittee hearing on IRS Reform: Challenges to Modernizing 

IT Infrastructure. Today’s hearing will focus on the current state 

of the IRS IT, the challenges faced as the IRS seeks to modernize 

itself, and areas where the IRS could improve its efforts. The importance of this topic cannot be understated. A modern, efficient, 

IT infrastructure is essential to effective tax administration, something that we would all like to see in the near future. 

While I am sure today we will hear a lot about the idea of budgetary needs, this is not just simply a budgetary issue. Budget is 

one aspect of running a successful enterprise. However, as a guy 

that ran businesses over the years, I don’t always have the money 

for everything I would like to do. Instead, I have to make tough decisions and set priorities in terms of my business moving forward 

in the future. 

Work from both the GAO and the inspector general has shown 

many instances where the IRS decision-making has led to significant IT problems. For example, in 2010, the IRS was instructed by 

the USCIO to pursue a cloud-first strategy. However, the IRS did 

not begin to work on the cloud strategy until 2016, and could not 

readily produce a full inventory of its clouds. The IRS has also 

spent millions of dollars procuring an IT system that later determined cannot be used. 

Again, examples such as these are not budget failures. They are 

management failures. But I am first to agree that we need to have 

a long-term vision in this area. As we examine tax administration 


Insert 33655A.002
4 

reform, we welcome a discussion on changes to the IRS, its budget. 

However, changes to the budget must be coupled with better management and governance of its resources the IRS already has. 

As I have said before, we would like to see the IRS work to improve how it procures and implements its IT systems. We also 

want to see the IRS be good stewards of the resources that we have 

already given them. To that end, I look forward to hearing from the 

witnesses today on ways we might improve the management, the 

IRS, and IT investment. 

The Ranking Member is not present today, so we will move forward with witness testimony. Without objection, other Members’ 

opening statements will be made part of the record. 

Today’s witness panel includes four experts: Jeffrey Tribiano, 

Deputy Commissioner for Operating Support at the IRS; Gina 

Garza, Chief Information Officer at the IRS; Danny Verneuille, Assistant Inspector General for Audit for Security and Information 

Technology Services at TIGTA; David Powner Director of IT Management Issues at the GAO. 

The Subcommittee will have received your written statements, 

and they will be made part of the formal hearing record. You each 

have five minutes to deliver your oral remarks. 

We will begin with the gentleman here to the left. You may start 

when you are ready. 

STATEMENT OF JEFFREY J. TRIBIANO, DEPUTY COMMISSIONER FOR OPERATIONS SUPPORT, ACCOMPANIED BY 

SILVANA GINA GARZA, CHIEF INFORMATION OFFICER, INTERNAL REVENUE SERVICE 

Mr. TRIBIANO. Thank you, Mr. Chairman. 

Chairman Buchanan, members of the subcommittee, my name is 

Jeff Tribiano, and I am the Deputy Commissioner for Operations 

Support at the IRS. I appreciate the opportunity to testify today. 

In my position at the IRS, I oversee internal operations and administration, which includes information technology, human capital, finance, privacy, procurement, planning, facilities, security, enterprise risk, and the Office of Equity Diversity and Inclusion. 

Joining me at the witness table is Ms. Gina Garza, the IRS’s Chief 

Information Officer. 

Providing outstanding taxpayer service is an ongoing high priority for the IRS. A safe, secure, and efficient, and up-to-date information technology system plays an increasing important role in our 

efforts to sustain and improve taxpayer service. The most visible 

taxpayer service the IRS provides is the delivery of a smooth, problem-free tax filing season, so people can file their returns and receive their refunds as quickly and easily as possible. 

Our IT systems process more than 150 million individual income 

tax returns, and we pay out more than $300 billion in refunds to 

individuals each year. During the filing season and throughout the 

year, we provide taxpayer services through a variety of delivery 

channels to help taxpayers file their returns accurately and on 

time. Hereto, our IT systems are an essential component of our 

service efforts. 

For example, IT supports our call center operation, which is one 

of the largest in the country, with which we answer over 60 million 

5 

taxpayers’ calls in 2016. Our IT systems also support our ability to 

offer online services, which we continue to expand in response to 

increasing taxpayer demand. 

The agency has been working for several years on longer term 

improvements to taxpayer experiences, and to tax administration. 

In this effort, the IRS relies heavily on information technology to 

help carry out these improvements. A major part of the initiative 

is developing an online account where taxpayers, or their representatives, can log on securely, get information about their account, and interact with the IRS as needed, including self-correcting some issues. 

Last year, we took the first step towards this when we launched 

an application on IRS.gov that provides information to taxpayers 

who have straightforward balance inquiries. Since its launch, this 

new tool has been used by taxpayers more than 1.7 million times. 

Providing outstanding taxpayer service also involves ensuring 

the information taxpayers provide to the IRS will be kept secure. 

We are constantly working to protect our main computer systems 

from cyber incidents, intrusions, and attacks. Our core tax processing systems remain secure and currently withstand more than 

1 million attempts to maliciously access the system each day. 

Another important area that IT supports is our battle against 

stolen identity refund fraud. Over the past years, we have made 

steady progress in protecting against this crime. That progress has 

accelerated since 2015, thanks to the collective efforts of the Security Summit Group and the implementation of the Return Review 

Program, or what we call RRP. The efforts of this strong, unique 

partnership between the public and private sectors, combined with 

RRP’s ability to enhance our fraud filters has produced real results. 

In fact, the number of people reported to us that they are victims 

of identity theft declined from 698,000 in calendar year 2015 to 

376,000 in 2016, a drop of more than 47 percent, and that decline 

has continued in 2017. 

For the IRS to improve, even to maintain all these services, it 

is critical for our IT systems to be up to date. But they have long 

been operating with antiquated hardware and software. Approximately 64 percent of the IRS hardware is aged and out of warranty. And 32 percent of the software is two or more releases behind the industry standards, with 15 percent more than four releases behind. 

The IRS needs to upgrade its IT infrastructure not only to help 

ensure reliable and modern taxpayer service, but also to mitigate 

the risk to the system. This is a high priority for us. We are concerned that the potential for a catastrophic system failure is increasing as our infrastructure continues to age. But in working 

modernization of our IT systems, the IRS faces a number of challenges. None is more critical than our budget. The IRS budget is 

currently about $900 million below what it was in 2010. And modernizing at a faster pace will require significant and substantial additional resources in the IT area. 

Along with providing adequate funding, Congress can also help 

us by reauthorizing streamline critical pay authority. The loss of 

this authority has made it very difficult and time consuming to reVerDate Sep 11 2014 13:34 Mar 12, 2019 Jkt 33655 PO 00000 Frm 000009 Fmt 06633 Sfmt 06602 I:\WAYS\OUT\33655.XXX 33655
6 

cruit, retain employees, and expertise in highly technical areas in 

IT, such as cybersecurity, architecture, engineering, and operation. 

Chairman Buchanan and members of the subcommittee, this concludes our opening statement, and we are happy to take your questions. 

[The prepared statement of Mr. Tribiano and Ms. Garza follows:] 

7 


Insert 33655A.003

WRITIEN TESTIMONY OF 

JEFFREY J . TRIBIANO 

DEPUTY COMMISIONER FOR OPERATIONS SUPPORT 

AND 

SILVANA GINA GARZA 

CHIEF INFORMATION OFFICER 

INTERNAL REVENUE SERVICE 

BEFORE THE 

HOUSE WAYS AND MEANS COMMITTEE 

SUBCOMMITIEE ON OVERSIGHT 

ON IRS INFORMATION TECHNOLOGY SYSTEMS 

OCTOBER 4, 2017 

INTRODUCTION 

Chainnan Buchanan, Ranking Member Lewis and members of the 

Subcommittee, thank you for the opportunity to appear before you today to 

discuss the IRS's infonnation technology (IT) systems and their role in delivering 

taxpayer services. 

Providing outstanding taxpayer service is an ongoing, high priority for the IRS. 

Making it as easy as possible for taxpayers to determine what they owe by 

providing them prompt answers to the questions they and their preparers have is 

a fundamental part of our overall mission. 

A safe, secure, efficient and up-to-date IT system plays an increasingly important 

role in our efforts to sustain and improve the taxpayer experience. To deliver the 

improvements the IRS envisions to taxpayer service, and even to continue 

maintaining the current level of services we provide, it is critical for the agency's 

infonnation technology systems to be up-to-date. 

But our IT systems have long been operating with antiquated hardware and 

software. Approximately 64 percent of IRS hardware is aged and out of warranty, 

and 32 percent of software is two or more releases behind the industry standard, 

with 15 percent more than four releases behind. 

The IRS needs to upgrade its IT infrastructure, not only to help ensure reliable 

and modern taxpayer services, but also to mitigate risks to the system. We are 

concerned that the potential for a catastrophic system failure is increasing as our 

infrastructure continues to age. Thus, replacing this aging IT infrastructure is a 

high priority for the IRS. 

The IRS remains very appreciative of Treasury Secretary Mnuchin's support for 

the IRS to have appropriate resources, and for upgrading our IT systems. In fact, 
8 


Insert 33655A.004

a priority in the President's Fiscal Year (FY) 2018 Budget is helping the IRS 

improve information services by addressing its antiquated IT. 

The President's budget request includes $3.9 billion for operations support. 

Within that total, $2.07 billion is allocated for information services, which is 

$216.1 million, or 11.6 percent, above the FY 2017 enacted level. This funding 

will allow the IRS to take the initial steps needed to bring our IT infrastructure up 

to date. 

TAXPAYER SERVICES SUPPORTED BY IT SYSTEMS 

Delivering the Tax Filing Season 

The most visible taxpayer service the IRS provides is the delivery of a smooth, 

problem-free tax filing season, so that people can file their returns and receive 

their refunds as quickly and easily as possible. Our IT systems process 

approximately 150 million individual income tax returns and more than $300 

billion in refunds each year. 

Our ability to effectively manage the IRS's IT systems, despite our aged 

infrastructure, is evidenced by the fact that the IRS continues to deliver smooth 

filing seasons, amid steady growth both in the number of returns filed and the 

percentage of electronically filed returns over the past decade. 

Today, nearly 90 percent of individual income tax returns are filed electronically. 

Return processing has gone smoothly, even in years where passage of tax 

legislation late in the year has required the IRS to move quickly to update our 

systems to accommodate tax changes enacted by Congress. 

During the filing season and throughout the year, the IRS provides taxpayer 

services through a variety of delivery channels to help taxpayers file their tax 

returns accurately and on time. Here too, our IT systems are an essential 

component of our service efforts. For example, IT supports our call center 

operation, which is one of the largest in the country, and which answered more 

than 64 million taxpayers calls in 2016, including automated calls and those 

using a live assistor. 

Our IT systems also support our ability to offer online services, which we 

continue to expand in response to increasing taxpayer demand. We provide a 

wealth of tax information on our website, IRS.gov, which was visited more than 

500 million times during FY 2016, and more than 400 million times so far in FY 

2017. The IRS recently completed a revamp of IRS.gov to make the site more 

user-friendly and to make it easier for taxpayers to view site content on their 

mobile devices. 

2 
9 


Insert 33655A.005

Protecting Taxpayer Data 

Providing outstanding taxpayer service also involves ensuring that the 

information taxpayers provide to the IRS will be kept secure. The IRS continues 

to work to protect our main computer systems from cyber incidents, intrusions 

and attacks, with our primary focus being on preventing criminals from accessing 

taxpayer information stored in our databases, as well as identifying fraud. Our 

core tax processing systems remain secure, and currently withstand more than 

one million attempts to maliciously access them each day. 

We realize the solution we have in place today may be insufficient in the future, 

as criminal enterprises continue to invest to find ways to penetrate and exploit 

our systems. They are persistent and have demonstrated their ability to adapt. 

Their tactics are ever-changing, and so our protections must keep changing as 

well. We therefore must continue to invest in cybersecurity and find ways to 

collaborate across government. The supplemental funds that Congress provided 

over the last two years helped us make great progress, but continued 

investments are needed. 

Protecting Taxpayers against Identity Theft and Refund Fraud 

Along with protecting the taxpayer data we have, the IRS is also focused on 

protecting taxpayers who may have had their personal information stolen from 

outside the tax system by identity thieves, who use this information to file false 

returns and claim fraudulent refunds. In recent years, we have made steady 

progress in protecting against identity thieves, by employing information 

technology to assist in fraud detection. 

An important advance that has helped us in the fight against identity theft has 

been the implementation of the Return Review Program (RRP). RRP is an 

integrated and unified system that enhances our ability to detect and potentially 

prevent tax non-compliance. During the 2016 filing season, RRP replaced the 

legacy Electronic Fraud Detection System (EFDS) as the government's primary 

line of defense against tax noncompliance in general and stolen identity refund 

fraud in particular. Continued investment in RRP will allow the IRS to retire EFDS 

and thereby address more sophisticated instances of identity theft more quickly. 

Over the past two years, our progress against stolen identity refund fraud has 

accelerated, thanks to the collaborative efforts of the Security Summit Group, a 

unique partnership launched in March 2015 that includes the IRS, industry 

leaders and state tax commissioners. Our collaborative efforts have put in place 

many new safeguards beginning in the 2016 filing season that produced real 

results. 

Since 2015 we have had fewer fraudulent returns entering our systems, fewer 

bad refunds going out the door, and fewer tax-related identity theft victims than in 

3 
10 


Insert 33655A.006

previous years. To illustrate, the number of people who reported to the IRS that 

they were victims of identity theft declined from 698,700 in Calendar Year (CY) 

2015 to 376,500 in 2016 - a drop of nearly half. 

The decline has continued during 2017. In the first five months of this year, about 

107,400 taxpayers reported they were victims of identity theft, compared to the 

same period in 2016 when 204,000 filed victim reports. That amounts to 96,000 

fewer victims and represents a drop of about 47 percent. Taken together, the 

number of taxpayers over the last two years who reported being victims of taxrelated identity theft has dropped by about two-thirds. 

Providing for the Future of Taxpayer Service 

In addition to ensuring that the basic taxpayer experience with the IRS is safe, 

secure and functional, the agency has been working for several years on longerterm improvements to the taxpayer experience and tax administration. In this 

effort, the IRS relies heavily on our information technology systems to help carry 

out these improvements. 

Our goal is to have a more proactive and interactive relationship with taxpayers 

and tax professionals by offering them the services, tools and support they want, 

in ways that are both innovative and secure. We are effectively trying to catch up 

with the kinds of online and virtual interactions people already use in their daily 

lives to communicate with banks, retailers, medical providers and many others. 

A major part of our initiative is developing an online account where taxpayers, or 

their representatives, can log in securely, get information about their account, 

and interact with the IRS as needed, including self-correcting some issues. 

In December 2016, we took the first step toward this with the launch of an 

application on IRS.gov that provides information to taxpayers who have 

straightforward balance inquiries. Since its launch, this new tool has been used 

by taxpayers more than 1.7 million times. We recently added another feature that 

lets taxpayers see recent payments posted to their account. These balance-due 

and recent-payment features, when paired with existing online payment options, 

have increased the availability of secure, self-service interactions with the IRS 

through IRS.gov. 

These are important steps, and over time, we will be adding other features to this 

platform as they are developed and tested with taxpayers and tax professionals. 

One of these features which is now in testing is Taxpayer Digital 

Communications. Taxpayer Digital Communications is intended to provide a 

secure online messaging capability so that taxpayers, their authorized 

representatives and IRS employees can correspond electronically and resolve 

issues more quickly than through traditional mail while maintaining security. 

4 
11 


Insert 33655A.007

Providing the Taxpayer an Effective Point of Contact 

Along the way, the IRS has come to realize that our efforts to move toward the 

future need to involve more than just online interactions between the IRS and 

taxpayers and their representatives. Therefore, our efforts to use technology 

more efficiently has evolved to cover the entire scope of the taxpayer experience, 

whether on-line or in person, and poses considerable opportunities for us and for 

taxpayers. 

Our present case management system treats each issue involving a taxpayer as 

a separate case. And those cases are handled throughout the agency by more 

than 60 aging case management systems that often don't communicate with 

each other. So, when taxpayers with more than one pending issue calls the IRS, 

they have to be transferred from one area to another to get the assistance they 

need. 

We are in the process of developing an Enterprise Case Management (ECM) 

system that will modernize, upgrade and consolidate our existing separate case 

management systems and give any authorized IRS employee the ability to see 

the entire range of issues and communications with an individual taxpayer. 

This will be a major improvement for taxpayers who call or visit us to resolve an 

issue, because it means that any IRS employee they go to for help can easily 

access the history of their dealings with the agency, including previous paper or 

verbal communications. In that way, our employees can more quickly and easily 

answer taxpayer questions and resolve issues. 

When completed, ECM will also increase our internal efficiency by giving us the 

ability to easily transfer cases between IRS divisions, since the basic information 

will be in a readily accessible database that does not require us to physically 

move a case from one system to another. This often involves printing, packaging 

and mailing hard copies from office to office. 

Another initiative that will help the IRS improve the taxpayer experience is the 

Event Driven Architecture (EDA) framework, which will allow us to process tax 

returns in near-real time. Once in place, the EDA framework will allow the IRS to, 

for example, notify taxpayers of potential errors on a return as soon as it is filed, 

and let taxpayers quickly correct return errors online - a major advance over the 

current system, in which the IRS corresponds with taxpayers by mail regarding 

potential problems in their returns. 

These and other improvements depend upon our continued development of the 

Customer Account Data Engine (CADE 2), which is our centralized database for 

all individual taxpayer accounts and allows IRS employees who are helping 

resolve taxpayer issues to easily access the taxpayer's information. 

5 
12 

f 


Insert 33655A.008

When fully implemented, CADE2 will replace the legacy Individual Master File 

(IMF), which historically has been the primary data source for individual taxpayer 

accounts. CADE2 is replacing the IMF in three major steps. It is important to note 

that this is a complex, multistep process - not a single, easily accomplished 

action. The steps we have undertaken thus far have already provided important 

improvements to our ability to interact with taxpayers efficiently and effectively. 

CHALLENGES TO MODERNIZING IRS IT SYSTEMS 

In recent years, Congress has tasked the IRS with implementing several 

legislative requirements. Satisfying these requirements has involved significant IT 

investments, diverting staff and resources that otherwise could have been used 

to continue modernizing our major IT systems and aging IT infrastructure. 

These legislative requirements include those stemming from: the Affordable Care 

Act (ACA); the Foreign Account Tax Compliance Act (FATCA); the Achieving a 

Better Life Experience (ABLE) Act, which includes a new certification 

requirement for professional employer organizations; reauthorization of the 

Health Coverage Tax Credit (HCTC); a private debt-collection program; and a 

registration requirement for newly created 501 (c)(4) organizations. 

Loss of Streamlined Critical Pay Authority 

The IRS also needs to be able to attract individuals from the private sector with 

highly specialized IT skills and expertise, particularly for our leadership positions 

in IT. In the past, the IRS has successfully recruited such individuals using 

streamlined critical pay authority that was enacted in 1998. 

In fact, TIGTA noted in a 2014 report that the IRS had appropriately used this 

authority, by adequately justifying the positions, demonstrating the need to recruit 

or retain exceptionally well-qualified individuals, and adhering to pay limitations. 

This authority expired at the end of FY 2013 and has not yet been renewed. 

The loss of streamlined critical pay authority has created major challenges to our 

ability to retain employees with the necessary high-caliber expertise in IT and 

other specialized areas. In fact, there are no longer any expert leaders or IT 

executives under streamlined critical pay authority at the IRS. The President's FY 

2018 Budget proposes reinstating this authority, and we urge Congress to 

approve this proposal. 

Chairman Buchanan, Ranking Member Lewis, and Members of the 

Subcommittee, this concludes our statement, and we would be happy to take 

your questions. 

6 
13 

Chairman BUCHANAN. Thank you. 

Ms. Garza, you are recognized. 

Ms. GARZA. I have no opening statement. It was with Jeff. 

Chairman BUCHANAN. Okay. Let’s see. Mr. Verneuille, you are 

recognized. 

STATEMENT OF DANNY VERNEUILLE, ASSISTANT INSPECTOR 

GENERAL FOR AUDIT, TREASURY INSPECTOR GENERAL FOR 

TAX ADMINISTRATION (TIGTA) 

Mr. VERNEUILLE. Chairman Buchanan, members of the subcommittee, thank you for the opportunity to discuss challenges to 

modernizing the IRS infrastructure. The IRS will spend about $2.9 

billion, or 26 percent of its fiscal year 2017 appropriations on information technology. About $500 million of this was allocated to business systems modernization. The IRS has faced significant challenges in modernizing its legacy systems. 

For example, the Customer Account Data Engine 2, referred to 

as CADE 2, is to plan replacement of the Individual Master File 

that is based on a 50-year-old program and architecture. Although 

CADE 2 has been under development since 2009, the previous 

CADE initiative dates back to the late 1990s. IRS has attributed 

the problems with developing CADE 2 to annual filing season, resources being provided for other system development projects, and 

the lack of key subject matter experts. Currently, there is no 

planned completion date for CADE 2 development. 

For the 2017 filing season, the IRS replaced the fraud detection 

capabilities of its legacy systems with the Return Review Program, 

which enhanced its capabilities to prevent, detect, and resolve 

criminal and civil noncompliance. However, the enterprise case 

management solution being developed to provide case management 

functions for the Return Review Program has stopped development 

efforts due to technical limitations in the commercial off-the-shelf 

product. We have an ongoing audit that will evaluate the IRS development of an enterprise case management solution and expect 

to issue the report in February 2018. 

The IRS has been slow to modernize its operations and deploy 

online applications. Our audit of the IRS’s implementation and use 

of cloud technologies and services found that the IRS does not have 

an enterprise-wide cloud strategy. In July 2016, the IRS created an 

integrated planning team with an overall goal of developing a cloud 

strategy. However, there is no timetable for implementation of a 

cloud strategy. 

We also recently reported that the IRS successfully deployed four 

web applications as part of its future-state initiative. However, the 

deployments were delayed because of inconsistent governance, and 

lack of project funding, and incompatible workflow processes. 

In addition to challenges in modernizing legacy systems, the 

IRS’s current hardware architecture is getting older and is in need 

of upgrading. At the beginning of fiscal year 2017, 64 percent of the 

hardware is aged. This level far exceeds the acceptable level of 

aged hardware of 20, 25 percent. IRS management explained that 

its budget, over the past 5 years, has impacted their ability to reduce the aged hardware. 

14 

In conclusion, TIGTA believes the IRS needs to improve its 

project planning prior to starting development activities. This 

should include more clearly defined requirements and scope, and a 

well-designed architecture and comprehensive assessments of commercial off-the-shelf products to be used. The IRS also needs to ensure that it follows established methodologies to guide project development. 

In addition, the IRS has more information technology demands 

that can be addressed with the skilled resources it has available. 

The IRS should focus on fewer projects and provide sufficient resources to ensure the completion of its highest priority projects. 

From a budget perspective, we have seen the IRS have success 

when appropriations are designated for specific programs such as 

when additional fiscal year 2016 funding was provided for cybersecurity enhancements and identity theft prevention. 

In addition, we agree with the IRS’s request in the fiscal year 

2018 President’s budget submission for additional operation support account funds to be available for 2 years. Given the length of 

the information technology life cycle process, 2-year funding will 

provide the IRS an opportunity to utilize appropriated funds before 

they expire. 

Chairman Buchanan, that ends my statement. I look forward to 

your questions. 

[The prepared statement of Mr. Verneuille follows:] 

15 


Insert 33655A.009

HEARING BEFORE THE 

COMMITTEE ON WAYS AND MEANS 

SUBCOMMITTEE ON OVERSIGHT 

U.S. HOUSE OF REPRESENTATIVES 

"IRS Reform: Challenges to Modernizing 

IT Infrastructure" 

Testimony of 

Danny Verneuille 

Assistant Inspector General for Audit 

Treasury Inspector General for Tax Administration 

October 4, 2017 

Washington, D.C. 
16 


Insert 33655A.010

TESTIMONY 

OF 

DANNY VERNEUILLE 

ASSISTANT INSPECTOR GENERAL FOR AUDIT 

TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION 

before the 

COMMITIEE ON WAYS AND MEANS 

SUBCOMMITIEE ON OVERSIGHT 

U.S. HOUSE OF REPRESENTATIVES 

"IRS Reform: Challenges to Modernizing IT Infrastructure" 

October 4, 2017 

Chairman Buchanan, Ranking Member Lewis, and Members of the 

Subcommittee, thank you for the opportunity to testify on the topic of challenges to 

modernizing information technology infrastructure at the Internal Revenue Service 

(IRS). 

The Treasury Inspector General for Tax Administration (TIGTA) was created by 

Congress in 1998 to ensure integrity in America's tax system. It provides independent 

audit and investigative services to improve the economy, efficiency, and effectiveness of 

IRS operations. TIGTA's oversight activities are designed to identify high-risk systemic 

inefficiencies in IRS operations and to investigate exploited weaknesses in tax 

administration. TIGTA plays the key role of ensuring that the approximately 85,000 IRS 

employees' who collected more than $3.3 trillion in tax revenue, processed more than 

244 million tax returns, and issued more than $400 billion in tax refunds during Fiscal 

Year (FY)2 2016,

3 have done so in an effective and efficient manner while minimizing 

the risk of waste, fraud, and abuse. 

TIGTA's Office of Audit (OA) reviews all aspects of the Federal tax administration 

system and provides recommendations to: improve IRS systems and operations; 

ensure the fair and equitable treatment of taxpayers; and detect and prevent waste, 

fraud, and abuse in tax administration. The Office of Audit places an emphasis on 

statutory audit coverage required by the IRS Restructuring and Reform Act of 1998 

(RRA 98)• and other laws, as well as on areas of concern raised by Congress, the 

' In Fiscal Year 2016, the IRS employed, on average, approximately 85,000 people, including more than 

16,000 temporary and seasonal staff. 2 The Federal Government's fiscal year begins on October 1 and ends on September 30. 3 1RS, Management's Discussion & Analysis, Fiscal Year 2016. 4 Pub. L. No. 105-206, 112 Stat. 685. 
17 


Insert 33655A.011

Secretary of the Treasury, the Commissioner of Internal Revenue, and other key 

stakeholders. The specific high-risk issues examined by the OA include identity theft, 

refund fraud, improper payments, information technology, security vulnerabilities, 

complex modernized computer systems, tax collection and revenue, and waste and 

abuse in IRS operations. 

MODERNIZATION EFFORTS TO REPLACE LEGACY SYSTEMS 

Successful modernization of IRS systems and the development and 

implementation of new information technology applications are critical to meeting the 

IRS's evolving business needs and to enhancing services provided to taxpayers. The 

IRS's reliance on legacy (i.e., older) systems, aged hardware, and its use of outdated 

programming languages pose significant risks to the IRS's ability to deliver its mission. 

Modernizing the IRS's computer systems has been a persistent challenge for many 

years and will likely remain a challenge for the foreseeable future. 

One of the IRS's top-priority information technology investments is the Customer 

Account Data Engine 2 (CADE 2). The IRS has been using the Individual Master File 

(IMF), which uses an outdated assembly language code, for more than 50 years. The 

IMF is the source for individual taxpayer accounts. Within the IMF, accounts are 

updated, taxes are assessed, and refunds are generated. Most of the IRS's information 

systems and processes depend on the IMF, either directly or indirectly. 

In 2009, the IRS began developing CADE 2 to address the issues regarding tax 

processing and to eventually replace the IMF. CADE 2 is the data-driven foundation for 

future state-of-the-art individual taxpayer account processing and data-centric 

technologies designed to improve service to taxpayers, enhance IRS tax administration, 

and ensure fiscal responsibility. 

In September 2013, TIGTA reported that the CADE 2 database could not be 

used as a trusted source for downstream systems due to the 2.4 million data corrections 

that had to be applied to the database, and to the IRS's inability to evaluate 431 

CADE 2 database columns of data for accuracy.5 To address these issues, the IRS 

developed additional tools and implemented a new data validation testing methodology 

intended to ensure CADE 2's timeliness, accuracy, integrity, validity, reasonableness. 

completeness. and uniqueness. The IRS requested that TIGTA evaluate the new data 

validation testing methodology. 

5 TIGTA. Ref. No. 2013-20·125. Customer Account Data Engine 2 Database Deployment Is Experiencing 

Delays and Increased Costs (Sept. 2013). 

2 
18 


Insert 33655A.012

In a September 2014 follow-up audit, TIGTA reported that the IRS had 

appropriately completed its data validation efforts.& According to the IRS, the CADE 2 

release plan is currently being adjusted to reflect impacts of staffing challenges and 

various possible budget scenarios. The loss of key IMF expertise is causing the 

reprioritization of CADE 2 goals to focus on IMF reengineering, the suspension of 

projects, and the potential deferral of planned functionality to be delivered. There are 

several reasons for the delays in implementing CADE 2, including other organizational 

priorities such as the annual filing season, other major information technology 

investments, contracting delays, aging architecture, lack of key subject matter experts 

on institutionalized processes, and outdated programming languages. There is no 

scheduled or planned completion date for CADE 2 development. 

In FY 2018, TIGTA will be initiating an audit to assess the effect of legacy 

systems on the IRS's ability to deliver modernized tax administration. TIGTA also plans 

to conduct an audit to determine the progress made on completing the CADE 2 project, 

including the IRS's retirement strategy for the IMF and a comparison of estimated costs 

to actual expenditures. 

In addition to CADE 2, the IRS replaced its Electronic Fraud Detection System 

(EFDS) with the Return Review Program (RRP), which enhanced its capabilities to 

prevent, detect, and resolve criminal and civil non-compliance. The RRP is an 

important development in the IRS's efforts to keep pace with increasing levels of fraud 

and in serving the organization's evolving compliance needs. 

In a September 2017 report, TIGTA reviewed the RRP to determine if the system 

could identify all fraud currently identified by other existing fraud detection systems, and 

assessed the EFDS retirement plans.' TIGTA concluded that the RRP better meets the 

IRS business objectives of delivering greater fraud detection at a lower false detection 

rate than the EFDS. 

