United States General Accounting Office

GAO Testimony

Before the Subcommittee on Government Management,

Information and Technology, Committee on Government

Reform and Oversight, House of Representatives

For Release on Delivery

Expected at

10 a.m.

Wednesday,

April 15, 1998

INTERNAL REVENUE

SERVICE

Remaining Challenges to

Achieve Lasting Financial

Management Improvements

Statement of Gene L. Dodaro

Assistant Comptroller General

Accounting and Information Management Division

GAO/T-AIMD/GGD-98-139

Mr. Chairman and Members of the Subcommittee:

We are pleased to discuss the results of our audit of the Internal Revenue

Service’s (IRS) fiscal year 1997 custodial financial statements.1

 This audit

was performed in accordance with the Chief Financial Officers Act of

1990, as expanded by the Government Management Reform Act of 1994.

The IRS custodial financial statements report the assets, liabilities, and

results of activities related to IRS’ responsibilities for implementing federal

tax legislation, including collecting federal tax revenues, refunding

overpayments of taxes, and pursuing collections of amounts owed.2

After several years of concerted effort by IRS and GAO, we were, for the first

time, able to conclude that IRS’ custodial financial statements were

reliable. In issuing an unqualified opinion on the fiscal year 1997 custodial

statements within the statutory deadline of March 1, we reported that the

over $1.6 trillion in tax revenue, $142 billion in tax refunds, and $28 billion

in net taxes receivable reported by the IRS were fairly stated. We commend

the significant effort that IRS officials made to achieve this major

accomplishment.

These positive results show that focused attention by the Congress and

this Subcommittee on IRS’ financial management, which GAO has identified

as a high-risk area for many years, has begun to pay dividends. Such

benefits include better information available to IRS management and to the

Congress to help make decisions.

Because of the volume and sensitivity of the tax collections and refunds,

the adequacy of IRS’ financial systems deserves careful attention. Federal

tax revenues dwarf most other financial activities undertaken by any

single entity, public or private, in the world. The government relies upon

IRS to collect the proper amount of tax revenues at the least cost to the

public, serve the public by continually improving the quality of its

products and services, and perform in a manner warranting the highest

degree of public confidence in its integrity. Its revenue collections

represent over 90 percent of the federal government’s revenues. Therefore,

it is imperative that IRS establish strong financial management and internal

controls to effectively meet its mission.

1

See Financial Audit: Examination of IRS’ Fiscal Year 1997 Custodial Financial Statements

(GAO/AIMD-98-77, February 26, 1998).

2

IRS’ fiscal year 1997 administrative financial statements, which were audited by the Inspector General

of the Department of the Treasury (Treasury), report on the financial position and results of

operations related to the administration of IRS funded by appropriations and reimbursements from

other agencies, state and local governments, and the public.

Page 1 GAO/T-AIMD/GGD-98-139
Prior to fiscal year 1997, we were unable to conclude that IRS’ custodial

financial statements were fairly stated, mainly because weaknesses in IRS’

internal controls and financial management systems prevented it from

producing reliable financial information.3

 Therefore, our ability to

conclude that the fiscal year 1997 custodial financial statements were

reliable was a mark of progress. However, this could only be accomplished

after extensive use of ad hoc programming by IRS to extract data from its

systems, followed by numerous adjustments to these data totaling tens of

billions of dollars to produce the final financial statements.

During our fiscal year 1997 audit, we found that IRS’ internal controls

remain plagued by weaknesses that affect its ability to promptly report

reliable financial information throughout the year, safeguard assets from

loss, and assure full compliance with laws and regulations. We reported

these weaknesses related to IRS’s custodial activities as a material

weakness in our report on the fiscal year 1997 consolidated financial

statements of the U.S. government.4

 These weaknesses fall into the

following areas.

• Unpaid assessments. For fiscal year 1997, we were able to report that most

of IRS’ unpaid assessments—amounts IRS had recorded as taxes due to the

federal government but not yet paid—were not receivables and were

largely uncollectible. Of the $214 billion in unpaid tax assessments, only

$90 billion represented receivables of the government under federal

accounting standards, and only $28 billion of these were estimated to be

collectible. However, this information had to be developed through

extracting data from IRS systems, analyzing these data, and making

substantial adjustments to derive reasonable amounts. This condition

exists because IRS’ general ledger cannot identify the portion of unpaid

assessments that represent taxes receivable, and because IRS does not

have a subsidiary ledger to track unpaid assessments. These weaknesses

impair IRS’ ability to effectively manage its unpaid assessments.

