GAO-04-553R IRS Management Report 

United States General Accounting Office

Washington, DC 20548 

April 26, 2004 

The Honorable Mark W. Everson 

Commissioner of Internal Revenue 

Subject: Management Report: Improvements Needed in IRS's Internal Controls 

and Accounting Procedures 

Dear Mr. Everson: 

In November 2003, we issued our report on the results of our audit of the Internal 

Revenue Service’s (IRS) financial statements as of and for the fiscal years ending 

September 30, 2003 and 2002, and on the effectiveness of its internal controls as of 

September 30, 2003.1 We also reported our conclusions on IRS’s compliance with 

significant provisions of selected laws and regulations and on whether IRS’s financial 

management systems substantially comply with requirements of the Federal 

Financial Management Improvement Act of 1996. A separate report on the 

implementation status of recommendations from our prior IRS financial audits and 

related financial management reports including this one will be issued shortly. 

The purpose of this report is to discuss issues identified during our fiscal year 2003 

audit regarding internal controls and accounting procedures that could be improved 

for which we do not presently have any recommendations outstanding. Although not 

all of these issues were discussed in our fiscal year 2003 audit report, they all warrant 

management’s consideration. This report contains 15 recommendations that we are 

proposing IRS implement in order to improve its internal controls and accounting 

procedures. We conducted our audit in accordance with U.S. generally accepted 

government auditing standards. 

Results in Brief 

During fiscal year 2003, we identified a number of internal control issues that 

adversely affected safeguarding of tax receipts, budgeting, operating costs, and 

financial reporting. These issues concern (1) enforcement of lockbox bank2

contractor policies, (2) courier service requirements, (3) lockbox bank management 

 

1

U.S. General Accounting Office, Financial Audit: IRS’s Fiscal Years 2003 and 2002 Financial 

Statements, GAO-04-126 (Washington, D.C.: Nov. 13, 2003). 2

Lockbox banks are financial institutions designated as depositories and financial agents of the U.S. 

government to perform certain financial services, including processing tax documents, depositing the 

receipts, and then forwarding the documents and data to IRS’s service center campuses, which update 

taxpayers’ accounts. 
Page 2 GAO-04-553R IRS Management Report 

reviews, (4) candling,3 (5) safeguarding of taxpayer receipts and information at IRS 

field offices and service center campuses, (6) physical security, (7) deobligation of 

funds, (8) overpayments to employees’ Thrift Savings Plan (TSP) accounts, 

(9) financial statement disclosures, and (10) interim performance measures. 

Specifically, we found the following: 

• IRS did not require lockbox banks to maintain information on the employment 

start dates of their contractors4

 who have access to taxpayer receipts and related 

information. As a result, there is no evidence that lockbox managers are adhering 

to IRS’s criterion that contractors receive favorable fingerprint results prior to 

having access to taxpayer receipts and information. 

• IRS allowed immediate family members to serve as couriers together, thereby 

undermining the intent of IRS’s requirements that two-person courier teams 

transport taxpayer receipts to depositories. Allowing two-person courier teams to 

consist of related individuals or individuals in close relationships increases the 

risk of collusion and consequently the theft of taxpayer receipts. 

• IRS did not require documentary evidence that lockbox management performed 

required reviews of certain control logs and transmittal documents. At the 

lockbox banks we visited, there were several instances for which no evidence of 

required reviews was available. The lack of such evidence reduces IRS’s 

assurance that the reviews are performed, in turn increasing the risk of untimely 

detection of theft of, loss of, or unauthorized access to taxpayer information and 

receipts. 

• Automated mail extraction machines used to perform candling were not checked 

prior to use to ensure that they were operating properly. As a result, IRS’s risk of 

loss of receipts and taxpayer information was increased. 

• IRS did not always follow the required procedures to safeguard taxpayer receipts 

and information in its facilities. We found (1) taxpayer receipts and information 

kept in unsecured containers and areas at field offices and (2) discovered 

remittances5

 stored in unsecured containers and areas at a service center campus. 

The reduced level of protection given to these taxpayer receipts and data 

increases the risk of their theft, loss, or misuse. 

 

3

Candling is a process used by IRS to determine if any contents remain in open envelopes. This is often 

achieved by passing the envelopes over a light source. 

4

For the purpose of this report, the term “lockbox bank contractors” refers to all individuals in a 

contractual relationship with a lockbox bank who are granted staff-like access to the lockbox bank but 

are not involved in the extraction and posting of receipts. This would include couriers and janitorial 

and equipment maintenance personnel. 

5

Discovered remittances are cash and noncash taxpayer receipts that instead of being identified and 

processed during the initial mail extraction phase are found later during further processing of mail. 
Page 3 GAO-04-553R IRS Management Report 

• Security guards did not respond to alarms at two of the four service center 

campuses we visited. The lack of timely response to alarms increases the risk of 

theft of taxpayer receipts and information as well as untimely detection of such 

incidents. 

• IRS did not always timely identify and deobligate outstanding obligations, 

hindering its ability to use the funds for other programs and initiatives. 

• IRS did not have controls in place to provide reasonable assurance that payroll 

calculations made on its behalf by the National Finance Center (NFC) were not 

adversely affected by control weaknesses at NFC, resulting in inaccurate 

contributions to employee TSP accounts. 

• IRS’s controls over the calculation and reporting of Other Claims for Refunds in 

the supplemental information to its financial statements were not effective in 

preventing errors from occurring in the reporting of those amounts. 

• IRS lacked adequate controls over the preparation of interim period performance 

management data. As a result, IRS reported inaccurate or outdated interim 

performance data, and program managers lacked consistent and reliable 

information to make informed decisions on interim program performance. 

At the end of our discussion of each of these issues in the following sections, we 

make recommendations for strengthening IRS’s internal controls. These 

recommendations are intended to bring IRS into conformance with the internal 

control standards that federal agencies are required to follow.6

In its comments, IRS agreed with our recommendations and described actions it was 

taking or planned to take to address the control weaknesses described in this report. 