Results from recent tax filing seasons support the IRS's decision to retire the 

EFDS models. TIGTA believes that the RRP is better positioned than the EFDS to 

address the changing nature of identity theft. Specifically, the EFDS uses models to 

generate one fraud score for each return. In contrast, RRP models generate a set of 

6 TIGTA, Ref. No. 2014-20.063, Customer Account Data Engine 2 Database Validation Is Progressing; 

However, Data Coverage, Data Defect Reponing, and Documentation Need Improvement (Sept. 2014 ). 7 TIGTA, Ref. No. 2017·20.080, The Retum Review Program Increases Fraud Detection but Full 

Retirement ofthe Electronic Fraud Detection System Will Be Delayed (Sept. 2017). 

3 
19 


Insert 33655A.013

predictive scores for every return. This enables the RRP to individually assess tax 

returns. In addition, the RRP fraud detection models provide greater flexibility in 

adjusting to new emerging fraud trends than the EFDS. 

The IRS retired the EFDS identity theft models for the 2016 Filing Season. The 

EFDS identified tax returns involving identity theft totaling $60 million (1 .5 percent of the 

total $3.92 billion in returns involving identity theft) that were not identified by any other 

fraud detection system. In contrast, the RRP identified tax returns involving identity 

theft totaling $1 .88 billion (47.8 percent of the $3.92 billion in returns involving identity 

theft) that were not selected by any other fraud detection system. 

In addition, when the IRS ran the EFDS and the RRP non-identity theft models in 

parallel for the 2016 Filing Season, the RRP selected 41,710 fraudulent tax returns not 

selected by the EFDS, representing $328 million in revenue protection. By comparison, 

the EFDS selected 6,824 fraudulent tax returns not selected by the RRP, representing 

$17 million in revenue protected. TIGTA does not believe the relatively small amount of 

non-identity theft tax returns selected by the EFDS warranted delaying the retirement of 

the EFDS non-identity theft models after the 2016 Filing Season. 

In September 2015,• TIGTA recommended that the IRS develop a system 

retirement plan for the EFDS and retire the system after validating that the RRP 

effectively identifies, at a minimum, all issues currently identified in the EFDS. The IRS 

agreed with the recommendation, and in December 2015, the IRS Executive Steering 

Committee unanimously approved the EFDS Retirement Strategy. However, our review 

of the EFDS Retirement Strategy showed that the IRS cannot shut down EFDS until all 

19 system components have been decommissioned. Eleven of the 19 components are 

related to the Enterprise Case Management project and have retirement dates as late 

as December 2018. With the Enterprise Case Management project starting over with 

software selection, the IRS will likely miss the December 2018 target date for retiring the 

remaining 11 EFDS components. As a result, the IRS will continue to incur annual 

costs to operate and maintain the EFDS system in each filing season for which it 

remains in operation beyond the 2018 Filing Season. The IRS estimated that the 

annual operating and maintenance cost for the EFDS for the 2018 Filing Season is 

$13.9 million. 

• TIGTA, Ref. No. 2015-20-093, Review of the Electronic Fraud Detection System (Sept. 2015). 

4 
20 


Insert 33655A.014

INFORMATION TECHNOLOGY INITIATIVES TO MODERNIZE OPERATIONS, 

APPLICATIONS, AND THE E-MAIL SYSTEM 

In addition to modernization efforts to replace legacy systems, the IRS is 

developing and implementing new information technology to modernize its operations, 

applications, and e-mail system to provide more sophisticated tools to taxpayers and 

IRS employees. TIGTA has identified several areas where the IRS can improve its 

efforts to upgrade or enhance its information technology systems. 

TIGTA conducted an audit to review the implementation and use of cloud 

technologies and services.9 In July 2016, the IRS created an Integrated Planning Team 

with an overall goal of developing an enterprise-wide cloud strategy for implementation 

within the IRS. The Integrated Planning Team's mission is to help the IRS define a 

"cloud" and to provide some specific guidance to assist in the selection and deployment 

of cloud services within the IRS. However, TIGTA reported that the IRS does not have 

an enterprise-wide cloud strategy and also that the IRS did not follow Federal and 

agency cloud service guidelines for the Form 990 Cloud Project.10 The IRS stated that 

there is no current timetable for adoption and implementation of the enterprise-wide 

cloud strategy. Not having a documented enterprise-wide cloud strategy creates a 

significant risk that organizations outside of the IRS Chief Information Officer and 

Information Technology (IT) organization may deploy systems and potentially expose 

Federal tax information with no reasonable assurance that the systems meet applicable 

Federal security guidelines. The IRS may also miss the opportunity to deliver value by 

increasing operational efficiency and responding more quickly to stakeholder needs. 

The Tax Exempt and Government Entities Division entered into an agreement to 

utilize a public cloud service with limited involvement from the IRS IT organization. In 

October 2015, the Tax Exempt and Government Entities Division had discussions with 

the Associate Chief Information Officer for Enterprise Services regarding the Form 990 

Cloud Project. However, the Tax Exempt and Government Entities Division was not 

instructed to appoint an authorizing official, generate an agency Authority to Operate 

letter, or ensure that the cloud service complied with Federal Risk and Authorization 

Management Program requirements. 

9 TIGTA, Ref. No. 2017-20-032, The Internal Revenue Service Does Not Have a Cloud Strategy and Did 

No/ Adhere to Federal Policy When Deploying a Cloud Service (Aug. 2017). 

'

0 A cloud service prOject initiated by the IRS Tax Exempt and Government Entities Division to allow 

public access to certain Form 990, Retum of Organization Exempt From Income Tax. information. 

5 
21 


Insert 33655A.015

A primary focus for the IRS over the past two decades has been to migrate 

taxpayers to electronic fil ing. Outside of filing activities, taxpayers also use the Internet 

to download forms, view content, and check the status of their refund. These types of 

online activities will increase as the IRS implements its Future State Initiative." 

TIGTA conducted an audit to review the development and implementation of the 

online Web Applications (Web Apps)•2 designed to deliver an online account for 

individual taxpayers along with the abilities to see a balance due, see payment 

status/history, make a payment, and view/download tax transcripts. The audit, released 

in September, found that the development and deployment of Release 1.0 of the Web 

Apps system has been significantly delayed. The Web Apps Program Management 

Office was initially tasked with delivering its four original functionalities for Release 1.0 

of the Web Apps system by September 30, 2015. A lack of funding caused a delay in 

the Web Applications Program Management Office obtaining the necessary staffing 

resources. Similarly, the IRS's inconsistent governance process contributed to project 

delays. These delays prevented taxpayers from being able to use any of Release 1.0 of 

the Web Apps system's planned functionalities for the 2016 Filing Season. 

In addition, further delays resulted in taxpayers being unable to use the Web 

Apps system to see payment status and history or view and download transcripts at the 

start of the 2017 Filing Season. To acquire this information, taxpayers had to use the 

separate Get Transcript Online Service or IRS2GO mobile phone app, or had to call, 

mail, fax, or visit an IRS taxpayer assistance center, which does not achieve the IRS's 

goals to modernize and increase the efficiency of the taxpayer experience. These 

requests could have been provided in a timelier and more direct manner by Release 1.0 

of the Web Apps system if it had been deployed on schedule. 

TIGTA has also evaluated the IRS's efforts to establish information technology 

capabilities to manage temporary and permanent e-mail records. TIGTA determined 

that the IRS purchased subscriptions for an enterprise e-mail system it could not use.,, 

The purchase was made without first determining project infrastructure needs, 

integration requirements, business requirements, security and portal bandwidth, and 

whether the subscriptions were technologically feasible on the IRS Enterprise. IRS 

executives made a management decision to consider the enterprise e-mail project an 

" Preparing the IRS to adapt to the changing needs of taxpayers is described generally as the IRS Future 

State initiative. A key part of this effort is tor taxpayers to have a more complete online experience tor 

their IRS interactions. 

" TIGTA, Ret. No. 2017-20-057, While Release 1.0 of the Web Applications System was Successfully 

DeplOyed, Several Factors Contributed to Implementation Delays (Sept. 2017). 

" TIGTA, Ref. No. 2016-20-080, Review of the Enterprise E·mail System Acquisition (Sept. 2016). 

6 
22 


Insert 33655A.016

upgrade to existing software instead of a new development project or program. As a 

result, the IRS did not follow its Enterprise Life Cycle guidance. The IRS authorized the 

$12 million purchase of subscriptions over a two-year period; however, the software to 

be used via the purchased subscriptions was never deployed. The IRS violated Federal 

Acquisition Regulation requirements by not using full and open competition to purchase 

the subscriptions. 

In an audit requested by the Chairman of the House Committee on Ways and 

Means and the Chairman of the Senate Committee on Finance, TIGTA determined that 

IRS policies are not in compliance with Federal electronic records requirements and 

regulations• • The IRS's current e-mail system and record retention policies do not 

ensure that e-mail records are automatically archived for all employees and can be 

searched and retrieved for as long as needed. The current e-mail system requires 

users to take manual actions to archive e-mail and results in e-mail records that can be 

stored in multiple locations, such as a mailbox folder, exchange server, network shared 

drive, hard drive, or on removable media or backup tape. 

According to the IRS, its Future State e-mail system is being developed to 

potentially allow records to be available and searchable while automatically applying a 

retention policy. However, until a solulion is effectively implemented, these e-mails 

remain difficult, if not impossible, to retain and search. 

TIGTA has also evaluated the readiness of the IRS to establish an upgraded 

e-mail solution with the information technology capabilities to manage e-mail records in 

compliance wilh the directive of the Office of Management and Budget and the National 

Archives and Records Administration, which requires that agencies eliminate paper 

records and use electronic recordkeeping to the fullest extent possible." TIGTA found 

that more effort is needed by the IRS to meet the National Archives and Records 

Administration e-mail management success criteria prior to the deployment of the 

enterprise e-mail solution. Specifically, TIGTA determined that as of January 31, 2017, 

13 of the 32 (41 percent) requirements related to the e-mail management success 

criteria remained under development. The requirements need to be fully developed and 

implemented before the IRS can successfully deploy its enterprise e-mail solution. Due 

to delays in developing and deploying the enterprise e-mail solution, the IRS will most 

likely not begin receiving any of the expected benefits of Federal records reform until 

14 TIGTA, Ref. No. 2017-10-034, Electronic Record Retention Policies Do Not Consistently Ensure That 

Records Are Retained ana ProaucecJ When Requested (July 2017). 1

' TIGTA. Ref. No. 2017-20-039, Additional Efforts Are Needed to Ensure the Enterprise E-Mail Records 

Management SOlution Meets A// Requirements Before DeplOyment (Aug. 2017). 

7 
23 


Insert 33655A.017

the end of Calendar Year 2017, nearly a year after the initially mandated deployment 

date. 

HARDWARE MODERNIZATION 

The IRS has a large and increasing amount of aged hardware, some of which is 

three to four times older than industry standards. In its FY 2016 President's Budget 

Request, the IRS noted that its information technology infrastructure poses significant 

risk of failures, although it is unknown when these failures will occur, how severe they 

will be, or whether they will have material impacts on tax administration during the filing 

season. 

TIGTA conducted an audit to determine and measure the impact of inefficiencies 

of the IRS's aged information technology hardware. Specifically, TIGTA analyzed all 

FY 2016 incident tickets'• from the Knowledge lncidenVProblem Service Asset 

Management system" categorized as either "critical" or "high" for all aged information 

technology hardware (e.g., desktop and laptop computers, servers, and telephone call 

routers). The aggregate length of time to resolve these incident tickets was 4,541 

hours. Aged information technology hardware still in use could result in excessive 

system downtime due to hardware failures. As information technology hardware ages, 

it becomes more difficult to obtain adequate support. Aged hardware failures have a 

negative impact on IRS employee productivity, security of taxpayer information, and 

customer service. 

Additionally, TIGTA reported that the IRS has not yet achieved its stated 

objective of reducing the percentage of its aged information technology hardware to an 

acceptable level of 20 to 25 percent. In fact, the IRS's percentage of aged information 

technology hardware has steadily increased from 40 percent at the beginning of 

FY 2013 to 64 percent at the beginning of FY 2017.18 Aged information technology 

hardware, when combined with the fact that components of the infrastructure and 

systems are interrelated and interdependent, make outages and failures unpredictable 

'

6 Incident tickets are created as part of the IRS"s Information Technology Incident Management Prooess 

that defines the process and proCedures for recording, categorizing, prioritizing, Investigating, diagnosing, 

resolving, dispatching, monitoring, and closing out the incidents. 17 Maintains the complete inventory of information technology and non-information technology 

organization assets. computer hardware. and software. It is also the reporting tool for problem 

management with all IRS-<Ieveloped applications and shares information with the Enterprise Servioe 

Desk. 

'" TIGTA. Ref. No. 2017-20-051. Sixty-Four Percent of /he Internal Revenue Service's Information 

Technology Hardware lnfrastn;cture Is Beyond Its Useful Life (Sept. 2017). 

8 
24 


Insert 33655A.018

and may also introduce security risks to critical taxpayer data that IRS systems must 

protect. 

To provide further perspective on the negative effects that these aged hardware 

failures may have had on IRS employee productivity, the security of taxpayer 

information, and customer service, here are some examples of incidents that the IRS 

reported as having affected its ability to conduct daily operations. 

• The existing Contact Recording•t infrastructure is extremely aged and averages 

one outage per day, affecting the quality control feedback for more than 200 IRS 

toll-free call center employees interacting with taxpayers and their 

representatives. 

• The IRS "Web Farm• houses over 500 internal websites, including many internal 

filing season-specific websites in use by all IRS business units. On 

October 31 , 2016, the Taxpayer Advocate's web page went off-line affecting 

more than 1,700 employees. 

• More than 30 percent of the IRS's installed network equipment had no end of 

software support20 and required replacement in order to support deployment of 

Direct Model Personal Identity Verification. Until the hardware is replaced, no 

software support means no computer bug fixes, no maintenance releases, and 

no security patches. This significantly increased the security risk vulnerability of 

the at risk equipment. According to the IRS, hardware equipment for the 

proposed permanent solution was scheduled to be installed in August2017. 

TIGTA recommended that the Chief Information Officer conduct additional 

coordination with the Chief Financial Officer and other business unit executives to 

identify the availability of additional transfers, reprogramming, and possible carryover 

funds earlier in the process to maximize their use and develop plans to expeditiously 

spend any potential surplus funds that might become available to aid in reducing its 

aged information technology hardware infrastructure. 

TIGTA believes the IRS needs to improve its project planning prior to starting 

development activities. This should include more clearly defined requirements and 

' 9 A commercial off-the-shelf software package for recording interactions between IRS customer service 

personnel and taxpayers or their representatives. 20 When a company ends support for a previous version of a software product or service. This may 

include ending support for security patches or upgrades that are used to protect users from viruses. 

matware, and other types of cytlerattacks. 

9 
25 


Insert 33655A.019

scope, a well-designed architecture, and comprehensive assessments of commercial 

off-the-shelf products to be used. The IRS also needs to ensure that it maintains its 

discipline in following established methodologies to guide project development. In 

addition, the IRS has more information technology demands than can be addressed 

with the properly skilled resources it has available. The IRS should focus on fewer 

projects and provide sufficient resources to ensure the completion of its highest priority 

projects before beginning new projects. 

Finally, we have seen the IRS has success when appropriations are designated 

for specific programs. such as when additional FY 2016 funding was provided for 

cybersecurity enhancements and identity theft prevention. While the IRS needs to 

retain information technology funding flexibility to address legislative requirements and 

priorities, any additional funding should be designated for specific modernization 

projects with appropriate oversight to ensure timely delivery of the projects. In addition, 

we agree with the IRS's request in the FY 2018 President's Budget submission for 

additional Operations Support account funds to be available for two years due to the 

length of the information technology lifecycle process and because it provides the IRS 

with an opportunity to utilize appropriated funds before they expire. 

We at TIGTA take seriously our mandate to provide independent oversight of the 

IRS in its administration of our Nation's tax system. As such, we plan to provide 

continuing audit coverage of the IRS's efforts to operate efficiently and effectively and to 

investigate any instances of IRS employee misconduct or other threats to tax 

administration. 

Chairman Buchanan, Ranking Member Lewis, and Members of the 

Subcommittee, thank you for the opportunity to share my views. 

10 
26 

f 


Insert 33655A.020

Danny Verneuille 

Assistant Inspector General for 

Audit 

Treasury Inspector General for Tax 

Administration 

Mr. Verneuille has served as an Auditor in the Treasury 

Inspector General for Tax Administration and the Internal 

nsclecltion Service, TIGTA's predecessor organization, for over 

30 years. In July 2017, Mr. Verneuille became a member of the Senior Executive 

Service and was promoted to the position of Assistant Inspector General for Audit 

(Security and Information Technology Services). He is responsible for providing 

guidance and direction to audits of the IRS's information technology that evaluate 

systems security, systems development, and systems operations. 

Prior to his current role, Mr. Verneuille was the Director, Systems Development, for 

TIGTA where he was responsible for reviews of the IRS's modernization and systems 

development efforts. He also worked as the Director, Systems Operations, where he 

was responsible for reviews to assess the effectiveness of IRS's information technology 

operations. 

Mr. Verneuille has a Bachelor of Science Degree in Accounting from the University of 

New Orleans and is a Certified Internal Auditor. 

11 
27 

Chairman BUCHANAN. Thank you. 

Mr. Powner. 

STATEMENT OF DAVID POWNER, DIRECTOR, IT MANAGEMENT 

ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. POWNER. Chairman Buchanan, members of the subcommittee, thank you for inviting us to testify on IRS’s efforts to 

modernize its antiquated IT systems and infrastructure. IRS 

spends about $2.7 billion annually on IT. Currently, about 1.9, or 

70 percent, of this goes towards operational or legacy systems, and 

about $800 million, or 30 percent, goes towards new development 

or modernization. This proportion of spending on modernization is 

nowhere near ideal, and IRS’s situation is a common Federal IT 

problem, as the Federal Government as a whole spends 80 percent 

of its IT spend on operational systems. 

Recognizing this problem, GAO put IT acquisitions and operations on our high-risk list in 2015, and we are tracking more than 

800 recommendations across all agencies related to this area. Several of these are to IRS on how they prioritize and report performance on their IT modernization efforts. 

This morning, I would like to discuss, one, IRS’s operational systems; two, efforts to modernize these systems; and, three, steps to 

address this situation. 

IRS’s legacy, or operational systems, are critical assets that are 

essential to the annual collection of over $3 trillion in taxes. Some 

are newer systems, like the fraud detection system, which, this 

past filing season, prevented over $4 billion in fraudulent payments. But IRS also has some of the oldest systems in the Federal 

Government, including the Individual Master File, which is over 50 

years old. 

Our main concern with the Individual Master File is that we 

don’t see a solid plan with realistic costs and milestones to replace 

it. Overall, IRS maintains over 20 million lines of assembly code. 

These millions of lines of archaic software and hardware that is no 

longer supported becomes more difficult and costly to maintain 

each year, and poses significant cybersecurity risks. 

To IRS’s credit, it keeps these old systems running during the filing season. But relying on these antiquated systems for our Nation’s primary source of revenue is highly risky, meaning that the 

chance of having a failure during the filing season is continually 

increasing. 

Now turning to IRS’s efforts to modernize these systems, I would 

like to discuss the Fraud Detection System, the Foreign Account 

Tax Compliance Act known as FATCA, ACA, and CADE 2. CADE 

2 is the system plan to replace the Individual Master File. Efforts 

continue to improve the Fraud Detection System. Congressional 

mandates like FATCA and ACA once consumed a large portion of 

IRS’s modernization dollars, but that is no longer the case. CADE 

2 is the number one modernization investment in terms of dollars. 

Having spent over $170 million in fiscal year 2016, and 120 in fiscal year 2017, but our ongoing work is showing that IRS is not delivering on this modernization effort as planned, nor is there a 

solid plan here to eventually deliver CADE 2. 

28 

We have made specific recommendations to IRS regarding modernization, but history tells us that congressional administration 

involvement could greatly help here starting with IRS. IRS needs 

to deliver on the priority modernization efforts like CADE 2. We 

are spending significant money here, and we are not delivering at 

an acceptable rate. IRS also needs to set clear modernization priorities and develop plans with accurate budgets and milestones. So, 

for instance, on IMF and CADE 2, we need to see exactly what it 

will take to convert the IMF to modern languages and replace it 

with CADE 2. 

Again, to be clear, we need to know how much money and a date 

when we expect to be done. No doubt, there will likely be gaps between needs and budget realities, but we need to know how much 

we are off, discuss it, and get realistic, achievable plans. Congress 

needs to hold IRS to the plan by receiving quarterly, or at least 6- 

month progress reports, to make sure they stay on track, and GAO 

can help with this effort. 

Turning to the administration. The administration has established the American Tech Council chaired by the President and the 

Office of Innovation, aimed at improving and modernizing Federal 

IT. Recently, these groups have set bold direction for the Department of Veterans Affairs to address tech improvements to better 

serve our vets. Leveraging these groups and setting similar direction for IRS modernization efforts are needed. 

Also, last fall, the comptroller general, Gene Dodaro, held a 

forum on IT high risk where former and current Federal and agency CIOs told us that one of the things that is important for these 

large modernization efforts is having the Federal CIO involved in 

our Nation’s most important modernization efforts. 

In conclusion, when IRS focuses on priorities, we tend to get good 

results. Continued attention needs to occur with the filing season, 

congressional mandates, and fraud detection. But more needs to be 

done on replacing the Individual Master File. Modernizing these 

tax processing systems should be a top priority for our country. 

This concludes my statement. I look forward to your questions. 

[The prepared statement of Mr. Powner follows:] 

29 


Insert 33655A.021

For Release on Oeliveoy 

EJqlecte<l et10;00 a.m. ET Wednesday, October 4, 2017 

GA0-18-153T 

United States Government Accountability Office 

Testimony 

Before the Subcommittee on Oversight, 

Committee on Ways and Means, House of 

Representatives 

INFORMATION 

TECHNOLOGY 

Management Attention Is 

Needed to Successfully 

Modernize Tax Processing 

Systems 

Statement of David A. Powner, Director 

Information Technology Management Issues 
30 


Insert 33655A.022

GJtO 

Highlights 

H..,....,...cfGA0-11-153T,e~ 

bebeu.~-.on~ 

Cotnmltlee on W•Yf. .net MNns House of 

Ropr~ 

Why GAO Old This Study 

lho IRS, a bureau of the Department 

of tho Treosury, relies extensively on 

tT to annually collect 1'1')()(0 than S3 

triUton ln taxes, d1stnbute mOte Ulan 

$400 bill.on in refunds, and carry oot Jts 

rr.S$100 ot proVidlng setVlce to 

A.rnenca'a taxpayer$'" meet•ng lhetr 

tax obllgotiOnS FO< ftocaJ year 2016, 

IRS expencled -ox'""'lely $2 7 

boloon for IT on-lme<\IS, 70 pertenl ol 

..toe~~ was llocaled for operabOnal 

syslems 

GAO has long repo<1ed lhatlhe 

enec~Ne end elllaenl managerne<>l ol 

IT ocqu..,I>On$ end operational 

tnvestmenll hi$ been a cnanenge '" lha federal govemmenl Accordingly, on 

FobNary 2015, GAO introduoed o new 

govemment·Wlde high-risk area. 

lmprovmg lhe Management of IT 

Acquisitions on<l Oporotlons. GAO has 

also reported on challenges IRS has 

faced In managing its IT &oquisitions 

and operations. and Identified 

opportunitie$ for IRS to Improve tt1e 

management of these •nvestments. 

In loghl of lhese ctoalenges, GAO was 

asl<ed 10 lo~fy obouiiT management 

o!IRS To do so, GAO summanzed rts 

prio<-" rogar<!ong IRS's IT 

managomonl. ondudong lhe agency's 

manogoment o1..,..-, or legacy, 

IT systems 

What GAO Recommends 

GAO hes made a number of 

recommendations to IRS to emprova its 

management of IT acqui$itk:wl$ and 

operations IRS has generally a_greed 

W1th the tecommendalions. 

VWNOAO-ta.153T FOfl'f'IQI'elnrotma!ion.. 

eontKt o.vld A Powntr 11 (202) 512·9286 or 

~-

INFORMATION TECHNOLOGY 

Management Attention Is Needed to Successfully 

Modernize Tax Processing Systems 

What GAO Found 

GAO has issued a sotles of reports which have identified numetous opportunities 

fO< the Internal Revenue Service (IRS) to improve the managemenl of Ita major 

acqulsilions and operational, 0< legacy, lnfO<mation technology (IT) investments. 

For example, 

• In Ju.,. 2016, GAO reported !hat IRS had developed a s~ured P<oceos for 

allocabng fundong 10 Its operalions activities, consistent with best tnctices; 

however, GAO found !hat IRS d<l no1 have a slmita~y slrudUred P<oceos for 

P<ioritizing modomaation a~ to Whiclllhe agency allocaled hundreds ol 

milions of dollars for foscel yeat 2016. Instead, IRS offiCials Slaled lhet they 

held discussions to determine !he modernization ef!O<ts lhel were ol highest 

prionty to meet IRS's fulure state vision and technology roadmap, and 

considered stoffing resources and ifecyde slage. However, they dod nol use 

folmal cntene for mal<ing final delermonalions. GAO conclu<led !hat 

establishong a Slructured process fO< prioritizing modernization aCIMIIes 

would boner osslSI Congress and other decision make!$ in ensuring that the 

right prioritlH ore funded. 

In !he same report, GAO noted thai IRS could improve the accuracy of 

reported performance Information for key developmentlnveslrneniS to 

provide Congress and other external parties with pertinent information about 

the delivery of lhese investments. This included investments IWd1 as 

Customer Account Data Engine 2, which IRS is developing to replace Ill 50-

year old repa.ltory of Individual tax account dala, an<lthe Retum Review 

Pr09ram, IRS's syslem of reOO<d for fraud defection. Accordingly, GAO 

recommended thai IRS Htabllsh, doam>Ont, and implement polocles and 

Pfooedures for prioritozlng modernization activities, and lake steps 10 lmPfOVO 

reporte<l ;,--.,t performance information. IRS agreed with GAO's 

rec:ommondat•><IS, and has efforts underway to address !hem. 

In a May 2016 rej)0<1 on~ IT·~ actO$$ the federal government, 

GAO noled lhetiRS used as#mtoly tonguage oode to program key~ 

syslerns Assembly language oode is a oornpuler language lno~ally used in 

the 19501 !hat is typically tied to !he hardware for which~ was deve4opod; ~ 

has become dlffocu~ 10 oode an<l maintain. One inveslment !hat used this 

language is IRS's lndlv'odual Master File which serves as !he authoritotive 

dala source fO< Individual taxpayer accounts. GAO noted !hal, although IRS 

has been wcrklng to replace the Individual Master File, !he bureau did not 

have time fremea for its modemization or replacernenL Therefore, GAO 

recommended thai the Department of Treasury identify and plan to 

modernize and replace !his legacy syslem, consislent with applicable 

guidance from the Office of Management and Budget. The depMmonl had 

no comments on the recommendation. 

------------United Slates Gowtftf'Mnt Accounbltlillly Clffice 
31 


Insert 33655A.023

Background 

Chairman Buchanan, Ranking Member Lewis. and Members of the 

Subcommittee: 

I am pleased to be here today to discuss our recent wOO< related to the 

Internal Revenue Service's (IRS) managemenl of infonnation technology 

(IT). IRS relies extensively on IT systems to annually collect more tttan $3 

trillion in taxes, distribute more than $400 billion in refunds, and carry out 

its mission of providing service to America's taxpayers in meeting their tax 

obligations. For fiscal year 2016, IRS expended approximately $2.7 billion 

for IT investments. including $1.9 billion. or 70 percent, for operational 

systems. and approximately $800 million. or 30 percent. for development 

and modernization. 

As you know, however. the effective and effiCient acquisition and 

management of IT investments has been a long-standing challenge in the 

federal government. IRS, in particular. has faced challenges in managing 

its acquisitions and operations, and we have reported on opportunities for 

the agency to improve the management of its IT investments. 

My statement today summarizes our prior reports that have addressed 

IRS's IT management, including the management of its operational, or 

legacy, systems.' A more detailed discussion of the objectives, scope, 

and methodology for the work conducted is included in these reports. 

We conducted the work on which this statement is based in accordance 

with generally accepted government auditing standards. Those standards 

require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and condusions 

based on our audit objectives. We believe that the evidence obtained 

provides a reasonable basis tor our findings and condusions based on 

our audij objectives. 

The mission of IRS. a bureau within the Department of the Treasury, is to 

(1) provide America's taxpayers top quality service by helping them 

understand and meet their tax responsibilities and (2) enforce the law with 

integrity and fairness to all. In carrying out its mission. IRS annually 

1

See for eXbmple. GAO. lnfOI'YYI8tion Teclmology: IRS~$ to ImprOve It$ Pr0«1sstor 

PriQrilizing end Rf(JO(Vng PerformtJnCfl of Investments,. GAQ-11)..545 (Wastinglon, D.C.; 

June 20, ::!016); o.nd lnfounotion TQChnology: Fcdr>ml Agcncico Norx/lo Addrooo Aging 

Legacy Systems. GAO-t6-468 (Washington, D.C.: May 25, 2016). 

GA0·18·153T 
32 


Insert 33655A.024

IRS Relies on Major IT 

Investments for Tax 

Processing 

collects aver $3 1rillion in taxes from millions of individual taxpayers and 

numerous other types of taxpayers, and manages the distribution of over 

$400 billion in refunds. To guide its future direction, the agency has two 

slrategic goals: (1) deliver high quality and timely service to reduce 

taxpayer burden and encourage voluntary compliance: and (2) effectively 

enforce the law to ensure compliance with tax responsibilities and combat 

fraud. 

Effective management of IT is critical for agencies to achieve successful 

outcomes. This is particularly true for IRS, given the role of IT in enabling 

the agency to carry out its mission and responsibilities. For example, IRS 

relies on information systems to process tax returns: account for tax 

revenues collected; send bills for taxes owed; issue refunds: assist in the 

selection or tax returns lor audit; and pravide telecommunications 

services for all business activ~ es, including the public's toll-free access to 

tax information. 

For fiscal year 2016. IRS was pursuing 23 major' and 114 non-major IT 

investments to carry out its mission. According to the agency, it expended 

approximately $2.7 billion on these investments during fiscal year 2016, 

induding $1.9 billion, or 70 percent, for operations and maintenance 

activities, and approximately $800 million, or 30 percent. for development, 

modernization. and enhancement. We have previously reported on a 

number of the agency's major investments, to include the following 

investments in development, modernization. and enhancement: 

The Affordable Care Act investment encompasses the planning, 

development, and implementation of IT systems needed to support tax 

administration responsibilities associated with key provisions of the 

Patient Protection and Affordable Care Act. IRS expended $253 million 

on this investment in fiscal year 2016. 

