Page 1 GAO-18-393R IRS Management Report

441 G St. N.W.

Washington, DC 20548

May 7, 2018

The Honorable David J. Kautter

Acting Commissioner of Internal Revenue 

Management Report: Improvements Are Needed to Enhance the Internal Revenue 

Service’s Internal Control over Financial Reporting 

Dear Mr. Kautter:

On November 9, 2017, we issued our report on our audit of the Internal Revenue Service’s 

(IRS) fiscal years 2017 and 2016 financial statements,1 which included our opinion that IRS’s 

internal control over financial reporting was not effective as of September 30, 2017, because of 

a continuing material weakness in internal control over unpaid assessments.2 The purpose of 

this report is to present two new control deficiencies that we identified during our fiscal year 

2017 testing of IRS’s controls and our recommendations related to these deficiencies.3 This 

report also presents the status, as of September 30, 2017, of IRS’s corrective actions to 

address our recommendations detailed in our previous management reports that remained open 

as of September 30, 2016.4 This report is intended for use by IRS management.

Results in Brief

During our audit of IRS’s fiscal years 2017 and 2016 financial statements, we identified a new 

control deficiency involving the timely correction and posting of tax transactions to taxpayer 

accounts that contributed to IRS’s continuing material weakness in internal control over unpaid 

assessments as of September 30, 2017.5 We also identified a new deficiency related to the 

monitoring of internal control activities for safeguarding taxpayer receipts and associated 

 1

GAO, Financial Audit: IRS’s Fiscal Years 2017 and 2016 Financial Statements, GAO-18-165 (Washington, D.C.: 

Nov. 9, 2017).

2

An unpaid assessment is a legally enforceable claim against a taxpayer and consists of taxes, penalties, and interest 

that have not been collected or abated (i.e., the assessment has been reduced by IRS). Internal Revenue Manual

(IRM) § 1.34.1.2 (138), Definitions and Acronyms (June 23, 2009). 

3

In addition to the internal control deficiencies included in this report, we plan to issue a separate report on the 

information systems control deficiencies identified during our fiscal year 2017 audit, including the previously 

unresolved and new issues that collectively contributed to a significant deficiency in internal control over financial 

reporting systems as of September 30, 2017, along with associated new recommendations for corrective actions. 

This report will also include the status of IRS’s actions to address the open recommendations related to information 

systems control deficiencies from prior audits.

4

GAO, Management Report: Improvements Are Needed to Enhance the Internal Revenue Service's Internal Control 

over Financial Reporting, GAO-17-454R (Washington, D.C.: May 17, 2017).

5

A deficiency in internal control exists when the design or operation of a control does not allow management or 

employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, 

misstatements on a timely basis. A material weakness is a deficiency, or combination of deficiencies, in internal 

control over financial reporting, such that there is a reasonable possibility that a material misstatement of the entity’s 

financial statements will not be prevented, or detected and corrected, on a timely basis.
Page 2 GAO-18-393R IRS Management Report

information. Although not considered material weaknesses or significant deficiencies, these new 

deficiencies nonetheless warrant IRS management’s attention.6

In this report, we are making 2 recommendations to address the control deficiency that 

contributed to IRS’s continuing material weakness in internal control over unpaid assessments 

and 3 recommendations to address the control deficiency related to monitoring of internal 

control activities for safeguarding hard copy taxpayer receipts and associated information, for a 

total of 5 new recommendations. These recommendations are intended to improve IRS’s 

internal controls over financial reporting as well as to bring IRS into conformance with its own 

policies and Standards for Internal Control in the Federal Government.

7

As of September 30, 2017, IRS had completed corrective action on 14 of the 41 

recommendations from our prior financial audits that remained open as of September 30, 2016. 

As a result, IRS currently has 32 GAO recommendations to address, which consist of the 

previous 27 remaining recommendations and the 5 new recommendations we are making in this 

report. Enclosure I provides details on the status of IRS’s actions to address the open 

recommendations from our prior audits.

In commenting on a draft of this report, IRS stated that it is committed to implementing 

appropriate improvements to ensure that it maintains sound financial management practices. 

IRS agreed with the 5 new recommendations and described planned actions to address each 

recommendation. IRS’s comments are reproduced in enclosure II.

Objectives, Scope, and Methodology

Our objectives were to evaluate IRS’s internal control over financial reporting and to determine 

the status of IRS’s corrective actions as of September 30, 2017, to address recommendations in 

our prior years’ reports for which actions were not complete as of September 30, 2016.8 This 

work was performed in connection with our audit of IRS’s financial statements for the fiscal 

years ended September 30, 2017, and 2016, to support our opinion on whether effective 

internal control over financial reporting was maintained, in all material respects.We designed 

our audit procedures to test relevant controls, including those for proper authorization, 

execution, accounting, and reporting of transactions and for the safeguarding of assets and 

taxpayer information. In conducting the audit, we reviewed applicable IRS policies and 

procedures, observed operations, tested statistical and nonstatistical samples of transactions, 

examined relevant documents and records, and interviewed IRS management and staff.

 6

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting 

that is less severe than a material weakness, yet important enough to merit the attention by those charged with 

governance.

7

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: September 

2014), contains the internal control standards to be followed by executive agencies in establishing and maintaining 

systems of internal control as required by 31 U.S.C. § 3512 (c), (d) (commonly referred to as the Federal Managers’ 

Financial Integrity Act). 

8

An entity’s internal control over financial reporting is a process effected by those charged with governance, 

management, and other personnel, the objectives of which are to provide reasonable assurance that (1) transactions 

are properly recorded, processed, and summarized to permit the preparation of financial statements in accordance 

with U.S. generally accepted accounting principles, and assets are safeguarded against loss from unauthorized 

acquisition, use, or disposition, and (2) transactions are executed in accordance with provisions of applicable laws, 

including those governing the use of budget authority, regulations, contracts, and grant agreements, noncompliance 

with which could have a material effect on the financial statements.
Page 3 GAO-18-393R IRS Management Report

During the course of our work, we communicated our findings to IRS management. We 

performed our audit in accordance with U.S. generally accepted government auditing standards. 

We believe that our audit provides a reasonable basis for our findings and recommendations in 

this report.

Internal Control Deficiencies Identified in Our Fiscal Year 2017 Audit

We identified the following two new internal control deficiencies during our fiscal year 2017 audit 

that warrant IRS management’s attention, one of which contributed to the continuing material 

weakness in IRS’s internal control over unpaid assessments. 

Correcting Unpostable Tax Transactions

Through its various operating divisions, IRS processes a large volume of tax-related 

transactions, including tax payments, requests for refunds, and assessments. To provide 

assurance that the transactions are accurate, IRS subjects them to a series of automated 

validity checks, which are intended to identify invalid transactions that should not be posted to 

IRS’s master files.