At the end of our discussion of each of the issues in this report, we have summarized 

IRS’s related comments and provided our evaluation. 

Scope and Methodology 

As part of our audit of IRS’s fiscal years 2003 and 2002 financial statements, we 

evaluated IRS’s internal controls and its compliance with selected provisions of laws 

and regulations. We designed our audit procedures to test relevant controls, including 

those for proper authorization, execution, accounting, and reporting of transactions. 

We requested comments on a draft of this report from the Commissioner of Internal 

Revenue. We received written comments from the Commissioner and have reprinted 

the comments in enclosure I. Further details on our audit scope and methodology are 

 

6

U.S. General Accounting Office, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). 
Page 4 GAO-04-553R IRS Management Report 

included in our report on the results of our audits of IRS’s fiscal years 2003 and 2002 

financial statements and are reproduced in enclosure II.7

Enforcement of Lockbox Contractor Background Investigation Policies 

In previous years, we found that IRS allowed lockbox bank employees and 

contractors access to cash, checks, and other taxpayer data at lockbox banks before 

lockbox management had received satisfactory results of the individuals’ background 

investigations, thereby subjecting IRS to an increased risk of theft or misuse of 

taxpayer receipts and data.8

 During our fiscal year 2003 audit, we found that IRS had 

made substantial progress in this area with regard to lockbox bank employees and, as 

a result, had substantially reduced its exposure related to the risks of hiring 

individuals prior to receiving the results of satisfactory background investigations. 

Additionally, IRS procedures require lockbox bank managers to ensure that they have 

received satisfactory results of fingerprint checks from the National Background 

Investigation Center (NBIC) for lockbox bank contractors, such as couriers, before 

they are granted staff-like access to the lockbox processing area or are entrusted with 

taxpayer receipts and information. However, at two of the four lockbox bank 

locations we visited this year, lockbox bank managers could not provide the 

necessary data to demonstrate that they had not granted contractors, such as 

couriers, access to taxpayer data without having previously received satisfactory 

fingerprint check results from NBIC. 

At one of the two locations where management was unable to demonstrate that it had 

received satisfactory fingerprint check results before it had granted couriers access 

to taxpayer receipts and data, the couriers’ start dates were inconsistent with data 

gathered from that same location during the prior year’s audit. As a result, we 

concluded that the lockbox bank’s data on contractor start dates were unreliable. At 

the second location, lockbox bank management informed us that maintaining 

information on start dates for contractors was not a requirement. From the 

information provided by the lockbox bank managers, we were not able to verify the 

controls the lockbox bank uses to validate its adherence to the fingerprinting 

requirement for contractors. GAO’s Standards for Internal Control in the Federal 

Government requires agencies to establish controls to safeguard vulnerable assets.9

Until IRS ensures that lockbox bank managers allow only contractors who have 

successfully met the background investigation requirements to have access to 

taxpayer receipts and data and sensitive IRS information, the federal government will 

be unnecessarily exposed to the risk of loss, theft, or misuse of taxpayer receipts and 

information. 

 

7

GAO-04-126. 

8

U.S. General Accounting Office, Internal Revenue Service: Progress Made, but Further Actions 

Needed to Improve Financial Management, GAO-02-35 (Washington, D.C.: Oct. 19, 2001). 9

GAO/AIMD-00-21.3.1. 
Page 5 GAO-04-553R IRS Management Report 

Recommendation

We recommend that IRS require lockbox bank managers to maintain appropriate 

documentation on-site demonstrating that satisfactory fingerprint results have been 

received before contractors are granted access to taxpayer receipts and data. 

IRS Comments and Our Evaluation

IRS agreed with our recommendation and indicated that its current Lockbox 

Processing Guideline (LPG) now requires appropriate documentation for couriers 

and guards before they are granted access to taxpayer receipts. Additionally, to 

ensure compliance with the LPG, IRS has included the requirement in its security and 

administrative reviews. We will evaluate the effectiveness of IRS’s efforts during our 

fiscal year 2004 financial audit. 

Courier Requirements

In a number of reports, we have pointed out that IRS lacks effective controls over 

various aspects of courier services used to transport taxpayer receipts.10 We have 

made numerous recommendations to IRS to strengthen related controls. IRS has 

made significant efforts to address the courier security weaknesses we identified by 

adopting more stringent security standards for couriers who transport IRS's daily 

deposits to depositary institutions. In particular, IRS adopted a requirement that 

courier service employees work in pairs to mitigate the risk of loss. 

While this modification was well conceived, it does not satisfactorily reduce risk in 

certain atypical situations we found at two service center campuses and one lockbox 

bank location we visited. At the two campuses, we found courier teams consisting of 

(1) a husband and wife and (2) a mother and daughter. At the lockbox bank location, 

we found one team consisting of a husband and wife11 and another team consisting of 

a father and son. When courier team members have close relationships, the risk of 

collusion is increased and the assurance provided by having two-person courier 

teams is diminished. 

Recommendation 

We recommend that IRS revise its policy on two-person courier teams to prohibit the 

use of courier teams consisting of closely related individuals to further minimize the 

risk of collusion in the theft of taxpayer receipts and data. 

 

10U.S. General Accounting Office, Internal Revenue Service: Physical Security Over Taxpayer 

Receipts and Data Needs Improvement, GAO/AIMD-99-15 (Washington, D.C.: Nov. 30, 1998); Internal 

Revenue Service: Custodial Financial Management Weaknesses, GAO/AIMD-99-193 (Washington, 

D.C.: Aug. 4, 1999); Internal Revenue Service: Recommendations to Improve Financial and 

Operational Management, GAO-01-42 (Washington, D.C.: Nov. 17, 2000); Management Report: 

Improvements Needed in IRS's Accounting Procedures and Internal Controls, GAO-02-746R 

(Washington, D.C.: July 18, 2002); and GAO-02-35. 