Customer Account Data Engine 2 is being developed to replace the 

Individual Master File investment. IRS's authoritative data source lor 

indWiduaJ ta.x account data. A major component of the program is a 

modernized database lor all individual taxpayers that is intended to 

provide the foundation lor more efficient and effective tax administration 

21A:S <Jefines a 1"1'18jof' ve tment M one that costs $10 million In eiuw the current yecw or bu<lget year. or $50 minion C1Ver the S.ye31 period extend!OQ trom the priot year through 

the budget year •2. 

Pag~2 
33 


Insert 33655A.025

and help address financial material weaknesses for individual taxpayer 

accounts. Customer Account Data Engine 2 data is also expected to be 

made available for access by downstream systems, such as the 

Integrated Data Retrieval System for online transaction processing by 

IRS customer service representatives. IRS expended $182.6 million on 

this investment in fiscal year 2016. 

The Return Review Program is IRS's system of record for fraud 

detection. As such, it is intended to enhance the agency's capabilities to 

detect, resolve. and prevent criminal and civil tax noncompliance. In 

addition, it is intended to allow analysis and support of complex case 

processing requirements foe compliance and criminal investigation 

programs during prosecution. revenue protection. accounts management. 

and taxpayer communications processes. According to IRS, as of May 

2017, the system has helped protect over $4.5 billion in revenue. IRS 

expended $100.2 million on this investment in fiscal year 2016. 

We have also reported on the following investments in operations and 

maintenance: 

Mainframes and Servers Services and Support provides for the design, 

development. and deployment of server: middleware: and large systems 

and enterprise storage infrastructures, induding supporting systems 

software products, databases. and operating systems. This investment 

has been operational since 1970. IRS expended $499.4 million on this 

investment in fiscal year 2016. 

Telecommunications Systems and Support provides for IRS's network 

infrastructure services such as network equipment, video conference 

service, enterprise fax service. and voice service for over 85,000 

employees at about 1,000 locations. According to IRS, the investment 

supports the delivery of services and products to employees, which 

translates into service to taxpayers. IRS expended $336.4 million on this 

investment in fiscal year 2016. 

Individual Master File is the authoritative data source for individual 

taxpayer accounts. Using this system, accounts are updated, taxes are 

assessed, and refunds are generated as required during each tax filing 

period. Virtually all IRS information system applications and processes 

depend on output, directly or indirecUy, from this data source. IR.S 

expended $14.3 million on this investment in fiscal year 2016. 

Pllge3 
34 


Insert 33655A.026

GAO, Congress. and the 

Administration Have 

Highlighted the Need for 

Government-wide 

Improvements for IT 

Acquisitions and 

Operations 

In fiscal year 2017, the federal government planned to spend more than 

$89 billion for IT that is critical to the health, economy, and security of the 

nation. However. we have reported that prior IT expenditures have often 

resulted in significant cost overruns. schedule delays, and questionable 

mission-related achievements. In light of these ongoing challenges. in 

February 2015, we added improving the management of IT acquisitions 

and operations to our list of high-risk areas for the federal government.3 

This area highlights several critical IT initiatives in need of additional 

congressional oversight, including (1) reviews of troubled projects; (2) 

efforts to increase the use of incremental development: (3) efforts to 

provide transparency relative to the cost. schedule, and risk levels for 

major IT investments; (4) reviews of agencies' operational investments; 

(5) data center consolidation; and (6) efforts to streamline agencies' 

por1folios of IT investments. We noted that implementation of these 

initiatives has been inconsistent and more worl< remains to demonstrate 

progress in achieving acquisitions and operations outcomes. Between 

fiscal years 2010 and 2015, we made about 800 recommendations 

related to this high-risk area to the Office of Management and Budget and 

agencies. As of September. 2017. about 54 percent of these 

recommendations had been implemented. 

The Federal Information Technology Acquisi6on Reform provisions 

(commonly referred to as FITARA). enacted as a part of the cart Levin 

and Howard P. 'Buck' McKeon National Defense Authorization Act for 

Fiscal Year 2015, aimed to improve federal IT acquisitions and operations 

and recognized the importance of the initiatives mentioned above by 

incorporating certain requirements into the law.

4 For exampJe. among 

other things, the act requires the Office of Management and Budget to 

publicly display investment performance information and review federal 

agencies' IT investment portfolios. 

The current administration has also inaiated additional efforts aimed at 

improving federal IT. Specifically, in March 2017, the administration 

3

GAO, High-R;sk Sories: An Updo<o. GAQ.15-290 (Washington, O.C.: Feb. 11, 2015~ 

GAO maintains a high-ris.k program to focus attention on 90'-'ernment operations that it 

identifies as high risk due to their greater vulnerabilities to fraud, waste, abuse, and mismanagement or the need fOtltarl$fonnation to address eoooomy, efficiency, or 

efte<:tiven&$$ d'latktngcs. 

c Pub. I.. No. 113·291 ,div A, tiUe VIII, subtitle 0. 128 St&t.3292, 3438-3450 (Oe¢. 19, 

2014). 

Pag~4 
35 


Insert 33655A.027

GAO Reviews Have 

Identified 

Weaknesses with 

IRS's Management of 

Its Modernization 

Activities and Legacy 

Systems 

established the Office of American Innovation, which has a mission to, 

among other things, make recommendations to the President on policies 

and plans aimed at improving federal government operations and 

services and modernizing federal IT. Further, in May 2017, the 

administration established the American Technology Council. which has a 

goal of helping to transform and modernize federal agency IT and how 

the federal government uses and delivers digital services. RecenUy this 

council worked with several agencies to develop a draft report on 

modernizing IT in the federal government. The council released the draft 

report for public comment in August 2017. 

In reviews that we have undertaken over the past several years. we have 

identified various opportunities fOf the IRS to improve the management of 

its IT investments. These reviews have identified a number of 

weaknesses with the agency's reporting on the performance of its 

modernization investments to Congress and other stakeholders. In this 

regard, we have pointed out that information on investments' performance 

in meeting cost, schedule, and soope goals is critical to determining the 

agency's progress in completing key IT investments. We have also 

stressed the importance of the agency addressing weaknesses in its 

process for prioritizing modernization activities. Accordingly, we have 

made a number of related recommendations, which IRS is in various 

stages of implementing. 

In our June 2012 report on IRS's performance in meeting cost, schedule, 

and scope goals for selected investments. we noted that, while IRS 

reported on the cost and schedule of its major IT investments. the agency 

did not have a quantitative measure of scope-a measure that shows 

whether these investments delivered planned functionality.' We stressed 

that having such a measure is a good practice as it provides information 

about whether an investment has delivered the functionality that was paid 

for. Accordingly, we recommended that the agency develop a quantitative 

measure of scope for its major IT investments, to have more complete 

information on the performance of these investments. IRS started 

developing a quantitative measure of scope for selected investments in 

December 2015 and has been working to gradually expand the measure 

to other investments. 

5GAO, IRS 2013 Budgel: Continuing to Jmprovt~JnfotrmJfiOn on ProgriN'n Costs and 

R6SUil$ COuld AkJ in R0.$0UfC. D«:J$100 AW<ing. GA0-12.oo3 (WaShington, D.C.: June 8. 

2012). 

GA0.18· 1S3T 
36 


Insert 33655A.028

In April 2013, based on another review of IRS's performance in meeting 

cost, schedule, and scope goals, we reported that there were 

weaknesses, to varying degrees, in the reliability of IRS's investment 

performance information' Specifically, we found that IRS had not 

updated investment cost and schedule variance information with actual 

amounts on a timely basis (i.e., within the 60-day time frame required by 

the Department of Treasury) in about 25 percent of the activities 

associated with the investments selected In our review. In addition, the 

agency had not specified how project managers should estimate the cost 

and schedule performance of ongoing projects. 

As a result of these findings. we recommended that IRS ensure that its 

projects consistently follow guidance for updating performance 

information 60 days after completion of an activity and develop and 

implement guidance that specifies best practices to consider when 

estimating ongoing projects" progress in meeting cost and schedule 

goals. IRS agreed with, and subsequenuy addressed, the 

recommendation related to updating performance information on a timely 

basis. However, the agency partially disagreed with the recommendation 

to develop guidance on estimating progress in meeting cost and 

schedule goals fO< ongoing projects. In this regard, we had suggested the 

use of earned value management data as a best practice to determine 

projected cost and schedule amounts. IRS did not agree with the use of 

the technique, stating that it was not part of the agency's current program 

management processes and that the cost and burden to use eamed 

value management would oUhVeigh the value added. 

We disagreed with the agency's view of earned value management 

because best practices have found that its value generally outweighs the 

cost and burden of its implementation (although we suggested it as one 

of several examples of practices that could be used to determine 

projected amounts). We also stressed that implementing our 

recommendation would help improve the re liabi l~y of reported cost and 

schedule variance information, and that IRS had flexibility in determining 

which best practices to use to calculate projected amounts. For those 

reasons, we maintained that our recommendation was warranted. 

However, IRS has yet to address the recO<nmendation. 

'GAO, lnfom>Otlon Tt<MoJogy: Colltist..,ly Applying Bost Prectlces Cook1 Holp IRS Improve the ReliaOiJ.ily of Reported Cost and Schedule Information. GAQ..13--401 

(Washington. D.C.: Apr. 17, 2013). 

GA0.1S-1$3T 
37 


Insert 33655A.029

We reported in April2014, 1hatlhe cost and schedule perfonrance 

information that IRS reported fO< its majO< investments was tor the fiscal 

year only. We noted that this reporting would be more meanirgful if 

supplemented with cumulative performance information in orcer to better 

indicate progress toward meeting goals.' In add~ion, we noted that the 

reported variances for selected investments were not always ·etiable 

because the estimated and actual cost and SCI1edule amounts on which 

they depended had not been consistently updated in accordance with 

Department of Treasury reporting requiremeniS as we had previously 

recommended. 

we recommenoeo tncn IRS report more comprenensive ano re11a01e cost and schedule information for its major investments. The agen:::y agceed 

with our recommendation and said it befieved it had addressed the 

recommendation in its quarterty reports to Congress. We disagreed with 

IRS's assertion, however, and maintained our recommendation. 

In February 2015, after assessing the starus and plans of the Return 

Review Program and Customer Account Data Engine 2. we reported that 

these investments had experienced significant varianoes from initial cost, 

schedule, and scope plans; yet, IRS did not indude these vanances in its 

reports to Congress because the agency had not addressed our prior 

re<:ommendations.'Specifically, IRS had not eddressed our 

recommendation to report on how delivered scope compared to what was 

planned, aod it also did not address guidance for determining projected 

cost and schedule amounts, or the reporting of cumulative cost and 

schedule performance information. We stressed that implementing these 

recommendations would improve the transparency of congressional 

reporting so that Congress has the appropOate information needed to 

make infooned decisions. We made additional recommendati:ms for the 

agency to improve the reliability and reporting of investment performance 

information and management of se1ected major investments. IRS agreed 

with the recommendations and has since addressed them. 

GAO.I~ll'Ott T~ogy: IR$NH<I$101~t~Re/i(Jl>ilttyMdTr~ot Repotted ltwe$tmenl ln!OI'mation, GA0-14·298 (Washing1on. D.C.: Afx. 2. 4.014). 

•GAo, lllfomtalion Teel'tnology: M$nagem.tttl NtHHJs to Adtk~n ~potting ~t IRS 

ln\>Wlmonts' Cost. Sch(J(,I(M. Md Scopt Jn/omiMiol!. GA0-15-297 (Wash ~~on. o.c.: Feb. :IS, 2015). 
38 


Insert 33655A.030

In our most recent report in June 2016, we assessed IRS's process for 

determining its funding pfiorities for both modernization and operations. 

We found that the agency had developed a structured process for 

allocating funding to its operations activities consistent with best 

practices.• which specify that an organization should document policies 

and procedures for selecting new and reselecting ongoing IT 

investments, and include criteria for making selection and prioritization 

decisions. 

However. IRS did not have a similarly structured process for prioritizing 

its modernization activities. to which the agency allocated hundreds of 

millions of dollars for fiscal year 2016.10 Agency officials stated that 

discussions were held to determine the modernization efforts that were of 

highest priority to meet IRS's future state vision and technology roadmap. 

The officials reported that staffing resources and lifecycfe stage were 

considered, but there were no fonmal criteria for making final 

determinations. Senior IRS officials said they did not have a structured 

process for the selection and prioritization of business systems 

modernization activities because the projects were established; and there 

were fewer competing activities than for operations support. 

Nevertheless, we stressed that, while there may have been fewer 

competing activities, a structured, albeit simpler, process that is 

documented and consistent with best practices would provide 

transparency into the agency's needs and priorities for appropriated 

funds. We concluded that such a process would better assist Congress 

and other decision makers in carrying out their oversight responsibilities. 

Acoordingly, we recommended that IRS develop and document its 

processes for prioritizing IT funding. The agency agreed with the 

recommendations and has taken steps to address them. 

Further. we found that IRS had reported complete performance 

information for two of the six selected investments in our review, to 

include a measure of progress in delivering scope, which we have been 

recommending since 2012. However, the agency did not always use best 

9These beSt pra¢lices ace iclentitled in GAO'$ fntorrnation Ted'lnoiOgy lrwesttnent 

Management Framework. See GAO, Information Technology trrvestment Manage em~ A 

Framework for Assessing and Improving Proce.ss Maturity (Supersedes AIMD-10.1.23). GA0.04-394G (Washington, D.C.: Mar. 1, 2004). 

10GAO, Information TechnQ/ogy: IRS NH(Is to lrrt{)f(111e Its Prtx:eS#s lor Prioritizing 8lld 

Repolting Perlotmanc:6 ollnvestmenls. GA0-16-545 (Washington, D.C.: June 29, 2016) 
39 


Insert 33655A.031

IRS Faces Challenges 

with Managing its Aging 

Legacy Systems 

practices for determining the amount of work completed by its own staff. 

resulting In inaccurate reports of work performe<l. Consequently, we 

recommended that IRS modify ~s processes for detenmining the work 

performed by its staff. The agency disagree<! with the recommendation, 

stating that the oosts involve<! would ouhveigh the value provide<!. 

Nevertheless. we maintained that the recommendation was still 

warranted. 

Our wof1< has also emphasized the importance of IRS more effectively 

managing its aging legacy systems. For example, in November 2013, we 

reported on the extent to which 10 of the agency's large investments had 

undergone operational analyses-a key performance evaluation and 

oversight mechanism require<! by lhe Office of Management and Budget 

to ensure investments in operations and maintenance continue to meet 

agency needs." We noted that IRS's Mainframe and Servers Services 

and Support had not had an operational analysis for fiscal year 2012. As 

a resul~ we recommended that the Secretary of Treasury direct 

appropriate officials to perform an operational analysis for the investment. 

including ensuring that the analysis addressed the 17 key factors 

identifie<l in the OffiCO of Management and Budget's guidance tor 

performing operational anatyses.12 The department did not comment on 

our recommendation but subsequently implemented it. 

In addition, we previously reported on legacy IT systems across the 

fe<leral government, noting that these systems were becoming 

increasingly obsolete and that many of them used outdated software 

languages and hardware parts that were unsupported. As part of that 

wof1<, we noted that the Department of the Treasury used assembly 

language code-a computer language initially used in the 1950s and 

typically lied to the hardware for which it was develope<l- and Common 

'

1

GAO. Information T~OIOgy; AgE~ncies Need to Slrtngthtn OvfJfsigflt of Multibillion 

Oollar Investments in Operations and Maintenance, GA0.14-66 (Washing1on, O.C.: Nov. 

6. 2013). 

1

2fhe-se 1aoCtOt$ ate lnek.lded in OMB·s Capital Programming Gukkl, Supp1emen1 to OMS 

ClrC<Jiar A-11. Pan 1 (J<.<y 2012): OMS Memo<ondum M·10·27 (June 2010). EX>mples of 

the faoetM ate (1) eludes a measure: of hOw wei the investment cootributes to ad'lieving 

the agani:tation's buSill6SS needs and strategic goals: (2) compar'U oxrent performance 

with a P'e-estabti:&hed cost baseline and escimates.: and (3) identif.es a need to redesign, 

modify, or terminate the investment. 

Pag<O GA0·18·153T 
40 


Insert 33655A.032

Business Oriented Language (COBOL)-a programming language 

developed in the late 1950s and early 1960s-to program its legacy 

systems. 

It is widely known that agencies need to move to more modem. 

maintainable languages. as appropriate and feasible. For example, the 

Gartner Group, a leading IT research and advisory company, has 

reported that organizations using COBOL should consider replacing the 

language and, in 2010, noted that there should be a shift in focus to using 

more modern languages for new products." The use of COBOL presents 

challenges for agencies such as IRS given that procurement and 

operating costs associated with this language will steadily rise. and 

because fewer people with the proper skill sets are available to support 

the language. 

Further, we reported that IRS's Individual Master File was over 50 years 

old and, although IRS was worl<ing to modernize it, the agency did not 

have a time frame for completing the modernization or replacement. 

Thus, we recommended that the Secretary of the Treasury direct the 

Chief Information Officer to identify and plan to modernize and replace 

legacy systems, as needed, and consistent with the Office of 

Management and Budgers draft guidance on IT modernization, including 

time frames, activnies to be perfonned, and functions to be replaced or 

enhanced.1

" The department had no comments on our recommendation. 

We will continue to follow.up with the agency to determine the extent to 

which this recommendation has been addressed. In addition, we have 

ongoing work identifying risks associated with IRS's legacy IT systems, 

and the agency's management of these risks. 

In sommary, IRS faces longstanding challenges in managing its IT 

systems. While effective IT management has been a prevalent issue 

throughout the federal government, it is especially concerning at IRS 

given the agency's extensive reliance on IT to carry out its mission of 

providing service to America's taxpayers in meeting their tax obligations. 

Thus, it is important that the agency establish, document, and implement 

policies and procedures for prioritizing its modernization efforts. as we 

13Gartner, IT Markel Oock fOf Application Oevetopment. August 2010. 

t

4

GAO. lnform8tion Tectm<Xogy: ~f81 Agttnc.les NH<I to Ad<:fi'ess Agirtg Legacy 

Sys<oms, GAQ-16-40$ {Washi"91on, O.C.; Moy 25. 2016), 

Pag~ 10 
41 


Insert 33655A.033

GAO Contacts and 

Staff 

Acknowledgments 

have recently recommended, and provide Congress with accurate 

information on progress in delivering such modemization efforts. In 

addition. we have emphasized tho need for IRS to address the inherent 

challenges associated with aging legacy systems so that it does not 

continue to maintain Investments that have outlived their effectiveness 

and are consuming resources that outweigh their benefits. Continued 

attention to implementing our recommendations will be vital to helping 

IRS ensure the effective management of its effons to mOdernize its aging 

IT systems and ensure its multibillion dollar Investment In IT Is meeting 

the needs of the agency. 

Chairman Buchanan, Ranking Member Lewis, and Members of the 

Subcommittee, this completes my prepared statemenLI would be 

pleased to respond to any questions that you may have at this time. 

If you <X your staffs have any questions about this testimony, please 

contact me at (202) 512·9286 <X at pownerd@oao.gov. IndiVIduals who 

made key contributions to this testtmony are Sabine Paul (Assistant 

OirectO<), Rebecca Eyt.,., and Bradley Roacll (Analyst ., Charge). 

Page 11 
42 


Insert 33655A.034

Related GAO Products 

(102l25) 

IRS 2013 Budget: Continuing to Improve Information on Program Costs 

and Results Could Aid in Resource Decision Making, GA0-12-603 

(Washington, D.C.: June 8, 2012) 

Information Technology: Consistently Applying Best Practices Could Help 

IRS Improve the Reliability of RepOJted Cost and Schedule Information, 

GA0-13-401 (Washington. D.C.: April 17, 2013) 

Information Technology: Agencies Need to Strengtl!en Oversight of 

Multibillion Dollar Investments in Operations and Maintenance, 

GA0-1 4-66 (Washington, D.C.: Nov. 6, 2013) 

Information Technology: IRS Needs to Improve the Reliabilffy and 

Transparency of RepOJted Investment Information, GA0-14-298 

(Washington, D.C.: April 2, 2014) 

Information Technology: Management Needs to Address RepOJting of 

IRS Investments' Cost, Schedule, and Scope Information, GA0-15-297 

(Washington, D.C.: February 25, 2015) 

Information Technology: Federal Agencies Need to Address Aging 

Legacy Systems, GA0-16-468 (Washington, D.C.: May 25, 2016) 

Information Technology: IRS Needs to Improve Its Processes for 

Prioritizing and Reporting Performance of Investments, GA0-16-545 

(Washington, D.C.: June 29, 2016) 

Page 12 GA0.18·153T 
43 


Insert 33655A.035

Thl• I$ • wonc olll>e U.S. govemmeM Md 1$ noc >Vbje¢1 10 oos>yright l)fOIOOtlon in the United Stales. The published product may be reprociJoed and cft5tributed W'l its enti.rety 

Without turther permission fr'om GAO. However, because M wert may eootaln 

oopyrigh1ed m~ages or other ma;eNI. perr'h!$$100 trom the c::opyrl~t hOlder may be 

necessary i1 you wtsh to reproooee this materiel sepatacety. 
44 

f 


Insert 33655A.036

GAO's Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

The Government Accountability Office. the audit, evaluation, and 

investigative arm of Congress, exists to support Congress In meeling its 

constitutional responsibilities and to help improve the perfOffllanee and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses. recommendations, and other assistance 

to help Congress make informed oversight. policy, and funding decisions. 

GAO's commitment to gOOd government Is reflected In Its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no 

oost is through GAO's website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a lost of newly posted 

products, go to http://www.gao.gov and select •e-mail Updates: 

The price of each GAO publocation reftects GAO's ectual oost of 

production and distributiOn and depends on the number of peges in the 

publication and Whether the publication is printed 1n color or black and 

while. Pricing and ordering informatiOn is posted on GAO's websrte, 

http://www gao.gov/otdenng htm. 

Place orders by calling (202) 512-6000, tolt free (866) 801-70n, or TOO (202) 512-2537. 

Orders may be paJd for us•ng Amerocan Express, O.soover Cerci, 

MasterCerd, ViSa, chedt, or money order. Calt tor eddmonal information. 

Connect with GAO on Facebook, Flock<, Twrtter, and YouTube. 

SUbscribe to our RSS Feeds or E-mail Updates 

Usten to our Podcasts and read The Watchblog 

VISit GAO on the web at www.gao gov. 

Contact 

Website: http:/lwww gao.govlfraudnellfraudnet htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424·5454 or (202) 512-7470 

Katherine Siggerud, Managing Director. stggerudk@gao.gov, (202) 512· 

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington. DC 20548 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington. DC 20548 

.!~ Please Print on Recycled P•per. 
45 

Chairman BUCHANAN. Thank you for your excellent testimony, 

all of you. I will now proceed to the question-and-answer session. 

In keeping with my precedent, I will hold my questions until the 

end. 

I now recognize the lady from Indiana, Mrs. Walorski. 

Mrs. WALORSKI. Thank you, Mr. Chairman. Thank you to the 

panel for being here. 

Ms. Garza, on September 7th, nearly a month ago, we learned 

of the single largest data breach with more than 140 million individuals being impacted. When did the IRS learn of the breach? 

Ms. GARZA. So we learned it as part of the news that evening. 

The very next day, we got together and started to talk about what 

that impact to the IRS might be. 

Mrs. WALORSKI. On September 8th, the next day, you were in 

contact with Equifax about the scope of the breach, whether it impacted the IRS data—— 

Ms. GARZA. That is correct. 

Mrs. WALORSKI [continuing]. As you just said. In fact, IRS sent 

a team of IT experts, criminal investigators, and the Treasury Inspector General for Tax Administration to Atlanta, to Equifax, to 

verify everything that Equifax had told the IRS, correct? 

Ms. GARZA. That is correct. 

Mrs. WALORSKI. Did you have any reason to doubt Equifax or 

what they had told you during that process? 

Ms. GARZA. I had no reason to doubt them, but it is our protocol 

to go and do a physical inspection to validate what we are being 

told. 

Mrs. WALORSKI. Did you learn anything that caused concern? 

Ms. GARZA. So, in this case there were a couple of things. One, 

we were able to verify, by looking at the forensics of what the bad 

actor did and was able to access, that none of the IRS data had 

been compromised. However, we did find that we had gotten inconsistent information when we had first talked to Equifax. We did 

find that in their network logs, along with other companies’ information, some of our information that we had sent over was maintained. But, as I said, there was no evidence that the bad actors 

were able to get to the network logs. Their primary area to look 

at were the databases. 

Mrs. WALORSKI. I read last night in the press that the IRS had 

just signed a $7 million contract to have Equifax provide identity 

proofing. That contract was just signed on September 29th, correct? 

Ms. GARZA. That is what I have learned this morning. 

Mrs. WALORSKI. So more than 20 days had passed since we 

learned of the greatest data breach in history, and you just signed 

a contract to pay Equifax to have access to IRS data for identity 

verification purposes. Did you approve and sign that contract? 

Ms. GARZA. I did not. 

Mrs. WALORSKI. Mr. Tribiano, did you approve and sign that 

contract? 

Mr. TRIBIANO. No, ma’am, I did not. 

Mrs. WALORSKI. Who signed the contract? 

Mr. TRIBIANO. Our procurement officer would have signed that 

contract. 

Mrs. WALORSKI. And who is that? 

46 

Mr. TRIBIANO. Ms. Shanna Webbers. 

Mrs. WALORSKI. How many employees at the IRS have the au- thority to sign a $7 million contract binding the IRS on IT issues? 

Mr. TRIBIANO. I would have to get back to you on that, ma’am. 

I don’t have that number. 

Mrs. WALORSKI. Can you do that? 

Mr. TRIBIANO. Yes, ma’am. 

Mrs. WALORSKI. You know, I am floored to sit here this morning. This is an abject failure. And I haven’t been on this Committee 

very long. But I think this is my third or fourth hearing already 

on this issue of IT and who is responsible. And we sit here this 

morning, we talk about all these issues we have talked about before with no changes happening. The American people are sitting 

there this morning saying, this is beyond abject failure. This is a 

management failure. If nothing, it shows that the IRS structurally 

needs some reform and needs major change. This is why the American people hold us accountable and we try to hold you accountable. 

And then we have contracts being signed right in the middle of 

these investigations of the biggest data breach in the history of this 

country, exposing a massive amount of Americans now to identity 

theft. 

Frankly, the IRS should not be in the position to have major IT 

acquisitions happening without you, Ms. Garza, or you, Mr. 

Tribiano, even knowing that they are happening. I don’t think 

there is anything anybody can say at this point, other than pointing the fingers now to a third person that signed the contract. 

Mr. Tribiano, did you want to say anything? 

Mr. TRIBIANO. Yes, ma’am, if I can. I just want to clarify a couple of things, if I can, and walk through this. And this is not an 

excuse. This is just what happens. We had a contract with Equifax. 

We had two different contracts. We had one that was managed out 

of our privacy team, and that was for credit monitoring. That contract was competed and awarded to a different vendor. So that happened and went into effect October 1. We had the other contract, 

which was our eAuthenticated service contract that was competed. 

Mrs. WALORSKI. Okay. Excuse me. I know we are going to run 

out of time here. I see the yellow light. And I know you have got 

to get back to me the number of people that can sign these contracts, but, obviously, Ms. Garza can, and you can, and the woman 

that you just explained can. Who else can? That is three right 

there. But who else has the authority to sign something like a $7 

million contract? 

Mr. TRIBIANO. I will get back to you on that, ma’am, about the 

numbers. But I want—— 

Mrs. WALORSKI. But you have to know the other people in the 

office that can sign. 

Mr. TRIBIANO. Well, there are certain procurement officers that 

have warrants to be able to do that. 

Mrs. WALORSKI. Are we talking 10 people? Are we talking 15 

people? Are we talking five people? 

Mr. TRIBIANO. The range of what procurement officers’ warrants are for are varied. Some procurement officers have warrants 

up to a certain dollar amount. I have to be able to get you that 

breakdown and show you who and what category can—— 

47 

Mrs. WALORSKI. I appreciate it. And I know I am out of time. 

Thank you, Mr. Chairman. I will yield back. 

Chairman BUCHANAN. Thank you. 

Mr. Holding, you are recognized. 

Mr. HOLDING. Thank you, Mr. Chairman. 

Ms. Garza, I think this is a question for you. As we know, the 

Federal Acquisition Regulation, I think, is 12.101, sets forth the acquisition principles, policies, procedures that govern acquisitions of 

Federal agencies. And this regulation governs the contracts, orders, 

and agreements entered into by the IRS, obviously. And among 

things, the Federal Acquisition Regulation requires prime contractors and subcontractors to incorporate, to the maximum extent possible, practicable, commercial items and components of items supplied to the agency. 

So my question to you is, to what extent do you feel you are 

leveraging the new, more effective, and modern technologies that 

are currently purchased by the IRS? 

Ms. GARZA. So in developing our solutions for—especially in our 

modernized projects, we look for COTS products that might be 

available. RRP is a perfect example where we went out and we 

looked at a suite of products for us to utilize to deliver that capability. So we integrated those products. We look for things best-inclass in order to deliver modernization projects. 

Mr. HOLDING. So do you believe that there is anything you 

have currently purchased that you are underutilizing? 

Ms. GARZA. There might be something. I don’t have an answer 

for that. I don’t have full knowledge of that answer. 

Mr. HOLDING. Is there a way that you could—do you maintain 

some sort of inventory of products that you purchased, and, you 

know, measure their effectiveness, measure whether you are using 

them or not? 

Ms. GARZA. We measure whether we are using them or not. We 

have an inventory of those products to measure utilization. In some 

cases, there are some products that are underutilized. By that, I 

mean we don’t have a lot of people using them. But some of this 

is a dialogue between us and our business customers. And there 

will be, like, groups of people that have unique needs that are 

using that product. And so it really goes back to, what is the business need? And is that product needed for that need? In some 

cases, we are trying to consolidate the products. We are trying to 

simplify our infrastructure, and we are making some progress in 

that. But it all goes back to, what is the business need? And does 

that product meet that need? 