• Receipts and refunds. Vulnerabilities in controls over cash received and

refunds disbursed weaken IRS’ ability to assure that all government and

taxpayer funds are properly protected. Cash and checks were not always

properly controlled upon receipt, and flawed procedures allowed

3

For fiscal year 1996, we were able to determine for the first time that total net revenue collections as

reported in IRS’ financial statements were reliable. However, we still could not conclude that IRS

correctly classified tax receipts and refunds by tax type because IRS could not provide sufficient

evidence supporting its classification. We also could not determine the reliability of reported net

federal tax receivables, as in prior years.

4

U.S. Government Financial Statements: Results of GAO’s Fiscal Year 1997 Audit (GAO/T-AIMD-98-128,

April 1, 1998).

Page 2 GAO/T-AIMD/GGD-98-139
improper refunds to be issued. IRS must establish stronger controls over

these areas to ensure that government and taxpayer funds are properly

safeguarded.

• Revenue accounting and reporting. IRS cannot identify the specific

amounts of revenue collected for certain major tax types at time of

remittance. Additionally, IRS certifies amounts to be distributed to trust

funds based on amounts assessed, which, for excise taxes, is not in

accordance with laws governing their distribution.

• Compliance with the Federal Financial Management Improvement Act. IRS’

financial management systems do not comply with the requirements of the

Federal Financial Management Improvement Act of 1996.5

 Consequently,

IRS’ financial management systems cannot routinely produce reliable

financial information for management decision-making and accountability.

• Computer security. Controls over IRS’ automated systems exhibit serious

weaknesses in areas such as physical security, data communications

management, and contingency planning. As a result, these weaknesses

leave the IRS vulnerable to unauthorized access, enabling sensitive data

and programs to be altered or deleted.

In total, these findings frame the remaining challenges that IRS still must

meet to ensure that (1) it is able to effectively manage unpaid assessments,

(2) its financial systems are able to provide accurate, relevant, and timely

management information, (3) funds are properly safeguarded, and (4) its

computer systems are properly designed and protected. IRS is taking steps

to address these issues but additional efforts will be required to fully

implement corrective measures.

The following sections outline our findings and related implications from

the fiscal year 1997 audit for each of the five areas: unpaid assessments,

safeguarding of assets, financial accounting and reporting, Federal

Financial Management Improvement Act compliance, and computer

systems. We also offer our observations on (1) the importance of IRS’

efforts to prepare its automated systems to be Year 2000 compliant and

(2) potential implications of the IRS Commissioner’s proposal for

restructuring the agency on IRS’ financial operations.

5

The Federal Financial Management Improvement Act of 1996 mandates (1) certain financial

management systems requirements for federal agencies, (2) auditors to report on agency compliance

with the financial systems requirements, and (3) agency heads to correct identified deficiencies within

a specified time period.

Page 3 GAO/T-AIMD/GGD-98-139
Unpaid Assessments Unpaid assessments consist of unpaid taxes that IRS has recorded as due to

the government by taxpayers. Based on federal accounting standards,

unpaid assessments are placed in one of the following three categories:

(1) taxes receivable, which are taxes due from taxpayers for which IRS can

support the existence of a receivable through taxpayer agreement (such as

the filing of a tax return) or a court ruling favorable to IRS,

(2) compliance assessments, where neither the taxpayer nor the court has

affirmed that the amounts are owed, such as an assessment resulting from

an audit of the taxpayer, and

(3) write-offs, which are any unpaid assessments for which IRS does not

expect further collections due to factors such as the taxpayer’s

bankruptcy, insolvency, or death.

Because only taxes receivable are reportable in the financial statements, it

is essential for IRS to be able to properly identify the portion of unpaid

assessments that is receivables. To adequately pursue collection of these

receivables, IRS must be able to readily identify the individual debtors and

to support the amounts owed. We found that in fact most of IRS’ recorded

unpaid assessments are not receivables. In addition, several weaknesses

prevent IRS from routinely identifying and tracking its receivables and from

providing documentation supporting the amounts taxpayers purportedly

owe.

Most Unpaid Assessments

Are Not Receivables and

Are Largely Uncollectible

As reflected in the supplemental information to IRS’ fiscal year 1997

custodial financial statements, the unpaid assessments balance was about

$214 billion at September 30, 1997. This balance has historically been

referred to as IRS’ taxes receivable or accounts receivable, even though

taxes receivable make up only one component of unpaid assessments.

Figure 1 depicts the components of the unpaid assessments balance at

September 30, 1997.