11This husband and wife team is the same husband and wife team we noted at one of the service center 

campuses. 
Page 6 GAO-04-553R IRS Management Report 

IRS Comments and Our Evaluation

In response to our recommendation, IRS agreed to work with its Revenue and 

Deposit Branch to assess the risks associated with its current courier policy and 

determine if changes are needed. We will evaluate IRS’s conclusions and any 

corrective actions during our fiscal year 2004 financial audit. 

Lockbox Management Reviews 

During our fiscal year 2003 financial audit, we found instances in which there was no 

evidence that lockbox management performed certain required reviews. GAO’s 

Standards for Internal Control in the Federal Government12 requires agencies to 

establish controls to enforce adherence to requirements, such as management 

reviews, and to create and maintain records providing evidence that these controls 

are executed. 

We visited four lockbox banks during our fiscal year 2003 audit. We found that at all 

four of these lockbox banks, there was no documentary or other evidence that some 

required management reviews of control logs and transmittal documents relating to 

transport of taxpayer receipts and access to taxpayer receipts and data had been 

performed. The lack of such evidence increases the risk that the reviews are not 

performed, thereby increasing the risk of untimely detection of theft of, loss of, or 

unauthorized access to taxpayer receipts and data. 

As discussed above, lockbox banks use couriers to transport taxpayer receipts and 

taxpayer information to depositories and to service center campuses. Each lockbox 

bank is required to maintain a log showing the courier driver’s signature, date and 

time of pickup, and number of boxes transported for all courier services, and lockbox 

bank managers are required to review these control logs monthly. At three of the four 

lockbox banks we visited, we found no evidence such as a reviewer’s signature or 

initial, date, or comment, that managers had reviewed these logs. On two of the logs 

we reviewed, we noted that the courier drivers’ signatures were missing, and at one 

lockbox bank we noted that no log existed for service center campus shipments or 

depository pickups. We also noted that at one of the lockbox banks, the transmittal 

document that is required to accompany all shipments of IRS- and taxpayer-related 

information, including cartridges and microfilm, from any bank site to the service 

center campus was frequently incomplete and often lacked a complete count of the 

items shipped. This transmittal document is extremely important since it is the only 

way assure that all packages included in each shipment are properly and timely 

received and acknowledged by the addressee at the service center campus. 

IRS also requires that lockbox banks using automated entry systems (AES) to the 

lockbox processing areas establish and maintain logs controlling key, proximity, and 

swipe cards in order to provide an up-to-date audit trail of employee access and to 

 

12GAO/AIMD-00-21.3.1. 
Page 7 GAO-04-553R IRS Management Report 

deter unauthorized access to restricted areas. Lockbox managers are required to 

review these logs monthly. At two of four lockbox banks we visited, managers either 

lacked evidence of their monthly review or did not perform the review in accordance 

with established guidelines. At one of these two lockbox banks, we noted that the 

AES control log did not list the dates that proximity cards were enabled or disabled. 

The lack of evidence of managerial reviews reduces IRS’s assurance that such 

reviews are performed, thereby increasing the risk of untimely detection of theft of, 

loss of, or unauthorized access to taxpayer receipts and data. 

Recommendation

We recommend that IRS develop procedures to require lockbox managers to provide 

satisfactory evidence that managerial reviews are performed in accordance with 

established guidelines. At a minimum, reviewers should sign and date the reviewed 

documents and provide any comments that may be appropriate in the event that their 

reviews identified problems or raised questions. 

IRS Comments and Our Evaluation

IRS agreed with our recommendation and stated that it would (1) consider the risk 

level of each document log, (2) assess each one to determine the appropriate level of 

review, and (3) follow up with additional guidelines, if necessary. We will evaluate 

the effectiveness of IRS’s efforts in future audits. 

Automated Candling Procedures 

In our previous audits, we reported that IRS did not always ensure that opened 

envelopes were candled twice before destruction, as required by its procedures to 

provide assurance that all contents have been extracted. During our fiscal year 2003 

financial audit, we continued to find weaknesses in IRS candling procedures. GAO’s 

Standards for Internal Control in the Federal Government13 requires that 

management establish physical controls to secure and safeguard vulnerable assets 

and provide qualified and continuous supervision to ensure that control objectives 

are achieved. 

During our testing at one of the four lockbox banks we visited, we found that 

machines were used to assist in the extraction of taxpayer remittances. These 

machines, after the operator extracted the contents from envelopes, subjected the 

envelopes to a light source and a sensor and were designed to notify the operator in 

the event that envelopes had not been fully emptied of their contents. We tested 4 of 

14 such machines by placing items in envelopes, and found that all four machines 

were not notifying the operators that envelopes were not emptied. IRS’s procedures 

for the lockbox banks require managers to monitor equipment and personnel for 

extraction accuracy and institute additional measures should trends occur or 

discovered remittance volumes increase. However, no specific guidance exists to 

 

13GAO/AIMD-00-21.3.1. 
Page 8 GAO-04-553R IRS Management Report 

help ensure that automated candling equipment is functioning as intended throughout 

the process. In addition, no evidence exists documenting that lockbox bank managers 

periodically reviewed the effectiveness of the automated candling equipment. The 

lack of such guidance increases the risk of loss of taxpayer receipts and data. 

Recommendations

We recommend that IRS 

• revise its candling procedures at lockbox banks to require testing of automated 

candling machines at appropriate intervals, taking into account such factors as 

use time, volume processed, machine requirements, and shift cycles, and 

• require lockbox managers to maintain logs of these tests and to periodically 

review their logs. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations and indicated that corrective actions have 

been or will be implemented. Specifically, IRS stated that it now requires an 

additional candling of all envelopes processed by extractors using automated 

candling machines. In addition, IRS agreed to include our recommendation on 

maintaining logs of the tests conducted as part of its assessment of testing standards 

for machines with automated candling equipment. We will evaluate the effectiveness 

of IRS’s efforts in future audits. 