Mr. HOLDING. So would you be able to provide the Committee 

with that inventory and with your analysis of what is being utilized or underutilized for our edification? 

Ms. GARZA. Sure. 

Mr. HOLDING. Good. Thank you. 

And, it came to light in a hearing last year, or the year before, 

the amount of unionization in the IRS. I think the Veterans Administration and the Internal Revenue Service are the two most 

unionized government agencies. Do you know the percentage of 

your IT employees that are unionized? 

Ms. GARZA. I do not know that answer. 

48 

Mr. HOLDING. Mr. Tribiano, you are reaching for the mic there. 

Do you—— 

Mr. TRIBIANO. No, sir. I do not know that answer. But those 

are statistics that we have, and we can deliver that answer to you. 

Mr. HOLDING. I think I recall that your contracts provide that 

you are able to spend something like 500,000 paid hours per year 

in union activity at the IRS. Does that sound about right? 

Mr. TRIBIANO. That could be right. 

Mr. HOLDING. I think Mrs. Walorski covered a couple of these 

in her questioning. But I want to make sure that we have got an 

answer for these for the Committee regarding the Equifax contract. 

Was it approved by the Director of Privacy at the IRS? 

Mr. TRIBIANO. No, sir. What I was trying to explain before is 

we had two contracts. The Director of Privacy had the one for credit monitoring which is different than the contract for 

eAuthentication. That contract for credit monitoring was recompeted and awarded to a new vendor. The eAuthentication was recompeted and awarded to a new vendor, but Equifax protested the 

procurement. And that happened in July. So that is under GAO 

right now for a decision about which way to go. So when we came 

down to September 29th when the Equifax contract expired, we 

had to either, one, stop the service, which means millions of taxpayers would not be able to get their transcripts, including those 

that are in need of it, like in the hurricane disaster areas. They use 

those tools to get their transcripts, or do a bridge contract with 

Equifax until GAO decides on the protest, and we move forward. 

Mr. HOLDING. All right. Mr. Chairman, I see I have run out of 

time. Thank you. 

Chairman BUCHANAN. Thank you. Mr. Bishop, you are recognized. 

Mr. BISHOP. Thank you, Mr. Chairman. 

I guess that I am not sure who to direct this to, Mr. Tribiano or 

Ms. Garza. I am listening to the questions. And, you know, Mrs. 

Walorski, I guess, I support the questions that she asked and the 

tone in which she asked them, because that is the tone in which 

my constituents are concerned about this. 

Can you give us some assurances, after this Equifax breach, that 

you have taken precautions, that there are steps that have been 

taken, to address what could be one of the biggest breaches in identity theft in the history of our country? Clearly, there is a gap 

there. And we have got to do something to address it. And I assume that the IRS has done something. What can you tell us today 

that would provide this Committee and our constituents assurances 

that we are going to do something about this to ensure that nothing really, really bad happens this tax filing season. 

Ms. GARZA. So I can take that. So what we did immediately, 

once we heard about the Equifax, we not only contacted Equifax, 

but we sent a team over. The team went over, and we did analysis 

of their data breach. We identified all of the elements that had 

been compromised. And then, working with—take the investigations. We went through all of that information. And then we went 

through, on an application-by-application basis, to determine if that 

compromise would put our systems at risk. Our evaluation showed 

that the approach that we have taken at the IRS is to have a mulVerDate Sep 11 2014 13:34 Mar 12, 2019 Jkt 33655 PO 00000 Frm 000052 Fmt 06633 Sfmt 06602 I:\WAYS\OUT\33655.XXX 33655
49 

tilayered defense mechanism in our applications. And so, based on 

that, we determined that we had other mitigating controls in place 

that would protect the taxpayer information. Furthermore, there 

was about 209,000 SSNs that we thought were at higher risk. And 

for those 209,000 SSNs, we are in the process of receiving the SSNs 

and we are going to protect those accounts specifically. 

Mr. BISHOP. Have those SSNs and the owners of those SSNs 

been informed of this situation? 

Ms. GARZA. That would be an Equifax question to be asked. We 

are going to tag the accounts to make sure that no one can come 

in and—— 

Mr. BISHOP. But if my account is tagged, I would like to know 

why it is tagged. And I would think as a taxpayer I would have 

the right to know that. 

Ms. GARZA. So I think that is a business decision, and we will 

support whatever the business decision is. 

Mr. BISHOP. Okay. A million and one questions to ask here. 

Great concern. If a person—let me ask, Mr. Powner, did you have 

something to add to that? 

Mr. POWNER. Yeah. I would like to go back to the question of 

approving IT contracts. There was a law passed December 2014 

called the Federal Information Technology Acquisition Reform 

Act—— 

Mr. BISHOP. Right. 

Mr. POWNER [continuing]. FITARA. I do a lot of work on 

FITARA at all agencies and departments. And one of the provisions 

in that law is to strengthen CIO authorities. The CIO should approve the IT budget. They should approve major IT contracts. That 

is a provision in the law. And I can tell you right now that was 

put in there because of this stuff that is happening. The procurement shop, and the IT shop, and sometimes the CFO organizations, 

there are walls between these organizations. And if we would simply approve major IT contracts by CIOs, it would help solve this 

problem. 

Mr. BISHOP. So that is another question that I have. 

Mr. Chairman, there has got to be a solution out there. In this 

great country of ours, with all the great innovation, the private sector has got to have a solution here. I know that the commercial 

side and the criminal side of the IRS deal with things differently. 

My understanding is the criminal side works with a 1994 product 

to address these issues, which is completely unacceptable to me. I 

may be wrong on that, on the timing, on the name of the product, 

but it is at EFDS. 

Ms. GARZA. So that is the system that RRP is replacing. And, 

basically, at this point, we have retired the bulk of the EFDS, the 

old system, and are using now the RRP system to do the pre 

refront in identity theft. 

Mr. BISHOP. How about the LCA system, the lead case analysis? 

Ms. GARZA. So that is part of the new RRP system, the link 

analysis, and it is available to be utilized on that new system. 

There are still components of the old legacy system, primarily 

around the case management components, that still need to be 

modernized. We made a decision in trying to simplify our footprint 

to develop an enterprise case management system. So rather than 

50 

having RRP build its own case management system and other 

parts of the organization building separate, there is 63 different 

case management systems that we are going to consolidate into one 

platform of case management. And so we are waiting for that platform to be developed so that then those components of EFDS can 

be replaced. 

Mr. BISHOP. Mr. Chairman, I see I am out of time. But I would 

hope that at some point in time, we can get this group together 

again and talk about what we have done and not what we are 

going to do. Because this is a 1994 technology, and there is too 

much technology in this country to not utilize. 

Chairman BUCHANAN. Thank you. 

Mr. Schweikert. 

Mr. SCHWEIKERT. Thank you, Mr. Chairman. 

Mr. Powner, and I will tell you, we were going through some of 

this late last night and early this morning, and there are lots and 

lots of questions. So let’s sort of go a different direction. When you 

have actually looked over the agency, first off, do you have a sense 

of how much of legacy systems are still up and running? And when 

I say legacy, I mean things that are maybe 15, 20, 25 years old, 

are still running in the background. 

Mr. POWNER. Yeah. There is a good portion as legacy spans. 

There is real old stuff that is over 50 years old, going back to the 

origination on the Individual Master File that processes our tax returns. 

Mr. SCHWEIKERT. And are they just using bolt on, and bolt on, 

and bolt on—— 

Mr. POWNER. And I think, as Mr. Tribiano mentioned, I mean, 

a lot of those versions behind, and we got hardware that there is 

no longer warranties on. That is the big issue. When you really 

look at IRS, I think the big problem at IRS is the Individual Master File. Because that is the system that processes our tax returns. 

And they do a great job getting this old system to work. But you 

know what is going to happen eventually one filing season? It is 

going to stop. And what is the plan to replace it? There isn’t a good 

one. 

Mr. SCHWEIKERT. Okay. My thoughts, let’s do them out of 

order. In your understanding, why is that master file not running 

on a cloud-based system? 

Mr. POWNER. Well, it is not running on a cloud-base or anything close to modern because there has been other priorities over 

the years. And it is not to say they don’t work on it some, because 

it is the number one investment. But we are not getting enough return on it. 

Mr. SCHWEIKERT. Isn’t there translational software that would 

basically do the migration? 

Mr. POWNER. Yes, sir. You can translate those languages. I 

mean, the issue with IRS now, they are multiple versions behind, 

so you are going to have multiple layers of translation. It is not an 

easy thing to do. But we need to focus on it as a priority. And that 

is why I say—— 

Mr. SCHWEIKERT. No, no, no. It is a lot easier than running 

around sticking thumbs in dikes. And I know I am interrupting, 

but it is partially the time. 

51 

When you also looked at the agency and its multiple subdivisions, did they have a commonality of platforms? They were all 

running on a certain type of software? Or did lots and lots, lots of 

little subdivisions within the agency, were they purchasing different types of software? 

Mr. POWNER. It is all over the board, depending on the mission 

criticality of the app—and some things are newer there. I think the 

RRP—— 

Mr. SCHWEIKERT. I am less concerned about the age of the 

software. It is the commonality of the platform. 

Mr. POWNER. It would not be completely common across. No. 

There are probably opportunities to improve that. 

Mr. SCHWEIKERT. Okay. And I am going to screw up the quote. 

But I remember a year or two ago reading one of the biographies 

of Steve Jobs, and within there was a real interesting discussion 

when they had had a failure, a huge failure, trying to move their 

accounting systems, and coming back in and saying, we are going 

to try something new. We are going to change our work methodology to match the software instead of trying to force the software 

to match our work process. 

And everything I am reading, you have lots of subdivisions within the agency that are trying to make the software match how they 

already do their workflow. Workflow is a lot easier to change. 

There is one other on my list that I need—did you see any pattern of IT talent in the agency leaving the agency and turning 

around and being rehired as a contractor in the agency? 

Mr. POWNER. I don’t have information on that. I will tell you, 

though, this. When you—the difference between paying an internal 

employee and a contractor to maintain that old assembly code, it 

is a lot more expensive if you hire a contractor. 

Mr. SCHWEIKERT. Okay. This may be for a future conversation, but we have someone who claims to be providing information 

that there is some sort of pattern. 

Mr. SCHWEIKERT. In my last—and, I am sorry. I thought I 

would go faster than this. I apparently haven’t had enough coffee. 

Why such great difficulty moving to the cloud when that was—almost 10 years ago was going to be the major mission of the agency’s CIO? 

Ms. GARZA. So although we do not have a cloud strategy documented, we have, for the last several years, been taking on elements of the cloud strategy. For example, our entire portal service, 

which was replaced in 2012 and has been steadily—as an infrastructure, as a service, private cloud strategy. We also did—our enterprise storage capability is a cloud solution that allows us to 

move data. 

Mr. SCHWEIKERT. Are you housing the enterprise servers? 

Ms. GARZA. I am sorry, what? 

Mr. SCHWEIKERT. Are you housing the enterprise servers? 

Ms. GARZA. Enterprise service. 

Mr. SCHWEIKERT. The servers. The servers. Do you control—— 

Ms. GARZA. For storage? 

Mr. SCHWEIKERT. Do you control the hardware or is the hardware distributed? 

52 

Ms. GARZA. For the enterprise storage capability, the servers 

are in the cloud, and we move the data back and forth. 

Mr. SCHWEIKERT. And those servers in the cloud are owned by 

someone on the outside or the agency? 

Ms. GARZA. I don’t have that answer. 

Mr. SCHWEIKERT. Okay. Mr. Chairman, I think this is one of 

those occasions where there is going to be a long letter to follow. 

Chairman BUCHANAN. Thank you. 

Mr. Rice, you are recognized. 

Mr. RICE. Thank you, Mr. Chairman. 

Who on the panel thinks that the modernization efforts of the 

IRS are acceptable? Who on the panel is in charge, or is anybody— 

any of you all the point person, the person who directs modernization? Is it you? 

Ms. GARZA. I am responsible for that. 

Mr. RICE. Okay. And if nobody up here thinks it is acceptable 

and you are the one in charge, how long have you been doing this? 

Ms. GARZA. So I became the CIO about 14 months ago. 

Mr. RICE. Uh-huh. 

Ms. GARZA. But I have been involved in the modernization effort for some time. I will tell you that we have had a lot of success, 

and I ask that you look at it from the bigger picture. Our current 

electronic filing system was a huge success. The Integrative Financial System was part of the modernization program. At the same 

time, we have been delivering very significant—— 

Mr. RICE. What—— 

Ms. GARZA [continuing]. Legislative mandates—— 

Mr. RICE. What is the Individual Master File? 

Ms. GARZA. So the Individual Master File is the database, the 

system, that holds every individual taxpayer’s account. It has a 

record of the account changes, the things that have occurred to that 

account. 

Mr. RICE. The system that holds that, it was designed 50 years 

ago? 

Ms. GARZA. It was first implemented in 1962. 

Mr. RICE. Okay. So the hardware that runs—that system runs 

on, it can’t be modern. That system—— 

Ms. GARZA. It is running on modern. The application, which is 

the ALC code, was developed in 1962. However, the hardware that 

it writes on is current technology. 

Mr. RICE. All right. So if the code was written that long ago, 

then you must have folks on your payroll that are continually 

maintaining that. Is that correct? 

Ms. GARZA. Yes. And the number of people that know and understand ALC is dwindling. So we do have a sense of urgency that 

we need to get the ALC, especially the core components of the master file modernized. 

Mr. RICE. It is only 55 years old. 

Ms. GARZA. That is correct. 

Mr. RICE. That is a heck of a sense of urgency. 

Mr. Powner, you said that part of the problem is that Congress 

needs to set goals and hold people accountable. Is that right? 

Mr. POWNER. I think that would be very helpful. And I have 

just seen it work over the years. 

53 

Mr. RICE. We can’t go in there ourselves and write code and convert files. That is not our job, and we are not capable. But can you 

help us come up with a—— 

Mr. POWNER. Where I think you could help is this: Ask Gina, 

Ms. Garza, how much money it will take, and how many years to 

replace the Individual Master File. We need a clear answer on 

that. Is it 5 years at $100 million each year, whatever it is, we 

need that—— 

Mr. RICE. What is the answer, Ms. Garza? What is the answer? 

Ms. GARZA. So there are two major components of the IMF that 

we have developed—— 

Mr. RICE. How much money and how long will it take? 

Ms. GARZA. So we believe that we can deliver a system replacing those core components in 5 years if we can get 50 to 60 FTEs 

and the funding associated with it, with some direct hire authority 

so that we can hire the right skills, and about $85 million each 

year. We—— Mr. RICE. $85 million a year? 

Ms. GARZA. Yes, sir. 

Mr. RICE. Well, you got $2.9 billion now, right? 

Ms. GARZA. So a lot of that fund, those funds, are going to do 

the unfunded legislative mandates, to do tax filing season, to run 

all of our current operations. Mr. RICE. But this $2.9 billion is for IT, right? 

Ms. GARZA. Yes. 

Mr. RICE. Isn’t it more expensive, at some point, to maintain 55- 

year-old software than it is to just buy new and convert it over? 

I mean, wouldn’t it be cheaper? 

Ms. GARZA. Actually, the IMF is very efficient. 

Mr. RICE. Mr. Powner, wouldn’t it be cheaper? 

Mr. POWNER. Yes, I think over time it would be cheaper, and 

I think it is efficient. The issue is, I think, the human capital scenario where we are running out of programmers that know this 

stuff. You know, we are training young programmers who know 

modern languages this old assembly code to keep it running. I just 

think it is highly risky, and I think what we heard here is they 

need $85 million over a 5-year period—— 

Mr. RICE. So if your programmer has a heart attack, nobody is 

going to be able to get their tax refund. Is that what you are saying? 

Mr. POWNER. You know what, we have had examples like this. 

Last year I highlighted all the old systems in the government. This 

is right up there along with the 8-inch floppy discs that DoD is 

using on our nuclear command system. So we got problems, but 

this is one of the top five. 

Mr. RICE. Mr. Chairman, I sure would like to keep going, but 

I see my time is up. 

Chairman BUCHANAN. Thank you. You know, our goal in this 

Committee, we are trying to do the overall Committee tax reform 

sometime this year ideally. We are hopeful. And then IRS reform 

we would like to do, it has been 20 years. But I guess my question, 

and a lot of us—at least I was motivated, to think that we have 

equipment out there—I got out of college in the mid 1970’s, we 

would sell many computers. I mean, just to think that we have got 

54 

equipment from 1970s and 1980s out there is mind-boggling. But 

I guess the question I would have initially as a business guy over 

the years, is do you have an IT plan in terms of going forward? Because I think one of the things is when we do IRS reform, we have 

to take a look at the whole thing on IT, and identity theft, and 

there are a lot of different things. But do you have a plan? Has 

that plan ever been presented to a committee? Because if someone 

came in to me—and we had this situation—what I would do is I 

would have the best and brightest, present a plan, and then get 

some sense of the return that we would get as shareholders or 

whatever. So let me just ask all of you. Do you feel like you have 

a plan? Is there a buy-in to the plan? We will start with the gentleman there. 

Mr. TRIBIANO. Yes, sir. We do have a digital roadmap on how 

we would get from where we are now to where we want to be. I 

don’t know if we shared it with the committee. I have to go back 

and take a look. 

Chairman BUCHANAN. How long is that plan? Is that a fiveyear, 10-year plan? 

Mr. TRIBIANO. It depends on what—there is a lot of components to it, and there are certain milestones that you have to 

reach. One of the major things we have to get to is stabilizing the 

infrastructure as we see it now so we can continue at least delivering filing season as we modernize from that point. So my concerns have been focused on the delivery of the filing season part 

of it. So we can have that—— 

Chairman BUCHANAN. The thing is, you have got to have a vision. You have got to have a sense of the future, because, you 

know, otherwise, I think that is probably why we are in the situation we are in. We are just trying to react instead of being 

proactive. 

Mr. TRIBIANO. Absolutely. And we would love to sit down and 

go through that plan with the committee, with your staff, whatever 

you deem necessary, roundtable discussion, and have that back and 

forth and explain where we are going and how we think we can get 

there and get the input. I mean, as our partners at GAO are stating, we want congressional engagement on this. We want you to 

understand the concerns and issues and how we need to get to 

where we need to go. 

Chairman BUCHANAN. What is your thought on that? Do you 

feel like we have got a workable plan going forward? I mean, you 

know, it is not just about throwing a lot of money at it. It just 

seems that we can be a lot more efficient going forward in terms 

of personnel costs and everything else. And I will get into that in 

a minute. But do you feel like there is a plan? I mean, you are the 

one that is kind of heading this up. 

Ms. GARZA. We have what we have called a technology roadmap. And that technology roadmap was developed in concert with 

a future-state vision for the IRS. And so as part of that document, 

you will see the evolution and the migration of current-state IT to 

future-state IT. 

A- subset of that is the digital roadmap, which is what we are 

really focused and have prioritized right now. We want to be able 

to get out and provide services to taxpayers. But those documents 

55 

are in place. We do utilize them. And as we talked earlier, the enterprise case management system is one of those things that came 

out of the technology roadmap where we are trying to consolidate 

63 legacy systems that have been around forever into a single 

COTS platform in the cloud so that we can provide case management capabilities across the board. 

One of the things that we did with RRP, we did not let them create their own case management system. That was a conscious decision on our part because we needed to stop creating stovepipe solutions. 

Mr. RICE. Mr. Chairman, can I make a suggestion? 

Chairman BUCHANAN. Yeah. 

Mr. RICE. Why don’t we ask Mrs. Garza, the CIO, to give us a 

plan from here to modern—— 

Chairman BUCHANAN. Uh-huh. 

Mr. RICE [continuing]. And have regular meetings, you know, 

quarterly, or whatever, and ask what the progress is on those. 

Chairman BUCHANAN. That is a good point. Do you feel like— 

is this a plan you have shared with anybody in terms of Members 

of Congress or anywhere else? 

Ms. GARZA. I don’t know if we have shared the technology roadmap and the digital roadmap, is certainly something that we can 

do. And we would be happy—I remember—and Dave Powner and 

I go back to when we used to come up and brief, on a quarterly 

basis, congressional staff on the progress against—— 

Chairman BUCHANAN. This is going to be an area where I 

think all of us are going to be interested going forward because it 

is not acceptable. 

But, Mr. Verneuille, I want to run through all of these. What is 

your sense? Is there a plan? Or is there a vision? What are your 

thoughts on it? 

Mr. VERNEUILLE. Like Ms. Garza mentioned, there is a technology roadmap, and we have seen it. The challenge we see is that 

the priorities change every year. So there is a strategy and a roadmap, but the details of what they deliver every year, the requirements that are going to be developed and delivered every year 

change annually based on priorities, resources, and other requirements coming in for that year. So it is a plan, but what they deliver is going to change every year. 

Chairman BUCHANAN. Mr. Powner, would you want to comment on it? 

Mr. POWNER. So to be balanced, I think there is a roadmap 

they have used to deliver on some aspects of the technology at IRS, 

but—and it is a big ‘‘but’’—there is not a workable, achievable plan 

to replace the IMF. 

Chairman BUCHANAN. The second follow-up question for all of 

you is this: I have a gentleman who has run a good-sized business, 

a lot of restaurants all over. He said to me, he said, Vern, you 

know, if I hire a manager, $50,000, in one of his stores—and then 

the cost today of supporting an individual is another 42 percent, so 

it is $70,000. He said, I have gone to much more automation, and 

as people retired out, I have just been able—not even had to cut 

head count, but, he said, we have been able to get a good return 

on our technology. 

56 

And I guess the question is, is that, you know, as a part of a 

plan, I would like someone to tell me, here is what we need to invest, but here is the efficiency coming out of the system. Because 

if we are dealing with software back in the 1970s and 1980s, and 

hardware, there has got to be a lot of deficiencies as a result of 

that. And I think that is the concern a lot of us have, just throwing 

more money at it. The question is, is to have a plan, what is the 

return on that plan in terms of the technology dollars being spent? 

We should have a way of being able to get to those numbers, because there has got to be an enormous savings. 

I went into a facility the other day with robots and everything. 

They have cut a lot of personnel out of this plant, a big plant, Amazon. It is one of our new facilities in our area. I was just shocked 

about it. They probably have three times as many folks working 

there because of today’s capability. And that is something we need 

to think about. That is why I am big on planning, personally, as 

a business guy. Because if you don’t have a vision, you perish. But 

we need to have a vision, a plan, in terms of this space, in terms 

of the IRS in general, before I would be willing to commit any dollars, because I would like to see what the return on that investment would be. 

So I will give you a chance, all of you, just to make a comment. 

Mr. TRIBIANO. Yes, sir. 

Chairman BUCHANAN. That is just my feeling. I am more of a 

big picture guy. 

Mr. TRIBIANO. Chairman, you are absolutely right. I mean, we 

have a plan. We have to do a better job of articulating what the 

results of that and the outcomes of those are. Now, there are some 

measurements with that that are not as easy as dollars versus 

costs. 

Chairman BUCHANAN. Uh-huh. 

Mr. TRIBIANO. But some of them is outcomes, meaning better 

taxpayer service, less lines at our walk-in centers, less calls to our 

call centers. But there are measurements that we can articulate. 

Chairman BUCHANAN. But my point is, is that it should also 

have some savings in terms of personnel costs, I would think. Because there is much more capability in terms of computing power 

and everything else. 

Would you like to add something, Ms. Garza? 

Ms. GARZA. I agree with you. And, actually, as we spoke earlier, 

we are looking to robotics ourselves. We believe that there are a 

lot of business processes that can be automated, and, therefore, decreasing the number of FTEs that the IRS might need. There is 

also areas in testing and other areas where automation would be 

very, very helpful. We keep looking for places where we can be 

more efficient. Moving to cloud is one of the strategies that we are 

pursuing. We believe that we can either have a managed service 

or a cloud service, that then we won’t need to have the people in 

order to maintain those systems, and then we can rely on them to 

make sure that all of the hardware/software is being maintained. 

So this is part of the conversation that we are having and the plans 

that we are doing. 

57 

Chairman BUCHANAN. Well, one thing we are going to want to 

do is get whatever plan that you do have, just talk about that, 

where we are at and where we are going. 

Mr. Verneuille? 

Mr. VERNEUILLE. Yes, sir. Part of the return on investment 

also involves retirement of systems that you are replacing. So the 

issue with IMF not being completed or converted to CADE 2, they 

cannot retire IMF until CADE 2 is completed. So that is a loss of 

efficiency. They are spending millions of dollars a year maintaining 

IMF. And if they complete CADE 2, that is more savings. As well 

as on the RRP case management process, they are currently spending millions of dollars maintaining the EFDS case management 

until they get the enterprise case management solution implemented. So there is more savings by retiring legacy systems. 

Chairman BUCHANAN. Mr. Powner. 

Mr. POWNER. I would agree that there are huge efficiencies 

with modernization. I think another key aspect, though, that comes 

with the efficiencies is the improved security, cybersecurity, with 

the modern technology. 

Chairman BUCHANAN. Huge issue, obviously. 

Mr. POWNER. Absolutely. So that is extremely important going 

forward. 

Chairman BUCHANAN. Mr. Bishop, did anybody else have a 

comment or a question? I think we have a couple of minutes. 

Mr. BISHOP. Mr. Chairman, I appreciate this hearing, and I 

think it is very helpful. This is not a shot at the IRS. But I think 

it would also be helpful for this Committee to bring in a panel from 

the private sector to hear their solutions for this issue. Because we 

have ample ingenuity out there, entrepreneurs out there, who are 

working in this space every day of the week. And when the IRS 

needs 35 FTEs, or $85 million a year, I think before we do anything like that, we spend taxpayer dollars in that way, we ought 

to be talking to the private sector to see what their solutions are. 

And I know that Palantir, for example, out in California, is one of 

the companies that has provided the technology on the—I believe 

it is on the civil side. 

Chairman BUCHANAN. Yeah. 

Mr. BISHOP. So it would be very helpful to be able to have them 

come in as well. 

Chairman BUCHANAN. Okay. I would like to thank our witnesses for appearing today before us. Please be advised that Members have two weeks to submit written questions, to answer later 

in writing. Those questions and answers will be a part of the formal record. And with that, the Subcommittee is adjourned. 

[Whereupon, at 9:57 a.m., the Subcommittee was adjourned.] 

[Member Questions for the Record follow:] 

58 


Insert 33655A.037

<tongrc.s.s or the 'mnitcd ~ta c.s 

'lf\.,S. )louse or 'Rcprucntotiocs 

Mr. JeffJey Tribiano 

OOMMrTTEE ON WAYS AND MEANS 

110(: lONG\YO~H H0uS( OFAcl: 8 UIIl.OIH<> 

1202) 225--3625 

Ulashington, BG: 2051Hl·IS http:llwaysandmeans.Mouse.gov 

November 15,2017 

Deputy Commissioner for Operations Support 

lnten1al Revenue Service 

II II Constitution A venue, NW 

Washington, DC 20224 

Dear Mr. Tribiano: 

Thank you for your testimony before the Commiuee on Ways and Means at the October 4, 2017 

Oversigltt Subeommillee hearing entitled "IRS Reform: Challenges to Modernizing IT 

Infrastructure." In ordC.r to complete our hearing record. we would appreciate your responses to 

the following questions: 

I. In the Internal Revenue Service's (IRS) oral testimony, IRS witnesses referenced the 

"Digital Roadmap" as a component of the IRS Technology Roadmap. 

a. Please explain the relationship between these two documents. 

b. How often are the IRS Technology Roadmap and Digital Roadmap updated? 

c. Please describe the process for proposing changes needed to one or both of these 

documents and the process for approving such changes. 

d. Please provide a list of the individuals who must approve changes made to these 

documents. 

e. How does the IRS measure ~~e usefulness of these documents? 

2. In Fiscal Year (FY) 2016, the IRS spent $800 million on modernization efforts. Please 

explain how this money was spent and what additional functionality or progress was 

achieved in FY 2016 using these funds. 

a. The IRS infomtation technology (IT) Development, Modernization, and 

Enhancement budget is expected to decline from 30 percent of total IT spending 

in FY 2016 to 14 percent in FY 2018, while the total IT budget is expected to 

rernain relatively stable. What led to this change and why has modernization 

funding decli1led so significantly? 

b. What efforts has the IRS made to roducc the percentage of funding spent on 

operations and maintenance, which is set to be over 80 percent of the IT budget in 

the coming year? 
59 


Insert 33655A.038

e. Does the LRS expect this trend to continue in future years? 

3. The Government Accountability Office (GAO) has reported that the LRS does not have a 

process for prioritizing its modernization activities) which it spent $800 million on in FY 

2016. 

a. Without a process, how does the LRS decide which modernization projects to 

dedicate resources to? 

b. Who ultimately makes these decisi.ons? 

c. What is the role of the IRS Cbieflnfonnation Officer (CIO) in this process? 

d. The IRS told GAO there is no documented formal process because there are less 

competing interests so it is not necessary. However, the LRS bas also argued that 

it does not have enough funding for its modernization efforts. Given the limited 

resources, why has the IRS not had an institutionalized process to ensure funds go 

to tbe agency's priorities? 

e. If adequately funded, does the IRS have an estimate for bow long it would take 

and at what cost to modernize all IRS IT systems? 

f. Since GAO's report was released last year, what steps has the IRS taken to 

institute a process for its modernization efforts? 

g. The Treasury Inspector General for Tax Administration (TIGTA) testified the IRS 

needs to improve its project planning prior to starting development activities. 

What actions has the IRS taken to address these concerns? 

4. Customer Account Data Engine (CAD£ 2)-

a. What year did the TRS deterll\ine the Individual Master File (IMF) would need to 

be replaced? 

b. \VItal year did the IRS begin developing a strategy for CADE 2? 

c. What was the initial cost estimate for the project? 

d. What is the total cost, to date, of CADE 2? 

c. What is the annual cos( of running and maintaining the lMF? 

f. When was the initially planned completion date Cor CADE 2? 

g. What is the planned completion date ofCADE 2? 

h. When will the IMF be taken oOline? 

What functionality has been achieved through CADE 2 thus far? 

j. What functionality has yet to be completed? 

k. Is ~te IRS still committed to replacing lMF via CADE 2, and if so, why is the 

planned PY 2018 spending for CADE 2 significantly lower than prior years? 

CADE 2 is considered to be one of the IRS's most sig11ificant modemization 

efforts and yet it is currently unde1· a strategic pause while its release plan is being 

revised. 