9 The validity checks include such steps as verifying that the math on a filed 

tax return is correct and that the taxpayer’s name corresponds to its registered taxpayer 

identification number. When an error is found and the transaction fails to pass the automated 

validity checks, it is placed into an “unpostable” status and cannot be posted to the master files 

until the responsible operating division researches the transaction and resolves the issue that 

rendered it unpostable. Unpostable transactions identified by the automated validity checks are 

displayed on a weekly status report for each responsible operating division to research and 

correct in order to complete recording the transactions in the master files. Each operating 

division has established separate policies and procedures for researching and correcting the 

unpostable transactions that appear on the status reports.

Condition. During our fiscal year 2017 audit, we found that IRS did not have fully effective 

processes in place to timely follow up on, resolve, and record to the master files transactions 

that had been initially identified as unpostable. Specifically, through our audit procedures, we 

noted several instances of unpostable transactions that IRS’s Chief Financial Officer (CFO) 

organization identified and referred to the four operating divisions responsible for resolution. 

These operating divisions had not researched and resolved the unpostable transactions until 

IRS’s CFO organization notified them to do so during fiscal year 2017. These transactions had 

remained uncorrected and unposted for periods ranging from 1 to 10 years. 

Criteria. Internal control standards state that management should design control activities to 

achieve objectives and respond to risks, which includes designing appropriate types of control 

activities for the entity’s control system, such as proper execution of transactions, accurate and 

timely recording of transactions, and reviews by management at the functional or activity level. 

Management should also implement control activities through policies, which includes 

documenting in policies for each unit its responsibility for an operational process’s objectives 

and related risks and control activity design, implementation, and operating effectiveness.10

 9

IRS’s master files contain detailed electronic records of taxpayer accounts. IRS uses information in the master files 

for tax administration purposes and to support information reported on its financial statements. IRS also uses the 

information in the master files in its interactions with taxpayers, such as discussing account inquiries and sending 

notices to taxpayers. 

10GAO-14-704G.
Page 4 GAO-18-393R IRS Management Report

Cause. While each of the four operating divisions responsible for processing unpostable

transactions had established its own policies and procedures for correcting them, we found that 

these policies and procedures were not fully effective in achieving these objectives. For 

example, the Internal Revenue Manual (IRM) sections that the various operating divisions used 

did not always clearly define the time frames by which unpostable transactions were expected 

to be corrected.11 Additionally, none of the four operating divisions had established effective 

oversight or supervisory review processes to reasonably assure that once personnel were 

assigned to correct unpostable transactions, they timely resolved the issue and recorded the 

transaction in the master file. IRS officials agreed that these issues contributed to the condition 

identified above. However, they indicated that the processes used to resolve unpostable 

transactions are very complex and that additional efforts are needed to research and determine 

the extent to which other factors may be affecting IRS’s ability to resolve them in a timely 

manner. 

Effect. Uncorrected and unposted tax transactions affect the accuracy of taxpayer accounts and 

integrity of IRS’s accounting records and increase the risk of misstatements in IRS’s financial 

statements. Such inaccuracies also cause undue burden to taxpayers that are assessed 

amounts they do not owe or whose accounts remained in IRS’s inventory for collection when 

IRS no longer had authority to collect on them.12

Recommendations for Executive Action. We are making the following two recommendations 

to IRS: 

• The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS 

officials research and determine why IRS’s existing policies and procedures intended to 

timely follow up on, resolve, and record unpostable transactions were not fully effective in 

achieving these objectives. (Recommendation 18-01)

• The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS 

officials, based on IRS’s research and determination, design and implement the corrective 

actions necessary to reasonably assure that IRS effectively resolves and records 

unpostable transactions in a timely manner, including establishing clearly defined time 

frames in the IRM by which the IRS operating divisions should correct unpostable 

transactions and appropriate related oversight and review processes. (Recommendation 18-

02)

Monitoring of Internal Control Activities for Safeguarding Hard Copy Taxpayer Receipts and 

Associated Information

IRS has designed several processes and tools to periodically monitor operational controls over 

safeguarding hard copy taxpayer receipts and associated taxpayer information as well as 

physical security controls at its facilities. IRS personnel perform a Submission Processing 

internal control review to assist senior management in monitoring and evaluating submission 

processing activities, which include the receipt, transcription, and posting of hard copy taxpayer 

 11The IRM is IRS’s primary, official compilation of instructions that relate to IRS’s administration and operations. The 

IRM is intended to ensure that IRS employees have the approved policy and guidance they need to carry out their 

responsibilities in administering the tax laws or other agency obligations. IRM § 1.11.2.2, Internal Revenue Manual 

Process (Jan. 1, 2017). 

12IRS’s statutory limitation on the length of time it can collect taxes is 10 years from the date of the tax assessment 

unless certain statutory exceptions apply. 26 U.S.C. § 6502. 
Page 5 GAO-18-393R IRS Management Report

receipts and data to taxpayers’ accounts. In connection with this review, IRS personnel 

complete the (1) Submission Processing Security Review and (2) Submission Processing 

Receipt and Control Internal Control Checklist. The results of the Submission Processing 

Receipt and Control Internal Control Checklist are compiled in the Findings and Corrective 

Actions Report, which is submitted to senior management for review. In addition to the 

Submission Processing internal control review, IRS Receipt and Control personnel responsible 

for day-to-day submission processing activities conduct other reviews at the functional level, 

including periodic inspections of candling equipment.13

IRS physical security specialists monitor and assess physical security and emergency 

preparedness controls in place at IRS facilities, such as controls over perimeter and building 

security, alarms, and access to restricted areas. Physical security specialists use the Audit 

Management Checklist (AMC) to perform and document their review and complete a Corrective 

Action Report (CAR) for any facility where control deficiencies are identified. In addition, on a 

monthly basis, the physical security specialists review the All Events History Report (AEHR) that 

summarizes the details of all alarm incidents in an IRS office, such as activated intrusion 

detection alarm signals and the response of the dispatcher, to identify and assess whether 

corrective actions are warranted for any of the alarm events.14 Physical security specialists 

annotate the AEHR with corrective actions taken for such alarm events. The completed AMCs, 

CARs, and AEHRs are reviewed by IRS security chiefs and territory managers.

Condition. During our fiscal year 2017 audit, we found that IRS’s processes and monitoring 

tools were not adequately designed or implemented to provide senior management the 

information necessary to make informed decisions and effectively evaluate IRS’s performance 

in safeguarding hard copy taxpayer receipts and associated information at its facilities. 

Specifically, for the Submission Processing internal control review, we found that (1) review 

questions on the Submission Processing Security Review were based, in part, on obsolete or 

unrelated IRM criteria; (2) the error threshold methodology used for assessing whether a control 

has met its objective had not been evaluated in the past 10 years to assess its current validity 

based on changes to the operating environment; (3) IRS procedures do not require findings 

identified during the Submission Processing Security Review to be compiled and reported in the 

Findings and Corrective Actions Report; and (4) the review does not include an assessment of 

safeguarding internal controls across all work shifts, particularly during peak seasons when 

multiple shifts are working and controls are most stressed.15 

 13Candling is a process IRS uses to determine if any contents were left behind in opened envelopes received from 

taxpayers after employees had extracted their contents. This is often achieved by passing an envelope over a light 

source.