Safeguarding of Taxpayer Receipts and Information 

During our fiscal year 2003 financial audit, we found instances in which IRS was not 

following its procedures for safeguarding taxpayer receipts and information in its 

facilities, thus increasing the risk that taxpayer receipts and information could be 

lost, stolen, or destroyed. GAO’s Standards for Internal Control in the Federal 

Government requires agencies to establish physical controls to secure and safeguard 

vulnerable assets.14

We visited three IRS Taxpayer Assistance Centers (TAC) during our fiscal year 2003 

audit. All three centers were receiving and storing taxpayer receipts and information 

in unsecured areas without properly securing them. From our observations, 

taxpayers were greeted, upon entering a TAC, by an IRS representative who was 

responsible for determining the type of assistance needed, assigning taxpayers a 

service number, and receiving drop-off payments. These functions were performed 

outside the secured area of the TAC. We observed the IRS representatives receiving 

taxpayer remittances and storing them in an unlocked drawer at the information 

desk. When the representatives left the information desk to assist other taxpayers 

waiting in the TAC, they did not secure or remove the remittances from the desk. The 

 

14GAO/AIMD-00-21.3.1. 
Page 9 GAO-04-553R IRS Management Report 

failure to properly safeguard assets created an opportunity for unauthorized access to 

and theft of taxpayer receipts and data. 

In addition, at one of the service center campuses, we observed discovered 

remittances outside a secured area and not stored in secured containers as required 

by IRS procedures. Storing receipts in unsecured containers in an unsecured area 

significantly increases the risk of theft of taxpayer receipts because anyone with 

access to the service center could gain access to the receipts. In our audits of IRS’s 

financial statements for fiscal years 1997 through 2001, we found similar weaknesses 

in controls over receipts discovered outside of designated receipt processing areas 

within IRS’s service center campuses. We recommended that IRS correct the 

weaknesses by providing secure containers in which service center employees could 

immediately store and inventory discovered remittances. In our May 2003 report 

following up on this and other issues,15 IRS officials stated that locked containers had 

been provided to all services centers, that instructions had been issued to service 

centers concerning proper handling and recording of discovered remittances, and 

that monitoring steps had been put in place. Our fiscal year 2003 audit finding, 

however, raises concern about IRS’s ability to effectively monitor its service center 

campuses’ implementation of sound controls over safeguarding discovered 

remittances. 

Recommendations

We recommend that IRS 

• discontinue its practice of storing taxpayer receipts and data outside TAC secured 

areas without storing the receipts in a secured locked container and 

• develop procedures to enhance adherence to existing instructions on 

safeguarding discovered remittances at service center campuses. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations and reiterated its Internal Revenue Manual 

(IRM) guidance on both recommendations. In both instances, IRS stated that it would 

continue to monitor adherence to the IRM guidance in its operational reviews at TAC 

offices and its monthly reviews of the service center campus revenue receipt and 

control process. We will evaluate the effectiveness of IRS’s efforts during our fiscal 

year 2004 and future financial audits. 

 

15U.S. General Accounting Office, Internal Revenue Service: Status of Recommendations from 

Financial Audits and Related Financial Management Reports, GAO-03-665 (Washington, D.C.: 

 May 29, 2003). 
Page 10 GAO-04-553R IRS Management Report 

Response to Alarms 

GAO’s Standards for Internal Control in the Federal Government16 requires that 

access to resources and records, such as IRS receipts and taxpayer data, be limited to 

authorized individuals to reduce the risk of unauthorized use or loss to the 

government. Tax receipts, such as cash and checks, are highly susceptible to theft, 

and unauthorized use of taxpayer data could result in identity theft and financial 

fraud.17 Due to the large volume of receipts and the assembly-line nature of tax 

receipt processing, taxpayer data and receipts are easily accessible to individuals on 

the processing floor. This vulnerability underscores the need for effective controls to 

deter and detect unauthorized access. 

As part of our fiscal year 2003 financial audit of IRS, we conducted tests of physical 

security controls at four IRS service center campuses, including tests to determine 

the responsiveness of security guards to activated building perimeter door alarms. 

We found that at two of four service center campuses we visited, security guards did 

not respond to the activated alarms. At one location, IRS officials told us that the exit 

door we tested did not show up as a breach in security on the monitoring equipment. 

However, a subsequent test of the same door resulted in a prompt response by the 

guards. At the second location, IRS officials informed us that the computer for the 

alarm system had gone down and was in the process of being rebooted at the time of 

breach. Nonetheless, the security guards’ lack of response increases the risk of theft 

of taxpayer receipts and information and reduces the possibility of timely detection 

of such incidents. 

Recommendations

We recommend that IRS 

• enforce its policies and procedures to ensure that service center campus security 

guards respond to alarms and 

• establish compensating controls in the event that automated security systems 

malfunction, such as notifying guards and managers of the malfunction and 

immediately deploying guards to better protect the processing center’s perimeter. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations and stated that by August 30, 2004, it would 

modify its IRM to include (1) the development, integration, and review of selfassessments for guards’ response capabilities to alarms; (2) initial, periodic, and 

annual security exercises; and (3) written reports to support the security exercises 

conducted. Also, IRS stated that its Physical Security Program within Mission 

Assurance would develop, within the same time frame, procedures to ensure that 

 

16GAO/AIMD-00-21.3.1. 

17Taxpayer data on tax forms could include taxpayer name, Social Security number, and address. 
Page 11 GAO-04-553R IRS Management Report 

local management is notified whenever there is a malfunction of alarms and that 

guards are deployed or doors are secured, as necessary, either during tests or when 

otherwise identified. We will evaluate the effectiveness of IRS’s efforts in future 

audits. 

Timeliness of Deobligations 

In prior years, we identified deficiencies in IRS’s process for deobligating funds that 

were no longer valid or needed.18 Over the past several years, IRS has made 

substantial progress in addressing internal control deficiencies related to 

deobligations. IRS issued policy memorandums and implemented procedures to more 

frequently review obligations that are no longer active and thus need to be 

deobligated. These improvements have allowed IRS to better manage its financial 

resources and improve its reporting on the status of budgetary resources. While we 

recognize IRS’s progress in reviewing outstanding obligations, our work performed as 

part of our fiscal year 2003 financial audit indicates that further improvements are 

needed. 

