APPENDIX 1

Good Accounting Obligation in Government Act Report for Fiscal Year 2022 Budget Justification Submission

Implementation Status of Government Accountability Office (GAO) Recommendations

Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

IRS WEBSITE: Long-Term Strategy 

Needed to Improve Interactive Services 

GAO-13-435 04/16/2013 Administration of 

Program Operations

The Commissioner of Internal Revenue should establish a numerical or other 

measurable goal to improve taxpayer satisfaction and a timeframe for 

achieving it.

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Controls

GAO-13-420R 05/13/2013 Financial Statements The Commissioner of Internal Revenue should perform a risk assessment to 

determine the appropriate level of IDRS access that should be granted to 

employee groups that handle hard-copy taxpayer receipts and related 

sensitive taxpayer information as part of their job responsibilities. 

IRS PCA Due Date: Mar-2021

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Controls

GAO-13-420R 05/13/2013 Financial Statements The Commissioner of Internal Revenue should update the IRM accordingly 

to specify the appropriate level of IDRS access that should be allowed for (1) 

remittance perfection technicians and (2) all other employee groups with 

IDRS access that handle hard-copy taxpayer receipts and related sensitive 

information as part of their job responsibilities. 

IRS PCA Due Date: Jun-2021

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Controls

GAO-13-420R 05/13/2013 Financial Statements The Commissioner of Internal Revenue should establish procedures to 

implement the updated IRM, including required steps to follow to prevent (1) 

remittance perfection technicians and (2) all other employee groups that 

handle hard-copy taxpayer receipts and related sensitive information as part 

of their job responsibilities from gaining access to command codes not 

required as part of their designated job duties. 

IRS PCA Due Date: Jun-2021

TAX ADMINISTRATION: IRS Could 

Improve Examinations by Adopting 

Certain Research Program Practices

GAO-13-480 05/24/2013 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should transcribe data from paperfiled Form 1040 Schedules C and E that are not currently transcribed and 

make that data available to SB/SE examiners for classification. If IRS has 

evidence that the costs related to transcribing all such data on Schedules C 

and E exceed the benefits or are otherwise prohibitive, IRS could transcribe 

less data by transcribing only the missing data for selected line items, such as 

certain large expense line items, and/or develop a budget proposal to fund an 

initiative for transcribing the Schedule C and E data.

IRS Implemented and Awaiting Auditor 

Verification

Corporate Tax Compliance: IRS 

Should Determine Whether Its 

Streamlined Corporate Audit Process Is 

Meeting Its Goals

GAO-13-662 08/22/2013 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should track savings from 

Compliance Maintenance and CAP overall and develop a plan for reinvesting 

any savings.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: 

Additional OMB and Agency Actions 

Are Needed to Achieve Portfolio 

Savings

GAO-14-65 11/06/2013 Administration of 

Program Operations

To improve the department's implementation of PortfolioStat, as the 

department finalizes and matures its enterprise architecture and valuation 

methodology, the Secretary of the Treasury should direct the CIO to utilize 

these processes to identify whether there are additional opportunities to 

reduce duplicative, low-value, or wasteful investments.

Treasury - DO Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: 

Additional OMB and Agency Actions 

Are Needed to Achieve Portfolio 

Savings

GAO-14-65 11/06/2013 Administration of 

Program Operations

The Secretary of the Treasury should direct the CIO to fully describe the 

following PortfolioStat action plan elements: (1) consolidate commodity IT 

spending under the agency CIO and (2) establish criteria for identifying 

wasteful, low-value, or duplicative investments.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Page 1 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Private Pensions: Clarity of Required 

Reports and Disclosures Could Be 

Improved

GAO-14-92 11/21/2013 Administration of 

Program Operations

The Commissioner of Internal Revenue should work with plan sponsors, 

enhance compliance, and help ensure that disclosures to participants are 

written in a manner that can be understood by the average participant, Labor, 

IRS, and PBGC should work together to: Create and regularly update a 

comprehensive online tool for plan sponsors to search for the reports and 

disclosures they are required to provide based on plan type, design, and 

circumstances.

IRS Implemented and Awaiting Auditor 

Verification

PARTNERSHIPS AND S 

CORPORATIONS: IRS Needs to 

Improve Information to Address Tax 

Noncompliance

GAO-14-453 05/14/2014 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should work to improve the quality 

of its Schedule K-1 data, develop a plan for conducting testing or other 

analysis to determine whether the improved Schedule K-1 data, perhaps 

combined with other IRS information about businesses and taxpayers, could 

be used more effectively to ensure compliance with the reporting of flowthrough income.

IRS Rejected. IRS disagreed with the 

recommendation. IRS understands the 

objective of this recommendation and, at such 

time that resources are available to enhance 

capabilities, we would consider this 

methodology of advanced testing. However, 

currently we will not be pursing the actions 

recommended. IRS views this GAO 

recommendation as not providing a sufficient 

return on investment to warrant allocating 

limited resources for implementing the 

recommendation. 

IRS Correspondence Audits: Better 

Management Could Improve Tax 

Compliance and Reduce Taxpayer 

Burden

GAO-14-479 06/05/2014 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should: (1) establish formal program 

objectives; (2) ensure that the program measures reflect those objectives; (3) 

clearly link those measures with strategic IRS-wide goals on ensuring 

compliance in a cost effective way while minimizing taxpayer burden.

IRS Implemented and Awaiting Auditor 

Verification

IRS 2015 BUDGET: Long-Term 

Strategy and Return on Investment Data 

Needed to Better Manage Budget 

Uncertainty and Set Priorities

GAO-14-605 06/12/2014 Budget Management The Commissioner of Internal Revenue should calculate actual ROI for 

implemented initiatives, compare the actual ROI to projected ROI, and 

provide the comparison to budget decision makers for initiatives where IRS 

allocated resources.

IRS Implemented and Awaiting Auditor 

Verification

IRS 2015 BUDGET: Long-Term 

Strategy and Return on Investment Data 

Needed to Better Manage Budget 

Uncertainty and Set Priorities

GAO-14-605 06/12/2014 Budget Management The Commissioner of Internal Revenue should use actual ROI calculations 

as part of resource allocation decisions. 

IRS Implemented and Awaiting Auditor 

Verification

Debt Management: Floating Rate Notes 

Can Help Treasury Meet Borrowing 

Goals, but Additional Actions Needed 

to Help Manage Risk

GAO-14-535 06/16/2014 Debt Management The Secretary of the Treasury should track and report an additional measure 

of the length of the portfolio that captures the interest rate reset frequency of 

securities in the portfolio.

Treasury - DO Implemented and Awaiting Auditor 

Verification

PRIVATE PENSIONS: Targeted 

Revisions Could Improve Usefulness of 

Form 5500 Information

GAO-14-441 07/07/2014 Administration of 

Program Operations

The Commissioner of Internal Revenue should improve the usefulness, 

reliability, and comparability of Form 5500 data for all stakeholders while 

limiting the burden on the filing community, we recommend the Secretaries 

of DOL and Treasury, and the Director of PBGC consider implementing the 

findings from our panel when modifying plan investment and service 

provider fee information, including: revise Schedule H plan asset categories 

to better match current investment vehicles and provide more transparency 

into plan investments.

IRS Implemented and Awaiting Auditor 

Verification

Page 2 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

PRIVATE PENSIONS: Targeted 

Revisions Could Improve Usefulness of 

Form 5500 Information

GAO-14-441 07/07/2014 Administration of 

Program Operations

The Commissioner of Internal Revenue should improve the usefulness, 

reliability, and comparability of Form 5500 data for all stakeholders while 

limiting the burden on the filing community, we recommend the Secretaries 

of DOL and Treasury, and the Director of PBGC consider implementing the 

findings from our panel when modifying plan investment and service 

provider fee information, including: revise the Schedule of Assets 

attachments to create a standard searchable format.

IRS Implemented and Awaiting Auditor 

Verification

PRIVATE PENSIONS: Targeted 

Revisions Could Improve Usefulness of 

Form 5500 Information

GAO-14-441 07/07/2014 Administration of 

Program Operations

The Commissioner of Internal Revenue should improve the usefulness, 

reliability, and comparability of Form 5500 data for all stakeholders while 

limiting the burden on the filing community, we recommend the Secretaries 

of DOL and Treasury, and the Director of PBGC consider implementing the 

findings from our panel when modifying plan investment and service 

provider fee information, including: develop a central repository for EIN and 

PN numbers for filers and service providers to improve the comparability of 

form data across filings.

IRS Rejected. IRS disagreed with the 

recommendation. IRS currently does not have 

the funding and staffing needed to develop the 

type of electronic repository that GAO has 

recommended. Further, IRS views this GAO 

recommendation as not providing a sufficient 

return on investment to warrant allocating 

limited resources for implementing the 

recommendation.

PRIVATE PENSIONS: Targeted 

Revisions Could Improve Usefulness of 

Form 5500 Information

GAO-14-441 07/07/2014 Administration of 

Program Operations

The Commissioner of Internal Revenue should improve the usefulness, 

reliability, and comparability of Form 5500 data for all stakeholders while 

limiting the burden on the filing community, we recommend the Secretaries 

of DOL and Treasury, and the Director of PBGC consider implementing the 

findings from our panel when modifying plan investment and service 

provider fee information, including: clarify Schedule C instructions for 

direct, eligible indirect, and reportable indirect compensation so plan fees are 

reported more consistently and, as we recommended in the past, better align 

with the 408(b)(2) fee disclosures.