14To assist in managing the risk of physical threats to IRS employees and the assets they safeguard, IRS maintains a 

system of electronic intrusion detection and duress alarms in its offices. The alarms are linked to a central monitoring 

station at the facility. The central monitoring station generates the AEHR and is responsible for notifying a qualified 

first responder and contacting a designated IRS official when an alarm is activated. 

15Peak season is a term used to describe the time frame when IRS expects to deposit the largest amount of money in 

the shortest time frame, specifically, the deposit of receipts related to U.S. Individual Income Tax Returns (April 

period). Mini-peak seasons are other time frames when IRS expects to deposit large amounts of money related to 

U.S. Corporation Income Tax Returns (March period), Quarterly Federal Excise Tax Returns (February, March, May, 

August, and November periods), U.S. Individual Income Tax Returns (October period), and when large volumes of 

mail are received (January 15 and September 15 periods). IRM § 3.30.123.3.1, Processing Timeliness: Cycles, 

Criteria, and Critical Dates – Peak Deposit Cycles (Jan. 1, 2014).
Page 6 GAO-18-393R IRS Management Report

In addition, at one site we visited during our audit, we noted that taxpayer information was not 

properly destroyed after initial processing in that multiple copies of taxpayer envelopes 

containing personally identifiable information dated as far back as 2012 were posted on the 

walls for use as training aids. At another site, we found that the results of a quarterly candling 

equipment review performed at the functional level determined that over 20 percent of the 

candling tables available for use did not meet minimum light meter standards. However, the 

Submission Processing internal control review is not designed to identify or report these 

findings. 

With regard to physical security, we determined that IRS management responsible for 

establishing policies related to safeguarding controls did not (1) use the information gathered 

from the AMC and AEHR reviews conducted by the physical security specialists to assess the 

effectiveness of these controls or provide a description of any other information that was used to 

monitor them nor (2) determine the minimum frequency for completing the AMC to provide 

information needed to monitor safeguarding controls for continued relevance and effectiveness, 

considering factors that may affect the appropriate timing of these reviews. The current 

instructions for performing the AMC review suggests three different scenarios that potentially 

allow up to 10 years between reviews, depending on the security level of the facility. In addition, 

we noted that for deficiencies identified during the AMC and AEHR reviews, management is not 

required to track all corrective actions until they are fully implemented. 

Criteria. Internal control standards state that management should use quality information to 

achieve the entity’s objectives, which includes management processing obtained data into 

quality information on a timely basis so that it can be used for effective monitoring and support 

to the internal control system and using the quality information to make informed decisions and 

evaluate the entity’s performance in meeting objectives and responding to risks. In addition, 

management should implement its control activities for gathering this information through 

documented policies.16 

Cause. The IRM does not require that the Submission Processing internal control, AMC, and 

AEHR reviews be conducted. In addition, IRS does not have policies in the IRM that require 

reporting the results of these reviews to senior management and senior management’s review 

of these monitoring processes and tools, including keeping them current and assessing their 

continued relevance in achieving objectives and addressing risk. 

Effect. Because IRS has not issued current and clear policies in the IRM for conducting and 

overseeing the reviews of operational and physical security controls, there is increased risk that 

deficiencies in the internal controls that the reviews are intended to monitor may exist and not 

be detected, and as a result, IRS may not promptly prevent or detect the theft, loss, or 

unauthorized access to hard copy taxpayer receipts and associated information. In addition, 

there is increased risk that IRS management may not effectively evaluate controls for continued 

relevance in achieving objectives and addressing risks.

Recommendations for Executive Action. We are making the following three 

recommendations to IRS: 

• The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS 

officials develop and implement policies in the IRM for conducting and monitoring the 

 16GAO-14-704G.
Page 7 GAO-18-393R IRS Management Report

Submission Processing internal control review. These policies should include or be 

accompanied by procedures to (1) assess and update the review questions and cited IRM 

criteria to reasonably assure they align with the controls under review; (2) periodically 

evaluate and document a review of the error threshold methodology to assess its current 

validity based on changes to the operating environment; (3) report findings identified in the 

Findings and Corrective Actions Report; and (4) assess and monitor (a) safeguarding 

internal control activities across all work shifts, particularly during peak seasons, 

(b) safeguarding internal control activities for the appropriate use and destruction of hard 

copy taxpayer information, and (c) the results of relevant functional level reviews. 

(Recommendation 18-03)

• The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS 

officials develop and implement policies in the IRM for conducting and monitoring the AMC 

review. These policies should include or be accompanied by procedures for IRS 

management responsible for establishing policies related to safeguarding controls to 

(1) periodically monitor the results of the review; (2) clarify the minimum requirements for 

how frequently the review should be completed at its various facilities while considering 

factors that may affect the most appropriate timing of these reviews, such as changes in 

personnel, operational processes, or information technology; and (3) reasonably assure that 

corrective actions for all identified deficiencies are tracked until fully implemented. 

(Recommendation 18-04)

• The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS 

officials develop and implement policies in the IRM for conducting and monitoring the AEHR 

review. These policies should include or be accompanied by procedures for IRS 

management responsible for establishing policies related to safeguarding controls to 

(1) periodically monitor the results of the review and (2) reasonably assure that corrective 

actions for all identified deficiencies are tracked until fully implemented. (Recommendation 

18-05)

Status of Prior Audit Recommendations

IRS has continued to work to address many of the control deficiencies related to open 

recommendations from our prior financial audits. As of September 30, 2016, there were 41 

recommendations to improve IRS’s financial operations and internal controls from prior year 

audits that we reported as open in our status of recommendations in the management report 

issued in May 2017.17 In the course of performing our fiscal year 2017 financial audit, we 

identified numerous actions IRS took to address previously identified control deficiencies. On 

the basis of IRS’s actions taken through September 30, 2017, that we were able to substantiate 

through our audit, we are closing 14 of these recommendations. As a result, a total of 32 

recommendations need to be addressed—27 remaining from our prior years’ audits and the 5 

new recommendations we are making in this report. See enclosure I for more details on our 

assessment of the status of IRS’s actions to address prior audit recommendations that 

remained open as of September 30, 2016.

Agency Comments 

We provided a draft of this report to IRS for comment. In its comments, reproduced in enclosure 

II, IRS agreed with the five new recommendations and described planned actions to address 

each recommendation. IRS stated that it is committed to implementing appropriate 

 17GAO-17-454R.
Page 8 GAO-18-393R IRS Management Report

improvements to ensure that it maintains sound financial management practices. IRS’s actions, 

if effectively implemented, should address the issues that gave rise to our recommendations. 