During our fiscal year 2003 audit, we found instances in which IRS did not timely 

identify and deobligate outstanding obligations. In our testing of a statistical sample 

of 110 undelivered orders19 as of August 31, 2003, we found four instances in which 

IRS did not deobligate undelivered orders that were no longer valid. These 

exceptions resulted primarily from (1) a system deficiency that prevented IRS 

personnel responsible for reviewing inactive obligations from having accurate 

information on when activity last occurred against the obligation and (2) IRS 

personnel’s failure to timely review certain obligations. Consistent with GAO’s 

Standards for Internal Control in the Federal Government,20agencies are required to 

properly execute and accurately record transactions. 

In fiscal year 2003, IRS issued a memorandum that provides financial plan managers21

guidelines for reviewing and identifying obligations to be deobligated. This 

memorandum supplemented existing guidance by providing the business unit finance 

staff with more detailed direction for reviewing outstanding obligations. For example, 

these guidelines state that IRS's business units are required to review aging 

unliquidated obligations (AUO) reports monthly and certify that all outstanding 

obligations with no activity for more than 180 days have been reviewed and validated 

as either (1) requiring deobligation or (2) valid obligations. IRS’s Beckley Finance 

Center (BFC) generates AUO reports by running a program to extract information on 

outstanding obligations from the accounting system. AUO reports provide lists of all 

open obligations, along with such information as the outstanding obligation amount 

 

18Deobligations are downward adjustments of previously recorded obligations. Deobligations can 

occur for a variety of reasons, such as if the actual expense was less than the amount obligated, a 

project or contract was canceled, an initial obligation was determined to be invalid, or previously 

recorded estimates were reduced.

19Undelivered orders represent the value of goods and services that were ordered and for which funds 

were obligated but have not been received. 

20GAO/AIMD-00.21.3.1. 

21Financial plan managers are responsible for managing the spending plans under their control.
Page 12 GAO-04-553R IRS Management Report 

and the obligation’s last activity date. The business units then review the obligations 

and make entries in the reports indicating whether the obligations are valid or should 

be deobligated. 

We found that AUO reports did not capture the information necessary for reviewers 

to correctly identify inactive obligations. IRS may issue an obligation to purchase 

several types of equipment or services for various units within the organization, each 

of which is reported as a separate obligation line amount in the accounting system. 

However, when generating an AUO report, the most recent date activity occurred 

against the obligation is extracted and applied to all of the line amounts. For 

example, in one of the cases, an AUO report for an obligation with five obligation line 

amounts had a last activity date of June 9, 2003, recorded for all five obligation line 

amounts. The last date on which any goods or services were charged against the line 

item in our sample, however, was September 25, 2002. Because the AUO reports did 

not capture the correct activity date for each outstanding obligation line amount, 

IRS’s business units did not have accurate data with which to identify all the inactive 

undelivered orders for possible deobligation. 

For certain obligations, IRS’s guidelines require concurrence between business unit 

staff and procurement office staff before an obligation can be deobligated. These are 

obligations that are processed through IRS’s Integrated Procurement System, such as 

interagency agreements and large-dollar contracts. In order to respond to the 

business units, procurement office staff perform research on the status of the 

contract, contact the vendor, or obtain additional documentation to support a 

deobligation. If the procurement office is silent as to whether the obligations should 

be deobligated, the business units certify that the obligations are valid. 

We found three instances in which obligations were not properly deobligated because 

the procurement office did not provide timely responses to the business units. In one 

case, IRS had ordered computer equipment and services at a cost of $334,910 on 

September 18, 2001. In October 2001, IRS received all the equipment and services 

ordered at a cost of $267,676. According to the documentation we reviewed, the 

vendor provided preliminary notification to IRS in November 2001 that IRS did not 

owe any additional funds because the vendor did not charge for goods and services 

that were initially ordered at $67,234. When we performed our testing, in August 2003, 

the procurement office had not yet confirmed with the vendor that the remaining 

$67,234 was a no-charge item and thus had not requested that this amount be 

deobligated. In another case, an undelivered order for computer equipment and 

services totaling $28,268 had not had activity since November 2000. As of August 

2003, the business unit had not received a response from the procurement office as to 

whether to deobligate the funds. Based on our review of these two files, IRS followed 

up on these cases and subsequently deobligated the funds. 

Since the AUO reports did not capture the information necessary to ensure that all 

outstanding obligations with more than one line amount had the appropriate activity 

dates, IRS’s financial plan managers did not identify all the obligations that needed to 

be reviewed for possible deobligation. Additional delays in deobligating funds were 
Page 13 GAO-04-553R IRS Management Report 

caused by the procurement office staff’s failure to provide responses to business 

units in a timely manner. Based on our testing, we estimate that $37 million of 

undelivered orders were not valid.22 By not promptly deobligating funds, IRS affected 

its ability to use its financial resources effectively. If IRS had deobligated the funds 

within their periods of availability, the funds could have been used for other 

initiatives and programs. 

Recommendations

We recommend that IRS 

• modify AUO reports to ensure that they report the last activity date for each 

outstanding obligation line amount and 

• require procurement office staff to review and sign off on whether obligations are 

valid or require deobligation before business units complete their quarterly 

certifications. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations. In its comments, IRS stated that its BFC 

revised the AUO report in March 2004 to accurately report the last activity date for 

each obligation line amount. Moreover, IRS stated that it is currently evaluating its 

approach toward reviewing open obligations and approving those obligations that 

require deobligation. This includes studying the relative responsibilities of the 

procurement office, business units, and BFC with respect to validating and certifying 

deobligations. IRS will issue new guidelines at the conclusion of its internal review. 

We will evaluate the effectiveness of IRS’s efforts during our fiscal year 2004 financial 

audit. 

Excess Contributions to Employees’ Thrift Savings Plan Accounts 

During fiscal year 2003, IRS did not have procedures in place to timely detect 

mathematical errors in its payroll information made by the NFC.23 We found that 

while processing IRS’s payroll in fiscal year 2003, NFC made mathematical errors 

when it calculated the mandatory agency TSP contribution for some IRS employees. 