IRS Rejected. IRS disagreed with the 

recommendation. The collection of 

information via Schedule C is within the 

exclusive jurisdiction of the DOL pursuant to 

Title I of ERISA. Accordingly, the IRS must 

defer to the DOL on the action and timing for 

those recommendations

PRIVATE PENSIONS: Targeted 

Revisions Could Improve Usefulness of 

Form 5500 Information

GAO-14-441 07/07/2014 Administration of 

Program Operations

The Commissioner of Internal Revenue should improve the usefulness, 

reliability, and comparability of Form 5500 data for all stakeholders while 

limiting the burden on the filing community, we recommend the Secretaries 

of DOL and Treasury, and the Director of PBGC consider implementing the 

findings from our panel when modifying plan investment and service 

provider fee information, including: simplify and clarify Schedule C service 

provider codes to increase reporting consistency.

IRS Rejected. IRS disagreed with the 

recommendation. The collection of 

information via Schedule C is within the 

exclusive jurisdiction of the Department of 

Labor (DOL) pursuant to Title I of ERISA. 

Accordingly, IRS must defer to the DOL on 

the action and timing for those 

recommendations.

New Markets Tax Credit: Better 

Controls and Data Are Needed to 

Ensure Effectiveness

GAO-14-500 07/10/2014 Administration of 

Program Operations

The Secretary of the Treasury should issue guidance on how funding or 

assistance from other government programs can be combined with the 

NMTC including the extent to which other government funds can be used to 

leverage the NMTC by being included in the qualified equity investment.

Treasury - DO PCA Due Date: Dec-2020

LARGE PARTNERSHIPS: With 

Growing Number of Partnerships, IRS 

Needs to Improve Audit Efficiency

GAO-14-732 09/18/2014 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should track the results of large 

partnerships audits, including (1) define a large partnership based on asset 

size and number of partners; (2) revise the activity codes to align with the 

large partnership definition; and (3) separately account for field audits and 

campus audits.

IRS Implemented and Awaiting Auditor 

Verification

Page 3 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

LARGE PARTNERSHIPS: With 

Growing Number of Partnerships, IRS 

Needs to Improve Audit Efficiency

GAO-14-732 09/18/2014 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should analyze the audit results by 

these activity codes and types of audits to identify opportunities to better 

plan and use IRS resources in auditing large partnerships.

IRS PCA Due Date: Sep-2021

INDIVIDUAL

RETIREMENT ACCOUNTS: IRS 

Could Bolster Enforcement on

Multimillion Dollar Accounts, but More 

Direction from

Congress Is Needed

GAO-15-16 10/20/2014 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should work in consultation with the 

Department of the Treasury on a legislative proposal to expand the statute of 

limitations on IRA noncompliance to help IRS pursue valuation-related 

misreporting and prohibited transactions that may have originated outside 

the current statute's 3-year window.

IRS Implemented and Awaiting Auditor 

Verification

INDIVIDUAL

RETIREMENT ACCOUNTS: IRS 

Could Bolster Enforcement on

Multimillion Dollar Accounts, but More 

Direction from

Congress Is Needed

GAO-15-16 10/20/2014 Tax Administration and 

Compliance

The Commissioner of Revenue should, building on research data on IRAs 

holding nonpublic assets, identify options to provide outreach targeting 

taxpayers with nonpublic IRA assets and their custodians, such as reminder 

notices that engaging in prohibited transactions can result in loss of the IRA's 

tax-favored status.

IRS Implemented and Awaiting Auditor 

Verification

Financial Stability Oversight Council: 

Further Actions Could Improve the 

Nonbank Designation Process

GAO-15-51 11/20/2014 Administration of 

Program Operations

The Secretary of the Treasury in consultation with Financial Stability 

Oversight Council members, should establish procedures to evaluate 

companies in Stage 2 and Stage 3 under both statutory determination 

standards when an evaluation in either stage concludes that a company does 

not meet one of the standards, or document--on a company-specific or more 

general basis--why the second determination standard is not relevant for 

determination evaluations

Treasury - DO Implemented and Awaiting Auditor 

Verification

Financial Stability Oversight Council: 

Further Actions Could Improve the 

Nonbank Designation Process

GAO-15-51 11/20/2014 Administration of 

Program Operations

The Secretary of the Treasury in consultation with Financial Stability 

Oversight Council (FSOC) members, should develop a process to collect 

information necessary for Stage 1 analysis, as appropriate, from certain 

nonbank financial companies for which public or regulatory information is 

otherwise unavailable. For example, FSOC could have companies for which 

such information is unavailable and that meet certain characteristics (such as 

quantitative thresholds similar to those used in Stage 1) report necessary 

information to the Office of Financial Research.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Private Pensions: Participants Need 

Better Information When Offered Lump 

Sums That Replace Their Lifetime 

Benefits

GAO-15-74 01/27/2015 Administration of 

Program Operations

Treasury should review its regulations governing the information contained 

in relative value statements to ensure these statements provide a meaningful 

comparison of all benefit options, especially in instances where the loss of 

certain additional plan benefits may not be disclosed.

Treasury - DO No Action Taken

Private Pensions: Participants Need 

Better Information When Offered Lump 

Sums That Replace Their Lifetime 

Benefits

GAO-15-74 01/27/2015 Administration of 

Program Operations

Treasury should review the applicability and appropriateness of allowing 

sponsors to select a "lookback" interest rate for use in calculating lump sums 

associated with a lump sum window that can serve to advantage the interests 

of the sponsor

Treasury - DO No Action Taken

Private Pensions: Participants Need 

Better Information When Offered Lump 

Sums That Replace Their Lifetime 

Benefits

GAO-15-74 01/27/2015 Administration of 

Program Operations

Treasury should establish a process and a timeline for periodically updating 

the mortality tables used to determine minimum required lump sums-- 

including a means for monitoring when experts' views may indicate that 

mortality tables may have become outdated, and for taking expedited action 

if warranted.

Treasury - DO No Action Taken

Page 4 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

INFORMATION TECHNOLOGY - 

Management Needs to Address 

Reporting of IRS Investments' Cost, 

Schedule, and Scope Information

GAO-15-297 02/25/2015 Information 

Technology

The Commissioner of the IRS direct the Chief Technology Officer should 

take the following action: Modify reporting of ACA testing status to senior 

management to include a comprehensive report on all impacted systemsincluding an explanation for why impacted systems were not tested at a 

particular level-and ensure this reporting is aligned with the manner in which 

testing is being performed.

IRS Rejected. IRS disagreed with the 

recommendation. We followed a rigorous riskbased process for planning the tests of 

Affordable Care Act (ACA) impacted systems, 

including the types and levels of testing. ACA 

Release 5.0 was complex and high-risk, thus 

reporting for testing within and outside IRS 

was frequent (sometimes daily), with test 

progress formally delivered via planned crossorganizational checkpoints and the Filing 

Season readiness assessment. 

Information Security: IRS Needs to 

Continue Improving Controls over 

Financial and Taxpayer Data

GAO-15-337 03/19/2015 Financial Statements The Commissioner of Internal Revenue should take the following action to 

effectively implement key elements of the IRS information security program: 

Update the remedial action verification process to ensure actions are fully 

implemented. 

IRS Implemented and Awaiting Auditor 

Verification

Information Security: IRS Needs to 

Continue Improving Controls over 

Financial and Taxpayer Data

GAO-15-337 03/19/2015 Financial Statements The Commissioner of Internal Revenue should take the following action to 

effectively implement key elements of the IRS information security program: 

Ensure that control testing methodology and results fully meet the intent of 

the control objectives being tested. 

IRS Implemented and Awaiting Auditor 

Verification

Telecommunications: Agencies Need 

better Controls to Achieve Significant 

Savings on Mobile Devices and 

Services

GAO-15-431 05/21/2015 Information 

Technology

The Secretary of Treasury should ensure an inventory of mobile devices and 

services is established department-wide (i.e. all components' devices and 

associated services are accounted for)

Treasury - DO Implemented and Awaiting Auditor 

Verification

Telecommunications: Agencies Need 

better Controls to Achieve Significant 

Savings on Mobile Devices and 

Services

GAO-15-431 05/21/2015 Information 

Technology

The Secretary of the Treasury should ensure procedures to monitor and 

control spending are established department-wide. Specifically, ensure that 

(1) procedures include assessing devices for zero, under, and over usage; (2) 

personnel with authority and responsibility for performing the procedures are 

identified; and (3) the specific steps to be taken to perform the process are 

documented.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Management Report: Improvements 

Are Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-15-480R 05/29/2015 Financial Statements The appropriate IRS officials should determine why staff did not consistently 

comply with IRS's existing requirements for the final candling of receipts at 

SCCs and lockbox banks, including logging remittances found during final 

candling on the final candling log at the time of discovery, safeguarding the 

remittances at the time of discovery, transferring the remittances to the 

deposit unit promptly, and passing one envelope at a time over the light 

source, and based on this determination, establish a process to better enforce 

compliance with these requirements.