What is the current status of CADE 2? 

ii. What date did the strategic pause being? 

iii. When is the strategic pause scheduled to end? 
60 


Insert 33655A.039

iv. Why is the release plan being revised? 

v. When will the revised release plan be completed? 

vi. Please describe any anticipated changes to the CADE 2 release plan. 

m. The IRS CIO testified that CADE 2 could be completed in five years if the IRS 

receives an additional $85 million per year and an additiottal 50 to 60 full-time 

equivalents. Please describe how the IRS determined Utis estimate. 

n. Is there a strategy to address 11' workforce gaps, especially as it relates to the 

IMF? If so, please describe. 

5. Enterprise Case Managemelll (ECM) Program· The ECM Program is reported to have 

paused all development activities. While the Committee understands the need to 

consolidate the number ofECM systems that the IRS maintains, please provide 

acquisition timeline(s) for the one or more ECM systems that the IRS anticipates 

acquiring aud a list of the business units or divisions that each ECM system will be used 

for. 

a. The ECM stopped development due to "technical limitations" of the commercial 

off-the-shelf product according to TIGTA's testimony. Please describe these 

tecllllieal limitations in detail. 

b. When was this ECM solution procured? 

c. When did the IRS become aware of these technical limitations and how did the 

IRS become aware of them? 

d. When did the IRS stop development of this ECM? 

e. \Vl1at is the currem date for completion? 

f. Why were these technical limitations not identified prior to the procurement of the 

ECM? 

g. What steps has the IRS taken and wbat safeguards has it put in place to ensure this 

situation does not occur again? 

6. In December of2010, the U.S. CIO directed agencies to shift to a cloud first policy. 

a. What steps has the IRS taken to move its systems to the cloud? 

b. And when did the IRS deploy its first cloud? 

c. What arc the security implications of failing to implement an IRS cloud strategy? 

d. Why was there a six-year delay before the IRS began to consider a cloud-first 

strategy, as mandated by the U.S. CIO? 

7. What is the IRS's process for determining and prioritizing which online account features 

or fimctionalities will be added next to existing online services? 

8. While the IRS has reported a significant decline in self-reported cases of identity theft, 

how does the IRS address individuals who may be unaware of having had their identities 

Slolen? 

a. Does the IRS have an estimate of how many taxpayers are victims of identity then 

and are unaware of it·? 

b. If so, please describe the methodology for this estimate. 
61 


Insert 33655A.040

9. What substantial IT cost savings have been achieved by the IRS in the last three y~'l 

I 0. What is the IRS's plan and time line for replacing the 64 percent of the IRS's hardware 

that TIGTA determined is past the end of its useful life? 

Ouestions from Ren . .Jackie Walor·ski CTN-02> 

The Remm Review Program, or RRP, was designed to replace a legacy fraud detection system 

from the 1990s, but it came in hundreds of millions of dollars over original estimates and years 

behind schedule. My concern is that after spending over $300 million and seven years on the 

RRP, lhere doesn't seem to have been an accompanying investment in analysis. As I understand 

it, IRS analysts are still using a progrem called Discoverer to analyze potential freud cases 

flagged by RRP. 

I. Is that correct? 

2. If yes, how old is Discoverer? 

3. Is it true that analysts need to nm complex queries on Discoverer overnight in order to 

prevent the whole system from crashing? 

4. How does this lag affec.t the ability to update RRP filters? 

5. Is there a plan to retire Discoverer? Ir so, what is the timeline? 

6. With the recent Equifax hack, what is the IRS doing to combat what will likely be more 

sophisticated fraud attempts? 

7. How many IRS employees have the ability to sign a $7 million contrect? Please provide 

a breakdown of which employees can sign which types of contracts. 

Ouest ions from Re p Mjkc Bjshon CMJ .. Q8l 

I. I understand that the IRS has identified the cost of consolidating case management 

systems through an internal process, I believe at the hearing you said $84 million 

annually for the next five years, to do it internally. Have you identified the cost of using a 

commercial product, or contracting with a data services company to utilize its expertise, 

for the purpose of consolidating ~le various case management systems? 

2. When did the IRS begin using the Lead Case Analysis (LCA) system? How many times 

has it bctn utilized by a case worker in the criminal division in e-ach filing season since 

its acquisition? And how many times has Electronic Freud Detection System (EFDS) 

been used by that same population of case workers? 

3. In the time since the Criminal Investigations Division bas begun using LCA, how many 

times has the civil division used EFDS to analyz.e a flagged return? And have they been 

able to usc LCA at all? 

4. 1 f civil division case workers have not had access to LCA, why can case workers in the 

criminal division use it? 

Sincerely, 

~.a~ Subcommittee on Oversight 
62 


Insert 33655A.041

Buthanan: 

Internal Revenue Service 

Response to Questions for the Record 

Ways and Means Subcommittee on Oversight 

Heafing on IRS Reform: Challenges to Modetnizating IT lnfra.sttuctute 

October 41 2017 

1. In the Internal Revenue Service's (IRS} oral te.stlmony1 IRS witnesses referenced the .,.Oig·ital 

RoadmapN as a component of the IRS Technolosy Road map. 

a. Please explain the telationshlp between these two documents. 

The Technology Roadmap and Digital Roadmap were initially c:reated separately and 

evolved with distinct communication needs. The Technology Roadmap, developed and 

maintained by the IRS Enterprise Architecture (EA) office, is a broad, long·range view of 

the IRS IT direction originalty published in January 2015. It is intended to .. translate .. the 

future state business vision into needed IT capabilities and services, and guide 

investment planning and architecture development. The IRS T«hnology Road map 

describes a vision for harnessing modern technology paradigms (e.g.1 Service Oriented 

Architecture, Application Program Interfaces, AnatytiCS1 Oev0ps1 Cloud) to enable key 

business priorities, such as the move toward online taxpayer accounts and on-arrival tax 

processing. The Technology Road map also identifies the envisioned architecture and 

plans for ensuring the security of IRS data and information assets. The Ted'lnology 

Road map is used to facilitate a convers<Jtion between IRS business and IT leaders 

around the future direction, priotities, and alignment of inves-tments and resource-s to 

achieve a common vision. 

The Digital Roadmap was initially created in early 2015 as a crosswalk document 

between the Technology Road map and six (6) key initiatives that were identified by the 

Digital Subcommittee. The Digital Subcommittee is comprised of the two IRS Deputy 

Commissioners, Wage and Investment Division Commissioner, Smaii Business/Setf· 

Employed OMsion Comm ss oner~ Chief lnfotmation Offiter and Oirector1 Online 

Services, and plays a Gritical role in governance and oversight of the digital initiatives. 

The Digital Roadmap was effectively a realilation of the IRS Digital Strategy. Today, the 

Digital Roadmap 1s shown as a subset of Oigltal Strategies which are aligned within the 

overall Technology Road map. The original crosswalk document is now maintained as a 

summary of the Digital Strategies, with implication and cross linking maintained within 

the Technology Roadmap. The Digital Strategies represent IRS's prioritized set of digital 

and modernization initiatives or programs that enable the digital taxpayer experience 

(e.g., Online Account1 Authenticat on~ Authorization, IRS.gov, Taxpayer OigitaJ 

Communication {TDC) solutions~ third party services). The Digital Strategies provide 

greater detail into the specific projects and plans in the priority areas. As the vision and 

plans evol·ve under the direction of the Digital Subcommittee~ the Technology Road map 

is updated as appropriate. 
63 


Insert 33655A.042

b. How often are the IRS Technology Road map and Digital Road map updated? 

The Technology Roadmap is planned for an updated release (i.e., new content, 

significant updates) 3·4 times per year, with any additional "maintenance" releases as 

needed (i.e., in the case of minor but important changes to the IRS business or 

technology direction, or identification of errors needing correction). Changes to the 

Technology Roadmap are periodically (usually annually) reviewed by executives of 

IT/Enterprise Services (ES) and major changes are reviewed by CIO. The Digital 

Subcommittee reviews and monitors progress to the Digital Strategies and resultant 

changes are maintained and updated with concurrence from the Digital Subcommittee. 

c. Please describe the process for proposing changes needed to one or both of these 

documents and the process for approving such changes. 

The Enterprise Architecture (EA) office within IRS IT is responsible for developing and 

maintaining the IRS Technology Roadmap. The EA team continuously assesses the IRS 

business and technology landscape and plans (e.g., strategic planning documentation, 

program/project plans, and investment information) as inputs and proactively identifies 

and validates needed changes. In addition, the roadmap is available online for all IRS 

employees with access to the Intranet, and anyone may contact the EA team with 

proposed changes, which the EA team evaluates, prioritizes and incorporates as 

appropriate. Finally, the Technology Roadmap is regularly socialized through briefings, 

and these sessions provide a forum for stakeholders to provide feedback. For the Digital 

Strategic Initiatives, the Digital Subcommittee periodically reviews the business and IT 

landscape (e.g., strategy and operational plans, the Technology Road map, architecture 

plans, investment proposals) and identifies any required changes to the Digital Strategic 

Initiatives (e.g., capabilities, funding posture, timelines), which is maintained by the 

office of Online Services (OLS) and IT Enterprise Services (IT/ES). The Digital Strategic 

Initiatives are frequently socialized with key IRS stakeholders, and feedback obtained is 

reviewed and approved by the subcommittee. Changes are then evaluated by the IRS 

EA team and reflected within the IRS Technology Roadmap. 

d. Please provide a list of the individuals who must approve changes made to these 

documents. 

The development of the Technology Road map is led by the EA office within the IT 

division, and the EA Director approves each new release/update. In addition, for major 

changes and releases changes, it is reviewed and approved by the Associate CIO for 

Enterprise Services and the CIO. The Digital Strategic Initiatives are approved by the 

Digital Subcommittee of the Services and Enforcement Executive Steering Committee 

{ESC). 

e. How does the IRS measure the usefulness of these documents? 
64 


Insert 33655A.043

The IRS continuously assesses the usefulness of the Technology Road map qualitatively 

through conversation and collaboration with stakeholders across the enterprise. The IRS 

EA office team define.s us.efulness for the Technology Road map on several dimension.s: 

(1) quality and ac<:urac:y of i nformation in reflecting a long-range vision and plans for IRS 

IT, in alignment with the enterprise business direction; (2) ability for readers to 

understand and apply the information; (3} support for evaluation of IT investments and 

priority setting; and (4} informing program/project solution architectures {i.e., providing 

a broader framework of technology direction Into which those solutions must fit). 

Through a continuous socialization process and feedback loop, IRS EA has consistently 

evolved the Technology Roadmap with new views and content, refinements, and 

improvement.s to usability. The us.efulness of the Technology Roadmap and the Digital 

Strategies. is measured by actual prosram delivero1bles, e.g. WebApps, IRS.s;ov, third 

party services, and other programs that are delivering capabilities Into production. In 

addition, the Technology Roadmap helps stakeholders understand how IT investment 

priorities impact delivery of the future state capabilities. 

2. In Fi.sul Year (FY} 2016, the IRS spent $800 million on modernization efforts.. Please explain 

how this money was spent and what additional functionality or progress was achieved in FY 

2016 using these funds. 

In FY 2016, the IRS spent $789 million on development, modernization and enhancements {OME) 

across the IT enterprise. Significant development addressed major areas such as support to 

taxpayers, compliance and enforcement, identity theft/ refund fraud/ cyber and other security, 

legislative mandates and operational upgrades. The following are key new functionalities and/or 

progress for each area. 

Support to Taxpayers: 

• launched website to support the voluntary registration of Certified Professional Employer 

Organizations {CPEO) and 501(c)(4} organizations, mandated by Congress in the Tax Increase 

Prevention Act of 2014. 

• Deployed a new telephone delivery system in 4 of 33 planned taxpayer contact center call 

sites that is enabling better service to taxpayers. This replacement of legacy automated call 

distributors us.ed to route taxpayers on the call center platform improves security and 

stability, increasing customer satisfaction with new Qll center agent functionality. 

• Deployed penalty and interest adjusted refundable credit capabilities that correct 8 million 

tax modules wHh inaccurate failure to pay penalty computations for adjusted refundable 

credits. 

• Improved accuracy of financial reports by induding pendine payment transactions in the 

unpaid assessment balance. 

• Implemented financlaVutlllty verification and tw<>-factor authentication for the web 

applications Get Transcript and IPPIN {Identity Protection PIN). 
65 


Insert 33655A.044

Compliance and Enforcement: 

• Deployed the lntern;Jtional Compliance MClnagement Model {ICMM) Cryptogrilphy updelte, 

Increasing the security of all incoming and outgoing Foreign Account Tax Compliance Act 

datil. 

• Deployed multiple Financial Institution Resistration maintenance releas-es improving the 

user experience for all Foreign Financial Institution users as well as Host Country Tax 

Authorities. 

• Developed the Withholding and Refund project, which establishes streamlined methods to 

conduct compliance activities; compares forms filed by the withholding agent with forms 

filed by the recipient and deposit informeltion from the withholding agent; and uses that 

information to allow or deny the credits claimed by taxpayers. 

Identity Theft/ Refund Froud/CVber and Other Security: 

• Sponsored the first Bureau-led Cyberse-curity Community of Practice forum to enhance 

information sharing of Cybersec:urity best practices. The interest garnered from this 

meeting has led to two additional forums sponsored subs-equently by the Mint and the 

Alrohol and Tobacco Tax and Trade Bureau {TIB}. 

• Implemented network protection capability that bloded transmission of over 16,000 un· 

encrypted emails from leaving the IRS network, preventing the possible disdosure of 

sensitive data such as social security numbers and passwords. 

• Implemented two cybersecurity threat countermeasures to prevent malware being 

Installed on .gov networ1<s and facilitate mellicious email filtering. IT detected and 

mitigated phishing and matware sites, and conducted a phishing pilot to train employee:s to 

properly identify and react to this threat. 

• Implemented softwelre capability and pr<Xess to track contractor security training 

completlon/Umeliness relative to eligibility for IRS system access. Wi th this capability, IRS 

can quickly disable the Clccount of any contractor who fails to complete minimum security 

awareness training. 

• Deployed Unified Network Access Phase One to five Initial Operating Capability (IOC} sites, 

allowing IRS to view network connections and ensuring only authorize:d users and devices 

can connect to the IRS network. 

• Expanded the Inte-grated Enterprise Portal (IEP) environment security protections and tools 

that significantly Improved the detection and temediation of attempted extemal attacks 

aimed at IRS.gov via automated scripts, bots, and suspicious and malicious Internet 

Pfotocol addfess.es. The layefed s.eeurity tools protect taxpayef facing applications at the 

earliest entry point of the IRS infra.structure, which is the edge security and portal 

environment. 
66 


Insert 33655A.045

Implemented advanced analytics and fraud detection capabilities within the IRS IEP and 

eAuthentication environments to better protect access to the Get ~nscr pt application. 

• Enhanced monitoring ~nd ~n~ yt c capabilities through investments, in infrastl'\.lcture, tools, 

and development expertise to accelerate continuous data monitoting. 

LegislatiVe Mandates: 

Developed the Affordable Care Act Information Returns (AIR) sys em~ which processed over 

200 million Forms 1095-B and over 100 million Forms 1095-C between January 20, 2016, 

and September 3, 2016. These forms provide information to the IRS from health care 

coverage providers on individuals with minimum essential coverage (as defined by law), 

and allow the IRS to determine whether employers are offering health insurance coverage 

to their full-time employees, and. if so, information about the coverage offered. 

Implemented the modification to the Health Coverage Tax Cr edit (HCTC). Previously, those 

eligible for the HCTC could d aim the uedit based on premiums they paid for certain health 

insurance covera.ge through 2013. This change allowed d aims for coverage through 2019. 

Implemented the Achieving a Setter life Experience {ABLE) Act, which was included in the 

Tax Increase Prevention Act of 2014 (Public Law 113-295) and included two components 

impacting the IRS. The first component enacted new Section 529A of the Internal Revenue 

Code of 1986 to create tax·free savings accounts for individuals with disabilities to cover 

qualified disability expenses such as education, housing and transportation. The second 

component established a Certified Professional Employer Organization {CPEO} certification 

progr-am that provides authority for CPEOs to collect and remit federal employment taxes 

under a CPEO Employer Identification Number for wages paid to individuals covered by a 

s.ervice contract. 

Implemented capabilities related to the Foreign Account Tax Compliance Act (FATCA) to 

improve tax compliance for U.S. taxpayers holding finand al accounts at f oreign Financial 

Institutions {FFis) and to promote and fac.ilitate international tax information sharing. FATCA 

requires certain His with U.S. accounts to register with the IRS, report U.S. accounts 

annually to the IRS, and withhold 30 percent of selected U.S. source payments made to 

recalcitrant account holders and nonparticipating FFis. Ffls that do not comply with their 

obligations are subject to 30 percent withholding on certain U.S. source payments. The 

fATCAprogram updated existing and prior year FATCA forms (paper and electronic). These 

form changes include M odernized E·File {MeF) updates to Form 1042·S data Including 

updates to Business Objects reporting, Withholding and Refund Credit Freeze changes for 

Forms 1040NR and 1120·F filings, and processing and storage of existing and prior year 

fATCA forms in the International Compliance Management Model (ICMM} system. 

Additional capabilities included the reciprocal exchange with certain jurisdictions of 

information on payments to accounts at U.S. financial institutions held by residents of such 

jurisdictions. 

Operationa,l Upgrades: 
67 


Insert 33655A.046

• ReduC4!d oper-ations and support costs for over 10,000 servers with successful 

implementation of new Server Administration strategy, with increased number of servers 

managed by a single Systems Administrator to 258-a 342% increase over 201S. 

• Upgraded the IBM Enterprise Server and achieved new efficiencies in data encryption 

resultjng in enhanced security of taxpayer data and improved processing performance. 

• Began the multi~year effort related to eRecol'ds Management (Microsoft Strategic 

ni iat ves~Enterpri e Exchange/SharePoint upgrade), to provide an enterpris-e sotution that 

will upgrade the Information technology lnfl'astructure with foundational electl'onlc 

records management capabilities which will store, preserve, and retire email records, and 

which will allow the IRS to meet fedel'al recol'ds management mandates. 

a. The IRS lnfol'mation technology (IT} Development, Modemization, and Enhancement 

budget is expected to decline fl'om 30 percent of total IT spending in FY 2016 to 14 

percent in FY 20 18~ while the total fT budget is expected to l'emain relatively stable. 

What led to this change and why has model'nlzatlon funding declined so significantly? 

There al'e sevel'al drivers that are causing the decrease in funding spent on OME. Fil'st, over 

the past several veal's the IRS had to implement costly legislative mandates such as the ACA. 

FATCA and the ABLE Act. This l'equired development of new systems capabilities, which 

once deployed move into production and requil'e ongoing operations and maintenante 

(O&M} costs. Second, as we developed and deployed capabilities that support taxpayel' 

services and enforcement programs such as Web Applications and Return Review P-rogram, 

these new capabilities also require O&M funds to sustain. Third, the impact of diverting 

funds to implement these and othel' legislative mandates, and the associated O&M cost to 

support them and the modernization projects. increase our aged infrastructure to 

unacceptable levels. The IRS has focused its resources on addressing that aged 

infrastl'ucture. 

b. What efforts has the IRS made to reduce the percentage of funding spent on operations 

and maintenance, which is set to be over 80 percent of the IT budget in the coming 

year? 

The IRS is constantly explol'ing options for !'educing the operations and maintenance (O&M) 

costs as new technological solutions emel'ge that could l'eplace more costly legacy methods. 

In addition, the IRS ev~ ates work processes for efficiencie-s, including redundancies of 

capabilities In systems that could be eliminated. Some IRS S-uccesses In !'educing O&M costs 

are as follows: 

• Implemented Convergence Unified Communications, which combines multiple 

serviU's - such as voice, video and data - through a single provider to deliver 

greatel' functionality and capabilities and annual savings of $25·$30 million. 

Integrated Enterprise Portal {IEP). IRS has been able to maintain 1~"' availability 

for its IRS.gov offel'ing while l'educ:ing its annual Infrastructure Operations and 

Maintenance cost on its IEP by appl'oximately SlM in FY 2015, $2M in FY 2016 and 

$1M 1n fY 2017 t.hrough innovation and contl'act negotiation. Support ror this time 

period was- covel'ed by two different contl'acts. 
68 


Insert 33655A.047

• Implemented an Enterprise Storage Service rather than the legacy method of 

procuring/owning the storage solutions. This saved the IRS $34 million from 2013 

through 2016. 

• Improved systems administration from 2015- 2017, increasing the number of 

servers that are administered by a single administrator from 50:1 to 376:1. The 

resulting ~ffici~nd~s allow~d syst~m administration r~sourtes to b~ r~assign~d to 

provide targeted support to other operations work rather than hiring new staff. 

In addition, thr~e significant efforts underway that will reduce O&M costs over time include: 

1. Migration to cloud technologies, which can simplify business operations by centralizing 

services while minimizing operational costs by enabling convenient, on-demand 

network access to a shared pool of confieurab1e computin;g resources (e.g., networks. 

servers, storage, applications, and services). Migration to cloud technologies will also 

facilitate a reduction to our aged asset inventory and out-of-date software. 

2. Development and Implementation of an Enterprise case Management (ECM} solution, 

which would consolidate multiple case management systems. Once the ECM solution is 

developed and fully implemented, it will provide an enterprise platform with common 

infrastructure and common IRS business functions and services. We expect cost 

reduction over time, as well as improved ease of interactions for taxpayers with the IRS 

with simplified and improved digital communications. 

3. The IRS is exploring the Implementation of bot technologies, which are designed to 

automate the kinds of tasks normalty performed by a human. Typically, bots perfor-m 

tasks that are both simple and structurally repetitive1 at a mucll higher rate than would 

be possible for a human alone. When implem~nted, this would allow us to use our labor 

more efficiently. 

c. Does the IRS expect this trend to continue in future years? 

This trend is expected to continue in the near term while IRS seeks to reduce the backlog of 

obsolete hardware, reprogram dozens of processing systems to account for tax reform, and 

continue the transition away from legacy platforms. Completing the transition to modern 

systems will eventually yield long-term O&M savings and efficiencies by allowing IRS to 

retire inefficient, manual platforms and processes. The timing of these ~vlngs and the 

future distribution of funding between O&M and OME will be determined by a number of 

factors Including new tax legislation, taxpayer demand for online services, trends in 

cybersecurity, and other constraints. Even so, we are making progress. We use the 

technology roadmap to guide all solution design work,lndudlng implementation of 

le-gislative mandates. As a result, we are advancing toward the vision we set for how IT will 

operate In the future, both directl"y and Indirectly. 

3. The Government Accountability Office (GAO) has reported that the IRS docs not have a process 

for prioritizing its modernization activitie.s, which it spent $800 million on in FY 2016. 

•· Without a process. how does the IRS decide which modernization projects to dedicC~te 

resources to? 

To darify, GAO report 16·545, IRS Needs to Improve Its Processes for Prioritizing ond 
69 


Insert 33655A.048

Reporting Performance of Investments, state-s the following: 

While IRS has developed a structured process for allocating funding to its 

operations activities cons;srent w;th best proctices, it has not fully documented 

this process.. IRS officials st-at~d this is becaus~ th~ roc~tss is r~tlatively new and 

not yet stabilized. In addition, IRS does not have a structured process for its 

modernization activities, because. according to officials, there are fewer 

competing activities than for operations activities.. 

Since the GAO report was issued, the IRS has documented the process for the Operations 

Support appropriation, and provided atopy to GAO (see attached). The process is the IRS's 

IT annual Portfolio Investment Plan (PIP) process. Through the PIP process, IT categorizes 

and ri ri z~s all IT demand related to the Operations Support approptiation into eight 

repeatable groups and within each group further das.sifies the requirement by 

operations/maintenance (O&M} or development /modernization /enhancement (DME), 

plus the filing season relationship or other internal priority designations. With limited 

resources and IT demand far exceeding available funding, this level of transparency 

facilitates leadership decision-making about where to apply funding based on priorities. 

Approximately 60% of our OME spend is covered as part of this process. To address the 

se-cond part of the GAO r~tcommendation, th~t IRS is in the process of documenting the 

prioritization process of the remoining modernizodon ocriv;ties that are funded from the 

8uS-iness Systems Modert'lization appropriation. The IRS does have a process to ensute 

res.ources are aligned to the highest priorities including modernization. However, as stated 

above, at the time of the GAO report that process had not been documented. In a 

memorandum dated November 2, 2017, the IRS Commissioner established the 

foundational enterpr s~ requirements that ar~ the Ser'V1ce's highest pdorities. These 

priorities are critical staffing (i.e. building redundancy in key areas, ensuring attrition does 

not put critical operating systems at risk, and dosing skills gaps)1 Cyber and data security, 

refreshing aged technology infrastructure, and modernization/Reform Plan projects such as 

Web Applications. Return Review Proaram, Enterprise case Management, etc. The IT 

priorities are aligned with IRS and Tr~asuty ptiorities. 

b. Who ultimately makes these dedsion.s? 

As stated in response to question 3a, the IRS Commi$.$ioner, with input from the IRS Senior 

hecutive Team (SET), establishes the overall priorities for the IRS. The IRS's Chief 

Information Officer is responsible for approvi ng the IT resource allocation, induding 

modernization projects, to ensure they support the IRS corporate priorities and vision. 

c. What is the role of the IRS Chief Information Offieer (CIO) In this process? 

The CIO is a member of the IRS SET and plays a role in determinin& the priorities for the 

organization. See response 3b above. The CIO has added responsibility for appro\ling IT 

resource alloation, including modernization projects, to ensure they support the IRS 

corporate priorities and vision. 

d. The IRS told GAO there is no documented formal process because there are less 
70 


Insert 33655A.049

competing interests so it is not necessary. However, the IRS has also argued that it 

does 110t have enough fundif1C for its modernization efforts. Given the limite-d 

resources, why has the IRS 110t had an institutionalited process to ensure funds go to 

the agency's priorities? 

IT has a process for prioritizing all IT demand and, in fact, the IRS SET prioritizes all major 

investments. As stated in the response to question 3a, the IRS documented the process for 

the Operations Support activities and is in the process of documenting the process for 

prioritizing the activities in the Business Systems Modernization appropriation. These 

processes, in conjunction with the IRS Commissioner's corporate pfiorities, provide a 

comprehensive framework that brings a long-term, repeatable, and rigorous proces.s to all 

facets of IRS strategic planning-including project planning, programming, budgeting, and 

performance management. 

e. If adequately funded, does the IRS have an estimate for how long it would take and at 

what cost to modernize all IRS IT systems? 

As one of the largest financial Institutions in the world, IRS supports hundreds of millions of 

taxpayers, requiring a large and in"redibly complex IT ecosystem consisting of 

approximently 400 applications and over 200,000 hardwar~ assets. Ass!g11ing a time 

estimate and costs to modern ~e all IRS IT systems is. not feasible given the enormity of the 

IRS IT environment. However, IRS does have plans to modernize major compo11ents of the IT 

ecosystem as part of our Technology and Digit-al Roadmap. 

In addition, an IRS IT infrastructure currency effort prioritizes the modemizat.ion of our 

operational hardware and software components. IRS is currently developing plans to 

address our aged infrastructure and is looking to cloud-based approaches. 

f. Since GAO's report was released last year, what steps has the IRS taken to institute a 

process for its modernization efforts? 

See response to question 3a. 

g. The Treasui'Y Inspector Ge11eral for Ta)( Administration {TIGTA) testified the IRS 11eeds 

to Improve its. project planning prior to starting development activities. What actions 

has the IRS taken to address these concerns? 

The IRS has a long-standing history of applying system lifecycle methodologies to application 

d~velopm~nt projects. Wear~ applying hes~ practices more holistically across a broader 

spec.trum of IT projects. While we have more work to do in this regard, including 

docum~ntation of certain processes, we believe we are on a good track. 

As an example, since adopting new methodologies like Iterative and Agile, the IRS is able to 

augment traditional methodologies such as waterfall. The waterfall methodology was 

traditionally used for large scale modemi.tation eHorts lasting several years, with 

requirements gathering, des.ign, development, test, and knowledge of all capabilities locked 

down up front for the entire lifecyde of the project. By planni ng with Agile and iterative 

technique, our collaborative effort with the business and IT delivery partners allows us to 
71 


Insert 33655A.050

define high level capabilities and prioritize their value and impact. We then can develop and 

deliver them incrementally so the customer can start realizing business results muCih sooner 

t han a waterfall, 'big bang' approach to delivery. Once initial capabilities ue delivered, the 

business then better understands the needs and priorities, and this new insight is factored 

Into the next set of capabilities to be developed. As we experimented and transitioned to 

the new agile development approach, more clarity and better sequeOGing of planning 

activities have evolved. 

Even so, the IRS conducts planning aetlvities prior to solution design and development, 

induding conducting market re.search, e~lter at ves analysis, information sessions with 

Industry and other agencies, to learn about new technologies and experiences In applying 

them, as well as performing prototypes and pilots, as appropriate. AsiR.S in.serts new 

technology we align it to the overall mission and strategy of the IRS and perform readiness 

e~ctivitie.s for the 011aniz.ation. IRS also has a rigorous governance process that serves as a 

decision-making entity and Includes all stakeholder groups to ensure cost, schedule, scope 

and priorities are clearly established and monitored throughout the lifecyde of an IT project. 

4. Customer Account Data Engine 2 

a. What year did the IRS determine the Individual Master File (IMF) would need to be 

replaced? 

In 1999, IRS made the decision to fows on replacing As.sembler language Code (ALC) 

systems, beginning with the Individual Master Fil~ (IMF'), and subsequ~ntlv the Customel' 

Account Data Engine {CADE) Program wa.slaunched in 2000. 

b. In what year did !he iRS begin developing a strategy for CADE 2? 

In 2008, th~ IRS creat~d a cOte team to explore al\ approach to modernize the IMF and 

address issues in the ongoing CADE approach. Building upon the work already done in 

CAOE, a new apptoach was developed to accelerate development of a centralized tax_payer 

account database (the '

1

CAOE 2 Database'"), with a plan to complete implementation in 

three transition states: 

• Transition State 1 (TSl- COMPLETED): Build out and stabilize a complete CAOE 2 

databas-e, start using the CADE 2 database fot on·line ae.cess and data exttacts to 

other IRS systems, and shift from weekly processing to daily processing to improve 

taxpayer service. 