We will evaluate the effectiveness of IRS’s efforts during our audit of its fiscal year 2018 

financial statements.

- - - - - - -

This report contains recommendations to you. The head of a federal agency is required by 31 

U.S.C. § 720 to submit a written statement on action taken or planned on our recommendations 

to the Senate Committee on Homeland Security and Governmental Affairs, the House 

Committee on Oversight and Government Reform, the congressional committees with 

jurisdiction over the programs and activities that are the subject of our recommendations, and 

GAO not later than 60 days after the date of this report. A written statement must also be sent to 

the Senate and House Committees on Appropriations with the agency’s first request for 

appropriations made more than 60 days after the date of this report. Please send your 

statement of actions to me at clarkce@gao.gov or Charles Fox, Assistant Director, at 

foxc@gao.gov. 

We are sending copies of this report to the Chairmen and Ranking Members of the Senate 

Committee on Appropriations, Senate Committee on Finance, Senate Committee on Homeland 

Security and Governmental Affairs, House Committee on Appropriations, House Committee on 

Ways and Means, and House Committee on Oversight and Government Reform, and to the 

Chairman and Vice Chairman of the Senate Joint Committee on Taxation. We are also sending 

copies to the Secretary of the Treasury, the Director of the Office of Management and Budget, 

and other interested parties. In addition, the report is available at no charge on the GAO website 

at http://www.gao.gov. 

We acknowledge and appreciate the cooperation and assistance provided by IRS officials and 

staff during our audit of IRS’s fiscal years 2017 and 2016 financial statements. If you or your 

staff have any questions about this report, please contact me at (202) 512-9377 or 

clarkce@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs 

may be found on the last page of this report. GAO staff who made major contributions to this 

report are listed in enclosure III. 

Sincerely yours,

Cheryl E. Clark

Director 

Financial Management and Assurance 

Enclosures – 3
Page 9 GAO-18-393R IRS Management Report

Enclosure I: Status of Recommendations from Prior Audits Reported as Open in GAO’s 

2016 Management Report

Table 1 shows the status of recommendations reported as open in our 2016 management 

report.18 We will continue to evaluate IRS’s actions to address recommendations that remain 

open during future audits. The abbreviations used are defined in the legend at the end of the 

table.

Table 1: Status of Recommendations Reported as Open in GAO’s 2016 Management Report

ID Recommendation per audit area Source report Status

Unpaid assessments

08-06 In instances where computer programs that control penalty assessments are 

not functioning in accordance with the intent of the IRM, take appropriate 

action to correct the programs so that they function in accordance with the 

IRM.

Action taken: IRS completed an internal assessment of its penalty 

computation programs and identified 19 programming issues that caused its 

financial system to record erroneous penalty assessments into taxpayer 

accounts. As of September 30, 2017, IRS provided us with supporting 

documentation validating that it addressed and corrected 18 of the 19 

programming issues. According to IRS, it will continue to address the final 

outstanding issue in fiscal year 2018. 

GAO-08-368R Open

10-04 Once IRS identifies the control weaknesses that result in inaccuracies or 

errors that materially affect the financial reporting of unpaid assessments, 

implement control procedures to routinely prevent, or to detect and correct, 

such errors.

Action taken: IRS created a long-term corrective action plan that contains 

specific actions to improve control procedures to routinely prevent or detect 

and correct errors that affect unpaid assessments. IRS completed some of 

these action items during fiscal year 2017, such as establishing a taskforce to 

improve unpaid assessments data quality. While IRS completed these 

actions, GAO and IRS continued to identify numerous misclassified unpaid 

assessments that resulted from inaccuracies or errors in taxpayer accounts. 

Thus, IRS’s actions to date have not been effective at fully addressing the 

issues that continue to cause material inaccuracies produced by IRS’s 

financial systems. 

GAO-10-565R Open

15-02 Develop and implement agency-wide procedures to routinely monitor the 

accuracy of penalties recorded in taxpayer accounts to timely detect and 

correct errors.

Action taken: In January 2017, IRS documented agency-wide procedures to 

routinely monitor the accuracy of penalties recorded in taxpayer accounts in 

the IRM, which details the agency-wide procedures IRS developed and 

implemented, and more specifically, the semiannual reviews it performs to 

reasonably assure the accuracy of penalty assessments recorded in taxpayer 

accounts and timely detect and correct errors. Additionally, IRS conducted 

and provided us with its penalty quality review results for February 2017, May 

2017, and August 2017. IRS’s actions sufficiently address our 

recommendation.

GAO-15-480R Closed

 18GAO, Management Report: Improvements Are Needed to Enhance the Internal Revenue Service’s Internal Control 

over Financial Reporting, GAO-17-454R (Washington, D.C.: May 17, 2017).
Page 10 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

17-01 Develop and implement a process to reasonably assure that IRS operating 

divisions and the IT organization effectively coordinate with the CFO 

organization when making programming changes to information systems 

affecting financial reporting.

Action taken: IRS issued a memorandum in March 2017 to reiterate that IRS 

operating divisions and the IT organization should coordinate with the CFO 

organization when making programming changes to information systems 

affecting financial reporting. However, as of September 30, 2017, IRS’s 

actions intended to fully address this recommendation, which include 

developing and implementing a coordination process, are ongoing. 

GAO-17-454R Open

17-02 Research and determine the reason the IT organization did not follow IRS 

policy to thoroughly test programming changes related to the automation of 

specific penalty abatement procedures to reasonably assure that they worked 

as intended before implementation. Based on this determination, establish a 

process to better ensure compliance with existing policies for testing 

programming changes, including the use and review of the Applications 

Development transmittal checklist when developing program changes and 

retention of test results.

Action taken: As of September 30, 2017, IRS’s actions to address this 

recommendation are ongoing. 

GAO-17-454R Open

Safeguarding

09-09 Establish procedures requiring that each physical security analyst conduct a 

periodic documented review of the Emergency Signal History Report and 

emergency contact list for its respective location to ensure that 

(1) appropriate corrective actions have been planned for all incidents 

reported by the central monitoring station and (2) the emergency contact list 

for each location is current and includes only appropriate contacts. 

Action taken: During fiscal year 2017, IRS updated its procedures to require 

that physical security analysts conduct (1) a monthly documented review of 

the AEHR, previously referred to as the Emergency Signal History Report, to 

ensure that appropriate corrective actions have been planned for all incidents 

reported by the central monitoring station and (2) an annual documented 

review of the emergency contact list for each location to ensure that it is 

current and includes only appropriate contacts. While IRS met the intent of 

this recommendation by updating its procedures, we found that in August 

2016, IRS removed from the IRM the requirement for physical security 

analysts to review the AEHR. IRS’s removal of the IRM requirement creates 

a new control deficiency, which we address in this report. 