IRS PCA Due Date: Dec-2020

Management Report: Improvements 

Are Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-15-480R 05/29/2015 Financial Statements The Commissioner of Internal Revenue should establish procedures to 

monitor whether non-IRS contractors with unescorted physical access to IRS 

facilities are receiving unauthorized access awareness training. 

IRS PCA Due Date: May-2021

Page 5 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

PATIENT PROTECTION AND 

AFFORDABLE CARE ACT: IRS 

Needs to Strengthen Oversight of Tax 

Provisions for Individuals

GAO-15-540 07/29/2015 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should take the following action: 

Assess whether or not the data received from the health insurance 

marketplaces are sufficiently complete and accurate to enable effective 

correction of tax returns at-filing based on matching with the marketplace 

data and, if the assessment determines that such corrections would be 

effective, seek legislative authority to correct tax returns at-filing based on 

the marketplace data. 

IRS Implemented and Awaiting Auditor 

Verification

PATIENT PROTECTION AND 

AFFORDABLE CARE ACT: IRS 

Needs to Strengthen Oversight of Tax 

Provisions for Individuals

GAO-15-540 07/29/2015 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should take the following action: 

Evaluate IRS efforts to collaborate and communicate with key external 

stakeholders to inform efforts related to implementation of the new 2015 

PPACA requirements. 

IRS Implemented and Awaiting Auditor 

Verification

IRS CASE SELECTION: Collection 

Process Is Largely Automated, but 

Lacks Adequate Internal Controls

GAO-15-647 07/29/2015 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should establish, document, and 

implement clear objectives for the collection program and enterprise-wide 

case categorization and routing processes, and define key terms, such as 

"fairness" and "risk."

IRS Implemented and Awaiting Auditor 

Verification

IRS CASE SELECTION: Collection 

Process Is Largely Automated, but 

Lacks Adequate Internal Controls

GAO-15-647 07/29/2015 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should build upon existing 

Enterprise Risk Management (ERM) guidance to help managers identify 

internal and external risks to collection program objectives, and better 

understand how long-standing risk processes integrate with new ERM 

approaches; incorporate this guidance into existing or future ERM or 

collection program risk assessment processes.

IRS Implemented and Awaiting Auditor 

Verification

IRS CASE SELECTION: Automated 

Collection System Lacks Key Internal 

Controls Needed to Ensure the Program 

Fulfills Its Mission

GAO-15-744 09/10/2015 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should establish, document, and 

implement objectives for the collection program and ACS, and define the key 

term of "fairness" as it applies to collection activities, which can be 

communicated to IRS staff.

IRS Implemented and Awaiting Auditor 

Verification

Information Technology Reform: 

Billions of Dollars in Savings Have 

Been Realized, but Agencies Need to 

Complete Reinvestment Plans 

GAO-15-617 09/15/2015 Information 

Technology

The Secretary of the Treasury should direct the CIO, as part of any future 

update to the department's IRM strategic plan or equivalent document, to 

include information regarding the approach to reinvesting savings from the 

consolidation of commodity IT resources (including data centers) in 

accordance with OMB's guidance.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology Reform: 

Billions of Dollars in Savings Have 

Been Realized, but Agencies Need to 

Complete Reinvestment Plans 

GAO-15-617 09/15/2015 Information 

Technology

The Secretary of the Treasury should direct the CIO to ensure that the 

department's integrated data collection submission to OMB includes, for all 

reported initiatives, complete plans to use any resulting cost savings and 

avoidances from OMB-directed IT reform-related efforts.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Critical Infrastructure Protection:

Sector-Specific Agencies Need to Better 

Measure Cybersecurity Progress

GAO-16-79 11/19/2015 Information 

Technology

The Secretary of the Treasury should direct responsible officials to develop 

performance metrics to provide data and determine how to overcome 

challenges to monitoring the financial services sector's cybersecurity 

progress.

Treasury - DO Implemented and Awaiting Auditor 

Verification

2015 Tax Filing Season GAO-16-151DO 01/14/2016 Tax Administration and 

Compliance

The Secretary of the Treasury should update the Department's performance 

plan to include overage rates for handling taxpayer correspondence as a part 

of Treasury's performance goals.

Treasury - DO Implemented and Awaiting Auditor 

Verification

IRS Referral Programs: Opportunities 

Exist to Strengthen Controls and 

Increase Coordination across 

Overlapping Programs

GAO-16-155 02/23/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the referral programs to 

establish a mechanism to coordinate on a plan and timeline for developing a 

consolidated, online referral submission in order to better position IRS to 

leverage specialized expertise while exploring options to further consolidate 

the initial screening operations.

IRS Implemented and Awaiting Auditor 

Verification

Page 6 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

IRS Referral Programs: Opportunities 

Exist to Strengthen Controls and 

Increase Coordination across 

Overlapping Programs

GAO-16-155 02/23/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the Internal 

Revenue Manual (IRM) has internal controls for processing information 

referrals by establishing, documenting, and implementing procedures for 

maintaining and communicating the information referral screening and 

routing guidelines to the Image Control Team (ICT) and IRS units receiving 

information referrals as well as procedures for ICT screening and routing 

operations.

IRS Implemented and Awaiting Auditor 

Verification

IRS Referral Programs: Opportunities 

Exist to Strengthen Controls and 

Increase Coordination across 

Overlapping Programs

GAO-16-155 02/23/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the IRM has 

internal controls for processing information referrals by establishing, 

documenting, and implementing ongoing monitoring of information referrals 

retained for destruction, including a mechanism for tracking the reasons 

referrals were retained prior to destruction.

IRS Implemented and Awaiting Auditor 

Verification

IRS Referral Programs: Opportunities 

Exist to Strengthen Controls and 

Increase Coordination across 

Overlapping Programs

GAO-16-155 02/23/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the IRM has 

internal controls for processing information referrals by establishing, 

documenting, and implementing procedures for each IRS operating unit 

receiving information referrals to provide feedback on the number and types 

of referrals misrouted and on their disposition, and a mechanism to analyze 

patterns of misroute errors.

IRS Implemented and Awaiting Auditor 

Verification

IRS Referral Programs: Opportunities 

Exist to Strengthen Controls and 

Increase Coordination across 

Overlapping Programs

GAO-16-155 02/23/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the IRM has 

internal controls for processing information referrals by establishing, 

documenting, and implementing supervisory review and segregation of 

duties for inventory management reporting procedure.

IRS Implemented and Awaiting Auditor 

Verification

IRS Referral Programs: Opportunities 

Exist to Strengthen Controls and 

Increase Coordination across 

Overlapping Programs

GAO-16-155 02/23/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should establish, document, and 

implement an organizational structure identifying responsibility for defining 

objectives with an appropriate line of reporting for measuring costs and 

results for information referrals.

IRS Implemented and Awaiting Auditor 

Verification

Information Security: IRS Needs to 

Further Improve Controls over Financial 

and Taxpayer Data

GAO-16-398 03/28/2016 Financial Statements The Commissioner of Internal Revenue should update system and 

application audit plans based on the current version of referenced policies 

and guidelines and when significant changes are made to a system or 

application.

IRS Implemented and Awaiting Auditor 

Verification

Cloud Computing: Agencies Need to 

Incorporate Key Practices to Ensure 

Effective Performance

GAO-16-325 04/07/2016 Information 

Technology

To help ensure continued progress in the implementation of effective cloud 

computing SLAs, the Secretaries of Health and Human Services, Homeland 

Security, Treasury, and Veterans Affairs should direct appropriate officials to 

develop SLA guidance and ensure key practices are fully incorporated as the 

contract and associated SLAs expire.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Low-Income Housing Tax Credit: Some 

Agency Practices Raise Concerns and 

IRS Could Improve Noncompliance 

Reporting and Data Collection

GAO-16-360 05/11/2016 Improper Payments The IRS Commissioner should evaluate how IRS could use HUD's Real 

Estate Assessment Center databases, including how the information might be 

used to reassess reporting categories on the Form 8823 and to reassess which 

categories of noncompliance information have to be reviewed for audit 

potential.

IRS Implemented and Awaiting Auditor 

Verification

Low-Income Housing Tax Credit: Some 

Agency Practices Raise Concerns and 

IRS Could Improve Noncompliance 

Reporting and Data Collection

GAO-16-360 05/11/2016 Improper Payments The IRS Commissioner should collaborate with the allocating agencies to 

clarify when allocating agencies should report such information on the Form 

8823 (report of noncompliance or building disposition). The IRS 

Commissioner should collaborate with the Department of the Treasury in 

drafting such clarifications to help ensure that any new guidance is consistent 

with Treasury regulations.

IRS Implemented and Awaiting Auditor 

Verification

Page 7 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-16-457R 05/18/2016 Financial Statements The Commissioner of Internal Revenue should determine the reason(s) why 

staff did not always comply with IRS's established policies and procedures 

related to initiating, monitoring, and reviewing the monitoring of manual 

refunds and, based on this determination, establish a process to better 

enforce compliance with these requirements.

IRS On Hold. Agreed with the recommendation. 

Due to funding constraints, the 

recommendation is put on hold. 