• Transition State 21TS2 - 3 OF 6 RELEASES DELIVERED)- The most complex 

Transition State which encompasses the goal of modernizing the core IMF 

components-where majority of the tax law is embedded-from ALC to Java. 

Originally, this tnJnsition state was also expected to make CADE 2 the Authoritative 

Oata Sourte {ADS) for financial and legal purposes and address the Financial 

Material Weakness (FMW) for individual taxpayer accounts. However. due to 

resource constraints and competing priorities, all outstanding projects assotiated 

with these two goals have been paused and will be deferred to a later transition 

state. 
72 


Insert 33655A.051

• Tran.sitlon State 3 (T$3): Following modernization of the core IMF components in 

TS2, TS3 will modernize the remaining IMF components including IMF 

preproce5sing (validation and acceptance of tax transactions} and post-processing 

applications (distribution of taxpayer information to other IRS and external 

systems}. Retire the IMF sequential files. 

c. What was the initial cost estimate for the project? 

The initial planned cost in January 2010 for the development of CAD£ 2 TSl and TS2 was 

$435 million. Costs associated with TS3 were not estimated at that point in time. Given the 

size and magnitude of the TS1 and TS2 effort, there was insufficient information to 

determine the scale of impacts to interfaces and downstream s·ystem that would need to be 

addressed in TS3, as well as internaiiMF complexities. 

d. What Is the total cost, to date, of CADE 2? 

As of October 31, 201?, the total cost of CAOE 2 is $1.2 billion- $1.16 billion from Business 

Systems Modernization (BSM) activities and $40 million from Operations and Maintenance 

activitie-s. These funds support a multitude of activities ne-eded to drive the- program 

forward induding: program planning and management, projea management, architecture 

and engineering, prototype development, vendor comparisons for conversion tools, 

requirements development, harvesting of businesslogk-from the existing code base, testing 

{performance, user, security, data generation), detailed design development, coding, 

infrastructure procurement, cyber security planning and scans, technical integration, 

organizational readiness and change management, and more. 

e. What is the annual cost of runnins and maintaining the IMF? 

The IRS spends approximately $15 million per year in direct costs to maintain the IMF. 

There are additional indirect costs sudl as training and system/database administration 

expenditures that are not included in this direct cost estimate. 

It is important to understand that cost is J12! the primary driver for modernizing the IMf. 

The primary driver is to ensure access to and protection of the data as an enabler to real· 

time transaction processing in support of moderniling the taxpayer experience. 

f. When was the initially planned completion date for CADE 2? 

When the IRS initiated TS2. the most complex of the Transition States, the final release w-as 

planned for deployment in the 2020 filing season. This timeline was considered a stretch 

goal at the time with several key assumptions, induding a) availability of fundln,g to acquire 

contract support for specialized skill sets and b) hiring of additional IRS FTEs to backfill 

attrition in key positions (especially technical leadership), These assumptions were never 

realized due to budget cuts and as.sodated hiring freeze-s over several years.. 

TS3 will modernize the remaining IMF components including preprocessing (validation and 

acceptance of transactions) and post settlement applications that are still written in AlC. It 
73 


Insert 33655A.052

will focus on integration-tying the data to the application and maldng it available to 

downstream systems for operational use- as the IRS works to retire the IMF sequential file 

and begin to update the database directly. A final timeline has not been estimated for this 

phase. 

g. What is the planned completion date of CADE 2? 

T$1 was completed in 2012. T$1.5 was completed in 2014, and TS2 is currently underway. As 

of FY 2017, TS2 was targeting completion in 2024. However, due to anticipated funding 

reductions, competing priorities, and starting/hiring constraints:, some scope 

elements/releases originally planned for TS2 have been deferred to future trcmsition states. 

All available resources are now directed to TS2's most critical goal, reenglneerlng the IMf 

core components, the most complex and risky portion of the system, where the majority of 

the ta.x law is embedded. The CADE 2 Release plan was updated and approved in January 

2018 to reflect TS2's reduced S<:ope with a new TS2 target completion in 2021·2022. There 

Is not yet a target completion date for T$3. At this time, it Is estimated that several years of 

work will remain to address TS3 goals and fully complete CAOE 2. TS3 goals indude replace 

all legacy reporting, add functionality to address the FMW for individual taxpayer a«<unts, 

make CADE 2 the AOS, and modernize feeds to downstream SY$tems. These assumptions 

may change based on fY 2018 enacted appropriations. 

h. When will theiMF be taken offline? 

A5 noted above, current plans call for the IMf to be taken offline at the completion of TS3 of 

CAOE 2 {see answer to question 4d above). With the deferment of scope from TS2 to TS3 

resources and funding levols must be stabilized and assessed to determine impacts to the 

current strategy of three Transition States. Until this is completed, it will be difficult to 

predict when all components that support the IMF can be retired. 

What functionality has been achieved through CAD£ 2 thus far? 

• Accelerated from weekty to daily tax processing, resulting in faster refunds, notices, and 

availability of more current taxpayer Infor mation across the IRS to serve taxpayers more 

effectively. In addition: 

o Tax payments, returns, and other transactions are uploaded and updated on 

taxpayer accounts faster. 

o The time required to complete a merge of ta.xpayer Information has been 

shortened, which helps to resolve issues such as identity theft more quickly. 

o IRS taxpayer asslstors can view taxpayer account information within two days of 

the planned posting of new taxpayer information (previously, the timeframe 

was two weeks}. 

• launched the CADE 2 Database, successfully migrating all Individual taxpayer account 

information (approximately 290 million accounts and over a billion tax modules) from 

legacy sequential flat files to a modem relational database, establishing the IRS' data· 

centric foundation for the future. 

• M 1.grated <...orporate F11es on-Lme ((..,1--0L), the IK)' taxpayer acc:ount Vlewmg system. 

from the IMF to the CAOE 2 database. 
74 


Insert 33655A.053

o Result was taxpayers and IRS as.sistors use CAOE 2 data when viewing tax data 

online, a critical step in replacing IMF. 

• Established CAOE 2 Operational Data Store {ODS) within the IRS' enterprise data 

warehouse, making up-to-date individual taxpayer data available to the Business and 

CFO for reporting and analysis. 

• Established self-service reporti ng and analysis capability using the CAOE 2 ODS as the 

data source, enabling the IRS Business and CFO to perform ad hoc queries and generate 

reports using up-to--date individual taxpayer data. 

• Improved currency of the data within the enterprise data warehouse by refreshing daity 

{previously was monthly}. 

• Deployed database year-end convetsion capability that allows IRS to retain expanded 

taxpayer history from the previous tax season for the first time ever, improv;ng taxpayer 

service and enhancing IRS compliance enforcement. 

• Took significant steps toward addressing the Financial Material Weakness for Individual 

Taxpayer accounting: 

o Implemented common Penalty & Interest {P&I) code across IMF, Business 

Master file (BMF) and lntesrated Data Retrieval System (I DRS) resulting in 

consistent and accurate P&l calculations on taxpayer accounts and financial 

statements. No projectable P&l errors were identified for fiscal year 2016 durins 

the Government Accountability Office's annual audit. 

o Implemented functionality to include Pendins Payment Transactions in the 

unpaid assessment balance, improving IRS financial statement and r eporti"g 

accuracy. 

• Modernized one of the IMF' s most complex set of financial reports (Financial Recap 

Reports) that Is used to feed the IRS General ledger and deployed to Production In 

parallel validation mode (provides the opportunity for the Business to confirm the 

accuracy of the CADE 2 financial reports by comparing results to the IMF). 

• Developed and tested a code conversion tool that moved IMF business rules from ALC 

into Intermediate Java code, allowing the use of modern Java tools to perform analysis 

as we modernize. We have launched the effort to re~write the core IMF components in 

Java, using the inter mediate Java code to identify IMF code related to the most critical 

business fundions and to priorit ~e early development of those functions. This 

intermediate code has also solved some critical design problems related to ALC coding 

constructs that were developed in the 1960's when efficiently using limited C.PU and 

storage capacity was more Important than ease of maintenance. 

• Implemented an Innovative legacy code analysis, documentation and knowfedge 

transfer methodology, enabling us to eJ<pand the number within our IT community who 

have knowledge of the most critical piece of individual taxpayer proce~ ng. 

j. What functionality has yet to be <ompleted? 

• Continue ongoi ns efforts to modernize core IMF components- where most of the tax 

law is embedded- from legacy AlC to Java platform, perform extensive parallel 

validation, and retire the core IMF components. 

• Modify the moderni zed Java components to update the database directly and retire the 

IMF sequential files. 
75 


Insert 33655A.054

• M~ke the CAOE 2 datiibase the Authoritative Data Store (ADS) for financial statements 

and reports (and the annual GAO financial statement audit). 

• Address the Unpaid Assessment Financial Material Weakness {FMW) for Individual 

t~xpayer accounts. 

• Modernize the ront~end of the system that accepts and v~lidates transactions from 

upstream systems, as well as the back-end of the system that generates notice-s and 

other operational, customer service and compliance information to downstr eam IRS 

systems. 

k. Is the IRS still committed to replacing IMF via CAOE 2, and if so, why Is the planned FY 

2018 spending for CADE 2 signific.antly lower than prior years? 

Replacing the IMF with CAOE 2 remains one of the IRS' highest priority projects. CAOE 2 has 

been re·planned to prioritize modernizing the IMF core components· where of most of the 

tax law is embedded· from legacy ALC to Java (see additional details in (I) below}, 

CADE 2 is considered one of the IRS' moSt significant modernization efforts and yet it i.s 

currently under a strategic pause while Its release plan is being revised. 

The CAOE 2 Ptogram is not under a strategic pause but specific CAOE 2 TS2 projects are 

currently paused to prioritize modernizing the IMF core components· where of most of the 

tax law Is embedded· from legacy ALC to lava. 

What is the curr(!nt status of CAOE 2? 

All CAOE 2 resources are now directed to the one, most critical CAOE 2 project: 

modernizing the core IMF components from eg~cy ALC to lava. All remaining CAOE 

2 TS2 ADS and FMW projects h~ve been p~used to ~!low resources to focus on 

modernizing the core components of the IMF. The CAOE 2 TS2 Release Plan (vS.O) 

wa$ updated and ~pproved in anu~ry 2018 to reflect these changes. 

ii. What date did the strategic pause begin? 

The p~us ng of specific CAOE 2 TS2 projects w~s conducted in waves. The first wave, 

executed in January 2017, addressed resource constraints, specifically IMF subject 

matter ex peru that could not support the conversion of IMF core components, 

FMW, and AOS projects in parallel. This resulted in pausing of FMW·related projects. 

The second wave occurred in June 2017, resulting in pausing a subset of ADS·related 

projects., the third wave occurred in September, October, and November 2017 

resulti ng in the pause of the remaining ADS· related projects. {See attached Release 

Plan v4.2 for a list of projects, description, and dates related to deployment, pau.se, 

and anticipated start date.} 

iii. When fs the strategic pause scheduled to end? 

As noted above, the CAOE 2 program is not under a strategic pause but has paused 

certain TS2 projects and directed all budgeted resource·s to its most critical project: 

modernizing the core IMF components from legacy ALC to Java. The IRS will re· 

evaluate this approach throughout the year 
76 


Insert 33655A.055

iv. Why is the release plan being revised? 

The release plan was updated in January 2018 to defer scope from Releases 4, S, 

and 6 in TS2 to a future transition state to reflect the Program's fOGu.s on 

modernizing IMF core c:omponents from ALC to Java. and the J)ltUsing of ADS and 

FMW projects. NOTE: Deferring ADS and FMW·related projects from TS2 to TS3 will 

push the overall timeline to complete CAOE 2 and retire IMF. 

When will the revised release plan be completed? 

The CAOE 2 TS 2 Release Plan (vS.O) was updated and approved by the Executive 

Steering Committee (ESC) on January 26, 2018. 

vi. Please describe any anticipated changes to the CAOE 2 release plan. 

As described above, the release plan was updated to reflect the Program's focus on 

moderni:ing IMF core components from ALC to Java and the pausing of AOS and 

FMW projects. The pause of these projects will push the overall timeline to 

complete CAOE 2 and retire IMF. 

m. The IRS CIO testified that CADE 2 could be completed in five years if the IRS receives an 

additional $85 million per year and an additional SO to 60 full·time equivalents. Please 

describe how the IRS determined this estimate. 

The five•year timeline referenced by the IRS CIO was specific: to completing the 

modernization of the core IMF components (where majority of the tax law is embedded) 

from ALC tolav.a, not to the completion of the full scope of CAOE 2. CAOE 2 can deliver the 

modernized IMF core components to production, followed by one year of parallel validation, 

resulting in retiring the legacy runs. 

n. Is there a strategy to address IT workforce gaps~ espedaUy as it relates to the IMF? If $01 

please describe. 

IT workforce gaps pose a very real risk to maintainability of the IMF system moving forward, 

as the number of developers who know and understand the technology and tax law 

business rules are deeteaslng at an alarming rate. Many of the existing developers are 

eli,gible for retirement~ the team is already understaffed, and there are not sufficient 

candidates available to backfill behind them because the technology is outdated and skills 

do not exist in the marketplace. Each year, it becomes increasingly challenging to implement 

new tax law changes and production fixes due to t he decrease in knowledge of how the 

system works. 

To mitigate these workforce risks in the short term the IMF Stabilization Plan was developed 

in 2016. The Plan describes detailed mitigation actMties that are planned and/or taking 

place for specific resource and skillset gaps. This plan is revisited and refined monthly. The 

next revision will further define our strategy to maintain core IMF components, while 

preparing to transition existing staff to the modernized components once completed. Hiring 
77 


Insert 33655A.056

staff is dependent upon the necessary funding and approvals to hire in order to close the 

gaps. 

s. Enterprise Case Management (ECM) Program. The ECM Program is reported to have paused all 

development activities. While the Committee understands the need to consolidate the number of 

ECM systems that the IRS maintains, please provide acqujsition timeline(s) for the one or more 

ECM systems that the IRS anticipates acquiring and a list of the business units or divisions that 

eaeh ECM system will be used for. 

The IRS Is currently developing a request for quotations (RFQ) for issuance in mid calendar year 2018 

that will allow the IRS to c:hoos.e two vendors to execute challenge~bas.ed scenarios (known in the 

Industry as a First Article Te-st}. The First Artide Test will provide limited funding to two vendors to 

install their product in the IRS IT environment and have the IRS test key functionality. Based on the 

First Article Test, the IRS will then select one or more products to license to resume development of 

an enterprise·wide case management system in early 2019. Implementation order will be more 

along similar lines of business {such as Exam or ColtectioM) rather than business unit/division. 

All activities beyond the RFQ stage are subject to the availability of staff and funding. 

a. The ECM stopped development due to "technical limitations• of the commercial off·the* 

shelf product according to TIGTA's testimony. Please describe these technical limitations 

in detail. 

In November 2016, the IRS sent MkroPact, vendor of the entellitrak commercial off the 

shelf (COTS) product, a list of 37 operational problems related to using entellitrak to develop 

the ECM system and requested that MicroPact address the problems. The 37 problems 

were categorbed into five levels of cr1ticality: 

1. Major (seven problems} · Direct impact on the ability to perform development 

and/or incorporate enteiUtrak into ECM Continuous Integration/Continuous Delivery 

processes that support multiple development teams, automated testing and 

automated software deployment. 

2. High {twenty problems}- Significant impact prohibiting the ability to support large 

software development teams1 integrate to automated tools for software. code 

control and automate software deployment to production. The vendor's 

recommended resolution to these issues required manual work arounds or 

unacceptable mitigation strategies. 

3. Moderate {four problems)· Elevated impact requiring minimal manual mitigation 

strateg.ies to resolve. lhe inability to customize the entellitrak user interface for 

particular users is included in this group. 

4. Nominal (four problems) - Impact requiring assessment of manual vs. automated 

mitigation strategies to ensure ECM development can move forward. Software code 

promotion through a plug-in would be an example. 

S. Minor (two problems) · Minor impacts that can be addressed with a manual 

mitigation strategy. 
78 


Insert 33655A.057

By January 2017, only seven of the 37 problems were closed and the remaining 30were 

open. Additionalty, any commitments for product enhancements to address these issues 

would not be available for validation for more than 24-36 months. 

b. When was this ECM solution procured? 

The ECM Program was launched In early 2015 with a COTS product-MIC'foPact'sentellitrak 

softw~re platform - that was already in V$e in the IRS IT environment. At that time, 

entellltrak Windows platform had been in use at the IRS since 2008, and was used 

successfully to support 14 sep~rate business processes. 

c. When did the IRS become aware of these ted\nicalllmitations and how did the IRS 

become aware of them? 

In September 2014, IRS performed~ technical review for Or an tation~l Hierarchy 

functlonalities for the Taxpayer Advocate Service Integrated System (TASIS) with 

entellitrak. The Technical Issues/Concerns & l essons Leamed Overview for that 

demonstration reported that this Windows·based version of entellitrak: 

• Had not proven it can be scalable to IRS needs 

• Old not have the ability to customize the entellitrak user Interface for a partiC\IIar 

user 

• Oid not have Continuous Integration capability 

• Oid not entirely insulate Its source control 

The IRS continued to use entellitrak because a new version of the software, version 3.23, 

based on the Unux operating system, promised signific-ant improvements over the older, 

WindOW$·based version. Entellitrak also had a proven track record at the IRS, supporting 14 

business systems using the entellitrak/e-Trak platform. It was only with hands-on, large· 

scale development work with proposed ECM "'early deliveries"' in the latter half of 2016 

that the IRS became aw~re of the breadth and depth of the issues with the latest version of 

entellitrak. As a result, the IRS launched a deep dive analysis over the summer of 2016 to 

explore and dowment all issues with entellitrak that could prevent it from being effective, 

as an enterprise-wide ECM platform. This analysis confirmed issues with the software 

platform, including those associated with managing developer's code, automated processes 

for deploying the application, scalability, upgrade path compatibility and user interface. 

In November 2016, the IRS sent Micro Pact... the vendor of the entellitrak COTS product, a 

list of 3? operational problems related to using entellitrak to develop the ECM system and 

requested that MlcroPact address the problems (described in Sa above). Based on 

MicroPact's response and ongoing discussions with the vendor, it was concluded in early 

2017 that the IRS needed to find another solution for enterprise case management. 

leveraging the work that had been completed and the lessons learned from the MlcroPact 

experience, the program defined and launched a product assessment and acquisition 
79 


Insert 33655A.058

strategy to identify and evaluate a suite of products with core capabilities that were 

sealable and best aligned with IRS future state to serve as the foundation for an enterprise 

case management platform. Our learnings were augmented by information exchanges 

with other agencies about their experiences in implementing enterprise case management, 

two requests for information (RFI) from the vendor community and an analysis of 

applicable audit findings and recommendation.s. The accumulation of all this data was the 

basis for the request for quotations (RFQ) under development. 

d. When did theiRS stop development of this ECM? 

Based on the deep dive analysis and input from Micro Pact abovt when they could or could 

not address the issues raised by the IRS, the IRS paused development of ECM in November 

2016. An orderly shutdown of all development activities was conducted, as the ECM 

project'S received Governance Board approval to cease development work. The IRS then 

conducted a retrospective evaluation of the program to date, identifying lessons learned 

and solution components that could be leveraged going forward. The ECM Program also 

developed a Go4 Forward Plan and received approval to move forward with the ECM 

Product Assessment and acquisition strategy (described in question Sg below). 

e. What is the current date for completion? 

The IRS is currently developing a Request for Quotations (RFQ) for issuance in mid-year 

2018 that will allow th~ IRS to choose vendors for challenge·based scenarios (F'irst Article 

Test}. The First Article Test will provide limited funding to two vendors to install their 

product in th~ IRS ll ecosyst~m and allow the IRS hands·on access to technical and 

business capc.bilities. Based on the First Article Test, the IRS will then select one or more 

products to license to resume development/implementation of an enterprise-wide ease 

management system in earty 2019. All activity past the First Article Test stage is subject to 

the availability of staff and funding. Based on our learnings from other aeencies and the 

scale and complexity of the legacy case management systems across the IRS, this will be a 

multi-year program. 

f. Why were these techn•cal limitations not identified ptiot to the procurement of the ECM? 

The entelliuak platform had been used succeS-sfully by the IRS for many years prior to the 

launch of the ECM Program in 2015. There were no major problems with any of the 

applications that were leveraging the product. Only in the "Early Deliveries" development 

work in 2016 did problems begin to emerge that would question the use of entellitrak as 

an IRS..wlde enterprise case management platform. The IRS launched these early deliveries 

precisely to learn about implementing solutions with entetlitrak and discover any issues or 

constraints that might impact the solution architecture. As Issues surfaced1 t he vendor 

assured the IRS that there were feasible workaround stl'ategie-s that had been successfully 

used with other c:lients to address the technical constrc.ints. Only after hands-on 

development and extensive analysis with the MicroPatt did the IRS determine that the1e 

workaround strategies were inadequc.te to support an enterprise solution of the scale 

required for IRS. These issues reached a critical point in 2016 {see response to Sa and Sc 

above} with the detailed d()(:'umentation of 37 operational problems with the use of 
80 


Insert 33655A.059

entellitrak. 

g. What steps has the IRS taken and what safeguards has it put Jn place to ensure this 

situation does not occur again? 

The IRS has defined a strategy and taken a number of actions to ensure that the selection 

of the product(s) for delivering Enterprise Case Management will meet both business and 

technic.il requirements. These reflect the analvsis and lessons learned from the entellitrak 

experience as well as lntetvlews with numerous agencies implementing programs of similar 

scope and sc.ile. In November 2016, tile IRS paused ECM development work and followed 

standard processes to stand down all development work, fowsing on conducting a 

retrospective evaluation of the program to date, identifV]ng lessons learned and solution 

components that could be leveraged going forward. The IRS approved a robust ECM 

Product Assessment approach and acquisition strategvin April2017. This product 

assessment is based on a strategv proven in government and inc:ludes a challenge-based 

acquisiUon process leveraging strong industry engagement along with multi-phased awards 

with challenge-based scenarios to validate sustain ability for IRS operations and business 

functionality. 

In the summer and fall of 2017 the IRS developed and issued two Requests for Information 

(RF"Is) to solicit industry ~rspect ve on Enterprise Case Management solutions. The IT and 

Business ECM Program Management Offices also studied GAO and TIGTA reports on 

relat4!'d projects, identifying lessons learned and b4!'st practio4!'s to apply to ECM. Thev also 

met with invited federal and state agencies to share lessoflS learned from implementing 

solutions of similar complexity and demands on their organization. Nearly all the 

experiences shared by other agencies were multi~year projects with valuable lessons 

learned occurring between 2013 and the present time. These agencies were attempting to 

address technical challenges and execute transformational changes to existing business 

processes of similar scale and complexity at the same time as the IRS. Many of the 

agencies the IRS met with had significant initial challenges with tools and solutions similar 

to those experienced bV the IRS. The IRS believes the apabilities of COTS products and 

cloud tec.hnologv have undergone a significant change in the past few years, so th4!' new 

market research and acquisition strategy is critical to determine the best product{s) that 

meet the IRS' business and technical requirements. 

The IRS invited ten vendors (eight product developers and two solution integrators) to 

demo!'lstrate products and discuss solutions presented In their response to RFI #1, and 

subsequently invited four vendors in for more in-depth, scenario-based demonstrations 

based on responses to RFI 112. 

The IRS is currently developing a Request for Quotations (RFQ} for issuance in eartv 2018 

that will allow the IRS to choose two vendors for challel'lge--based scenarios {First Article 

Test}. The IRS has determined minimum mandatory requirements to spe<:ifically address 

the lessons learned from entellitrak, as well as more than 300 business and technical 

capabilities and requirements. The First Article Test will provide limited funding to selected 

vendors to install their product in the IRS IT ecosystem and allow the IRS hands-on access 
81 


Insert 33655A.060

to technical and business capabilities. Based on the First Artide Test, the IRS will then 

select one or more products to license to resume development of an enterprise-wide case 

management system in early 2019. AJI activity past the First Article Test stage is subjec-t to 

the availability of staff and funding. 

6. In oe.cember of 2010, the u.s. CIO directed agencies to shift to a cloud first policy. 

a. What steps has the IRS taken to move its systems to the cloud? 

The IRS has developed and approved Version 1 of an enterprise4 wide doud strategy. The IRS 

Cloud Strategy will be the foundation for work to achieve tangible cloud results and will be 

updated routinely. The IRS Ooud Strategy addresses a path to: 

• Orive cloud adoption by creating processes to select, manage, and Inventory cloud· 

based services at IRS. 

• Develop appropriate risk frameworks to ensure safe cloud adoption 

• Develop a roadmap to assess and migrate legacy IRS IT capobilities to the cloud. We 

anticipate significant cost savings once migrations are completed. Additionally, IRS 

has begun work within and across its IT units to push forward with clovd adoption. 

These steps, which are in-night as or March 2018, Include: 

• Developing a target state architecture for the IRS Cloud 

• Drafting RFI to engage cloud vendors i n discussions to better understand the 

marketplace for cloud services and collecting RFP requirements to procure cloud 

services 

• Developing security architecture for IRS Cloud 

• Standing up appropriate management and governance structures for Cloud adoption 

and Cloud operations at IRS in order to facilitate migration. 

• Assessing numerous IRS applications across technical, risk, and pricing dimensions to 

determine doud suitabUity and recommendations for cloud migration. 

~eral IR.S applications (including MoveliNQ, eFOIA, and eOiscovery) have moved or are 

currently moving to the Cloud, following the Software-as-a-Service (SaaS) service model. In 

addition, IRS his network upgrades underway, which will enhance secure connectivity 

between the IRS and Cloud service providers. 

b. And when did theiRS deploy IU first cloud? 

IRS hjS used cloud technologies and managed services strategically in the past several years 

and has used these experiences to help shape our cloud strategy. Examples of early cloud 

implementations include: 

• The IRS implemented the Enterprise Storage Solution {ESS) in FY2014. 

foreign Account Tax Compliance Act {FATCA) International Data Exchange Service 

OCS) . • Am~z:on Web Service {AWS)-tRS Avthority·to-Qper~ e (ATO) to GSA in 201S 

and then reviewed and updated on 2/7/2017 
82 


Insert 33655A.061

• lntegtated Enterprise: Portal (IEP) - a secure managed service pfivate cloud. Uses 

Akamai cloud service for content distribution. -IRS ATO to GSA on 7/12/2016 

• Web Content Management System (WCMS)- Acquia Cloud to support IRS.gov- IRS 

ATO to GSA on 7 n6/17 

• MoveUNQ ·Financial relocation management software to SaaS based cloud provider 

- IRS ATO to GSA on 9/22/2017 

c. What are the security implications of failing to implement an IRS cloud strategy? 

There are multiple security benefits the IRS hopes to achieve by i mplementing cloud 

technology: 

Due to the superior speed and agility enabled by doud, security vulnerabilities of 

cloud applications can be addressed more rapidly. 

The centralized management and high degree of standardization and automation 

enabled by doud ensures consistent and rapid security action and responses acr0$5 

the portfolio of applications/services hosted In the cloud. 

Cloud vendors adhere to strict security requirements that can be tailored to IRS 

needs, and eviewed~ tested1 and approved in advance to ensure compliance with IRS 

and NIST standards. All applications in a cloud environment inherit a strict set of 

baseline cloud security controls, ensuring high degree of security and consistency. 

Implementing cloud ensures that infrastructure utilization is maintained at the 

optimal level, decreasing risks associated with maintaining excessive physical 

infrastructure. 

d. Why was there a shc·year delay before the IRS began to consider a cloud-first strategy, as 

mandated by the u.s. CIO? 

At the time the U.S. CIO direcUve was issued, many of the industry mechanisms necessary to 

exeoote a cloud-first strategy were oot yet 1n place. At that point$ the market was still 

maturing in sever~ I important respects, i ncluding the proven capabilitie-s/offerings of ctoud 

vendors, federal guidan<:e around d oud security, and most importantly the understanding 

of security risks specific to cloud. Given the paramount position of -security and the data 

security/privacy requirements of IRS under sec-tion 6103, the agency took a low-risk 

approach and continued to monitor the maturity of the market. f'edRAMP security controls 

were released i n 2012, and the first Fed RAMP Authorlty·to·Operate {ATO) was issued in 

May 2013. Once the market of cloud vendor offerings, federal guidance, and cloud security 

advanced to greater maturity, the IRS began exploring cloud. In 2012. the IRS implemented 

the Enterprise Storage Solution (ESS}, Storage·.u-a-Service, cloud-managed service solution 

offering, while the International Data Exchange System {IDES) went live in January 2015. IRS 

successfully used cloud technologies and managed services strategically and 

opportunistically in the past several years, per the examples provided for question 6{b). 

Given the numerous successful cloud implementations aa oss federal agencies in the past 

few years, IRS has developed and approved {in December 2017) its enterprise·wide d oud 

st ategy~ which addresses the • cloud first'" directive. 

7. What is the IRS's process for determining and prioritizing which online: account features or 

functionalities will be added next to existing online services? 
83 


Insert 33655A.062

The IRS determines and prioritizes the addition of new features and func·tionetlities to online 

accounts by evaluating and prlodtizing proposals led by a uoss.·functjon.al team. The proposals ar~ 

evaluated and ranked against both previously proposed online account c:apabilities and other 

capabilities within the Web Apps scope. This process is facilitated by the Web Apps PMO and begins 

when IRS business units propose new features/capabilities for online accounts through a well· 

structured intake methodology. The proposals are evaluated by the business operating unit, Online 

Services and IT, and scored across multiple dimensions. A list of scored capabilities. also referred to 

as the .. product prioritization backlog;'' is reviewed regularly by a core team made up of th~ business 

units and I'T, which selects capabilities to be proposed for development based on the score. The 

proposals and any dependencies are reviewed and dispositloned by the Web Apps Governance 

board, the Digital Subcommittee and the Strategic Development Executive Steering 

Committee. Approved entries go through a product elaboration process where the team discusses 

the requirements and design before transitioning the capability to the development teams. 

Once approved, features and functionallties are delivered using an agile delivery model that 

emphasizes adaptive planning, evolutionary development, continuous improvement, and 

encourages rapid and flexible response to change. The development and delivery of features for 

online accounts are managed using a product backlog, which reflects user stories for each approved 

feature. Development activity prioritizes the planned features based on application metrics, user 

testing/feedback, and business priorities. Generally, new features have been released approximately 

every 9 weeks. 