GAO-09-513R Closed

11-12 Based on a review of all existing contracts under $100,000 without an 

appointed contracting officer's technical representative that should require 

contract employees to obtain favorable background investigation results, 

amend those contracts to require that favorable background investigations be 

obtained for all relevant contract employees before routine, unescorted, 

unsupervised physical access to taxpayer information is granted. 

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, it plans to review all contracts under 

$100,000 open as of October 1, 2016, and ensure that each contract 

includes a clause requiring that favorable background investigations be 

obtained for all relevant contract employees before they are granted routine, 

unescorted, unsupervised physical access to taxpayer information. However, 

as long as IRS does not have a policy for reviewing potential service 

contracts (see Recommendation 11-13), IRS’s review should include existing 

contracts within the most recent fiscal year.

GAO-11-494R Open
Page 11 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

11-13 Establish a policy requiring collaborative oversight between IRS’s key offices 

in determining whether potential service contracts involve routine, 

unescorted, unsupervised physical access to taxpayer information, thus 

requiring background investigations, regardless of contract award amount. 

This policy should include a process for the requiring business unit to 

communicate to the Office of Procurement and the HCO the services to be 

provided under the contract and any potential exposure of taxpayer 

information to contract employees providing the services, and for all three 

units to (1) evaluate the risk of exposure of taxpayer information prior to 

finalizing and awarding the contract and (2) ensure that the final contract 

requires favorable background investigations, as applicable, commensurate 

with the assessed risk.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that by August 2018, several internal organizations plan to partner 

to identify the remaining actions needed to address this recommendation. 

Proposed actions include refining policies and procedures to reasonably 

assure that (1) oversight between IRS’s key offices is conducted to determine 

whether potential service awards that IRS enters into involve routine, 

unescorted, unsupervised physical access to taxpayer information by 

contractors, thus requiring background investigations, and (2) the resulting 

processes clarify who is responsible for completing the various steps, as well 

as who should maintain documentation of the approved access determination 

prior to the contractor providing services. 

GAO-11-494R Open

11-24 Revise the post orders for the SCCs and lockbox bank security guards to 

include specific procedures for timely reporting exterior lighting outages to 

SCCs or lockbox bank facilities management. These procedures should 

specify (1) whom to contact to report lighting outages and (2) how to 

document and track lighting outages until resolved.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that by June 2018, it plans to analyze all campus post orders and 

update them as needed to ensure that documented procedures specify 

(1) whom to contact to report lighting outages and (2) how to document and 

track lighting outages until resolved. 

GAO-11-494R Open

12-10 Update the IRM to specify steps to be followed to prevent campus support 

clerks as well as any other employees who process payments through the 

electronic check presentment system from making adjustments to taxpayer 

accounts. 

Action taken: IRS’s actions to address this recommendation are ongoing. 

Although IRS updated the IRM in an attempt to meet the intent of this 

recommendation, IRS did not undertake a global review of the level of access 

provided to all employee groups that handle hard copy taxpayer receipts and 

related sensitive information. As a result, in May 2016, IRS reassessed the 

risks at its TACs, where employees process taxpayer remittances through the 

electronic check presentment system and adjust taxpayer accounts. 

However, IRS has not updated the IRM to reflect policy changes based on its 

risk assessment. IRS stated that in fiscal year 2018, its W&I organization will 

ensure that applicable IRM sections are revised for any policy changes based 

on its risk assessment, including specifying the appropriate level of IDRS 

access given to TAC employees who process payments. 

GAO-12-683R Open

13-05 Perform a risk assessment to determine the appropriate level of IDRS access 

that should be granted to employee groups that handle hard copy taxpayer 

receipts and related sensitive taxpayer information as part of their job 

responsibilities.

GAO-13-420R Open
Page 12 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

Action taken: IRS’s actions to address this recommendation are ongoing. 

Although IRS performed a risk assessment to determine the appropriate level 

of IDRS access that should be granted to TAC employees who handle hard 

copy taxpayer receipts and related sensitive taxpayer information as part of 

their job responsibilities, it has not undertaken a global review of the level of 

access provided to all non-TAC employee groups that have IDRS access and 

staff-like access to hard copy taxpayer receipts and related sensitive 

information. IRS stated that by October 2019, its LB&I, TEGE, TAS, and 

SBSE organizations, in coordination with its IT organization, will complete a 

risk assessment of all employee groups that handle hard copy taxpayer 

receipts and related sensitive taxpayer information to determine the most 

appropriate level of IDRS access. Based on the results of the assessment, 

these organizations plan to develop follow-up actions to mitigate or, where 

appropriate, accept the related risks from incompatible job duties of affected 

employee groups.

13-06 Based on the results of the risk assessment, update the IRM accordingly to 

specify the appropriate level of IDRS access that should be allowed for 

(1) remittance perfection technicians and (2) all other employee groups with 

IDRS access that handle hard-copy taxpayer receipts and related sensitive 

information as part of their job responsibilities.

Action taken: IRS’s actions to address this recommendation are ongoing. As 

a result of its risk assessment efforts, IRS updated the IRM to restrict the use 

of certain IDRS command codes for remittance perfection technicians. In May 

2016, IRS reassessed the risks at its TACs, including the specific risks and 

mitigating factors associated with allowing TAC employees to process 

taxpayer remittances and to adjust taxpayer accounts. However, IRS has not 

updated the IRM to reflect policy changes based on its risk assessment 

related to TAC employees. IRS stated that in fiscal year 2018, it plans to 

revise the applicable IRM sections for any policy changes, including 

specifying the appropriate level of IDRS access allowed for TAC employees 

who process payments. IRS also stated that by October 2020, it plans to 

undertake a global review of the level of access provided to non-TAC 

employee groups that have access to IDRS and hard copy taxpayer receipts 

and related sensitive information and update the applicable IRM sections. 

GAO-13-420R Open

13-07 Establish procedures to implement the updated IRM, including required steps 

to follow to prevent (1) remittance perfection technicians and (2) all other 

employee groups that handle hard-copy taxpayer receipts and related 

sensitive information as part of their job responsibilities from gaining access 

to command codes not required as part of their designated job duties.

Action taken: IRS’s actions to address this recommendation are ongoing. As 

a result of its risk assessment efforts, IRS updated the IRM to include 

procedures to restrict the use of certain IDRS command codes for remittance 

perfection technicians. However, IRS has not updated the IRM to reflect 

policy changes based on the results of its risk assessment related to TAC 

employees and, as applicable, other employees who have access to 

sensitive command codes and handle hard copy taxpayer receipts and 

related sensitive information as part of their job duties. IRS stated that by 

October 2020, it plans to undertake a global review of the level of access 

provided to non-TAC employee groups that have access to IDRS and hard 

copy taxpayer receipts and related sensitive information, update the 

applicable IRM sections, and establish applicable procedures to adhere to 

the IRM updates. 