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-16-457R 05/18/2016 Financial Statements The Commissioner of Internal Revenue should establish and implement 

monitoring procedures designed to reasonably assure that the key detailed 

information for tangible capitalized P&E is properly recorded and updated in 

the KISAM system.

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-16-457R 05/18/2016 Financial Statements The Commissioner of Internal Revenue should Identify the cause of and 

implement a solution for dealing with the periodic backlogs of ICO inventory 

that is hampering the performance of quality reviews.

IRS Implemented and Awaiting Auditor 

Verification

Information Technology: Federal 

Agencies Need to Address Aging 

Legacy Systems

GAO-16-468 05/25/2016 Information 

Technology

The Secretaries of Commerce and the Treasury should direct the respective 

agency CIO to ensure that required analyses are performed on investments in 

the operations and maintenance phase.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology: Federal 

Agencies Need to Address Aging 

Legacy Systems

GAO-16-468 05/25/2016 Information 

Technology

To address obsolete IT investments in need of modernization or replacement, 

the Secretaries of Agriculture, Commerce, Defense, Energy, Health and 

Human Services, Homeland Security, State, the Treasury, Transportation, 

and Veterans Affairs; the Attorney General; and the Commissioner of Social 

Security should direct their respective agency CIOs to identify and plan to 

modernize or replace legacy systems as needed and consistent with OMB's 

draft guidance, including time frames, activities to be performed, and 

functions to be replaced or enhanced.

Treasury - DO Rejected. Treasury disagreed with the 

recommendation. Treasury will develop the 

corresponding policy once OMB finalizes its 

guidance.

Refundable Tax Credits: 

Comprehensive Compliance Strategy 

and Expanded Use of Data Could 

Strengthen IRS's Efforts to Address 

Noncompliance

GAO-16-475 05/27/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct Refundable Credits 

Policy and Program Management (RCPPM) to, take necessary steps to 

ensure the reliability of collections data and periodically review those data to 

(a) compute a collections rate for post-refund enforcement activities and (b) 

determine what additional analyses would provide useful information about 

compliance results and costs of post-refund audits and document-matching 

reviews.

IRS Rejected. IRS disagreed with the 

recommendation. The Wage and Investment 

compliance workload is predominantly prerefund audits, where taxpayer claims for 

refundable credits are not paid prior to the 

conclusion of the examination. By holding 

potential refunds, revenue is protected and any 

subsequent disallowance of the claimed 

credits, generally, does not result in balances 

due that require follow-up collection activity. 

The level of effort to complete the 

recommended analysis would consume limited 

resources and would not justify the results. 

Further, it would not provide meaningful data 

to the program. IRS views this GAO 

recommendation as not providing a sufficient 

return on investment to warrant allocating 

limited resources for implementing the 

recommendation. 

Page 8 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Information Technology: IRS Needs to 

Improve Its Processes for Prioritizing 

and Reporting Performance of 

Investments

GAO-16-545 06/29/2016 Information 

Technology

The Commissioner of Internal Revenue should direct the Chief Technology 

Officer to establish, document, and implement policies and procedures for 

selecting new and reselecting ongoing business systems modernization 

activities, consistent with IRS's process for prioritizing operations support 

priorities, which addresses (1) prioritization and comparison of IT assets 

against each other, (2) criteria for making selection and prioritization 

decisions, and (3) ensuring IRS executives' final funding decisions on IT 

proposals are based on IRS's prioritization process.

IRS Implemented and Awaiting Auditor 

Verification

Information Technology: IRS Needs to 

Improve Its Processes for Prioritizing 

and Reporting Performance of 

Investments

GAO-16-545 06/29/2016 Information 

Technology

The Commissioner of Internal Revenue should direct the Chief Technology 

Officer to modify existing processes for Foreign Account Tax Compliance 

Act (FATCA) and Return Review Program (RRP) for measuring work 

performed by IRS staff to incorporate best practices, including accounting 

for actual work performed and using the level of effort measure sparingly.

IRS Implemented and Awaiting Auditor 

Verification

IRS Could Improve Presentation of 

Budget Data in Its Congressional 

Justification

GAO-16-695 07/21/2016 Budget Management The Commissioner of Internal Revenue, to the extent feasible, should ensure 

that the CJ includes data by appropriation account on the amount of funding 

requested to maintain current services for each future state theme.

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection: IRS Needs to 

Define Field Program Objectives and 

Assess Risks in Case Selection

GAO-16-787 09/13/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should develop, document, and 

communicate control procedures guidance for group managers to exercise 

professional judgment in the Field Collection program case selection process 

to achieve fairness and other program and collection case selection 

objectives.

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection: IRS Needs to 

Define Field Program Objectives and 

Assess Risks in Case Selection

GAO-16-787 09/13/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should develop, document, and 

communicate Field Collection program and case selection objectives, 

including the role of fairness, in clear and measurable terms sufficient for use 

in internal control.

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection: IRS Needs to 

Define Field Program Objectives and 

Assess Risks in Case Selection

GAO-16-787 09/13/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should develop, document, and 

implement performance measures clearly linked to the Field Collection 

program and case selection objectives.

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection: IRS Needs to 

Define Field Program Objectives and 

Assess Risks in Case Selection

GAO-16-787 09/13/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should develop, document, and 

implement procedures to periodically monitor and assess the design and 

operational effectiveness of both automated and manual control procedures 

for collection case selection to assure their continued effectiveness in 

achieving program objectives.

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection: IRS Needs to 

Define Field Program Objectives and 

Assess Risks in Case Selection

GAO-16-787 09/13/2016 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should incorporate program and case 

selection objectives into existing risk management systems or use other 

approaches to identify and analyze potential risks to achieving those 

objectives so that Field Collection can establish risk tolerances and 

appropriate control procedures to address risks.

IRS Implemented and Awaiting Auditor 

Verification

Information Technology Reform: 

Agencies Need to Increase Their Use of 

Incremental Development Practices

GAO-16-469 09/15/2016 Information 

Technology

To improve the certification of adequate incremental development, the 

Secretaries of Defense, Education, Health and Human Services, and the 

Treasury should direct their CIOs to establish a department policy and 

process for the certification of major IT investments' adequate use of 

incremental development, in accordance with OMB's guidance on the 

implementation of the Federal Information Technology Acquisition Reform 

Act.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Page 9 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Information Technology: Agencies 

Need to Improve Their Application 

Inventories to Achieve Additional 

Savings

GAO-16-511 09/26/2016 Information 

Technology

To improve federal agencies' efforts to rationalize their portfolio of 

applications, the heads of the Departments of Agriculture, Commerce, 

Education, Energy, Health and Human Services, Housing and Urban 

Development, the Interior, Labor, State, Transportation, the Treasury, and 

Veterans Affairs; and heads of the Environmental Protection Agency; 

National Aeronautics and Space Administration; National Science 

Foundation; Nuclear Regulatory Commission; Office of Personnel 

Management; Small Business Administration; Social Security 

Administration; and U.S. Agency for International Development should 

direct their Chief Information Officers (CIOs) and other responsible officials 

to improve their inventories by taking steps to fully address the practices we 

identified as being partially met or not met.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Improper Payments - Strategy and 

Additional Actions Needed to Help 

Ensure Agencies Use the Do Not Pay 

Working System as Intended

GAO-17-15 11/14/2016 Information 

Technology

The Commissioner of the Bureau of the Fiscal Service should modify the 

working system to track adjudication of matches obtained through all 

functionalities.

Fiscal Service Implemented and Awaiting Auditor 

Verification

401(K) Plans: Effects of Eligibility and 

Vesting Policies on Workers' 

Retirement Savings

GAO-17-69 11/21/2016 Administration of 

Program Operations

To ensure that current vesting policies appropriately balance plans' needs and 

interests with the needs of workers to have employment mobility while also 

saving for retirement, Treasury should evaluate the appropriateness of 

existing maximum vesting policies for account-based plans, considering 

today's mobile labor force, and seek legislative action to revise vesting 

schedules, if deemed necessary. The Department of Labor could provide 

assistance with such an evaluation.

Treasury - DO On hold. Agreed with the recommendation. 

Due to lack of legislative authority, the 

recommendation is put on hold.

IT Workforce: Key Practices Help 

Ensure Strong Integrated Program 

Teams; Selected Departments Need to 

Assess Skill Gaps

GAO-17-8 11/30/2016 Information 

Technology

The Secretary of the Treasury should require the Chief Information Officer, 

Chief Human Capital Officer, and other senior managers as appropriate to 

address the shortfalls in IT workforce planning noted in this report, including 

the following actions: (1) establish and maintain a workforce planning 

process; (2) develop competency and staffing requirements for all positions; 

(3) assess competency and staffing needs regularly; (4) assess gaps in 

competencies and staffing for all components of the workforce; (5) develop 

strategies and plans to address gaps in competencies and staffing for all 

components of the workforce; (6) implement activities that address gaps, 

including a career path for program managers and special hiring authorities, 

if justified and cost-effective; (7) monitor the department's progress in 

addressing competency and staffing gaps; and (8) report to department 

leadership on progress in addressing competency and staffing gaps for all 

components of the workforce.