8. While the IRS has reported a significant decline in self-reported cases of identity theft, how does 

the IRS address individuals who may be unaware of having had their Identities stolen? 

We take all type.s of tax-related identity theft fraud seriously. We have expended substantial 

resources to identify and stop tax-related fraud and the victimization of innocent taxpayers when 

their personally identifiable information is used to file a tax return. When we identify tax-related 

fraud, we make every effort to notify the taxpayer and assist them In takjng the necessary steps to 

protect their identity from further misuse. The notification depends on how we detected the tax· 

r elated Identity theft. There are instances where we are unable to notify them because we do not 

have a valid mailing address. 

For example, when an attempt to electronically file a tax return is made which includes a Social 

Security number (SSN) already used or listed on another return for the same tax year, the return is 

rejected. The taxpayer receive$ a rejection mess.age through thee-File system which alert$ them 

that they may be a victim of identity theft. After receiving the reject notification, taxpayers generally 

call the IRS and assistance is provided. If a retum was previously processed with the taxpayer's SSN, 

the assistor instructs the taxpayer to file a paper return and attach Form 14039,1dentity Theft 

Affidavit. The assistor will also provide the caller general identity theft information on how to 

protect their identity. In February 2018, The Federal Trade Commission (fTC), in cooperation with 

the IRS, updated their ldentityTheft.gov website to provide taxpayers reporting an identity theft 

incident with the opportunity to send a Form 14039 to the IRS. FTC's Identity Theft questionnaire 

was updated to include questions for the tax.payer to complete. The questionnaire gathers the 

information necessary to complete a Form 14039 from the taxpayer. After completing the 

Questionnaire. the taxpaver previously had to print the completed form 14039. Identity Theft 

Affidavit, from FTC's ldentityTheft,gov website and forward it to the IRS for processing. Now at the 

push of a button~ the Form 14039 information is sent by FTC to the IRS, if the taxpayer informs FTC 
84 


Insert 33655A.063

to do so. The data files containing the Form 14309 information, for taxp,ayers who chose to submit 

it to the IRS. are sent by FTC to the IRS daily through secure servers. fhe IRS takes the information 

received from FTC, converts it to a Form 14039, and processes it. 

Here are other instances when the IRS sends notifications which may alert the taxpayer of potential 

identity theft: 

• We notify taxpayers of questionable returns filed usin.g their SSN when the returns are selected 

for review by the Taxpayer Protection Program. The letter informs the taxpayer we detected a 

tax return with indications of identity theft and asks them to confirm if they filed the return in 

question. After confirming their identity, if the tax.payer did not file the return, we take steps to 

assist them. If the taxpayer did file the return, we release the return for processing and issuance 

of the refund. 

• We notify taxpayers, either directly or through an Electronic Return Originator, if we receive an 

electtonlcaiiY·filed extension request al\d our records show a tax return has already been filed 

for that tax year. We reject the extension request and notify the taxpayer that a return has 

already been filed using their SSN. 

We notify taxpayers who are potential victims of employment-related identity theft. The IRS 

defines employment-related identity theft as the misuse of another person's SSN to obtain 

employment. In January 2017, we began issuing a letter (CP01E} when a new incident of 

employment-related Identity theft is Identified. The letter Is sent to the taxpayer whose SSN was 

listed on a Form W·2 which does not belong to that taxpayer. This notice alerts the taxpayer 

that we\re taken actions to ensure there is no Impact to their tal( return or tax account, and they 

may wish to review the eamings posted to their Social Security Admini.stfation account. 

IRS also works closely with the Federal Trade Commission to provide information and guidance on 

identity theft ptevention and detection. Steps to follow if you are a victim are provided year·round 

at IRS.gov and emphasized during the national Security Awareness Week. For more information on 

IRS.gov see "Identity Protection: Prevention, ~tect on and Victim Assistance", "How Oo You Report 

Suspected Tax Fraud Activitvr and '"IRS Identity Theft Victim Assistance: How It Works". 

a. Does the IRS have an estimate of how many taxpayers are victims of Identity theft and are unaware 

of it? 

The IRS is not able to esti mate how many taxpayers are victi ms of identity (10) theft and are 

unaware of it; however, we do estimate the extent of protected and unprotected identity 

theft through our annual Taxonomy. If the IRS identifies tax-related Identity theft, we notify 

the taxpayers. It is possible that in the population of unprotected identity theft, the 

taxpayers may not be aware they are a victim. We are not able to offer an estimate of that 

population. The IRS does monitor the extent of identity theft refund fraud through our 

Taxonomy. This research·based effort ai ms to report on the effectiveness of IRS's identity 

theft defenses to internal and external stakeholders, help us identify identity theft trends 

and evolving risks. It also helps us to refine Identity theft filters to better dete-ct potentially 
85 


Insert 33655A.064

fraudulent returns, while reducing the likelihood of flagging legitimate tax returns. 

Uncertainty exists because the ID theft unprotected figures represent an estimate of 10 theft 

returns not stopped by the IRS defenses. To produce the estimate, IRS must distinguish 

these 10 theft returns (that by-pas.sed our defenses) from legitimate filings as well as first 

party fraud. This is a difficult task as 10 thieves are attempting to present themselves as a 

legitimate taxpayer. 

For 2016, 10 theft returns unprotected are estimated to be between 740K-810K ($1.68 -

$2.31 billion in refunds); whereas 10 theft returns protected are estimated to be between 

1.98 million to 1.99 million ($10.56- $10.61 billion In refunds). Both estimates are lower 

than they were in 2015 (estimated unprotected returns between 860K - 1.03M for $2.24 • 

3.34 billion in refunds; estimated protected returns 2.38M-2.47M for $12.35·12.88 billion 

In refunds). 

b. If so, please describe the methodology for this estimate. 

The Taxonomy estimates the number of identified identity theft refund fraud cases where IRS (1) 

prevented or recovered the fraudulent refunds, and {2) paid the fraudulent refunds. We break these 

estimates into categories corresponding to lOT detection strategies, which occur at three key points 

in the life cyde of a tax refund: before accepting a tax return, during return processing, and post 

refund. 

9. What substantial IT cost savings have been achieved by the IRS in the last three years? 

As Deputy Commissioner Tr1blano shared during the hearing, IRS needs to do a better job of 

articulating the benefits from our IT investments. While there are substantial cost 

s..vings/reductions ~ssoc ated with some of our IT investments, in many ~ses the value in our IT 

Investments are attributable to expanded setVices and performance Improvements. Much like 

when you finally upgrade your old flip phone to~ smartphone- it was not c:ost savin.gs thilt 

compelled you to upgrade but rather new and expanded forms of communication and services 

necessary to remain functional in the current digital age. l ikewise, cost savin,gs/reduction.s are not 

always the compelling reason to modernize IRS systems. In many cases It Is the need for expanded 

$-ervice to ti~.xpayer.s, such as our web appli~tion.s; to address proliferation of fraud detection, such 

as our RRP anomaly detection system; to create new operational efficiencies. such as our Enterpfise 

Case Management enterprise platform and common business functions; or even to ensure long· 

term viability and security of our core tax processing systems and data, such as in CAOE 2. 

Following are examples of IT investments over the last three years where there was not only 

expanded business value but also substantial IT cost reductions realized: 

• Integrated Enterprise Portal fiEPl. IRS has been able to maintain 100% availability for its 

IRS.gov offering while reducing its annual Infrastructure Operations and Maintenance cost 

on Its IEP by approxlmat<ly $1M In FY 2015, $2M in FY 2016 and $7M In FY 2017 through 

innovation and contract negotiation. 

• Storau·as·a·Service. IRS's data storage strategy to maintain a manageable and 

scalable storage infrastructure under a private cloud managed service has shown cost 
86 


Insert 33655A.065

nvings of over $34M from 2013 to 2016 and 12 petabytes of disk. storage over a period 

of 36 months. 

• Convergence Unified Communicatio-ns. Modernization of IRS's disparate legacy 

networks infrastructure, from over 470 assets managed and maintained by dispersed 

teams of 108 FTE, to one unified system distributed geographically across 13 call 

control dusters maintained by 40 centraliied engineers and technicians, showed 

approximately $49.7M In combined savings for FY 2015 to 2017 (to-tal $200M in savings 

projected from FY 2012 through FY 2021). As of FY 2017, converged network is showing 

savings of over $2S·30M annually in circuit costs and annual maintenance. 

Strategic Aoouisition-s. Use of strategic sourcing technique-s in contract negotjations has 

re-sulted in nearly $34M in major hardware and software savings realized in FY 2014 to 

FY 2016. IT cost savings were ad'lieved by Implementing centralized management of 

software licenses, increasing license utilization, licensing by more efficient use models, 

and effectively using total cost of ownership analysis to guide hardware purchases. 

Source Type FY15 Savinas 

BMC Softwan~ Ucensing Software 3,101,774 

IBM Mainframe Platform 

Refresh Hardware 14,000,000 

Total 27,202,774 

Source T\iDe FY16 Savina 

Oracle Lic-ensint Software 1,992,299 

IBM Mainframe Hardware 1,115,009 

Total 3107308 

Source Type FY17 SavinasMicrosoft licensing Software 11 775 232 

Pitney Bowes Ucensing Software 1,950,708 

Total 13 725 940 

10. What is the IRS1 s plan and timeline for replacJng the 64 percent of the IRS's hardware that TIGTA 

determined ls past the end of its useful life? 

One of our biggest dsks ls ouf a.ging infrastructure. Over the last several years, we used our 

~ppropri~ted reso-...rc;es ~nd user fees to m~i tao n inf ~struc;:tvre c;.omponents for ovr c;.ore filin8 

season systems. However, the impaet of not Investing il'l our nol'l·filil'lg seasol'l systems is bei l'lg 

realized, with inc;reasing levels of aged infrastructure resulting in higher levels of instability and 
87 


Insert 33655A.066

downtime in these areas. Our eoal to ensure that the hardware, software and other infrastructure 

components supporting filing season systems were curr~nt has be~n difncult to maintain. With aged 

infrastructure reachine unacceptable levels, the IRS identified a.ging infrastructure as the top 

~nterpr s.e risk in FY 2016 and took steps to begin addr~ss ng this growing problem. As a result, IRS 

decreased the estimated replacement cost percentage of a.ge<l hardware assets in use from 63% in 

FY 2017 to 58% tho >tart of FY 2018. 

Beyond the existing backlog of aged hardware and software, there is an ongoing need to replace 

approximately 200.4 of the IT hardware annually, requiring $136M in dedicated recurring funding to 

remain current. 

The IRS has completed or is currently worki ng through over 32,000 hardware assets prioritized 

through the Sustaining Infrastructure program that involves setVers, network hardware {Ex. 

switches, routers, automated call distributors) and IRS employee end user equipment {Ex. laptops, 

printers). 

Walorskl 

The Return Review Program, or RRP, was designed to replace a legacy fraud detection system from 

the 1990s, but It came ln hundreds of millions of dollats over original estimates and years behind 

schedule. My concern is that after spending over $300 million and seven years on the RRP, there 

do~sn't seem to have been an accompanying Investment in analysis. As I understand lt, IRS 

analyst.s are still using a program called Discoverer to analyze potential fraud cases flaaed by RRP. 

1. Is that correct? 

RRP has been in operation since Filing Season (FS) 2015, and continues to perform i n Filing 

Season 2018 as the Govert~ment's primary li ne of defense against t he perpetration of tax 

refund identity theft, fraud and non.complianc:e. RRP is an integral part of the tax system 

pipeline and u.ses state-of·the-art analytics tools to prevent the loss of billions of dollars of 

revenue by identifying fraudulent tax refund cases and preventing related refunds from being 

issued. Since the start or FS 2015, RRP has protected over $10.29 billion in total confirmed 

revenue, with a Return on Investment (ROJ) of more than 1~572%. In FS 2018 (as of March 8, 

2018), RRP has systemically flagged approximately 1.3 million potentially fraudulent tax refund 

returns, with revenue protected figures not available at this time as it normally takes about 120 

days to confirm fraud. In fS 2017, RRP systematically selected approximately 1.1 million 

potential tax refund return.s and protected approximately $4.39 billion in total confirmed 

revenue. RRP has increased Identity Theft detection by 96% between 2015 and 2016, which has 

helped decrease Identity Theft victims by over 60% since 2015. 

Oracle Discoverer is an IRS enterprise approved COTS software tool that provides users with 

standard reports, ad·hoc reports and manual research (i.e., querying) capabilities. Yes, Oracle 

Discoverer is one of many software tools that the RRP leverages to identify fraud. Leveraging 

Discoverer, analysts have an ability to manually flag potential fraud cases. In FS 2017, analysts 

selected 194,418 potential tal( refund retums and protected $323 million in total confirmed 

revenue. 

2. If yes, how old is Discoverer? 
88 


Insert 33655A.067

IRS analysts have leveraged Oracle Discoverer since 2009. Currently. there are approxjmately 

27$ active users using the software tool to analyze the RRP data of potential fraud. 

3. Is it true that analysts need to run complex queries on Discoverer overnight in order to prevent 

the whole system from crashing? 

No, i t 1s not true t hat analysts need to run complex queries overnight in order to prevent the 

whole system from crashing. Analysts do run complex queries on Discoverer. sometimes on a 

24x7 basis. due to just·in·time analytics needs (i.e., to support a time critical investigation) 

which may take longer to execute depending on the complexity. 

lhe whole fraud detection system is designed to be composed of both systemic and manual 

selection. Anatysts use Discoverer to manually identify potential Identity Theft cases by running both 

simpfe and complex queries. Analysts use Discoverer with read-only access to a separate reporting 

database environment, which is synchronized nightly with the production database environment. 

This is a common strategy to ensure that production processing is not impacted by reporting 

processing 

4. How does this lag affect the ability to update RRP filters? 

There is no lag that affects RRP's ability to update models,. rules, dusters and filters. RRP employs the 

Cross Industry Standard Process for Data M ining (CfUSP·DM) methodology for all its modeling and 

data mining acti\lities to e-nwre business involvement in each stage of analytic development. IT 

collaborates with our business partners on a resular basis to identify new and evolving fraud 

patterns. to evaluate perlormance of existing models and to discuss changes for the next Filing 

season. RetOmmended changes to RRP Analytics (models, rules. clusters and filters) follow an 

evaluation and change management process. and are deployed during periodic maintenance 

releases. 

5. Is there a plan to retire Discoverer? If so, whe~t is the timeline? 

IRS is working to determine processes and tools that will allow us to retire legacy components such 

as Oracle Discoverer. RRP's most recent Releases (2.1 and 2.2) deployed to ptoduction in August 

2017 and November 2017 respectively, prov;ded the business with additional standard reports and 

ad·hoc reporting capability. but these do not provide all the manual research capabilities required. 

There is currently no timeline for Oiscoverer retirement; however, we continue to work diligently 

with the business and IT delivery partnets to identify solutions that will offer the required capabilities 

securely and cost·effectively.IRS is working on defining an appropriate timeline and apPfoach to 

retire the remaining capabilities of the Discoverer tool. 

6. With the recent Equifax hack, what is the IRS doing to combat what will likely be more 

sophlsticated fraud attempts? 

Refund fraud caused by identity theft (I on is one of the biggest challenges facing the IRS today. and 

the harm it inflicts on innocent taxpayer~ is a problem we take vety seriously. The IRS ha~ a 

comprehensive strategy focusing on preventing refund fraud. investigating these aimes. and 
89 


Insert 33655A.068

assisting ta:xpayel's \lictimited by tax·l'elated lOT. Thl'ough the Secutity Summit an unprecedented 

partnel'ship between the IRS. the software industry, and the states. we continue a unified battle 

against lOT and wot'k on collabot"ative solutions to combat stolen lOT l'efund fraud. IRS data shows 

significant improvements as fewer lOT returns entered the tax system. fewer fraudulent refunds 

wel'e issued and fewel' taxpayet"s were reporting themselv&S as victims of identity theft. 

As identity thieves continue to become more sophisticated, the IRS has tightened its secul'ity in 

response to the increased threat. We are taking steps to make it harder for identity thieves to 

successfully masquel'ade as taxpayel's and file fl'audulent refund claims on behalf of these taxpayetS. 

1he IRS and partners recognize that large data breaches of per$0nally identifiable information (PU) is 

a difficult and frustrating situation for the victims and financial ecosystem. A large--scale data breach 

such as Equifax.. and many others, is a reminder of the value of data fcx fTaudulent purposes and 

identity theft. Over the last several years, the IRS lOT fraud filtering processes remain effective even 

in situations of large losses of PU. 

IRS uses several robust tools to assist in combatting tax-related lOT and fraud.lhis includes tools that 

are specific to addressing taxpayers who have been victims of a data loss of federal tax informatioo 

(FTI). Because the data losses involving federal tax related data can be used to file returns that 

appear to be coming from the true taxpayer, IRS has implemented measures to address this. IRS's 

existing models and filters have been updated to address the level of sophistication used to file these 

fraudulent returns. We have implemented the use of Dynamic Selection Usts that allow IRS to 

monitor specific taxpayer accounts who have been victims of an FT1 data beach when the data 

compromised would have a direct impact on federal tax administration. This allows the IRS to more 

effectively identify these suspiCious returns and resu1ts in better protection for taxpayers' federal tax 

accounts and Increased revenue protection. 

In addition, there are multiple points in the pr<XA!Ssing life cyde to identify, prevent and assist 

possible lOT victims: pre--filing. at·filing, and post-filing. 

To prevent lOT returns from even coming in the dOOf (pre-filing), we have worked with tax software 

providel's to lmJ)f'ove the procedures that new and returning customers must use to Identify 

themselves in order to minimize the chance that the taxpayer's software account can be taken over 

by identity thieves. This additional security is one of the most vfsibfe signs of increased J)(Otection to 

taxpayers because they will notice passwcxd requirements and other website security features. In 

addition, we have Implemented a variety of mechanisms to prevent criminals from using a deceased 

individual's identity information to perpetrate fraud. We routinely lock the accounts of deceased 

taxpayers and have locked more than 30 million accounts so fal'. 

At·fllin& our lOT and fraud detection systems contain complex models and filters developed from 

historical and newly emerging knO'Wn fraud characteristics. Address and bank account changes as 

weU as histol'ical taxpayer filing data are characteristics that are used in conjunction with othel' filters 

to identify potentially fraudulent:AOT returns. When returns are selected by a filter. the refunds are 

fro2en untll additional reviews verify if the refunds are legitimate. 

7. How many IRS employees have the ability to sign a $7 million contract? Please provide a 

t.neaktJown or whi"h ernpluyt:t:S"oel'' ~i~'' wl1i1.h lyp~~: vr Wt•hau:.. 
90 


Insert 33655A.069

Currently, there are 781RS employees with warrant authority to sign a $7M contract. In addition, 

there are 28 other IRS employees with warrant authority to sign contracts that are less than $7M. In 

order to obtain warrant authority, IRS employees must satisfy federal and agency4 speclflc uaining.. 

edvcation, and experience requirements. The below table shows a breakdown of number of 

employees and warrant limits. 

Warrant Levels 

$100M+ $100M $25M $20M SIOM SSM $1M SSOOK SISOK 

Contracting 

Officer 

QuantitY 63 2 3 I 9 2 12 2 II 

Bishop 

1. I understand that the IRS has identified the cost of consolidating c.ase management systems 

through an Internal process. I believe at the hearing you said $84 million annually for the next 

five years, to do it internally. Have you identified the cost of using a commercial product or 

contracting with a data services company to utilize Its expertise, for the purpose of consoUdatlng 

the various case management systems? 

First, the $84 million annually for the next five years was attributable to CAOE 2 and not ECM. The 

IRS is developing a draft Request for Quotations {RFQ) for ECM that is sdleduled for issuance in earty 

2018, which will allow the Service to choose vendors for challenge·based scenarios known as a First 

Article Test in the industry. The First Article Test will provide limited fundi~ to a small number of 

vendOf"S to install their product in the IRS IT ecosystem and allow the IRS hands·on access to 

technical and business capabilities. This will help ensure that the IRS selects the best possible 

product(s) to do the job based on utilization within the IRS environment. Fol owing~ First Article 

Test.. the IRS will then select one or more commercial off the shelf {COTS} products to license to 

resume development of an enterprise-Wide case management system in late 2018 or early 2019. 

Actual toSts: of this solution are unknOwn at this time, but would indude any licensing, development, 

testing. implementation and ongoing operations/maintenanc-e costs. The IRS is actively considering 

a COTS product or products to OOn$ofidate the case management systems currently in us.e. 

2. When did the IRS begin using the Lead case Analysis (LCA} system? How many times has it been 

utilized by a case worker in the criminal division each filing season since its acquisition? And how 

many time$ has Electronic Fraud Detection System (EFDS) been used by that same population of case 

workers? 

IRS Criminal Investigation (CI) deployed LCA in 2014. lCA is utilized in combination with EFOS daily 

by Cl analysts per1orming research, developing schemes, identifying emerging fraud and supporting 

ongoing refund crimes compliance investigations. Since that initial 2014 deployment, lCA's use has 

also ex:panded to other user groups within Cl working multiple case typeS, including all field agents 

and those with a focus on international. money laundering, and cyber·crimes. The numbers below 

reflect logins forO's entire user population, as LCAdoes not track which users are also EFDS users. 

Cl perlorms I <ompli<mce workload ..-ctivity within EFOS as it is Cl's ontyworldoad management 

system to ensure downstream processing occurs. 

S2SK SISK 

0 l 
91 


Insert 33655A.070

~&ai'"~~~ n~s;;l UQ~ iSifi.~iKs! !ax g• 

calendar Year Total logins Calendar Year Total loglns 

2017(asofNovn) 624,383 017 (as of Nov 22) 8,789 

2016 295,910 016 0,774 

2015 37,924 015 4,310 

2014 4,255 014 9,614 

• qualified by the number of log•ns not number of sess•ons 

3. In the time sin{e the Cl'iminatlnvestlgations Division has begun using LCA, how many times has the 

dvll division used EFOS to analyze a flagged return? And havetheybeen able to use lCAat all? 

Nine users in IRS business operating divisions (BOOs} other than Cl were granted use of LCA. They 

were able to aoc:ess daily; however, they only accessed LCA periodically. 

The Wage and Investment (W&I) BOO uses EFOS daily as their primary inventory workload 

management tool to take action on their potential fraudulent inventory and uses Discoverer and 

Business Objects tools to conduct primary analysis and research on rettJrns and Identifying emerging 

fraud. 

IRS requires a reaHime system in support of revenue protection and detecting emerging fraud 

trends. A real-time system is necessary in order to prevent returns from posting and refund$ from 

generating. The functionality of LCA meets most of Cl's needs but the data is only updated weeldy 

unlike EFDS which is updated daily; data ftom LCA does not flow back to EFDS or RRP. 

t.CA accessed b:t BOOs other than a EFOS accessed bX Civil BOOs 

&l 11~it V£Jr ~ 5:ilt::ns;!ir Yt::i!' ~ 

2017 (as of Nov 22) 19 017(asofNov22) 70,683 

2016 14 016 198,062 

2015 (Sept·Oec) 3 015 346,108 

2014 N/A 01 4 blb,~)~ 
92 

f 


Insert 33655A.071

4. If civil division case workers have not had access to lCA, why Qn case workers in the criminal 

division use it? 

Ct purdlased the commercially available off-the-shelf product as a platform to access multiple 

datas.ets at a single access point to suppon thei( investigative res,ea(ch needs. IRS IT appfOved its use 

for 0 only, and the softwa(e is not integntted into the wcxkftow business case selection, treatment 

and management processes in EFOS. In order to be effective for non-0 users, additional 

capabilities/modules would need to be added to the softwa(e. 
93 


Insert 33655A.072

Mr. Danny Vemeuille 

~n!Jrrn.s of thr 'tinittil tatt.s 

'ti.~. )louse on~pn:scnrotiocs 

COMMITTEE ON WAYS AND MEANS 

1102 loHGWO!nH HOUSE 0ma: BULOING 

(202) 225-3625 

UJashingron. B~ l011Hl1S 

ht1p.:/1WII'fNndmt•ns.houlof.gov 

November 15,2017 

Assistant Inspector General for Audit, Security and 

Information Technology Services 

Treasury Inspector General for Ta.x Administration 

1401 H Street NW, Suite 469 

Washington, DC 20005 

Dear Mr. Vemeuille: 

Thank you for your testimony before the Committee on Ways and Means at ~te October4, 2017 

Oversight Subeomminee hearing entitled " IRS Reform: Challenges to Modernizing IT 

lnfrastructure." In order to complete our hearing record, we wouJd appreciate your responses to 

the following questions: 

I. Is the Internal Revenue Service (IRS) Information Technology (Jl) division properly 

placed within the IRS and does it have the tools necessary to properly weigh in on IT· 

dependent decision making? 

2. The Fcdcrallnformalion Technology Acquisition Ref om> Act was intended to empower 

agency Chief lnfonnation Officers (CIOs) and ensure greater oversight on a regular basis 

of major IT investments. 

a. Why do you believe that providing greater ,·oles for CIOs in major IT decisions is 

important? 

b. In the case of the IRS, do you believe that the IRS CIO has all of the powers that 

she needs to ensure that IRS IT is well managed and runs efficiently? 

c. Is the IRS undertaking its review of its major IT investments in a mean.ingful 

way? I las it led to improvements? If not. what else is needed? 

3. Enterprise Case Mtmagemenr (ECM) l'rogram · 

a. Why did illakc the IRS 18 months 10 determine that the ECM system being 

procured would not meet IRS needs? 

b. How is t1te IRS able to procure IT solutions such as an enterprise case 

management system or an enterprise email system lhat later are detennincd to not 

meet its own needs? 

c. Are these a violation of the IRS's own internal policies and procedures? 
94 


Insert 33655A.073

d. Wltat steps has the IRS taken and what safeguards has it put in place to ensure 

situations such as this do not occur again? 

e. What additional steps could be taken to further ensure that this does not oecur 

again? 

Cha

::;,0~ imum 

Subcommittee on Oversight 
95 


Insert 33655A.074

HOUSE COMMITTEE ON WAYS AND MEANS 

SUBCOM~ TTEE ON OVERSIGHT 

QUESTIONS FOR THE RECORD FOR 

DANNY VERNEU ILLE 

ASSISTA1'11T INSPECTOR GE!\ERA L FOR AUDIT 

TREASURY INSPECTOR G ENERAL FOR TAX ADMINISTRATION 

SUBMITTED BY REPRESENTATIVE VERN BUCHANAN 

October 4, 2017 

" IRS Reform: Challenges to Moderniz.ing IT Infrastructure" 

I. Is the Internal Revenue Service (IRS) Information Technology (IT) division properly 

placed within the IRS and does it have the tools necessary to properly weigh in on 

IT -dependent decision making? 

Answer: 111e IRS Jr division has the tools necessary to properly weigh in ou n-. depeudem decisions. 17w IRS C/O and seniorfimctional managemelll (IRS Senior 

Executive Team and 1he IRS Commissioner) work wgether to make key corporate 

decisions. 

2. The Federallofoml3tion Technology Acquisition Refonn Act (FITARA) was intended to 

e-mpower agency Chief Information Officers and ensure greater oversight on a regular 

basis of major JT investments. 

a . Why do you believe that pro,; ding greater roles for CIOs in major IT decisions is 

imponant? 

Answer: II is important for the (lOs to be invohft'li in major IT tlecisions because the 

C/0 is ultimately going to be key in providing resources and managing/delivering 

programs ami IT projects and hwestments. C/0 im:olvemellf in all major IT 

decisions also ensures accormtability for delivering programs and /TprojeCJS and 

iuvestmems. 

b. In the case of the IRS, do you believe that the IRS CIO has all of the powers that 

she needs to ensure that IRS IT is well managed and runs efficiently? 

Answer: The Treaswy Inspector Genera/for Tax Admiuislralion (f!GTA} believes 

Jhe IRS C/0 has the authority needed to nm an effective and efficie/11 program. 

c. Is the IRS undenaking i1s review of its major IT investments in a meaningful 

way? Has it led to improvements? If not. what else is needed? 

Answer: The IRS IS tmdenaklng a sul>stamive review ojlls IT lm"esnnems. Willie 

FI7"ARA is direcJed at the agency le\tel, i.e .• (and the IRS is not a covered agency, the 
96 


Insert 33655A.075

IRS is in the process of implementing all of its FITARA-re/ated responsibilities 

del<.1£llled by the Departmem oft he Treasury (trea~·wy}, including reviewing the 

IRS's major IT investments. In addition. the Treaswy and !he JR.,\' already have 011 

imegrated Capil(l/ Planning and lnvestmem O>utrol process which has made the 

IRS's implemenlarion of its FITARA-reloled resp<msibililies easier. As an ou(ii/ is 

cun·ently in process. TIG1if does 1101 have u definitive tmswer about improvements 

and what else may be needed. 11G1"A plans to issue a repor1 durinK the 1hird quctrter 

of Fiscal Year 1018. 

3. Enterprise Case Management (ECM) Program -

a. Why did it take lhe IRS 18 momhs to detem1ine lhatthe ECM system being 

procured would not meet IRS needs? 

Answer: The IRS did not properly determine a complete set ofre.quiremeuls prior to 

starting the ECM Program. 11~e IRS also did 1101 perform a fit!/ evaluation of the 

software's ability 10 meet requirements prior to staffing the ECM project. TJGTA is 

cun-ently auditing the E('M Program and will be issuing a reporr during Jhe second 

quarter of Fiscal Year 2018. 

b. How is the IRS able to procure IT solutions such as an enterprise case 

management system or an enterprise email system that later are detennined 10 not 

meet its own needs? 

A11swer: 111 ge11eral, this occurred because the IRS did not follow its established 

guidance and procedures. If the IRS had followed its established guidance and 

procedures, it u:ould have alrea(/y pe1jormed I he steps it is now JOking to de1ermine 

the soflware(s) that will sujjic:ie.mly meet its requiremems for an enterprise case 

managemem sys1em. 

c. Are these a violation of the IRS' s own internal policies and procedures? 

Answer: Yes, generally the IRS did not follow its own illfemal policies and 

proce<luresfor developing requiremems and determining the proper software(s) to 

meet those requlreme/lls. 

d. What steps has the IRS taken and what safeguards has it put in place to ensure 

sittlations such as ahis do not occur again? 