IRS did not detect these errors because, although it had control procedures in place 

to test certain payroll information processed by NFC, these procedures did not 

include verifying the accuracy of NFC’s calculations. IRS relied on NFC to accurately 

process the biweekly payroll for its employees. Consistent with GAO’s Standards for 

Internal Control in the Federal Government, IRS’s internal controls should provide 

reasonable assurance that its financial transactions, including those processed by 

NFC, are accurately recorded.24 The errors we identified with respect to employee 

 

22We are 95 percent confident that the amount of invalid undelivered orders did not exceed $82 million. 23NFC is a component of the U.S. Department of Agriculture that provides administrative and financial 

services to many federal agencies, including IRS. 

24GAO/AIMD-00.21.3.1. 
Page 14 GAO-04-553R IRS Management Report 

contributions to TSP were not material to IRS’s financial statements. Nonetheless, 

because it did not have controls in place to verify NFC’s calculations, IRS had less 

assurance that government funds were used as intended and that employee TSP 

accounts were accurate. 

We found that in fiscal year 2003, a total of 131 IRS employees erroneously received 

excess mandatory contributions to their TSP accounts equaling 2 percent of their 

base pay, rather than the 1 percent required by law. IRS must identify and recover 

amounts overpaid to TSP on behalf of its employees within 1 year of the time of 

payment or forfeit the funds to the Federal Retirement Thrift Investment Board or to 

the employees’ TSP accounts. IRS did not detect these errors through its review 

process but became aware of them when we informed the agency about them. Some 

of these errors related to overpayments that had exceeded the 1-year limitation for 

recovery. 

For the past several years, the Department of Agriculture’s Office of Inspector 

General has reported weaknesses in internal controls over NFC’s payroll operations.25

In addition, in a previous audit report,26 we stated that any agency that uses a service 

organization, such as NFC, to process its payroll transactions should establish 

adequate policies and procedures to ensure that the services provided meet the 

objectives of agency management. We further stated that adequate internal controls 

over input and output data to prevent or detect material misstatements are 

particularly critical when it has been determined that the service organization’s 

internal controls do not provide reasonable assurance that payroll transactions were 

processed and reported accurately. In our report, we recommended that IRS 

implement control procedures to compensate for the weaknesses identified in NFC’s 

payroll operations. 

In response to our recommendation,IRS implemented compensating internal control 

procedures to ensure that NFC accurately processed IRS’s payroll each pay period. 

Specifically, each pay period, IRS’s Transactional Processing Operations Division 

reviews a nonrepresentative selection of employee Social Security numbers from a 

list of IRS employees paid that pay period and compares key payroll information 

(e.g., hours worked, leave taken, and payroll deductions) received from NFC to 

information that IRS submitted to NFC (e.g., time and attendance data, employee 

health plan, and life insurance election). Our findings during fiscal year 2003 also 

indicate that the mathematical errors we detected in NFC’s payroll calculations 

occurred as a result of the NFC internal control weaknesses identified. However, 

since IRS’s compensating control procedures do not include a test of the 

mathematical accuracy of NFC’s calculations of payroll amounts, they do not give IRS 

the capability to timely detect errors in payroll calculations made by NFC during the 

processing of IRS payroll transactions. Because IRS did not have controls in place to 

 

25U.S. Department of Agriculture, Office of Inspector General, Fiscal Year 2003 National Finance 

Center Review of Internal Control Structure, 11401-15-FM (Washington, D.C.: Nov. 19, 2003), is the 

most recently issued inspector general audit report on NFC’s internal controls. 

26U.S. General Accounting Office, Management Letter: Suggested Improvements in IRS’ Accounting 

Procedures and Internal Controls, GAO/AIMD-99-182R (Washington, D.C.: June 30, 1999). 
Page 15 GAO-04-553R IRS Management Report 

verify NFC’s calculations within the period allowed for recovery, it lost the ability to 

recover the erroneously contributed funds and use them to pay for its operations. 

Recommendations

We recommend that IRS 

• enhance its compensating internal controls by including tests or recalculations of 

payroll computations performed by NFC for the IRS employees selected for 

review each pay period and 

• timely investigate and resolve any identified errors. 

IRS Comments and Our Evaluation

IRS agreed with our recommendations and stated that its Transactional Processing 

Operations (TPO) division will expand its current random sample payroll review and 

validation process to include the recalculation of agency TSP contributions. IRS 

expects implementation of the review process by June 2004. The TPO division will 

also be responsible for following up immediately on any discrepancies found and 

ensuring that NFC responds timely. We will evaluate the effectiveness of IRS’s efforts 

during our fiscal year 2004 financial audit. 

Supplemental Information for Other Claims for Refund 

During our audit of IRS’s fiscal year 2003 financial statements, we found that IRS 

reported incorrect information in the supplemental information to the financial 

statements. Specifically, IRS incorrectly reported the total estimated payout for 

refund claims pending review by IRS’s Appeals organization27 or federal courts. This 

error occurred because IRS’s controls over the calculation and reporting of estimated 

payouts for refund claims were ineffective. GAO’s Standards for Internal Control in 

the Federal Government28 requires that transactions be properly executed and 

accurately recorded. Because IRS did not have effective controls in place to ensure 

proper calculation and reporting of estimates of Other Claims for Refund, 

management did not have relevant, reliable, and timely information to achieve its 

objectives, increasing the risk that these amounts could be misstated. 

During our audit, we found two errors relating to Other Claims for Refund in the 

supplemental information contained in IRS’s draft fiscal year 2003 financial 

statements. 

• IRS’s draft financial statements disclosed that the total estimated payout for 

claims pending review by IRS’s Appeals organization was $5.2 billion. However, 

 

27The purpose of the Appeals organization is to resolve tax controversies without litigation on a basis 

that is fair and impartial to both the government and the taxpayer. Appeals provide an independent 

channel for taxpayers who wish to dispute recommended enforcement actions. 