Treasury - DO PCA Due Date: Sep-2021

Retirement Security: Improved 

Guidance Could Help Account Owners 

Understand the Risks of Investing in 

Unconventional Assets

GAO-17-102 01/09/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should provide guidance to IRA 

owners and custodians on how to determine and document fair market value 

(FMV) for certain categories of hard-to -value unconventional assets. For 

example, IRS could consider updating Form 5498 instructions to custodians 

on how to document FMV for hard-to-value assets (e.g., last-known FMV 

based on independent appraisal, acquisition price) and provide guidance 

directed at account owners that provides examples of how to ascertain FMV 

for different types of unconventional

assets.

IRS Implemented and Awaiting Auditor 

Verification

Page 10 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct LB&I to adopt a 

standard process for monitoring audit selection decisions in the field, such as 

by modifying the existing quality control system.

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the 

documentation gaps in policies and procedures are addressed for the 

following internal control principles for the selection method: communicate 

internally the necessary quality information about the objectives

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the 

documentation gaps in policies and procedures are addressed for the 

following internal control principles for the selection method: define 

objectives to identify risk and define risk tolerances

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the 

documentation gaps in policies and procedures are addressed for the 

following internal control principles for the selection method: design control 

activities to achieve objectives and respond to risks

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the 

documentation gaps in policies and procedures are addressed for the 

following internal control principles for the selection method: evaluate issues 

and remediate identified internal control deficiencies on a timely basis

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the 

documentation gaps in policies and procedures are addressed for the 

following internal control principles for the selection method: identify, 

analyze, and respond to risks to achieving the objectives

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the 

documentation gaps in policies and procedures are addressed for the 

following internal control principles for the selection method: use quality 

information to achieve objectives

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

To further ensure that the new campaigns under LB&I's new approach for 

addressing tax compliance are implemented successfully, the Commissioner 

of Internal Revenue should develop and document criteria to use in choosing 

selection methods for campaigns using audits.

IRS Implemented and Awaiting Auditor 

Verification

Page 11 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

To further ensure that the new campaigns under LB&I's new approach for 

addressing tax compliance are implemented successfully, the Commissioner 

of Internal Revenue should document lessons learned from stakeholder input 

and past performance.

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

To further ensure that the new campaigns under LB&I's new approach for 

addressing tax compliance are implemented successfully, the Commissioner 

of Internal Revenue should establish metrics to help determine whether the 

campaign effort overall meets LB&I's goals.

IRS Implemented and Awaiting Auditor 

Verification

IRS RETURN SELECTION: Improved 

Planning, Internal Controls, and Data 

Would Enhance Large Business 

Division Efforts to Implement New 

Compliance Approach

GAO-17-324 03/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should monitor overall performance 

across future campaigns, not just individual compliance projects, and in 

doing so ensure that the data used for monitoring accounts for the costs 

beyond the auditor's time can clearly be linked with specific selection 

methods, including the Discriminant Analysis System (DAS) method, to the 

extent that the selection methods continue to operate.

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-17-454R 05/17/2017 Financial Statements The Commissioner of Internal Revenue should Strengthen the process for 

reasonably assuring that the IRM is reviewed annually to align with the 

current control procedures and guidance being implemented by agency 

personnel. This should include a mechanism for reasonably assuring that 

program owner directors (1) review their respective program control 

activities and related guidance annually and timely update the IRM as 

needed, (2) document their reviews, and (3) utilize interim guidance and 

supplemental guidance correctly for their intended purposes.

IRS PCA Due Date: Dec-2021

Management Report: Improvements 

Needed in Controls over the Preparation 

of the U.S. Consolidated Financial 

Statements

GAO-13-540 06/29/2017 Financial Statements To improve the reliability of the information presented in the CFS budget 

statements, the Secretary of the Treasury should direct the Fiscal Assistant 

Secretary, working in coordination with the Controller of OMB's Office of 

Federal Financial Management, to establish and implement effective 

procedures for reporting amounts in the CFS budget statements that are fully 

consistent with the underlying information in significant federal entities' 

audited financial statements and other financial data.

Fiscal Service PCA Due Date: Sep-2025

Management Report: Improvements 

Needed in Controls over the Preparation 

of the U.S. Consolidated Financial 

Statements

GAO-13-540 06/29/2017 Financial Statements To improve the reliability of the information presented in the CFS budget 

statements, the Secretary of the Treasury should direct the Fiscal Assistant 

Secretary, working in coordination with the Controller of OMB's Office of 

Federal Financial Management, to establish and implement effective 

procedures for identifying and reporting all items needed to prepare the CFS 

budget statements.

Fiscal Service PCA Due Date: Sep-2022

Page 12 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Management Report: Improvements 

Needed in Controls over the Processes 

Used to Prepare the U.S. Consolidated 

Financial Statements

GAO-17-524 07/12/2017 Financial Statements The Secretary of the Treasury should direct the Fiscal Assistant Secretary, 

working in coordination with the Controller of OMB, to improve corrective 

action plans for (1) treaties and international agreements, (2) additional audit 

procedures for intragovernmental activity and balances, and (3) the 

Reconciliation Statements so that they include sufficient information to 

address the control deficiencies in these areas effectively.

Fiscal Service Rejected. Treasury disagreed with the 

recommendation as it considers this 

recommendation redundant to existing open 

recommendations issued in previous years. 

Treasury will continue to work with agencies 

to facilitate improvement of processes, 

minimizing the need for Treasury adjustments 

to agency reporting. Ultimate responsibility for 

the desired outcome of minimizing the need 

for Treasury adjustments rests with the agency 

community and their auditors, and is 

dependent on the quality and completeness of 

agency data provided to Treasury.

Improper Payments: Improvements 

Needed in CMS and IRS Controls over 

Health Insurance Premium Tax Credit

GAO-17-467 07/13/2017 Improper Payments The Commissioner of Internal Revenue should Assess and document the 

feasibility of approaches for incorporating information from the 

marketplaces on individuals who did not demonstrate that they met the 

eligibility requirements for citizenship or lawful presence in the tax 

compliance process. If determined feasible, IRS should work with Treasury 

to require marketplaces to periodically provide such information on 

individuals and use such information to recover advance PTC made for those 

individuals.

IRS PCA Due Date: Dec-2020

Improper Payments: Improvements 

Needed in CMS and IRS Controls over 

Health Insurance Premium Tax Credit

GAO-17-467 07/13/2017 Improper Payments The Commissioner of Internal Revenue should Assess the program against 

applicable IPIA-defined thresholds and conclude on its susceptibility to 

significant improper payments, and revise the scope of its improper 

payments susceptibility assessment for the PTC program to include instances 

in which advance PTC is greater than or equal to the amount of PTC claimed 

on the tax return. If the program meets the IPIA definition for being 

susceptible to significant improper payments based on this assessment, 

estimate and report improper payments associated with the PTC program 

consistent with IPIA requirements.

IRS Implemented and Awaiting Auditor 

Verification

Improper Payments: Improvements 

Needed in CMS and IRS Controls over 

Health Insurance Premium Tax Credit

GAO-17-467 07/13/2017 Improper Payments The Commissioner of Internal Revenue should assess whether IRS should 

require its examiners to verify health care coverage of individuals to 

determine eligibility for PTC. To do this, IRS should complete its evaluation 

on the level of noncompliance related to duplicate health insurance coverage. 

Based on this evaluation and if cost effective, IRS should design and 

implement formal policies and procedures to routinely identify individuals 

inappropriately receiving PTC because of their eligibility for or enrollment in 

health care programs outside of the marketplaces and notify such individuals 

of their ineligibility for PTC.

IRS Implemented and Awaiting Auditor 

Verification

Information Security:Control 

Deficiencies Continue to Limit IRS's 

Effectiveness in Protecting Sensitive 

Financial and Taxpayer Data

GAO-17-395 07/26/2017 Financial Statements The Commissioner of Internal Revenue should Ensure that system 

administrators and security operations analysts are alerted in the event of 

audit processing failures.

IRS PCA Due Date: Dec-2020

Information Security:Control 

Deficiencies Continue to Limit IRS's 

Effectiveness in Protecting Sensitive 

Financial and Taxpayer Data

GAO-17-395 07/26/2017 Financial Statements The Commissioner of Internal Revenue should Identify and review service 

organizations' listing of user controls that are deemed relevant and test those 

controls to appropriately draw conclusions about the operating effectiveness 

of controls.

IRS PCA Due Date: Nov-2020

Page 13 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Information Security:Control 

Deficiencies Continue to Limit IRS's 

Effectiveness in Protecting Sensitive 

Financial and Taxpayer Data

GAO-17-395 07/26/2017 Financial Statements The Commissioner of Internal Revenue should Implement a compliance 

verification application, or other appropriate process, to ensure configuration 

policies are comprehensively tested on the mainframe.

IRS PCA Due Date: Jul-2021

Information Security:Control 

Deficiencies Continue to Limit IRS's 

Effectiveness in Protecting Sensitive 

Financial and Taxpayer Data

GAO-17-395 07/26/2017 Financial Statements The Commissioner of Internal Revenue should Implement the audit plans for 

the 12 systems and applications that we reviewed in the production 

computing environment.