Answer: The IRS is now performing the process il should h{l\vt performed at the 

beginning of the E('M Program to fully determine requirements and scope. and is 

evaluating m•ailoble G~o!muercial o.ffthe··she(fproducts. No new safeguards were put 

in place. 

e. What additional steps could be taken to further ensure that this does not occur 

again? 
97 

f 


Insert 33655A.076

Answer: The IRS CIO should ensure that the IT division effectiwdy follows its well· 

defim!<l and established procedures and processes for the development of new IT 

projects and im"estments · . 
98 


Insert 33655A.077

KE'I1W IIMOY. TlXAS. 

~Longrrns of the 'tinitcd ~totes 

'!I..,S. llousr of 'Reprcsenmtiors -

__ ...... 

........... 

'"'UIIIOl~'Nilliii.CMO 

~ 

"'l''PJ -o.~-"* ....... ~ COMMin'EEONWAVSANDMEANS 

1102 lO!'fGWOAltt HOUSE OrRa 8UILOIHG ---- (202) 22S-3$25 :'".OC:::=:"" 

~~~ 

-

[n 

.,._.,. 

,_...,. 

-t1JaShingron. DQ: lOlJ1-0Ji& 

htlp:J/wlJYSandmoar.s.housct.gov 

:c.~~ 

---

CAI!lot~I\OfiOA 

-. ............. 

Mr. David Powner 

Direccor. IT Management Issues 

Government Accountability Office 

441 GSt.NW 

Washington, DC 20548 

Dear Mr. Powner: 

November 15,2017 

Thank you for your cestimony before the CommiNeeon Ways and Means at the October4, 2017 

Oversight Subcommittee hearing entitled "IRS Ref om>: Challenges to Modernizing IT 

Infrastructure." ln order to complete our hearing record, we would appreciate your responses to 

the following questions: 

I. How can tlte American Technology Council and the Offioe of American Innovation be 

leveraged to help the Internal Revenue Servioe (IRS) with its modernization efforts? 

2. Is the IRS lnfomtation Technology (ID division properly placed within the IRS and does 

it have the tools necessary to properly weigh in on IT -dependent decision making? 

3. The Federallnfomtation Technology Acquisition Reform Act was intended to empower 

agency Chief lnfomtation Onicers (CIOs) and ensure greater oversight on a regular basis 

or major JT investments. 

a. Why do you believe that providing greater roles for C!Os in major IT decisions is 

important? 

b. In the case of the IRS, do you believe that the IRS CIO has all of the powers she 

needs to ensure that IRS IT is well-managed and runs efiiciently? 

c. Is the IRS undertaking its review of its major IT investments in a meaningful 

way? Has it led to improvemellts? If not, what else is needed? 

Cha

VERNBUCH~ imtan 

~ Subcommittee on Oversight 
99 


Insert 33655A.078

GAO u.s. GOVERNMENT ACCOUNTABILITY OFFICE 

441 G St. N.W. 

Washington, DC 20548 

December 13,2017 

Vern Buchanan 

Chairman 

Subcommittee on Oversight 

Committee on Ways and Means 

House of Representatives 

Subject: GAO Response to Post-Hearing Questions on the Internal Revenue 

Service's Information Technology Modernization 

Dear Chairman Buchanan: 

It was a pleasure to appear before your subcommittee on October 4, 2017, to discuss 

the Internal Revenue Service's (IRS) information technology (IT) modernization efforts. 

This letter responds to a request that I provide answers to post-hearing questions for 

the record. The questions, along with my responses, follow. 

1. How can the American Technology Council (ATC) and the Office of American 

Innovation (OAI) be leveraged to help the Internal Revenue Service (IRS) with 

its modernization efforts? 

IRS can leverage the ATC and OAI by seeking their assistance in addressing the 

challenges it is facing in modernizing IT and, in particular, in modernizing its 

Individual Master File. The Individual Master File is the system for processing 

individual taxpayer account data, for which IRS has been undertaking a complex 

modernization effort to, among other things, convert the legacy assembly language 

code' in which it is written to a modern programming language. Given that ATC's 

mission is to help modernize federal agency IT and OAI's mission is to make 

recommendations to the President on policies and plans that improve federal 

government operations and services, both groups could play a significant role in 

assisting the IRS. The attention provided to the IRS's modernization effort by 

1

Assetnbly language code Is a oornputer langvage Initially used in the 1950s that Is typically tied t<> the hardware for 

vd'lioh it was developed; it has become cfdfic;utl to ()()($e end main lain. 
100 


Insert 33655A.079

federal officials of the stature of these groups' members could potentially lead to 

significantly improved outcomes.2 

2. Is the IRS Information Technology (IT) division properly placed within the IRS 

and does it have the tools necessary to property weigh in on IT -dependent 

decision making? 

IRS's Chief Information Officer (CIO) reports to the Deputy Commissioner for 

Operations Support, which positions the CIO and the IT organization to weigh in on 

IT decisions. This placement is consistent with the controls that are specified in the 

Office of Management and Budget's (OMB) guidance for implementing the 

provisions commonty referred to as the Federal Information Technology Acquisition 

Reform Act (or FITARA)' which are critical to enhancing the CIO authorities 

specified in the law.• The law requires the heads of covered executive branch 

agencies• to ensure that the CIO has a significant role in the decision-making 

process for IT budgeting, and in the management, governance, and oversight 

processes related to IT.• 

Over the years, IRS has improved the tools it needs to weigh In on decision-making, 

but there are still opportunities for improvement. Specifically, in 1995, we identified 

significant management and technical weaknesses with the agency's business 

systems modernization program, which led us to include the program on GAO's 

high-risk list. Through the years, IRS took action to address the weaknesses we 

identified. For example, in 2007, the agency developed policies, procedures. and tools 

for developing and managing project requirements.' As a result of its actions, we 

removed the business systems modernization program from the high-risk list in 

2013. Nevertheless, as we testified before you on October 4, 2017, we have 

2The ATC Is chaired by the Pfesiderd. and includes the heads of several dep&rttnellts and agencies as well as the 

Dire<:eor of the Off10e of ~tanagement and Budget and the Federal Chief lnformadon Officer. The OAI inclUdes several 

Seniot Ac.Msors and Spec::ial As$stanls to the President. 

3fn Oecembef2014, Congress enacted IT acquisition reform legislation (oommonly referred to as lhe Federal 

lnfOtmation TechnolOgy AoquWtion A:oiOtm Act, cw FITARA) as part of the Catl l eW'I and Howatd P. 'BudC McKeon 

National Defenu Authorization Act fOf F".scal Year 2015, Pub. L No. 113--291, div. A, titkt VIII, subtitle o. 128 Stat 

3292, 3438-3450 (Dec. 19, 2014). The law applies to covered agency CIOs and not directly co CIOs of the agency's 

components or bureaus. 

"OMB, Manag.cment and Mrs:ight of Federal Information Te<:hnOIOgy. Memo;afld~om M·1S.14 (Washington, D.C.: 

June 10. 2015). 

5 The 24 agencies covered by FITARA are the Departments of AQri<:ulture, Commerce. Defense, Education, Energy, 

Heallh and Human Scwvites, Homeland Se<:utity, Housing and Urban DevGIOpment. the intorior, Justice. LabOr. 

State, Transportation, the Treaswy, and Veterans Affair$; and the Environmental Protection Agency; National 

Aeronautics and Space Administration; ""eocy for lnterna1ional Development; General Services Administration; 

National Science Foonda1ion; Nuclear Regulatory Commission; Offtce of Personnel Management Small Business 

Administration; and Social Seovrity Administr31jon. 

' The Department of Oeten$e is exempt from these provisions of the law. 

7(.jA!.J, Htgll~HASk ~An UpOate, UA0·1:$-2tiJ (W8ShWlgton, U.f.;.: t-eb. 14, 201;1). 

Page2 
101 


Insert 33655A.080

identified opportunities for IRS to improve the way it manages its acquisitions and 

operational investments. 

3. The Federal Information Technology Acquisition Reform Act was intended to 

empower agency Chief Information Officers (CIOs) and ensure greater 

oversight on a regular basis of major IT Investments. 

a. Why do you believe that providing greater roles for CIOs in major IT 

decisions is important? 

We have previously reported that the federal government's investments in IT have 

too often resulted in significant cost overruns, schedule delays, and questionable 

mission-related achievements, due to. among other things, ineffective exeoutivelevel governance and oversight provided by CIOs.• Providing CIOs with greater 

authorities for major IT decisions would, therefore. position them to more effectively 

manage programs and contribute to improved outcomes. This is consistent with the 

provisions of FITARA. 

b. tn the case of the IRS, do you oolieve that the IRS CIO has all of the powers 

she needs to ensure that IRS IT is well-managed and runs efficiently? 

As previously mentioned, we believe that IRS's CIO is positioned in the organization 

to have the authority to effectively manage IRS IT, but we have not specifically 

determined the extent to which the CIO is exercising her authority. Nevertheless, as 

we recently testified oofore you, over the past several years, we have identified 

numerous opportunities to improve the way IRS manages its IT acquisitions and 

operational (i.e., legacy) systems·• For example, in June 2016, we reported that the 

agency had developed a structured process for allocating funding to its operations 

activities, consistent with best practices; however, the agency did not have a 

similarly structured process for prioritizing modernization activities to which it 

allocated hundreds of millions of dollars for fiscal year 2016.'0 Accordingly, we 

recommended that IRS establish, document. and implement policies and procedures 

for prioritizing modernization activities. IRS agreed with, and has efforts underway, 

to address the recommendation. 

In the same report, we noted that IRS could improve the accuracy of reported 

performance information for key development investments in order to provide 

Congress and other external parties with pertinent information about the delivery of 

'see for example, GAO,InfonnatiOn TechnolOgy: Further lmpt&mentalion of FITARA R!Wt9d RecommendatiOns Is 

NoodCd to BonN MamJgo ACXIuisltk>r>s 8fld o,.,.tions. GAQ.18-234T (Wa>Nngton, O.C : Nov. 15. ~17). 

9GAO. ln/()lmiJ/ion TechnQ/Qgy: Management Mention s~ to $CJ(X;4ssfulty MockJrnize Tax Proces$ing 

SystemS;. GA0.18-1 53T (Washington. D.C.: Oct. 4, 2017). 

10GAO, lnformark>n Technology: IRS Needs lo lm/){0'11& Irs PIOC9sses for Priorlizing and Reporting P(JI(ormance of 

/nv(lsrlttQms. GNJ·16•545 (Wasnington, o.c.: June 29. 2016). 

Page3 
102 


Insert 33655A.081

these investments. We recommended that the agency take steps to improve 

reported investment performance infonmation. IRS agreed with the recommendation 

and has efforts underway to address it. 

Further. in a May 2016 report on legacy IT systems across lhe federal government, 

we noted that IRS used assembly language code to program key legacy systems, 

including for its Individual Master File." We noted that, although IRS has been 

working to replace the Individual Master File, the agency did not have time frames 

for its modernization or replacement. We recommended that these time frames be 

established. At your October 4, 2017, hearing, IRS's CIO testified that it would take 

approximately 5 years, 50 to 60 employees and associated funding, direct hire 

authority, and approximately $85 million each year to replace a core component of 

the Individual Master File. 

c. Is the IRS undertaking its review of its major IT investments in a meaningful 

way? Has it led to improvements? If not, what else is needed? 

While we have not performed any recent studies of IRS's process for reviewing its 

major IT investments. as mentioned above, in June 2016, we reported that the 

agency had developed a structured process for prioritizing activities associated with 

its investments in operations and maintenance which was consistent with best 

practices.'' For example, we noted that the process, among other things, addressed 

(1) prioritization and comparison of IT assets against each other and (2) criteria for 

making selection and prioritization decisions. However, we reported that IRS did not 

have a similar process for prioritizing its modernization activities. In addition, as 

previously noted, and as we testified before you on October 4, 2017, we have 

identified opportunities for the agency to improve its management of both its 

acquisitions and operational systems. Continued attention to implementing our 

recommendations is vital to helping IRS ensure the effective and efficient 

management of its efforts to modernize its aging systems and ensure its multibillion 

dollar investment in IT is meeting the needs of the agency. 

11Auembly language OOdO is a oornputer language initiaty used in the 1950s that is typk:ally Ued to th& harctware fOt 

which it was developed; it has be¢Ome <liff101..11t to <XXIe •nd maintain. 

t1GAO t6 646. 

Page4 
103 

f 


Insert 33655A.082

In preparing this correspondence, we relied primarily on our prior reports that have 

addressed IRS's IT management." Should you or your staff have any questions on 

matters discussed in this letter, please oontact me at (202) 512·9286, or Sabine Paul, 

Assistant Director, at (202) 512·6374. We can also be reached by e-mail at 

pownerd@gao.gov or pauls@gao.gov, respectively. 

Sincerely yours, 

David A. Powner 

Director, Information Technology Management Issues 

13See fof exampte, GAO. Infomuttlon T6Chflol<>gy: IRS Noods to lmptovtJ Its Process/or Prfori(;z;ng alld Reporting 

Petformance ollrt~~V.slment$, GAQ-16-545 (Washington. D.C.: June 29. 2016); and fn!Otmation Technology: F~ 

A~$ Nce<1 tO A(J(JffJSS Agk'tg Legacy S)'stoms. GA0-16-468 {Wasnington, D.C.: May 25, 2016), 

Page5 
104 

[Public Submissions for the Record follow:] 

105 


Insert 33655A.083

CITIZENS 

AGAINST 

GOVERNMENT 

WASTE 

The lionorable Vern Buchanan 

Chairman 

Committee on Ways and Means 

Subcommittee on Oversight 

Th om as A. Schatz., President 

1100 Connecticut Ave .• N.W., Suite 650 

Washington, D.C. 20036 

cagw.otg 

October 3, 2017 

The lionorable John Lewis 

Ranking Member 

Commiuee on Ways and Means 

Subcommittee on Oversight 

1102 Longwonh House Office Building 

Washington, D.C. 205 15 

II 02 Longworth House Office Building 

Washington, D.C. 20515 

Dear Chairman Buchanan and Ranking Member Lewis, 

On behalf of the more than one 1nillion members and S\apponers of Citizens Against Govenunent Waste 

(CAGW), l submit the following leuer for the record. Your efforts to address issues of idemiry thefl and 

fraud at the Internal Revenue Service (1 RS) are appreciated, and I thank you for the opportunity to 

provide input into the commiuee's work. 

In 1994, the IRS created the Electronic Fraud Detection System (EFDS), which was intended to identify 

fraudulent tax ren1ms and maximize revenue protection. In 2009. the IRS began deve.loping the Retum 

Review Program (RRP) to replace EFDS. In 2010, the IRS declared EFDS "too risky tO maintain, 

upgrade, or operate beyond 20 15." 1 Despite the recognized need to unplug the EFDS aod get the RRP 

in place in a time ly manner, the program is still in development, and is now estimated to be completed in 

2022. 

Anyone familiar with tbe long history of failed federal IT investmems will not be surprised to leam that 

tl1e RRP has had substantial cost overmns and produced inadequate results. A February 2015 

Government Accountability Office report noted chat the RRP had exceeded its initial budget by S86.5 

million. According to a December II, 2015 Treasury Inspector General for Tax Administration 

(TIGTA) report, during a two-year pilot program, tlte RRP missed 54,175 fraudulent returns totaling 

$3 13 million.> 

Federal Acquisition Regulation 12. 10 I requires agencies to "conduct market research to determine 

whether commercial items or non-developmental items are available that could meet the ageocy's 

requirements," and use them when available. In other words, if it is available in the private sector, also 

k.nown as "commercial off-the-shelf," or COTS, it should be used. A July 26, 2013 TIGT A repon found 

1 Taxpayer Ad\'ocate Se-rvice, "fiscal Year 20 14 Objectives," lntt-nL11 Revenue Sc:-rvke. June 30, 2014, 

hnps://taxP:t\'tfi\sh·ocatc.us..gov/uscrliles/filc::IFuiiReoontbuotcmcntntion=9f·!I&IRS%Er,PSWo99s.-Retum-Revic-wProaram·ls-at-Excrcmc-Rjsli·Witich·Could·Causc-Signjfgnt·Hann-nnd.Cosl pdf 1 Michllel £. McKenney, "Coc1 im ~ Refir~ruc-m orth~ Retnm ev ~w Prosram d~ thy TheA O~te<: n Model:. i$ N~&d 

lo Increase Dc:tcc:lion." Treasury lnspcc:tor Gc:ncr..al for Tax Adminislr.nioo. December II. 2015. 201(1-40-00S.. 

hupst/W\\ w lrcasury.goy/tigtafaudiurponMlO 16tcpons120l640008fr Qdf 
106 

f 


Insert 33655A.084

that commercial software products were not fully considered before beginning development of the RRP 

system.

3 A September 29, 2015 TIGTA repon estimated that the operation and maintenance of ru•ming 

EFOS while RRP is being developed will cost taxpayers $18.2 million annually.' Funhennore, while 

the IRS civil division continues to invest in the underperfonning RRP. the IRS criminal division is 

already utilizing a private sector platform for its anti-fraud efforts. Tlte. civil division should drop its 

government•created software and join the criminal division in using proven private sector solutions. 

There is significant room for technological improvements at the IRS. CAGW thanks you for your 

efforts to address these concems. If you have any questions regarding these comments. please feel free 

to contact myself or CAGW Associate of Policy and Government Affairs Peter Klensch at (202)-467-

5300. 

Sincerely, 

~s~ 

President, CAGW 

' Mic;hac;l E. Me; Kenney ... lmprovcmcnti arc Needed to Ensure S\JC«s.sful Oc\-tlopmcnt and Sy~cm lntcgr3lion ror the 

Retum Review Program." Trt.asury Jnspcctor General for Tax Administration, July 26. 2013, 2013·20.()63, 

1lllj)S://www.lrc:)su:rv.gov/llg;tafauchtreports12013rcponsi2013200(,J(r.hlm1 

' Michael E. McKenney. "'Review or the Electronic Fraud Det«:tion System." Treasury lllSpceiOr General for Tax 

Administration. Scptetnbcr 29.2015. 2015-20-093. huos·J/www lrtasU!y.sov/tigtalauditrsportg'2015rcport.s/201520093rr.odf 
107 


Insert 33655A.085

6NTEU 

Anthony M. Reardon 

National President 

National Treasury Employees Union 

Statement for the Record 

For 

House Ways and Means Subcommittee on Oversight 

" Jnternal Revenue Service's (IRS) efforts to modernize its 

information technology (IT) infrastructure" 

October 4, 20 17 

1750 H Strocl, N.W. • Wnsbing1on, D.C. 20006 • (202) 512·5500 
108 


Insert 33655A.086

Chainnan Buchanan, Ranking Member lewis and distinguished members of the 

subcommittee, I would like to thank you for allowing me to provide comments on the lntemal 

Revenue Service's (IRS) effons to modernize its information tedmology (IT) infrastructure. As 

President of the National Treasury Employees Union (NTEU), I have the honor of representing 

over ISO.OOO federal workers in 31 agencies. including the men and women at lhe IRS. 

Mr. Chairman, according to TIGTA, 64% of IRS IT hardware systems are aged and out of 

warranty and 32% of software products are two or more releases behind the industry standard, with 

15% more than four releases behind. furthermore, every year, another 200/o of hardware moves to a 

status of aged beyond the manufacturers recommended useful life. if not replaced. In a September 

2017 report, TIGTA specifically noted that "aged information technology hardware still in use 

introduces unnecessary risks ... aged hardware failures may have also had a negative effect on IRS 

employee productivity, security of taxpayer infonnation, and customer service." As long as the IRS 

struggles to fund it basic operations. its employees without adequate resources, wiU continue to 

struggle to perform their duties for the public. 

The risk to the American tax syste•n of IRS' agi11g IT i•lfrastnlc.ture cannot be overstated. As 

the IRS Fiscal Year (FY) 2018 budget request notes. "this aging infrastn1cture putS the American tax 

system at risk of failure. Such conditions introduce security risks. excessive system downtime, 

systems and hardware no longer supponed by the vendor, and incompatibilities across systems and 

programs." 

Despite the clear threat posed by an aging IT infrastructure. insufficient funding in recent 

years has forced the IRS to defer investing in or upgrading its existing aged IT infrastructure. As you 

know, since FY 2010, IRS funding has been cut by almost $1 billion, or nearly a 20 percent 

reduction on an inflation adjusted basis. 

In addition, over the last several years lhe J RS has had to implement a number of 

significant legislative mandates, nearly all of which came with no additional funding which has 

limited its ability to replace its aged IT hardware inventory. According to TIGTA, between 

FY 2012 and FY 2016, the IRS lnfonnation Technology organization, responsible for delivering 

information technology services and solutions that drive effective tax administration to ensure 

public confidence, allocated more tllan $1 .3 billion of its funds alone to implement several 

unfunded legislative requirements, including the Affordable Care Act (ACA) and the Health 

Coverage Tax Credit (HCTC). 

The IRS was tasked with a number of other unfunded mandates from congress which 

funher required the rRS to divert limited IRS resources to implement, including the Foreign 

Account Tax Compliance Act (FACTA), the Achieving a Better life Experience (ABLE) Act, 

reauthorization of the seriously delinquent debt certification program and the 20 l S Protecting 

Americans from Tax Hikes (PATH) Act. 

NTEU was disappointed to see the FY 2018 Omnibus Appropriations Act recently passed 

by tbe House would further reduce funding for the tRS by more than S 155 million, which will 
109 


Insert 33655A.087

funher impede its ability to address its aging IT infrastrucnare and make necessary software 

upgrades that are critical to ensuring the imegrity of our tax system. 

In addition to the risk posed by an aging IT infrastructure, I would be remiss if l didn't 

mention the risk to our tax system posed by insufficient staffing levels across the service. 

Funding reductions since FY 2010 have forced the Service to reduce the total number of fulltime employees by approximately 18,000 across every state in the country, greatly hampering 

IRS' ability to provide America's mxpayers top quality service and enforce our nation's tax laws. 

The drastic cuts to lRS• budget come at a time when the IRS workforce is already facing 

a dramatically increasing workload with staffing levels down almost 20 perce-nt below what they 

were just 6 years ago. In 2010, the IRS had 92,148 full-time employees to administer tax laws 

and process 230 million tax returns. By dteclose of2016, that number had fallen to 74,15 I to 

administer a more complicated tax code and process 244 million much more eomptex tax returns 

and other fonns. 

NTEU was disappointed that the Administration's FY 2018 budget calls for reducing IRS 

funding by an additional $260 million below the FY 2017 enacted level and reducing overall 

staffing by more than 4,200. NTEU knows any funher reductions in funding and staffing will 

funher exacerbate the adverse impact previous cuts have had on IRS~ ability to provide. taxpayers 

with tlte service they need and to enforce our nation•s tax laws. We believe that in order to 

continue to make improvements in taxpayer services while handling a growing workload and 

increasing collections, it is imperative to reverse t1te severe cuts in IRS staffing levels and begin 

providing adequate resources to meet these challe•1ges. With the future workload only expected 

to continue to rise, the IRS will be under a great deal of pressure to improve cusromer service 

standards while simultaneously enforcing the 11 ation's tax laws. 

Impact oflnadequate Funding on Taxpayer Services 

Mr. Chairman, providing quality taxpayer service is a criticaJ component of the IRS' 

efforts to help the taxpaying public understand its federal tax obligations while making it easier 

to comply with the UtJ< system. Unfortunately, the IRS' ability to provide excellent taxpayel' 

service has been severely challenged due to reduced funding in recent years. Since FY 2010, 

overall funding for the IRS has declined by 111ore than $900 million, while the number of 

individual taxpayers has increased by 10 million, or more than 6 percent. These reductions have 

resulted in a reduc.tion in the numbe-r of employees assigned to answer telephone calls from 

9,400 in 2010 to 6,200 in 2015, a 34% drop. 

In a letter to Congress following the c lose of the 2015 filing season, dte IRS highlighted 

some of the adverse impacts these reductions had on its' ability to deliver taxpayer services 

during the filing season. These include: 

•A reduction in the percemage of callers seeking live assistance who received it 

(telephone level of service) to 38 percent- down from 74 percent in PY 2010. 

•Taxpayers waited abom 23 minutes on average for an IRS representative 10 get 

on the line, and more than 60 percem of calls were never answered. This 
110 


Insert 33655A.088

represents a sharp decline from 2010, when the IRS answered ~!fee-quarters of 

calls and had an average wait time of just under II minutes. 

•The lRS was not able to answer any tax~law questions except ··basic" ones 

during the filing season, and now that the filing season is over, it will not answer 

any tax-law questions at all, leaving the roughly IS million taxpayers who file 

later in the year unable to get aJtswers to thei.r questiotts by calling or visiting LRS 

offices. 

•The IRS historically has prepared tax returns for taxpayers seeking its help, 

particularly for low income, elderly, and disabled taxpayers. Eleven years ago, it 

prepared some 476,000 returns. That number declined significantly over the past 

decade, and in 2014 the IRS announced it would no longer prepare retums at all. 

Additionally, because funding reductions forced the IRS to shorten the period of 

employment for their seasonal employees who help answer taxpayer correspondence, the IRS' 

inventory of correspondence from taxpayers in 2014 and 20 IS grew significantly above what it 

normally would have been to more than 900,000. 

For FY 2016 and FY 2017, the IRS was provided with $290 million to improve the 

customer service representarive level of service (LOS) rate, among other things. Wirh this 

funding, the IRS was able to hire additional temporary telephone assistors which drastically 

reduced taxpayer wait times and helped the IRS raise the phone level of service from 38 percent 

during the 20 IS filing season to 72 percent during the 2016 filing season and to 79 percent 

during the 2017 filing sea.son. The additional funding also freed up more resources to help the 

IRS reduce the correspondence inventory to 690,000 by the end of FY 2016, a drastic reduction 

from just 1wo years prior. 

Despite the clear evidence 1hat providing the £RS with the $290 million in targeted 

funding enabled them to drastically reduce taxpayer wait times and improve the phone level of 

service during the 2016 and 2017 filing seasons, neither the Admi11istration's FY 2018 budget 

request nor the House passed FY 2018 Omnibus bill include this specific funding. In fact, the 

Administration's request acnaally calls for reducing tax1H1yer services seasonal stAffing costs 

by $239 million and overall taxpayer services staffing by almost 2,200 FTEs. The 

Adm stration~s request seems to acknowledge the adverse impact that these reductions will 

have on IRS' ability to provide quality service by noting the target level of service for all of 

FY 2018 is just 39 percent, a drop of 2S percent from the FY 2017 level. It is clear that the 

Administration's proposed reductions in funding and staffing for taxpayer services will simply 

reverse the gains made in recent years and lea,•e the IRS unable to provide taxpayers with the 

assistance they need. 

The imponance of providing taxpayers with timely assistance over lhe phone or in 

pe-rson is also of particular importance for victims of identity theft and other types of tax refund 

fraud. These cases are extremely complex cases to resolve, frequently touching on multiple 

issues and multiple tax years, and the process of resolving these cases can be very frustrating for 

victims. This same S290 million was also utilized to safeguard taxpayer data, enhance cyber 

security. and improve tln~ identifkation and prevention ofiO theft and refund fraud. 
111 


Insert 33655A.089

While 1he IRS has made considerable progress in 1his area, addi1ionalwork remains. 

Fighting identity theft is an ongoing battle as identity thieves cominue to create new ways of 

stealing personal infonnation and using it for the-ir gain. Therefore-, it is criticalrhat the IRS has 

the resources and staffing necessary to prevent refund fraud from occurring in the first place, to 

investigate identity theft·related crimes when they do occur~ and to help taxpayers who have 

been vic1imized by idenri1y thieves as quickly as possible. 

Mr. Chainnan, it is clear that draslic funding reductions in recent years have seriously 

eroded 1he IRS' ability 10 provide taxpayers wi1h 1he services 1hey need. Wirhou1addirional 

funding. taxpayers will continue experiencing a degradation of services. including longer wait 

times to receive assistance over the telephone. increasing correspondence inventories, inc.luding 

letters from victims of identity lheft and taxpayers seeking to resolve issues with taxes due or 

looking to set up payment plans. 

Impact on Enforcement & Efforts to Reduce the Federal Deficit 

NTEU believes a Slrong enforcemen1 program 1hat respec1s 1axpayer righ1s, and 

minimizes taxpayer burden~ plays a critical role in IRS' effons to enhance voluntary compliance, 

comba1 1he rising incidence of idemily 1hefr, and reduce the tax gap. 

nf tu nately~ funding reductions in recent years are undennining the Service's ability to 

maximize taxpayer compliance, prevent tax evasion alld reduce the de-ficit The adverse impact 

of insufficient funding on IRS' capacity to collect revenue critical to reducing the federal deficit 

is clear. In FY 2016, operating on a budge< of$ 11.2 billion, 1he IRS collec1ed S3.3trillion, 

roughly 93 percenl of federal government receipls. According to d>e IRS, every dollar invested in 

IRS enforcement programs generates roughly S6 in increased revenues, bur reduced funding for 

enforcement programs in recent years has led to a decline in enforcement revenue since FY 

2007. In FY 2016, 1RS enforcemenr ac1ivi1ies brough1 in $54,3 billion, do""' almos1 SS billion 

from the S59.2 billion of FY 2007. 

The reduction in revenue can be partly attributed to a reduc.tion in the total number of IRS 

enforcement personnel. inc luding revenue officers and revenue agents - two groups critical to 

effons 10 reduce 1he federal budge1 deficit Since FY 2010, 1he 101al number of revenue officers 

and revenue agenrs fell more 1han 32 percenr from 20,510 10 13,791, a reduc1ion of almos1 6,800 

positions. 

\Vithout sufficiem staffing to effectively enforce the law to ensure compliance with tax 

responsibilities and combat fraud. our voluntary tax compliance system is at risk. And as the IRS 

Commissioner has repe-atedly noted. a simple one· percent decline in the compliance rate 

translates into S30 billion in lost revenue for the government. 

Sufficien1 enforcemenr s1afling is also cri1ical if1he IRS is to make further progress on 

closing the tax gap~ which is the amount of tax owed by 1axpayers that is not paid on time. 

According to 1he IRS, 1he amoun1 of tax no11imely paid is S450 billion, 1ransla1ing 10 a 

noncompliance rare of alm0$1 17 perc.ent. 

4 
112 

Æ 


Insert 33655A.090