GAO-13-420R Open
Page 13 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

15-03 Determine the reason(s) why TAC managers and personnel did not 

consistently comply with existing IRM requirements that TAC managers and 

personnel (1) perform and document reviews of the Follow-Up Review Log by 

the last day of the following month, (2) maintain control copies of transmittal 

forms, and (3) ship taxpayer receipts and information via traceable overnight 

mail and, based on this determination, establish a process to better enforce 

compliance with these requirements.

Action taken: During fiscal year 2016, IRS performed a study of the reasons 

why TAC managers and personnel did not consistently comply with IRM 

requirements and determined that staffing shortages, delays in receiving 

acknowledgments, and training inconsistencies were among the causes. 

During fiscal year 2017, IRS completed several actions to address its 

findings, such as establishing TAC appointment services to alleviate 

scheduling and staffing issues, revising its procedures for documenting 

transmittal acknowledgments, and providing comprehensive training to TAC 

managers and personnel. IRS’s actions sufficiently address our 

recommendation.

GAO-15-480R Closed

15-04 Update the IRM to require managers to reconcile transmittal forms with the 

Follow-Up Review Log to reasonably assure that personnel are properly 

entering transmittal forms into the log and are appropriately documenting 

follow-up on unacknowledged transmittals of taxpayer receipts and 

information. 

Action taken: In January 2017, IRS updated the IRM to require managers to 

review all remittance transmittals and a sample of nonremittance transmittals 

each month to ensure that personnel are documenting follow-up on 

unacknowledged transmittals of taxpayer receipts and information. This 

update also requires managers to document the results of the monthly review 

on the Field Assistance TAC Document Transmittal Review and 

Reconciliation form. As a result, our recommendation to require managers to 

reconcile the transmittals to the Follow-up Review Logs is no longer 

applicable, as IRS discontinued the use of the logs given its updated process. 

IRS’s actions sufficiently address our recommendation.

GAO-15-480R Closed

15-06 Establish a process to ensure that the requirement for unauthorized access 

awareness training is explicitly communicated to non-IRS contractors who 

have unescorted access to IRS facilities.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that by August 2018, its FMSS organization plans to partner with 

key stakeholders to identify the remaining actions and time frames necessary 

to refine existing policies, procedures, and processes to ensure 

(1) oversight among IRS’s key stakeholders to determine whether potential 

service awards that involve routine, unescorted, unsupervised physical 

access to taxpayer information by non-IRS contractors require the completion 

of unauthorized access security awareness training and (2) the resulting 

processes and responsibilities are clear for each stakeholder to verify that 

the required training is completed. 

GAO-15-480R Open

15-07 Establish procedures to monitor whether non-IRS contractors with 

unescorted physical access to IRS facilities are receiving unauthorized 

access awareness training. 

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that by October 2018, it plans to send out communication to its 

FMSS field offices that will include SOPs for monitoring and acquiring 

unauthorized access awareness training documentation for each non-IRS 

contractor. 

GAO-15-480R Open
Page 14 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

15-08 Determine the reasons why staff did not consistently comply with IRS's 

existing requirements for the final candling of receipts at SCCs and lockbox 

banks, including logging remittances found during final candling on the final 

candling log at the time of discovery, safeguarding the remittances at the time 

of discovery, transferring the remittances to the deposit unit promptly, and 

passing one envelope at a time over the light source, and based on this 

determination, establish a process to better enforce compliance with these 

requirements.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, it plans to identify and analyze the risks 

associated with candling at the SCCs and lockbox banks, along with any 

mitigating factors, to determine whether further actions are warranted. 

GAO-15-480R Open

16-02 Establish a process to prevent Employment Operations staff from allowing 

potential employees to enter on duty without favorable determinations of 

suitability by Personnel Security adjudicators. 

Action taken: IRS’s actions to address this recommendation are ongoing. 

During fiscal year 2016, IRS’s HCO developed a process and revised 

procedures for its Employment Operations office to conduct monitoring 

procedures to reasonably assure that new employees do not enter on duty 

before prescreening adjudications are completed and approved by Personnel 

Security adjudicators. However, during our fiscal year 2017 audit, we 

identified IRS employees who entered on duty without completed or 

approved suitability adjudication determinations. IRS stated that in fiscal year 

2018, it plans to determine the additional steps needed to reasonably assure 

that Employment Operations staff do not allow potential employees to enter 

on duty without approved adjudication determinations. 

GAO-16-457R Open

16-03 Establish a policy and procedures requiring IRS officials to review and 

address situations in which it is later discovered that an employee deemed 

unsuitable for employment during the prescreening process was erroneously 

allowed to enter on duty.

Action taken: IRS’s actions to address this recommendation are ongoing. 

While IRS responded that it established a policy and related procedures, it 

has not sufficiently demonstrated that the policy and procedures were 

implemented. During our fiscal year 2017 audit, we identified an instance 

where an employee was allowed to enter on duty and it was subsequently 

discovered that this employee was deemed unsuitable for employment during 

the prescreening process. IRS was unable to demonstrate that its procedures 

had been carried out for this employee. IRS stated that in fiscal year 2018, it 

plans to determine the additional steps needed to reasonably assure that it 

addresses situations in which it is later discovered that an employee deemed 

unsuitable for employment during the prescreening process was erroneously 

allowed to enter on duty. 

GAO-16-457R Open

16-04 Develop and provide training, on a recurring basis, to all FMSS specialists 

and managers involved in the duress alarm validation and testing process to 

reinforce the related policies and procedures. 

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that by June 2018, it plans to develop a mandatory training for all 

physical security specialists and managers responsible for duress alarm 

validation and testing. In addition, it plans to develop a policy to ensure that 

the training is completed annually. 

GAO-16-457R Open
Page 15 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

16-06 Establish and implement a policy requiring recurring training for TAC group 

and territory managers on their TSRRD responsibilities, including detailed 

instructions for completing responses to questions in TSRRD and for 

reviewing TSRRD submissions for accuracy and completeness. This training 

should be updated for changes in TSRRD questions over time and be 

provided to new TAC group and territory managers soon after they are hired 

or appointed.

Action taken: In January 2017, IRS updated the IRM to require that TAC 

group and territory managers receive annual training on TSRRD 

responsibilities. In June 2017, IRS attested that all managers completed the 

annual TSRRD training for fiscal year 2017. IRS noted that if there is a 

change to the TSRRD process between the dates of the annual training, 

managers will be notified of any changes via e-mail. In addition, if the 

procedures are affected, the IRM and TSRRD job aid will be updated to 

reflect any changes. IRS’s actions sufficiently address our recommendation.

GAO-16-457R Closed

17-03 Strengthen the process for reasonably assuring that the IRM is reviewed 

annually to align with the current control procedures and guidance being 

implemented by agency personnel. This should include a mechanism for 

reasonably assuring that program owner directors (1) review their respective 

program control activities and related guidance annually and timely update 

the IRM as needed, (2) document their reviews, and (3) utilize interim 

guidance and supplemental guidance correctly for their intended purposes.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, its Research, Applied Analytics and 

Statistics organization plans to strengthen the process to reasonably assure 

that all IRM sections are reviewed annually to align with the current control 

procedures and guidance being implemented by IRS personnel. This will 

include a mechanism to reasonably assure that program owner directors 

(1) review their respective program control activities and related guidance 

annually, and update the IRM timely, if needed; (2) document their reviews; 

and (3) use interim guidance and supplemental guidance correctly for their 

intended purposes. 