IRS PCA Due Date: Feb-2021

Information Security:Control 

Deficiencies Continue to Limit IRS's 

Effectiveness in Protecting Sensitive 

Financial and Taxpayer Data

GAO-17-395 07/26/2017 Financial Statements The Commissioner of Internal Revenue should Regularly update 

configuration standards and guidelines for network devices to incorporate 

recommendations from industry leaders, security agencies, and key practices 

from IRS partners to address known vulnerabilities applicable to IRS's 

environment.

IRS PCA Due Date: Feb-2021

Data Center Optimization:

Agencies Need to Address Challenges 

and Improve Progress to Achieve Cost 

Savings Goal

GAO-17-448 09/06/2017 Information 

Technology

The Secretaries of Agriculture, Commerce, Defense, Homeland Security, 

Energy, HHS, Interior, Labor, State, Transportation, Treasury, and VA; the 

Attorney General of the United States; the Administrators of EPA, GSA, and 

SBA; the Director of OPM; and the Chairman of NRC should take action to, 

within existing OMB reporting mechanisms, complete plans describing how 

the agency will achieve OMB's requirement to implement automated 

monitoring tools at all agency-owned data centers by the end of fiscal year 

2018.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Small Business Contracting: Actions 

Needed to Demonstrate and Better 

Review Compliance with Select 

Requirements for Small Business 

Advocates

GAO-17-675 09/25/2017 Procurement 

Management

The Secretary of the Treasury should comply with sections 15(k)(8) and 

(k)(11) of the Small Business Act, as amended, or report to Congress on why 

the agency has not complied, including seeking any statutory flexibilities or 

exceptions believed appropriate.

Treasury - DO Implemented and Awaiting Auditor 

Verification

DATA Act: OMB, Treasury, and 

Agencies Need to Improve 

Completeness and Accuracy of 

Spending Data and Disclose Limitations

GAO-18-138 11/08/2017 Information 

Technology

The Secretary of the Treasury should reasonably assure that ongoing 

monitoring controls to help ensure the completeness and accuracy of agency 

submissions are designed, implemented, and operating as designed. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

DATA Act: OMB, Treasury, and 

Agencies Need to Improve 

Completeness and Accuracy of 

Spending Data and Disclose Limitations

GAO-18-138 11/08/2017 Information 

Technology

The Secretary of the Treasury should disclose known data quality issues and 

limitations on the new USAspending.gov

Treasury - DO Implemented and Awaiting Auditor 

Verification

IDENTITY THEFT: Improved 

Collaboration Could Increase Success of 

IRS Initiatives to Prevent Refund Fraud 

GAO-18-20 11/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the Information 

Sharing and Analysis Center (ISAC) pilot better aligns with leading practices 

for effective pilot design. This should include (1) establishing criteria for 

assessing whether the pilot's objectives have been met before making 

decisions about its scalability and whether, how, and when to proceed to full 

implementation; and (2) developing a data analysis plan that identifies data 

sources and criteria necessary for effectively evaluating the pilot.

IRS Implemented and Awaiting Auditor 

Verification

IDENTITY THEFT: Improved 

Collaboration Could Increase Success of 

IRS Initiatives to Prevent Refund Fraud 

GAO-18-20 11/28/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the ISAC 

Partnership develops an outreach plan to expand membership and improve 

states' and industry partners' understanding of the ISAC's benefits. 

IRS Implemented and Awaiting Auditor 

Verification

IRS Needs Specific Goals and 

Strategies for Improving Compliance

GAO-18-39 11/30/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should instruct the appropriate 

officials to develop and document a strategy that outlines how IRS will use 

National Research Program data to update compliance strategies that could 

help address the tax gap.

IRS PCA Due Date: Jan-2021

Page 14 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

IRS Needs Specific Goals and 

Strategies for Improving Compliance

GAO-18-39 11/30/2017 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should re-establish long-term, 

quantitative goals for improving voluntary compliance. 

IRS Rejected. IRS disagreed with the 

recommendation. By remaining committed to 

estimating the tax gap and voluntary 

compliance rate, the IRS will be able to 

ascertain whether it is broadly making 

progress toward the goal of increasing 

voluntary compliance, without a quantitative 

target. The voluntary compliance/tax gap data 

are not effective for making strategic, 

operational decisions. They are allencompassing measures, affected by IRS 

actions and non-IRS factors; therefore, it will 

be next to impossible to isolate the effects of 

any given action.

Information Technology: Agencies 

Need to Involve Chief Information 

Officers in Reviewing Billions of 

Dollars in Acquisitions

GAO-18-42 01/10/2018 Information 

Technology 

The Secretary of the Treasury should ensure that IT acquisition plans or 

strategies are reviewed and approved according to OMB's guidance.

Treasury - DO Implemented and Awaiting Auditor 

Verification

TAX FRAUD AND 

NONCOMPLIANCE: IRS Can 

Strengthen Pre-refund Verification and 

Explore More Uses 

GAO-18-224 01/30/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should implement any identified 

changes to improve pre-refund compliance checks.

IRS Implemented and Awaiting Auditor 

Verification

TAX FRAUD AND 

NONCOMPLIANCE: IRS Can 

Strengthen Pre-refund Verification and 

Explore More Uses 

GAO-18-224 01/30/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should use IRS's existing authority to 

modify the refund hold such that it minimizes the risk of releasing fraudulent 

or noncompliant refunds.

IRS Implemented and Awaiting Auditor 

Verification

TAX FRAUD AND 

NONCOMPLIANCE: IRS Can 

Strengthen Pre-refund Verification and 

Explore More Uses 

GAO-18-224 01/30/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should assess options for improving 

enforcement of late W-2 filing penalties, for example, by mailing notices 

before the next filing deadline. 

IRS Rejected. IRS disagreed with the 

recommendation. Penalties for late-filed, 

incorrect media, and missing/incorrect TINs 

are assessable systemically under IRC 6721 for 

various information returns including the 

Forms W-2. IRC 6721 has a maximum 

limitation for each payer and a penalty notice 

cannot be issued for each information return 

(Forms W-2 as recommended in this case) 

because it will ignore the maximum limitation 

required by law. In addition, SSA provides to 

IRS a drop-file in December of the year the 

Forms W-2 are due. IRS needs this file to 

exclude these payers from receiving an 

erroneous penalty notice.

TAX FRAUD AND 

NONCOMPLIANCE: IRS Can 

Strengthen Pre-refund Verification and 

Explore More Uses 

GAO-18-224 01/30/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should assess the benefits and costs 

of additional uses and applications of W-2 data for pre-refund compliance 

checks, such as addressing underreporting, employment fraud, and other 

fraud or noncompliance before issuing refunds.

IRS Implemented and Awaiting Auditor 

Verification

TAX FRAUD AND 

NONCOMPLIANCE: IRS Can 

Strengthen Pre-refund Verification and 

Explore More Uses 

GAO-18-224 01/30/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should develop an evaluation plan to 

fully assess the benefits and costs, including taxpayer burden, of modifying 

the February 15 refund hold, and determine how this effort informs IRS's 

overall compliance strategy for refundable tax credits and fraud risk 

management.

IRS Implemented and Awaiting Auditor 

Verification

Page 15 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Committee on Foreign Investment in the 

United States: Treasury Should 

Coordinate Assessments of Resources 

Needed to Address Increased Workload

GAO-18-249 02/14/2018 Administration of 

Program Operations

Treasury, as CFIUS lead, should coordinate member agencies' efforts to 

better understand the staffing levels needed to address the current and 

projected CFIUS workload associated with core committee functions.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Additional Actions Are Essential for 

Assessing Cybersecurity Framework 

Adoption

GAO-18-211 02/15/2018 Information 

Technology

The Secretary of Treasury should take steps to consult with respective sector 

partner(s), such as the SCC, DHS and NIST, as appropriate, to develop 

methods for determining the level and type of framework adoption by 

entities across their respective sector. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Derisking along the Southwest Border 

Highlights Need for Regulators to

Enhance Retrospective Reviews

GAO-18-263OCC 02/26/2018 Terrorism and Financial 

Crime

The Comptroller of the Currency should work jointly with FinCEN, the 

FDIC and the FRB to conduct a retrospective review of BSA/AML 

regulations and their implementation for banks, focusing on how banks' 

regulatory concerns may be influencing their willingness to provide services 

to certain populations. GAO also recommended that the OCC, FDIC, FRB, 

and FinCEN take steps to revise the BSA regulations or the way they are 

being implemented to help ensure BSA/AML regulatory objectives are being 

met in the most effective and least burdensome way.

OCC Implemented and Awaiting Auditor 

Verification

Bank Secrecy Act - De-risking along the 

Southwest Border Highlights Need for 

Regulators to Enhance Retrospective 

Reviews

GAO-18-263 02/28/2018 Terrorism and Financial 

Crime

The Director of FinCEN should jointly conduct a retrospective review of 

BSA/AML regulations and their implementation for banks with FDIC, the 

Federal Reserve, and OCC. This review should focus on how banks' 

regulatory concerns may be influencing their willingness to provide services. 

In conducting the review, FDIC, the Federal Reserve, OCC, and FinCEN 

should take steps, as appropriate, to revise the BSA regulations or the way 

they are being implemented to help ensure that BSA/AML regulatory 

objectives are being met in the most effective and least burdensome way.