Page 4 GAO/T-AIMD/GGD-98-139
Figure 1: Components of IRS’ $214

Billion of Unpaid Assessments (Dollars

in Billions)

13% • Taxes Receivable - Collectible

($28)

29% • Taxes Receivable - Uncollectible

($62)

22%•

Compliance Assessments ($48)

•36%

Write-offs ($76)

Of the $214 billion balance of unpaid assessments, $48 billion represent

compliance assessments that have not been agreed to by either taxpayers

or the courts. Due to the lack of agreement, these compliance assessments

have significantly less potential for future collection than those unpaid

assessments that are considered federal taxes receivable. Seventy-six

billion dollars represent write-offs, which principally consist of payroll and

corporate income taxes owed by bankrupt or defunct businesses,

including many failed financial institutions closed or otherwise resolved

by the Federal Deposit Insurance Corporation (FDIC) and the former

Resolution Trust Corporation (RTC).

The remaining $90 billion of unpaid assessments represent federal taxes

receivable. About 70 percent—$62 billion—of this balance is estimated to

be uncollectible due primarily to the taxpayers’ economic situations, such

as individual taxpayers who are unemployed or having other financial

problems. However, IRS may continue collection action for 10 years after

the assessment or longer under certain conditions. Thus, these accounts

may still ultimately have some collection potential if the taxpayers’

economic conditions improve. Only the remaining 30 percent—about

$28 billion—of federal taxes receivable is estimated to be collectible.

Page 5 GAO/T-AIMD/GGD-98-139
Components of the collectible balance include installment agreements

with estates and individuals, as well as relatively newer amounts due from

individuals and businesses that have a history of compliance.

Since traditionally the full amount of unpaid assessments has been

equated with receivables, it is significant to note that after years of audit

scrutiny, IRS has finally been able to determine that only $28 billion of its

total unpaid assessments of $214 billion—about 13 percent—actually

represent collectible taxes receivable. Thus, while the Congress and IRS

may have been making decisions based on a presumed level of taxes

receivable due the federal government, in fact, only a small portion of that

balance represented receivables for which collection could reasonably be

expected. While such information is necessary for IRS to prepare reliable

financial statements, on a broader level, good reliable financial data are

essential to enable management to measure and report on IRS’

performance and for the Congress to rely upon for making its budgeting

decisions.

In addition, it is also important to note that of the unpaid assessment

balance, about $136 billion (over 60 percent) represents interest and

penalties, as depicted in figure 2, which are largely uncollectible.

Page 6 GAO/T-AIMD/GGD-98-139
Figure 2: Unpaid Taxes and Interest

and Penalty Components of $214

Billion in Unpaid Assessments (Dollars

in Billions)

36% • Taxes ($78)

64%•

Interest and Penalties ($136)

Interest and penalties are a high percentage of the balance because IRS

continues to accrue them through the 10-year statutory collection date,

regardless of whether an account meets the criteria for financial statement

recognition or has any collection potential. For example, despite no hope

of collection, interest and penalties continue to accrue on write-offs, such

as FDIC and RTC cases, as well as on assessments made as a result of audits

of taxpayers where the taxpayers have not agreed to the validity of the

assessments. In fact, the overall growth in unpaid assessments during

fiscal year 1997 was wholly attributable to the accrual of interest and

penalties, rather than to any significant increase in taxes due the

government.

We plan to issue a separate report discussing the composition and

collectibility of IRS’ unpaid assessments in more detail.

General Ledger Cannot

Separate Categories of

Unpaid Assessments

While only the taxes receivable portion of unpaid assessments are

reportable in the financial statements, IRS’ general ledger system cannot

separate the amount of gross or net taxes receivable from total unpaid

assessments. Instead, IRS has to use special computer programs to extract

Page 7 GAO/T-AIMD/GGD-98-139
unpaid assessment data from its master files—the only detailed record of

taxpayer information it maintains—and classify these unpaid assessments

into the three categories (taxes receivable, compliance assessments, and

write-offs). IRS then analyzes those unpaid assessments classified as taxes

receivable to estimate the amount deemed to be collectible (the net taxes

receivable).

In our prior financial audits, IRS attempted to use this approach to

determine the taxes receivable balance. However, various problems

encountered in extracting the information as well as errors made in

attempting to classify the amounts from the data extracted precluded us

from determining that the amounts reported were reliable. For fiscal year

1997 we were able to determine that taxes receivable as reported in the

financial statements were reliable, but this was only after significant

adjustments totaling tens of billions of dollars were made. Figure 3

illustrates the level of adjustments made to the fiscal year 1997 master file

extractions in order to arrive at reliable, auditable amounts for each

category.

Figure 3: Comparison of Unpaid

Assessments Before and After Audit

Adjustments

Taxes

receivable

Compliance 

assessments

Write-offs

Before audit 

adjustments

After audit 

adjustments

Dollars in 

billions

$0 $20 $40 $60 $80 $100 $120 $140

Note: The adjusted balance of taxes receivable presented above represents the gross taxes

receivable (does not include the allowance for doubtful accounts). Additionally, the original

unpaid assessment balance of $236 billion was adjusted to $214 billion, due primarily to

duplicate assessments.