28GAO/AIMD-00.21.3.1. 
Page 16 GAO-04-553R IRS Management Report 

based on our review of the supporting documentation, we found that the correct 

amount was $7.6 billion. This misstatement occurred because IRS used the wrong 

amount for interest in its computation. As a result, the supplemental information 

to the draft financial statements was misstated. When we informed IRS of the 

error, IRS corrected the amount reported in the supplemental information for the 

final financial statements. 

• IRS’s financial statements disclosed that the estimated amount of claims pending 

review by federal courts was $6.5 billion. However, in its November 7, 2003, 

update for contingencies as of September 30 through November 1, 2003, IRS 

counsel reported estimated claims pending review by federal courts as 

$6.2 billion. The updated data were not included in IRS’s final supplemental 

information because of weaknesses in controls over reporting this information. 

These misstatements did not materially affect IRS’s financial statements, but without 

effective controls in place to ensure that amounts estimated for Other Claims for 

Refund are correctly reported, the risk of misstatement increases, and the accuracy 

of information available to IRS management for decision-making purposes is 

impaired. 

Recommendation

We recommend that IRS establish review procedures for amounts being reported in 

Supplemental Information to the financial statements for Other Claims for Refund. 

IRS Comments and Our Evaluation

IRS agreed with our recommendation and stated that it would add a second level of 

management review to its final financial statements to ensure that changes are 

identified and reported before final print. In addition, IRS stated that it would work 

closely with our financial audit team to determine the last day of fieldwork, and 

notify its Chief Counsel’s office to determine if there are any material changes needed 

to its final financial statements. We will evaluate the effectiveness of IRS’s efforts 

during our fiscal year 2004 financial audit. 

Controls over Reporting Interim Performance Measures 

During our audit of IRS’s fiscal year 2003 financial statements, we found that IRS’s 

controls over its reporting of interim performance measurement data were not 

effective throughout the year. Specifically, we found that data reported at interim 

periods for certain performance measures were either not accurate or were outdated. 

This occurred because of data entry errors made in the reports generated from the 

performance data submitted by IRS’s divisions. We also found that review of the 

reports was not documented. GAO’s Standards for Internal Control in the Federal 

Government29 requires the review of performance measurement data. Such reviews 

 

29GAO/AIMD-00.21.3.1. 
Page 17 GAO-04-553R IRS Management Report 

should be designed to validate the propriety and integrity of performance 

measurement data and indicators. IRS reviews the Monthly Summary of Performance 

(MSP) reports from performance data submitted by IRS divisions, but these reviews 

were undocumented and were not effective in identifying the erroneous performance 

data reported. While we did not identify any errors in the performance data IRS 

reported in its year-end Management Discussion and Analysis, IRS management did 

not always have reliable performance measurement data available at interim periods 

to assist managers in making decisions. 

IRS’s Corporate Planning and Performance Division (CPPD) collects and reports 

performance data for each of its 69 performance measures. Each month and at yearend, CPPD compiles performance data submitted by operating divisions in an MSP 

report. These reports contain records of tax enforcement results that IRS uses for 

such purposes as forecasting, financial planning, and resource management. 

Information reported for each performance measure includes full-year performance, 

year-to-date comparison of performance data, and current fiscal year actual and 

planned performance data. Staff in CPPD review the data submitted by IRS’s 

operating divisions. To identify any anomalies, the CPPD review includes 

comparisons of current-month data to prior-month data and current-year data to 

prior-year data. Generally, the offices responsible for submitting the data can explain 

any anomalies or, if data errors are found, will correct them. CPPD staff, using the 

reviewed and corrected performance data submissions, then manually prepare the 

MSP report. At the end of the fiscal year, IRS uses the MSP report to prepare the 

performance measure results reported in the Management and Discussion Analysis 

section of its financial statements. 

As part of our fiscal year 2003 audit, we reviewed a nonrepresentative selection of 

five performance measures. For each measure, we obtained the supporting 

documentation and compared the support to what was reported in IRS’s MSP reports 

for July and August 2003. In conducting our review, we identified data that were not 

current or not accurate for two of the five performance measures: 

• The number reported for the “Criminal Investigations Completed” performance 

measure as of July 2003 was the planned, rather than the actual, amount. 

• The number reported for the “Federal Tax Payment Transactions Paid 

Electronically” performance measure in both July and August 2003 was actually 

the April 2003 amount. 

IRS agreed that the data were incorrect due to errors in data entry by CPPD staff 

during preparation of the MSP report. However, IRS is in the process of implementing 

a Business Performance Management System (BPMS) that when fully operational, is 

intended to be able to accept performance data directly from the operation divisions’ 

reporting systems and would eliminate the need for data entry by CPPD staff. BPMS 

is expected to validate the accuracy of the data submitted by IRS’s operating 

divisions. 
Page 18 GAO-04-553R IRS Management Report 

Recommendation

Until BPMS is fully operational, we recommend that IRS implement procedures to 

ensure that all performance data reported in MPS reports are subject to effective, 

documented reviews to provide reasonable assurance that the data are current at 

interim periods. 

IRS Comments and Our Evaluation

IRS agreed with our recommendation. In its comments, IRS stated that it has taken 

steps to ensure that performance measurement data are properly reviewed before 

being published. IRS plans to increase control over data by (1) increasing the number 

of measures reported through the automated BPMS, (2) requiring the submitting 

divisions to certify that their data are accurate, and (3) reducing the number of 

measures manually reported in the monthly report. We will evaluate the effectiveness 

of IRS’s efforts during our fiscal year 2004 financial audit. 

- - - - - 

This report contains recommendations to you. The head of a federal agency is 

required by 31 U.S.C. 720 to submit a written statement on actions taken on these 

recommendations. You should submit your statement to the Senate Committee on 

Governmental Affairs and the House Committee on Government Reform within 60 

days of the date of this report. A written statement must also be sent to the House 

and Senate Committees on Appropriations with the agency’s first request for 

appropriations made more than 60 days after the date of the report. 