FinCEN Implemented and Awaiting Auditor 

Verification

WORKPLACE RETIREMENT 

ACCOUNTS: Better Guidance and 

Information Could Help Plan 

Participants at Home and Abroad 

Manage Their Retirement Savings 

GAO-18-19 03/03/2018 Administration of 

Program Operations

The Commissioner of Internal Revenue should clarify how U.S. individuals 

are to report their foreign retirement accounts. The clarification could 

include addressing how these accounts should be designated and how the 

taxpayer should report contributions, earnings, and distributions made from 

the account.

IRS PCA Due Date: Oct-2021

WORKPLACE RETIREMENT 

ACCOUNTS: Better Guidance and 

Information Could Help Plan 

Participants at Home and Abroad 

Manage Their Retirement Savings 

GAO-18-19 03/03/2018 Administration of 

Program Operations

The Commissioner of Internal Revenue should consider revising the letter 

forwarding program in a cost effective manner to again provide information 

on behalf of plan sponsors on unclaimed retirement accounts to participants.

IRS Rejected. IRS disagreed with the 

recommendation. Guidance the Department of 

Labor issued in 2014 affirms the steps plan 

administrators can take to locate missing 

participants which is based on widespread use 

of commercially available locator services. 

With limited IRS staff and resources and the 

many locator services commercially available 

today, it is not feasible for the IRS to reinstate 

this program. Further, IRS views this GAO 

recommendation as not providing a sufficient 

return on investment to warrant allocating 

limited resources for implementing the 

recommendation. 

Page 16 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

WORKPLACE RETIREMENT 

ACCOUNTS: Better Guidance and 

Information Could Help Plan 

Participants at Home and Abroad 

Manage Their Retirement Savings 

GAO-18-19 03/03/2018 Administration of 

Program Operations

The Commissioner of Internal Revenue should review taxation issues 

relating to distributions involving incorrect participant addresses and 

uncashed benefit checks and clarify for the public the Internal Revenue 

Code's requirements in these circumstances.

IRS PCA Due Date: Oct-2021

WORKPLACE RETIREMENT 

ACCOUNTS: Better Guidance and 

Information Could Help Plan 

Participants at Home and Abroad 

Manage Their Retirement Savings 

GAO-18-19 03/03/2018 Administration of 

Program Operations

The Commissioner of Internal Revenue should systematically analyze data 

reported through Form 8938 filings on foreign retirement accounts owned by 

U.S. individuals with the goal of developing an evidence-based 

understanding of how these accounts change over time and what level of risk 

these accounts pose for tax evasion. To assist with this analysis, IRS should 

consider revising Form 8938 to more clearly distinguish between retirement 

accounts and other types of accounts or assets being reported by taxpayers 

under current reporting requirements.

IRS Rejected. IRS disagreed with the 

recommendation. The modification to the 

Form 8938 suggested in this recommendation 

may seem minor, but systemically collecting 

and analyzing the data would require resources 

beyond those currently available to IRS. 

Further, IRS views this GAO recommendation 

as not providing a sufficient return on 

investment to warrant allocating limited 

resources for implementing the 

recommendation. 

WORKPLACE RETIREMENT 

ACCOUNTS: Better Guidance and 

Information Could Help Plan 

Participants at Home and Abroad 

Manage Their Retirement Savings 

GAO-18-19 03/03/2018 Administration of 

Program Operations

The Commissioner of Internal Revenue should take steps to improve the 

likelihood that the Notice of Potential Private Pension Benefit Information 

corresponds to actual retirement benefits in the future, for example, by 

working with the Social Security Administration as necessary.

IRS PCA Due Date: Oct-2021

Financial Technology: Additional Steps 

by Regulators could Better Protect 

Consumers and Aid Regulatory 

Oversight

GAO-18-254 03/22/2018 Information 

Technology

The Comptroller of the Currency should engage in collaborative discussions 

with other relevant financial regulators in a group that includes all relevant 

stakeholders and has defined agency roles and outcomes to address issues 

related to consumers' use of account aggregation services. 

OCC Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-18-393R 05/07/2018 Financial Statements Based on IRS's research and determination, design and implement the 

corrective actions necessary to reasonably assure that IRS effectively 

resolves and records unpostable transactions in a timely manner, including 

the establishment of clearly defined timeframes in the IRM by which 

unpostable transactions should be corrected by the IRS operating divisions 

and appropriate related oversight and review processes.

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-18-393R 05/07/2018 Financial Statements The Commissioner of Internal Revenue should develop and implement 

policies in the IRM for conducting and monitoring the AEHR review. These 

policies should include or be accompanied by procedures for IRS 

management responsible for establishing policies related to safeguarding 

controls to (1) periodically monitor the results of the review and (2) 

reasonably assure that corrective actions for all identified deficiencies are 

tracked until fully implemented. 

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-18-393R 05/07/2018 Financial Statements The Commissioner of Internal Revenue should develop and implement 

policies in the IRM for conducting and monitoring the AMC review. These 

policies should include or be accompanied by procedures for IRS 

management responsible for establishing policies related to safeguarding 

controls to (1) periodically monitor the results of the review, (2) clarify the 

minimum requirements for how frequently the review should be completed at 

its various facilities while considering factors that may affect the most 

appropriate timing of these reviews, such as changes in personnel, 

operational processes, or information technology, and (3) reasonably assure 

that corrective actions for all identified deficiencies are tracked until fully 

implemented. 

IRS Implemented and Awaiting Auditor 

Verification

Page 17 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-18-393R 05/07/2018 Financial Statements The Commissioner of Internal Revenue should, develop and implement 

policies in the IRM for conducting and monitoring the Submission 

Processing internal control review. These policies should include or be 

accompanied by procedures to (1) assess and update the review questions 

and cited IRM criteria to reasonably assure they align with the controls under 

review, (2) periodically evaluate and document a review of the error 

threshold methodology to assess its current validity based on changes to the 

operating environment, (3) report findings identified in the Findings and 

Corrective Actions Report, and (4) assess and monitor (a) safeguarding 

internal control activities across all work shifts, particularly during peak 

seasons, (b) safeguarding internal control activities for the appropriate use 

and destruction of hardcopy taxpayer information, and (c) the results of 

relevant functional level reviews. 

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements 

Needed in Controls over the Processes 

Used to Prepare the U.S. Consolidated 

Financial Statements

GAO-14-543 06/20/2018 Financial Statements The Secretary of the Treasury should direct the Fiscal Assistant Secretary, 

working in coordination with the Controller of OMB, to establish and 

implement policies and procedures for accounting for and reporting all 

significant General Fund activity and balances, obtaining assurance on the 

reliability of the amounts, and reconciling the activity and balances between 

the General Fund and federal entities.

Fiscal Service PCA Due Date: Sep-2025

Management Report: Improvements 

Needed in Controls over the Processes 

Used to Prepare the U.S. Consolidated 

Financial Statements

GAO-14-543 06/20/2018 Financial Statements The Secretary of the Treasury should direct the Fiscal Assistant Secretary, 

working in coordination with the Controller of OMB, to establish a 

formalized process to require the performance of additional audit procedures 

specifically focused on intragovernmental activity and balances between 

federal entities to provide increased audit assurance over the reliability of 

such information.

Fiscal Service Rejected. Treasury disagreed with the 

recommendation. The Office of Management 

and Budget (OMB) and Treasury do not think 

they need to place additional audit burden on 

agencies. With respect to this 

recommendation’s reference to a need for 

additional agency audit procedures for 

intragovernmental activity and balances, 

Treasury’s plan already contains multiple 

corrective actions aimed at increasing the 

quality of intragovernmental data. These 

actions are proving effective, as reflected by a 

reduction of over 80 percent in elimination 

differences of intragovernmental data 

submitted by federal entities from FY 2015 to 

FY 2016. Moreover, in alignment with the 

current administration’s efforts to reduce 

agency burden, we do not support 

encumbering agencies with the cost and 

burden of the additional audit procedures 

being recommended. However, Treasury will 

continue to work collaboratively with OMB 

and the federal agency community on existing 

corrective actions.

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should ensure the operational 

analysis for EUSS includes a comparison of current performance with a preestablished cost baseline.

IRS Implemented and Awaiting Auditor 

Verification

Page 18 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should ensure the operational 

analysis for IDRS addresses the extent to which the investments support 

customer processes as designed, and how well the investments are delivering 

the goods or services they were designed to deliver.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should ensure the operational 

analysis for IMF fully addresses greater utilization of technology or 

consolidation of investments to better meet organizational goals.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should ensure the operational 

analysis for TSS addresses the extent to which the investments support 

customer processes as designed, and how well the investments are delivering 

the goods or services they were designed to deliver.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should ensure the operational 

analysis for TSS includes a comparison of current performance with a preestablished cost baseline.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement IT workforce 

planning practices, including the following actions (1) setting the strategic 

direction for workforce planning; (2) analyzing the workforce to identify 

skill gaps; (3) developing strategies and implementing activities to address 

skill gaps; and (4) monitoring and reporting on progress in addressing skill 

gaps.

IRS On Hold. Agreed with the recommendation. 

Due to funding constraints, the 

recommendation is put on hold.

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with analyzing risk for the IDRS 

investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with analyzing risk for the IMF 

investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with analyzing risk for the MSSS 

investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with identifying risk for the MSSS 

investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with mitigating risk for the IDRS 

investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with mitigating risk for the IMF 

investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with mitigating risk for the MSSS 

investment. 