Source: IRS masterfiles and IRS fiscal year 1997 custodial financial statements.

Page 8 GAO/T-AIMD/GGD-98-139
The most significant adjustments related to amounts that were originally

reported as taxes receivable or compliance assessments but were really

write-offs. For example, 149 of the 626 items we sampled—about

24 percent—that were initially identified as taxes receivable in the master

files were actually write-offs and consisted primarily of corporate income

and payroll taxes6

 owed by corporations that had been defunct for years.

Similarly, 23 percent of the compliance assessments we sampled were also

write-offs. The extensive reliance IRS must place on ad hoc procedures to

identify actual taxes receivable and the significant adjustments necessary

to make these data reliable raise serious questions about the integrity of

unaudited IRS information and the ability of IRS to effectively manage its

unpaid assessments.

IRS Lacks a Subsidiary

Ledger to Track Unpaid

Assessments

As we have reported in our previous financial audits, IRS does not have a

detailed listing, or subsidiary ledger that tracks and accumulates unpaid

assessments on an ongoing basis. Such a subsidiary ledger could have

compensated for the general ledger’s inability to separate unpaid

assessments. Additionally, the lack of a detailed subsidiary ledger also

impairs IRS’ ability to effectively manage the unpaid assessments.

For example, IRS’ current systems cannot ensure that all parties liable for

certain assessments get credit for payments made on those assessments.

Specifically, payments made on unpaid payroll tax withholdings for a

troubled company, which can be collectible from multiple individuals, are

not always credited to the responsible parties to reflect reductions in their

tax liability. In 53 of 83 cases we reviewed involving multiple individuals

and companies, we found that payments were not accurately recorded to

reflect the reduction in the tax liability of each responsible party. For

example, in one case we reviewed, three individuals had multimillion

dollar tax liability balances, as well as liens placed against their property,

even though the tax had been fully paid by the company.

A proper subsidiary ledger for unpaid assessments is necessary to provide

management with complete, up-to-date information about the amounts

due from each taxpayer, so that managers will be in a position to make

informed decisions about collection efforts and collectibility estimates.

This requires a subsidiary ledger that (1) makes readily available to

management the amount, nature, and age of all unpaid assessments

outstanding by tax liability and taxpayer and (2) can be readily and

6

Payroll tax withholdings consist of individual income tax withholdings and employer and employee

withholdings for Federal Insurance Contribution Act, which include Social Security and Hospital

Insurance taxes.

Page 9 GAO/T-AIMD/GGD-98-139
routinely reconciled to corresponding general ledger balances for financial

reporting purposes. Such a system should also track and make available

key information necessary to assess collectibility, such as account status,

payment and default history, and installment agreement terms.

We will be issuing a separate report on this issue. In that report, we will be

making recommendations to assist IRS in identifying the key components

needed for an effective subsidiary ledger for unpaid assessments.

Documentation

Improvements Are Still

Needed

We also continued to find in our fiscal year 1997 audit that IRS has

problems locating and providing supporting documentation for its unpaid

assessments, primarily due to the age of the items. IRS has acknowledged

problems with documentation and is working to make needed

improvements in this area. We will continue to work with IRS in identifying

ways to improve documentation.

Vulnerabilities Exist

in Controls Over

Receipts and Refunds

Our fiscal year 1997 audit identified vulnerabilities in IRS’ controls over

both its receipts and refunds processes, which raise concerns over IRS’

ability to protect the government’s money. We found that IRS’ controls over

the receipt of cash and checks it receives directly from taxpayers are not

adequate to assure that these payments will be properly credited to

taxpayer accounts and deposited to the Treasury’s general revenue fund.

To ensure appropriate security over payments received at its lock box7

depositories, IRS requires controls such as the use of a surveillance camera

to monitor staff when they open mail containing cash and checks.

However, we found that controls over cash payments received at the four

IRS service centers where we tested such controls were not held to

comparable standards. At these locations, IRS allowed individuals to open

mail unobserved, relying on them to accurately report amounts received,

and did not require payments received to be logged or otherwise recorded

at the point of receipt to immediately establish accountability and thereby

deter and detect diversion.

In fact, accountability for cash and checks received at a service center is

not established until the money has passed through several sets of hands,

as illustrated in the attachment to this statement.

7

A lock box is a cash management service provided by banks under contract to IRS. Using this service,

taxpayers mail payments to a post office box or a lock box facility where the contract banks collect

the receipts, deposit them in Treasury’s general revenue fund, and report the receipts to IRS.