GAO-17-454R Open

17-04 Ensure that the respective Agency-Wide Shared Services IRM and 

supplemental guidance related to the frequency of performing 

(1) emergency/alarm contact-list validation, (2) duress alarm inventory 

validation, and (3) federal security risk assessments are consistent.

Action taken: In February 2017, IRS revised the IRM and updated the 

corresponding SOP to synchronize the frequency of performing 

(1) emergency/alarm contact-list validation, (2) duress alarm inventory 

validation, and (3) federal security risk assessments. IRS’s actions sufficiently 

address our recommendation.

GAO-17-454R Closed

17-05 Update the respective (1) Privacy, Governmental Liaison and Disclosure and 

(2) CFO IRM sections related to the definition of the tax gap to align with the 

current understanding followed by IRS personnel.

Action taken: IRS’s actions to address this recommendation are ongoing. In 

April 2017, IRS updated the CFO IRM section to align the tax gap definition 

with the current understanding followed by IRS personnel. IRS stated that in 

fiscal year 2018, its Privacy, Governmental Liaison and Disclosure 

organization plans to remove the tax gap definition from its IRM section. 

GAO-17-454R Open
Page 16 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

Refunds

14-15 Establish and implement policies and procedures requiring a review process 

to reasonably assure that the accounts related to deceased taxpayers are 

only reopened for valid refunds. 

Action taken: In January 2016, IRS automated the process of locking 

deceased taxpayer accounts during its year-end processing. In January 

2017, IRS implemented a process to prevent systemic tax refunds from being 

issued when a date of death is present on a deceased taxpayer’s account. 

With this process in place, if a deceased taxpayer’s account is reopened to 

process a tax return, IRS performs additional procedures to determine 

whether the tax refund is valid. During our fiscal year 2017 audit, we 

reviewed tax refunds disbursed on deceased taxpayer accounts that were 

reopened and determined that IRS’s actions meet the intent of our 

recommendation. 

GAO-14-433R Closed

14-16 Establish and implement policies and procedures that require monitoring to 

reasonably assure that accounts related to deceased taxpayers that have 

been reopened are timely closed after processing the refund. 

Action taken: In January 2016, IRS automated the process of locking 

deceased taxpayer accounts during its year-end processing. In January 

2017, IRS implemented a process to prevent systemic tax refunds from being 

issued when a date of death is present on a deceased taxpayer’s account. 

With this process in place, systemic tax refunds do not get processed on 

reopened deceased taxpayer accounts that were not timely closed. Instead, 

IRS performs additional procedures to determine whether the tax refunds are 

valid. During our fiscal year 2017 audit, we reviewed tax refunds disbursed 

on deceased taxpayer accounts that were reopened and determined that 

IRS’s actions meet the intent of our recommendation.

GAO-14-433R Closed

16-07 Determine the reason(s) why staff did not always comply with IRS’s 

established policies and procedures related to initiating, monitoring, and 

reviewing the monitoring of manual refunds and, based on this determination, 

establish a process to better enforce compliance with these requirements.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in September 2017, its TAS organization established a 

process to better enforce the policies and procedures related to initiating,

monitoring, and reviewing the monitoring of manual refunds. However, IRS 

anticipates that efforts by its W&I organization will not be completed until 

fiscal year 2018.

GAO-16-457R Open

16-08 Enhance the training program provided to COs to address all the job 

responsibilities related to certifying manual refunds for payment, including the 

required review of supporting documentation for manual refunds.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, it plans to develop and provide interim 

training to COs on their roles and responsibilities related to certifying manual 

refunds for payment, including requirements to review supporting 

documentation for manual refunds. In addition, IRS stated that by February 

2019, it also plans to develop a training course that will be provided annually. 

GAO-16-457R Open

16-10 Identify the cause of and implement a solution for dealing with the periodic 

backlogs of ICO inventory that is hampering the performance of quality 

reviews.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, it plans to identify the cause of and 

GAO-16-457R Open
Page 17 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

implement a solution for dealing with the periodic backlogs of ICO inventory. 

17-06 Revise the applicable IRM sections pertaining to manual refunds to require 

employees to verify the validity of the digital signatures on the manual refund 

request forms and the manual refund signature authorization forms.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, it plans to revise the applicable IRM 

sections pertaining to manual refunds to require that employees validate the 

digital signatures on manual refund request forms and manual refund 

signature authorization forms. 

GAO-17-454R Open

Gross cost

13-11 Establish and implement written policies or procedures that require the 

agency to record the obligation of funds when a contract or agreement is 

entered into and prior to taking delivery of goods or services.

Action taken: In August 2015, IRS updated the IRM to require IRS to record 

the obligation of funds when a contract or agreement is entered into and prior 

to taking delivery of goods and services. We tested IRS's implementation of 

the policy during our fiscal year 2017 audit and did not identify any 

exceptions. IRS’s actions sufficiently address our recommendation.

GAO-13-420R Closed

16-16 Establish and implement detailed written procedures for calculating future 

lease payments for noncancelable operating leases that are reported in the 

notes to the financial statements. The procedures should (1) include steps for 

considering any ad hoc clauses that may have specific termination dates and 

(2) include a requirement for supervisory review to provide reasonable 

assurance of the accuracy of future lease payment amounts for 

noncancelable operating leases.

Action taken: In October 2016, IRS established and implemented 

procedures for calculating future lease payments for noncancelable operating 

leases that are reported in the notes to its financial statements. The 

procedures include (1) steps for considering any ad hoc clauses that may 

have specific termination dates and (2) a requirement for supervisory review 

to reasonably assure the accuracy of future lease payment amounts for 

noncancelable operating leases. We did not identify any exceptions during 

our fiscal year 2017 review of IRS’s noncancelable operating lease 

schedules. IRS’s actions sufficiently address our recommendation.

GAO-16-457R Closed

17-07 Revise system access rights in HR Connect to prevent HR assistants within 

the Employment Operations office from approving and releasing pay-related 

personnel actions to NFC. 

Action taken: In April 2017, IRS identified and removed the system access 

rights in HR Connect that allowed HR assistants within the Employment 

Operations office to approve and release pay-related personnel actions. 

During our fiscal year 2017 audit, we observed that IRS’s corrective actions 

were effective in preventing HR assistants from approving and releasing payrelated personnel actions and confirmed that these access rights were 

removed from all HR assistants in the Employment Operations office. IRS’s 

actions sufficiently address our recommendation.