This report is intended for use by the management of IRS. We are sending copies to 

Chairmen and Ranking Minority Members of the Senate Committee on 

Appropriations; Senate Committee on Finance; Senate Committee on Governmental 

Affairs; Senate Committee on the Budget; Subcommittee on Treasury and General 

Government, Senate Committee on Appropriations; Subcommittee on Taxation and 

IRS Oversight, Senate Committee on Finance; and the Subcommittee on Oversight of 

Government Management, Restructuring, and the District of Columbia, Senate 

Committee on Governmental Affairs. We are also sending copies to the Chairmen and 

Ranking Minority Members of the House Committee on Appropriations; House 

Committee on Ways and Means; House Committee on Government Reform; House 

Committee on the Budget; Subcommittee on Treasury, Postal Service, and General 

Government, House Committee on Appropriations; Subcommittee on Government 

Efficiency, Financial Management, and Intergovernmental Relations, House 

Committee on Government Reform; and the Subcommittee on Oversight, House 

Committee on Ways and Means. In addition, we are sending copies of this report to 

the Chairman and Vice-Chairman of the Joint Committee on Taxation, the Secretary 

of the Treasury, the Director of the Office of Management and Budget, the Chairman 

of the IRS Oversight Board, and other interested parties. Copies will be made 

available to others upon request. The report is also available at no charge on GAO’s 

Web site at http://www.gao.gov. 
Page 19 GAO-04-553R IRS Management Report 

We acknowledge and appreciate the cooperation and assistance provided by IRS 

officials and staff during our audits of IRS’s fiscal year 2003 and 2002 financial 

statements. If you have any questions or need assistance in addressing these matters, 

please contact Larry Malenich, Assistant Director, at (202) 512-9399. 

Sincerely yours, 

Steven J. Sebastian 

Director 

Financial Management and Assurance 

Enclosures - 3
Page 20 GAO-04-553R IRS Management Report 

Enclosure I 

Comments from the Internal Revenue Service 
Page 21 GAO-04-553R IRS Management Report 
Page 22 GAO-04-553R IRS Management Report 
Page 23 GAO-04-553R IRS Management Report 
Page 24 GAO-04-553R IRS Management Report 
Page 25 GAO-04-553R IRS Management Report 
Page 26 GAO-04-553R IRS Management Report 

Enclosure II 

Details on Audit Methodology 

To fulfill our responsibilities as the auditor of the Internal Revenue Service’s (IRS) 

financial statements, we did the following: 

• Examined, on a test basis, evidence supporting the amounts and disclosures in the 

financial statements. This included testing selected statistical samples of unpaid 

assessment, revenue, refund, accrued expenses, payroll, nonpayroll, property and 

equipment, and undelivered order transactions. These statistical samples were 

selected primarily to substantiate balances and activities reported in IRS’s 

financial statements. Consequently, dollar errors or amounts can and have been 

statistically projected to the population of transactions from which they were 

selected. In testing these samples, certain attributes were identified that indicated 

either significant deficiencies in the design or operation of internal control or 

compliance with provisions of laws and regulations. These attributes, where 

applicable, can be and have been statistically projected to the appropriate 

populations. 

• Assessed the accounting principles used and significant estimates made by 

management. 

• Evaluated the overall presentation of the financial statements. 

• Obtained an understanding of internal controls related to financial reporting 

(including safeguarding assets), compliance with laws and regulations (including 

the execution of transactions in accordance with budget authority), and 

performance measures reported in IRS’ Management Discussion and Analysis. 

• Tested relevant internal controls over financial reporting (including safeguarding 

assets) and compliance, and evaluated the design and operating effectiveness of 

internal controls. 

• Considered the process for evaluating and reporting on internal controls and 

financial management systems under 31 U.S.C. § 3512 (c), (d), (commonly 

referred to as the Federal Managers’ Financial Integrity Act of 1982). 

• Tested compliance with selected provisions of the following laws and regulations: 

Anti-Deficiency Act, as amended (31 U.S.C. § 1341(a)(1) and 31 U.S.C. § 1517(a)); 

Agreements for payment of tax liability in installments (26 U.S.C. § 6159); Purpose 

Statute (31 U.S.C. § 1301); Release of lien or discharge of property (26 U.S.C. § 

6325); Interest on underpayment, nonpayment, or extensions of time for payment 

of tax (26 U.S.C. § 6601); Interest on overpayments (26 U.S.C. § 6611); 

Determination of rate of interest (26 U.S.C. § 6621); Failure to file tax return or to 

pay tax (26 U.S.C. § 6651); Failure by individual to pay estimated income tax (26 

U.S.C. § 6654); Failure by corporation to pay estimated income tax (26 U.S.C. § 

6655); Prompt Payment Act (31 U.S.C. § 3902(a), (b), and (f) and 31 U.S.C. § 3904); 

Pay and Allowance System for Civilian Employees (5 U.S.C. §§ 5332 and 5343 and 
Page 27 GAO-04-553R IRS Management Report 

29 U.S.C. § 206); Federal Employees’ Retirement System Act of 1986, as amended 

(5 U.S.C. §§ 8422 and 8423 and 8432); Social Security Act, as amended (26 U.S.C. 

§§ 3101 and 3121 and 42 U.S.C. § 430); Federal Employees Health Benefits Act of 

1959, as amended (5 U.S.C. §§ 8905, 8906, and 8909); and Consolidated 

Appropriations Resolution, 2003 (Pub. L. No. 108-7). 

• Tested whether IRS’s financial management systems substantially comply with 

the three requirements of the Federal Financial Management Improvement Act of 

1996.30

 

30Pub. L. No. 104-208, div. A., § 101 (f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 1996).
Page 28 GAO-04-553R IRS Management Report 

Enclosure III 

GAO Contacts and Staff Acknowledgments 

GAO Contacts 

J. Lawrence Malenich, (202) 512-9399 

John D. Sawyer, (202) 512-9566 

Acknowledgments 

Staff who made key contributions to this report were Nina Crocker, John Davis, Alain 

Dubois, Valerie Freeman, Patrick McCray, Ryan Holden, Theresa Patrizio, and Robert 

Preshlock. 

(196013)