Page 10 GAO/T-AIMD/GGD-98-139
In addition, during our review we observed that at one service center, on

several occasions, payments were being received by personnel who should

not have been authorized to accept such payments. As a result of these

weaknesses, IRS is vulnerable to losses of cash and checks received from

taxpayers. In fact, between 1995 and 1997, IRS identified 80 instances of

actual or alleged employee embezzlement of receipts totaling about

$5.3 million. These actual and alleged embezzlements underscore the need

for effective internal controls over the IRS’ service center and district office

receipts processes.

We also found that IRS did not have sufficient preventive controls over

refunds to assure that inappropriate refunds were not disbursed. Such

inappropriate payments have taken the form of refunds improperly issued

or issued for incorrect amounts that IRS did not identify because of flawed

IRS procedures, or fraud by IRS employees. For example, we found nine

instances where refunds were paid for inappropriate amounts. Three of

these occurred because IRS did not compare tax returns to the attached

W-2s (Wage and Tax Statement) at the time the returns were initially

processed and, consequently, did not detect discrepancies with pertinent

information on the tax returns. As we have reported in prior audits, such

inconsistencies generally go undetected until such time as IRS completes

its document matching program,8

 which can take as long as 18 months. In

addition, during fiscal year 1997, IRS identified alleged employee

embezzlement of refunds totaling over $269,000. IRS is also vulnerable to

issuance of duplicate refunds made possible by gaps in IRS’ controls. IRS

reported this condition as a material weakness in its fiscal year 1997

Financial Managers’ Financial Integrity Act report.

We will be reporting on these issues in more detail, and our

recommendations for strengthening controls over receipts and refund

processes, in a follow-on report on internal control issues at IRS.

Revenue Accounting

and Reporting

IRS is unable to currently determine the specific amount of revenue it

actually collected for the Social Security, Hospital Insurance,9

 Highway,

8

This program involves matching tax return information with information provided by third parties

(e.g., 1099, W-2) to identify any differences for further investigation.

9

The Hospital Insurance Trust Fund (HI) is one of two trust funds comprising the accumulated funds

of the Medicare program. The other Medicare trust fund is the Supplemental Medical Insurance Trust

Fund (SMI). Of these trust funds, only HI receives distributions from the Treasury’s general revenue

fund.

Page 11 GAO/T-AIMD/GGD-98-139
and other relevant trust funds. As we previously reported,10 the primary

reason for this weakness is that the accounting information needed to

validate taxpayers’ liability and record the payments to the proper trust

funds is not provided at the time that taxpayers remit payments.

Information is provided on the tax return, which can be received as late as

9 months after a payment is submitted. However, the information on the

return only pertains to the amount of the tax liability, not the distribution

of the amounts previously collected. As a result, IRS cannot currently

report actual revenue collected for Social Security, Hospital Insurance,

Highway, and other trust funds nor can it accurately report revenue

collected for individuals. Because of this weakness, IRS had to report

Social Security, Hospital Insurance, and individual income tax collections

in the same line item on its Statement of Custodial Activity for fiscal year

1997. However, requirements for the form and content of governmentwide

financial statements11 require separate reporting of Social Security,

Hospital Insurance, and individual income taxes collected. Beginning in

fiscal year 1998, federal accounting standards12 will also require this

reporting.

Taxes collected by IRS on behalf of the federal government are deposited

in the general revenue fund of the Treasury, where they are subsequently

distributed to the appropriate trust funds. Amounts representing Social

Security and Hospital Insurance taxes are distributed to their respective

trust funds based on information certified by the Social Security

Administration (SSA).13 For excise taxes, IRS certifies the amounts to be

distributed based on taxes assessed, as reflected on the relevant tax forms.

However, by law, distributions of excise taxes are to be based on taxes

actually collected.

We also found IRS did not have adequate controls over its process of

certifying excise tax distributions to the appropriate trust funds. The lack

of fundamental internal controls, such as supervisory review, resulted in a

10Financial Management: Important IRS Revenue Information Is Unavailable or Unreliable

(GAO/AFMD-94-22, December 21, 1993).

11OMB’s Format and Instructions for the Form and Content of the Financial Statements of the U.S.

Government (September 2, 1997).

12The Federal Accounting Standards Advisory Board recommends accounting standards, and OMB,

Treasury, and GAO decide whether to adopt the recommended standards; if they are adopted, the

standards are published by OMB and GAO.

13Social Security and Hospital Insurance taxes are required to be distributed based on a certification by

the Commissioner of SSA. This certification is based on wage information maintained by SSA, which

may be augmented by IRS assessed amounts. However, generally this certification is based on IRS

assessed amounts.