GAO-17-454R Closed

17-08 Revise the HR Connect HR User Profiles Desk Guide to clearly indicate that 

HR assistants within the Employment Operations office should not be granted 

access to approve and release pay-related personnel actions to NFC. 

Action taken: IRS revised the HR Connect HR User Profiles Desk Guide in 

December 2016 and subsequently in April 2017. The revised desk guide 

GAO-17-454R Closed
Page 18 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

provides instructions for granting access rights to HR assistants within the 

Employment Operations office that will not allow them to both approve and 

release pay-related personnel actions to NFC. IRS’s actions sufficiently 

address our recommendation.

Net cost presentation

17-09 Establish and implement procedures to periodically review the process for 

determining the intragovernmental costs and costs with the public for each 

major program reported in the notes to the financial statements to provide 

reasonable assurance that these amounts are reliable and fairly presented.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, its CFO organization plans to establish 

and implement procedures to periodically review the process for determining 

intragovernmental and public costs for each major program reported in the 

notes to the financial statements.

GAO-17-454R Open

Property and equipment

16-11 Establish policies for (1) how long an asset can remain in missing status 

before it is removed from P&E reported on the financial statements and 

(2) how long assets can go unverified during the annual inventory process 

before they are identified as missing in the property management system.

Action taken: IRS issued AM064, Asset Management Policy Directive to 

Identify Uncertified Class A and Class B Assets as Missing in KISAM, 

effective October 1, 2016. This directive states that assets not verified or 

certified for more than two inventory cycles should be identified as “missing” 

in IRS’s property management system. In November 2016, IRS established 

the Missing Assets Financial Reporting Assessment procedure, which states 

that assets in “missing” status for 1 year or more should be removed from the 

P&E reported on IRS’s financial statements. IRS’s actions sufficiently 

address our recommendation.

GAO-16-457R Closed

16-12 Establish and implement procedures to reasonably assure that missing 

assets are timely removed from the financial statements when applicable. 

Action taken: In November 2016, IRS established the Missing Assets 

Financial Reporting Assessment procedure, which includes procedures for 

identifying assets that have been in missing status in the property 

management system for 1 year or more and for removing them from the P&E 

reported on IRS’s financial statements. We verified that IRS conducted a 

missing assets analysis as of September 30, 2017, and determined that the 

net book value of the missing assets as of September 30, 2017, is 

immaterial. Thus, no adjustments to the financial statements were necessary. 

IRS’s actions sufficiently address our recommendation.

GAO-16-457R Closed

16-13 Establish and implement monitoring procedures designed to reasonably 

assure that the key detailed information for tangible capitalized P&E is 

properly recorded and updated in the KISAM system.

Action taken: IRS established the Asset Management Program Monitoring 

and Review procedure, effective October 1, 2016, for performing quarterly 

sample reviews of IT assets in KISAM. In September 2017, IRS also revised 

the IRM to require FMSS territory managers or section chiefs to review 

KISAM key data elements for non-IT assets to verify they are correct and 

updated. During our fiscal year 2017 audit, we verified that IRS conducted 

quarterly reviews of a sample of IT and non-IT asset records in KISAM. Since 

fiscal year 2017 is the first year that IRS implemented its quarterly reviews, 

we will further assess the effectiveness of these reviews in providing 

GAO-16-457R Open
Page 19 GAO-18-393R IRS Management Report

ID Recommendation per audit area Source report Status

reasonable assurance that key detailed information is properly recorded and 

updated in KISAM during our fiscal year 2018 audit when we will conduct 

tests of physical inventory.

16-14 Design a process to reasonably assure the adequacy of detailed supporting 

information for tangible P&E amounts recorded in the general ledger.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, its CFO organization plans to implement a 

P&E subsidiary ledger and also design and implement processes based on 

the P&E subsidiary ledger that will reasonably assure the adequacy of 

detailed supporting information for tangible P&E amounts recorded in the 

general ledger. 

GAO-16-457R Open

17-10 Provide clear guidelines as to what events constitute removal from IRS 

premises and the disposal date that should be recorded in its inventory 

system, either through an update of the IRM or other property and 

equipment-related desk guides.

Action taken: IRS’s actions to address this recommendation are ongoing. 

IRS stated that in fiscal year 2018, its FMSS organization plans to provide 

clear guidelines on events that constitute removal of trackable property and 

equipment assets from IRS premises, and the disposal date that should be 

recorded in its inventory system, either by updating the IRM or the property 

and equipment-related desk guides. 

GAO-17-454R Open

Legend:

AEHR: All Events History Report

CFO: Chief Financial Officer

CO: Certifying Officer 

FMSS: Facilities Management and Security Services

HCO: Human Capital Office

HR: Human Resources

ICO: Input Correction Operation 

ID: identification of GAO recommendation number

IDRS: Integrated Data Retrieval System

IRM: Internal Revenue Manual

IRS: Internal Revenue Service

IT: information technology

KISAM: Knowledge, Incident/Problem, Service Asset Management 

LB&I: Large Business and International

NFC: National Finance Center

P&E: property and equipment

SBSE: Small Business Self-Employed

SCC: service center campus

SOP: standard operating procedures

TAC: Taxpayer Assistance Center

TAS: Taxpayer Advocate Service

TEGE: Tax Exempt Government Entity

TSRRD: TAC Security and Remittance Review Database

W&I: Wage and Investment

Source: GAO evaluation of the status of recommendations as of September 30, 2017. | GAO-18-393R.
Page 20 GAO-18-393R IRS Management Report

Enclosure II: Comments from the Internal Revenue Service
Page 21 GAO-18-393R IRS Management Report
Page 22 GAO-18-393R IRS Management Report
Page 23 GAO-18-393R IRS Management Report
Page 24 GAO-18-393R IRS Management Report
Page 25 GAO-18-393R IRS Management Report

Enclosure III: GAO Contact and Staff Acknowledgments 

GAO Contact 

Cheryl E. Clark, (202) 512-9377 or clarkce@gao.gov 

Staff Acknowledgments 

In addition to the contact named above, the following individuals made major contributions to 

this report: Charles Fox (Assistant Director), Destiny Bowie, Stephanie Choi, Liliam Coronado, 

Nina Crocker, Ryan Guthrie, Cory Mazer, Bin Park, Michael Reed, John Sawyer, Kevin Scott, 

Eric Stalcup, Sunny Stanley, Vanessa Taja, Monasha Thompson, LaDonna Towler, and Cherry 

Vasquez.

(102470)
This is a work of the U.S. government and is not subject to copyright protection in the United States.

The published product may be reproduced and distributed in its entirety without further permission

from GAO. However, because this work may contain copyrighted images or other material,

permission from the copyright holder may be necessary if you wish to reproduce this material

separately.
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to https://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, https://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at https://www.gao.gov.

Contact:

Website: https://www.gao.gov/fraudnet/fraudnet.htm

Automated answering system: (800) 424-5454 or (202) 512-7470

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.