Page 12 GAO/T-AIMD/GGD-98-139
number of errors14 that affected the amounts ultimately distributed to the

trust funds. We found inadequacies in the review of excise tax

• returns received, resulting in taxpayer errors on the returns going

undetected;

• returns processed, resulting in IRS input errors going undetected; and

• certifications prepared, resulting in human error in extracting and

analyzing data from the master file going undetected.

As a result of these weaknesses, trust funds may not have received the

proper amount of excise tax revenue during fiscal year 1997. In fact, these

weaknesses were a contributing factor in the Department of

Transportation Inspector General’s qualified opinion on the fiscal year

1997 financial statements of the Highway Trust Fund.

IRS Systems Do Not

Comply With

Requirements

The Federal Financial Management Improvement Act of 1996 requires

auditors performing financial audits to report whether agencies’ financial

management systems comply substantially with federal accounting

standards, financial systems requirements, and the government’s standard

general ledger at the transaction level. The act’s premise is that agencies

that satisfy the act’s systems requirements will be better positioned to

routinely produce complete and reliable financial information for

managing operations and ensuring management accountability.

In our fiscal year 1997 audit of IRS, we reported that IRS’ systems do not

substantially comply with the requirements of the act. For example, IRS’

general ledger does not conform to the government standard general

ledger at the transaction level. Additionally, IRS’ lack of a subsidiary ledger

for unpaid assessments does not comply with federal financial

management systems requirements. In many respects, the status of IRS’

systems mirrors what we found across the federal government. As we

outlined in our report on the fiscal year 1997 consolidated financial

statements of the U.S. government, the majority of federal agencies’

financial management systems are not designed to meet current

accounting standards and systems requirements and thus cannot routinely

provide reliable information for management decision-making and

accountability.

We have reported on many of these issues in our IRS financial audits over

the years and made recommendations for corrective action. Although IRS

14See Agreed-Upon Procedures: Excise Taxes (GAO/AIMD-98-78R, February 26, 1998).

Page 13 GAO/T-AIMD/GGD-98-139
has drafted a plan of action intended to incrementally improve its financial

reporting capabilities, which is scheduled to be fully implemented during

fiscal year 1999, the plan falls short of fully meeting federal financial

management system requirements. IRS also has a longer range plan to

address the financial management system deficiencies noted in prior

audits and in IRS’ own self-assessment.15 During future audits, we will

monitor IRS’ implementation of these initiatives, and assess their

effectiveness in resolving the issues discussed above.

Computer Systems

Issues

IRS places extensive reliance on computer systems to process tax returns,

maintain taxpayer data, calculate interest and penalties, and generate

refunds. The huge volume of transactions it processes and the

decentralized structure of the agency—which includes two computing

centers, 10 service centers, and numerous district offices

nationwide—make its operations highly computer-driven. In addition, the

IRS Commissioner recently testified that electronic filing of returns and

taxpayer use of its electronic payment system has significantly increased

and is continuing to grow.16 Consequently, it is critical that IRS maintain

effective internal controls over these systems.

Controls Over Computer

Security Are Inadequate

We previously reported that IRS had serious weaknesses in the controls

used to safeguard its computer systems, facilities, and taxpayer data.17 Our

review of these controls as part of our audit of IRS’ fiscal year 1997

custodial financial statements found that overall controls continued to be

ineffective. IRS’ controls over automated systems continued to exhibit

significant weaknesses in areas such as physical security and data

communications management. These weaknesses can allow unauthorized

individuals access to critical hardware and software where they may

intentionally or inadvertently add, alter, or delete sensitive data or

programs. We have found that such weaknesses are widespread

throughout the government, as discussed in our report on the fiscal year

1997 consolidated financial statements of the U.S. government.

15Tax Systems Modernization: Blueprint Is a Good Start But Not Yet Sufficiently Complete to Build or

Acquire Systems (GAO/AIMD/GGD-98-54, February 24, 1998).

16Hearing on the 1998 Tax Return Filing Season and the IRS Budget for Fiscal Year 1999, Statement of

Charles O. Rossotti, Commissioner, Internal Revenue Service, before the Committee on Ways and

Means, Subcommittee on Oversight, March 31, 1998.

17See Financial Audit: Examination of IRS’ Fiscal Year 1996 Custodial Financial Statements

(GAO/AIMD-98-18, December 24, 1997), and IRS Systems Security: Tax Processing Operations and

Data Still at Risk Due to Serious Weaknesses (GAO/AIMD-97-49, April 8, 1997).

Page 14 GAO/T-AIMD/GGD-98-139
IRS recognized these weaknesses in its fiscal year 1997 Financial Managers’

Financial Integrity Act report and has corrected a significant number of

the computer security weaknesses identified in our previous audits.

Additionally, IRS has centralized responsibility for security and privacy

issues and added staff in this area. IRS informed us it plans to substantially

address the remaining weaknesses by June 1999. However, until corrected

fully, IRS’ automated systems remain vulnerable to losses, delays or

interruptions in service, and compromise of the sensitive information

entrusted to IRS by taxpayers. We are continuing to review IRS’ efforts in

this area, and plan to issue separate reports, by IRS location, on computer

security issues we identify, along with recommendations for corrective

action. We will also follow up on these issues as part of our fiscal year

1998 financial audit.

Success of IRS’ Year 2000

Efforts Is Critical

It is critical that IRS successfully address its Year 2000 computing problem.

The Year 2000 problem is rooted in the way dates are recorded and

calculated in many computer systems. For the past several decades,

systems have typically used two digits to represent the year in order to

conserve on electronic data storage and reduce operating costs. With this

two-digit format, however, the year 2000 is indistinguishable from the year

1900. As a result, systems hardware and software (system and application)

that are date dependent may generate incorrect results, or fail to work at

all, when processing years after 1999. We have reported this issue as a

governmentwide high risk area,18 and the President has designated it as a

priority management objective. In addition, we discussed this as a serious

governmentwide issue in both our report on the fiscal year 1997

consolidated financial statements of the U.S. government and in a recent

hearing before this subcommittee.19

IRS has one of the largest conversion efforts in the civilian sector

underway. IRS’ goal is to complete all renovation efforts scheduled for

completion by January 1999 in order to allow a full year of operational

testing. However, with less than 21 months remaining, the task of

completing renovation and testing on time is formidable. If IRS is unable to

make its mission-critical systems Year 2000 compliant, IRS could be

rendered unable to properly process tax returns, issue refunds, correctly

calculate interest and penalties, effectively collect taxes, or prepare

accurate financial statements and other financial reports. We are working

18High-Risk Series: Information Management and Technology (GAO/HR-97-9, February 1997).

19Year 2000 Computing Crisis: Strong Leadership and Effective Public/Private Cooperation Needed to

Avoid Major Disruptions (GAO/T-AIMD-98-101, March 18, 1998).

Page 15 GAO/T-AIMD/GGD-98-139
with the Congress and the executive branch to strengthen our nation’s

Year 2000 efforts, including those of key sectors of our nation’s economy

as well as the associated efforts of key federal agencies. We plan to review

the effectiveness of IRS’ Year 2000 program in conjunction with our fiscal

year 1998 financial audit.

Comments on IRS

Restructuring

Over the past decade, IRS has proposed and initiated many efforts aimed at

reengineering its business processes and modernizing its computer

systems. Some of these efforts have resulted in improvements in the way

IRS conducts its business and deals with taxpayers. Nonetheless, it is

widely recognized that much more needs to be done.

Commissioner Rossotti recently announced his plans for modernizing IRS.

The overriding concept of the plan is to change IRS from an

internally-focused organization to one that emphasizes assistance to

taxpayers in complying with the tax laws and ensures the fair treatment of

taxpayers. While IRS has announced many plans for restructuring and

modernization over the past decade, Mr. Rossotti’s plan appears to go far

beyond past proposals by, among other things, changing IRS’ organizational

structure to reflect a new focus. The Commissioner has categorized his

proposed changes as falling into several key areas, including (1) an

organizational structure built around taxpayer needs, (2) balanced

performance measures, and (3) new technology.

Organizational Structure

Built Around Taxpayer

Needs

IRS currently has three separate kinds of organizations, spread over 43

organizational units, that use several separate computer systems to

support their activities. Under the Commissioner’s proposed changes, IRS

would be reorganized into four units, each serving a different group of

taxpayers: (1) wage earners, (2) sole proprietors and other small

businesses, (3) large corporations, and (4) tax-exempt entities. Under the

proposal, each group of taxpayers would be the complete responsibility of

a business center, from the processing of returns to collecting delinquent

taxes. The Commissioner’s proposal is based on the belief that different

groups of taxpayers need very different types of assistance and programs

to be compliant and that tax administration needs to recognize this to

meet those needs.

While the implementing details of his proposal are not yet in place and,

consequently, we have not evaluated the proposal in detail, this would

appear to make sound business sense. If implemented, an organizational

Page 16 GAO/T-AIMD/GGD-98-139
focus on taxpayers could bring together different functions, such as

customer service and collections, to target those taxpayers that are

noncompliant and better ensure that IRS is treating compliant taxpayers

fairly.

Balanced Measures of

Performance

The Commissioner’s plan emphasizes the importance of having measures

of organizational performance that balance customer satisfaction,

business results, employee satisfaction, and productivity. The intent is to

provide incentives for service-oriented, as opposed to inappropriate,

behavior toward taxpayers, which is in line with the plan’s overriding

concept. As IRS refines its performance measures, getting stakeholder

involvement is important. Stakeholders, including the Congress, the

executive branch, and other interested parties, could help IRS as it devises

performance measures. Conceived in this way, the measures would

enhance IRS’ ability to make informed decisions about how to allocate its

resources between the competing demands of taxpayer assistance and

enforcement.

New Technology The Commissioner’s plan notes that a key factor limiting IRS’ ability to

modernize its business practices is the extent of deficiencies that exist in

IRS’ computer systems, which significantly affect the ability of these

systems to support IRS’ mission and goals. The plan points out, however,

that the new business practices and organizational structure provide a

basis for completing and implementing the modern systems outlined in IRS’

recently issued technology modernization blueprint.

As we have reported many times, existing IRS systems do not provide ready

access to needed information and, consequently, do not adequately

support modern work processes. Modernized systems would significantly

assist IRS in carrying out its mission. However, it is important to note that

the systems architecture and sequencing plan outlined in the

modernization blueprint issued by IRS in May 1997 were premised on the

agency’s concept of business operations and related business

requirements that existed at that time. To the extent that the

Commissioner’s organizational restructuring alters these business

operations and functions, the architecture and sequencing plan may need

to be modified.

Page 17 GAO/T-AIMD/GGD-98-139
Moreover, as we reported in February 1998,20 the modernization

blueprint’s business requirements, systems architecture, and sequencing

plan have yet to be validated using defined, implemented systems life cycle

processes. Such validation is essential to ensure that IRS’ modernization

plans are complete and correct. In light of the Commissioner’s planned

restructuring of the agency, the need for such validation of the blueprint is

even more acute. Therefore, we reiterate our recommendation that IRS

validate the business requirements, architecture, and sequencing plan

using the completed and implemented systems life cycle processes.

Long-Standing Financial

Management Issues Must

Still Be Addressed

The Commissioner has brought in the consulting firm of Booz-Allen &

Hamilton to validate the concept of his proposed restructuring plan in

terms of risk, cost and impact on customers, both external and internal.

However, it is important to note that a key to the IRS’ ability to effectively

carry out its mission is sound financial management. This requires strong

financial management systems and internal controls to ensure that

information used in decision-making is routinely available and reliable.

This holds true under IRS’ existing structure as well as the focus and

structure of the organization as envisioned in the Commissioner’s plan.

Consequently, for the Commissioner’s restructuring plan to be successful,

it is critical that the longstanding internal control and systems weaknesses

we have identified in our audits, as well as the new issues identified during

our fiscal year 1997 audit, be fully addressed and corrected. It is only

through such actions that IRS will be able to routinely and promptly

produce reliable information necessary to fulfill its mission. This will

prove to be a significant challenge for IRS, as many of these issues are

complex and do not lend themselves to short-term solutions.

Our hope is that the business goals of the new IRS Commissioner coupled

with continued congressional oversight will change the agency culture to

recognize the critical importance of resolving IRS’ financial management

issues. Commissioner Rossotti recently testified that IRS has a new focus

and fundamental commitment to customer service and his proposed plan

to restructure the IRS emphasizes this new focus and commitment.

However, IRS cannot achieve excellence in customer service without

lasting improvements in its financial management. We look forward to

continuing to work with IRS on long-term solutions to these problems.

20Tax Systems Modernization: Blueprint Is a Good Start But Not Yet Sufficiently Complete to Build or

Acquire Systems (GAO/AIMD/GGD-98-54, February 24, 1998).

Page 18 GAO/T-AIMD/GGD-98-139
Mr. Chairman, this concludes my prepared statement. I would be pleased

to answer any questions.

Page 19 GAO/T-AIMD/GGD-98-139
Attachment 

Initial Handling of Service Center Mail

Mail Room

Extraction Unit

Perfection Unit

Remittance 

Processing Units

Returns with cash 

or checks

Sorts and 

distributes mail

Opens, extracts, 

and sorts mail

If errors are 

identified, 

performs 

corrections

Enters returns 

and receipts 

into system

No log to track individual receipts

No count of receipts received

No surveillance device

No log to track individual receipts

No dual controls over opening of mail

No surveillance device

No count of receipts received and 

extracted

No log to track individual receipts

No count of receipts processed

No surveillance device

Specific control number assigned to 

individual receipts

Checks encoded and endorsed

Inventory sheet created for all receipts 

processed through system

Unit Function Status of Internal Controls

(919212) Page 20 GAO/T-AIMD/GGD-98-139
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100