IRS Implemented and Awaiting Auditor 

Verification

Page 19 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with monitoring, reporting, and 

controlling risk for the IDRS investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with monitoring, reporting, and 

controlling risk for the IMF investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with monitoring, reporting, and 

controlling risk for the MSSS investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with preparing for risk management for 

the IDRS investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with preparing for risk management for 

the IMF investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice associated with preparing for risk management for 

the MSSS investment.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION TECHNOLOGY: IRS 

Needs to Take Additional Actions to 

Address Significant Risks to Tax 

Processing

GAO-18-298 06/28/2018 Information 

Technology

The Commissioner of Internal Revenue should fully implement the risk 

management key practice for prioritizing risk for the IMF investment.

IRS Implemented and Awaiting Auditor 

Verification

Civil Penalties: Certain Federal 

Agencies Need to Improve Inflation 

Adjustment Reporting

GAO-18-519 07/18/2018 Administration of 

Program Operations

The Secretary of the Treasury should include in Treasury's fiscal year 2018 

AFR information about all civil monetary penalties within its jurisdiction, 

including the inflation adjustment of the civil monetary penalties.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should include and prioritize these 

options, as appropriate, in IRS's Identity Assurance Strategy and Roadmap.

IRS Implemented and Awaiting Auditor 

Verification

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Identity Assurance 

Office to prioritize foundational initiatives in its Identity Assurance Strategy 

and Roadmap.

IRS Implemented and Awaiting Auditor 

Verification

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Identity Assurance 

Office and IRS business owners to develop a plan for performing risk 

assessments for telephone, in-person, and correspondence channels for 

authentication.

IRS Implemented and Awaiting Auditor 

Verification

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should implement improvements to 

IRS's systems to fully implement NIST's new guidance.

IRS PCA Due Date: Feb-2023

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should develop a repeatable, 

comprehensive process to identify and evaluate alternative options for 

improving taxpayer authentication, including technologies in use by industry, 

states, or other trusted partners.

IRS Implemented and Awaiting Auditor 

Verification

Page 20 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Identity Assurance 

Office and other appropriate business partners to develop a plan-including a 

timeline, milestone dates, and resources needed-for implementing changes to 

its online authentication programs consistent with new NIST guidance.

IRS Implemented and Awaiting Auditor 

Verification

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that IRS business 

units have access to complete AMS data to monitor authentication 

performance and identify potential issues.

IRS PCA Due Date: Dec-2020

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should establish a mechanism to 

collect data on outcomes for telephone, in-person, and correspondence 

authentication, consistent with federal standards for internal control.

IRS PCA Due Date: Feb-2021

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should establish a policy for 

conducting risk assessments for telephone, in-person, and correspondence 

channels for authentication. This policy should include, for example, the 

frequency of assessments to be performed and timeframes for addressing 

deficiencies.

IRS Implemented and Awaiting Auditor 

Verification

Identity Theft: IRS Needs to Strengthen 

Taxpayer Authentication Efforts 

GAO-18-418 07/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should revise or establish, as 

appropriate, procedures to ensure data quality in the Account Management 

Services (AMS) consistent with federal standards for internal control.

IRS PCA Due Date: Jun-2021

INFORMATION SECURITY: IRS 

Needs to Rectify Control Deficiencies 

That Limit Its Effectiveness in 

Protecting Sensitive Financial and 

Taxpayer Data

GAO-18-391 07/31/2018 Financial Statements The Commissioner of Internal Revenue should take steps to improve the 

implementation of IRS's information security program by documenting 

access authorizations for non-unique accounts.

IRS PCA Due Date: Dec-2020

INFORMATION SECURITY: IRS 

Needs to Rectify Control Deficiencies 

That Limit Its Effectiveness in 

Protecting Sensitive Financial and 

Taxpayer Data

GAO-18-391 07/31/2018 Financial Statements The Commissioner of Internal Revenue should take steps to improve the 

implementation of IRS's information security program by entering correct 

contractor password expiration dates, per IRS's policy, in the system used for 

managing user access authorizations.

IRS Implemented and Awaiting Auditor 

Verification

INFORMATION SECURITY: IRS 

Needs to Rectify Control Deficiencies 

That Limit Its Effectiveness in 

Protecting Sensitive Financial and 

Taxpayer Data

GAO-18-391 07/31/2018 Financial Statements The Commissioner of Internal Revenue should take steps to improve the 

implementation of IRS's information security program by reviewing nonunique accounts at least annually, per IRS's policy.

IRS PCA Due Date: Dec-2020

Federal Chief Information Officers: 

Critical Actions Needed to Address 

Shortcomings and Challenges in 

Implementing Responsibilities

GAO-18-93 08/02/2018 Information 

Technology

The Secretary of the Treasury should ensure that the department's IT 

management policies address the role of the CIO for key responsibilities in 

the six areas GAO identified. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

PAPERWORK REDUCTION ACT: 

Agencies Could Better Leverage 

Review Processes and Public Outreach 

to Improve Burden Estimates

GAO-18-381 08/10/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should include enough information 

in Federal Register notices to allow the public to reasonably calculate or 

determine the number of respondents, the frequency of response, and the 

average burden time per response for each information collection activity.

IRS Implemented and Awaiting Auditor 

Verification

Page 21 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

PAPERWORK REDUCTION ACT: 

Agencies Could Better Leverage 

Review Processes and Public Outreach 

to Improve Burden Estimates

GAO-18-381 08/10/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should leverage existing consultation 

with stakeholders and the public to explicitly seek input on the estimated 

burden imposed by information collections.

IRS Implemented and Awaiting Auditor 

Verification

Tax Fraud and Noncompliance: IRS 

Could Further Leverage the Return 

Review Program to Strengthen Tax 

Enforcement 

GAO-18-544 08/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should implement the most costeffective method to digitize information provided by taxpayers who file 

returns on paper.

IRS On Hold. Agreed with the recommendation. 

Due to outside of Treasury's purview, the 

recommendation is put on hold.

Tax Fraud and Noncompliance: IRS 

Could Further Leverage the Return 

Review Program to Strengthen Tax 

Enforcement 

GAO-18-544 08/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should expand RRP to support 

identified activities. 

IRS On Hold. Agreed with the recommendation. 

Due to outside of Treasury's purview, the 

recommendation is put on hold.

Tax Fraud and Noncompliance: IRS 

Could Further Leverage the Return 

Review Program to Strengthen Tax 

Enforcement 

GAO-18-544 08/23/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should evaluate the costs and 

benefits of expanding RRP to analyze individual returns not claiming 

refunds to support other enforcement activities.

IRS Implemented and Awaiting Auditor 

Verification

Low-Income Housing Tax Credit: 

Improved Data and Oversight Would 

Strengthen Cost Assessment and Fraud 

Risk Management

GAO-18-637 09/18/2018 Tax Administration and 

Compliance

IRS's Associate Chief Counsel, in consultation with Treasury's Assistant 

Secretary for Tax Policy, should communicate to credit allocating agencies 

how to collect information on and review LIHTC syndication expenses, 

including upper-tier partnership expenses.

IRS Rejected. IRS disagreed with the 

recommendation. IRS already communicates 

this information. The Regulations require 

taxpayers to certify to HFAs all sources of 

funds and all development costs. Section 1.42-

17(a)(3)(i) provides that development cost 

information includes, among other costs, 

syndication and legal fees. In addition, IRS 

communicates regularly with HFAs regarding 

LIHTC compliance issues and best practices. 

Low-Income Housing Tax Credit: 

Improved Data and Oversight Would 

Strengthen Cost Assessment and Fraud 

Risk Management

GAO-18-637 09/18/2018 Tax Administration and 

Compliance

IRS's Associate Chief Counsel, in consultation with Treasury's Assistant 

Secretary for Tax Policy, should require general contractor cost certifications 

for LIHTC projects to verify consistency with the developer cost 

certification.

IRS Rejected. IRS disagreed with the 

recommendation. The GAO report describes 

the use of misrepresented contractor costs that 

could potentially produce excess LIHTC 

allocations. IRS considered how general 

contractor cost certifications might be helpful 

in verifying consistency with the costs but is 

concerned that requiring the additional burden 

of these certifications does not comport with 

the flexibility for the States contemplated by 

the statute.

Page 22 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Low-Income Housing Tax Credit: 

Improved Data and Oversight Would 

Strengthen Cost Assessment and Fraud 

Risk Management

GAO-18-637 09/18/2018 Tax Administration and 

Compliance

IRS's Commissioner of the Small Business/Self-Employed Division should 

encourage allocating agencies and other LIHTC stakeholders to collaborate 

on the development of more standardized cost data, considering information 

in this report about variation in data elements, definitions, and formats.

IRS Rejected. IRS disagreed with the 

recommendation. The standardization of 

LIHTC cost data is not statutorily or 

regulatorily required for IRS tax 

administration. Congress has given the States 

broad flexibility and discretion to determine 

allocation practices and the QAPs that guide 

them. Therefore, IRS defers to the HFAs and 

other LIHTC stakeholders to collaborate on 

the development of more standardized cost 

data.

Tax Administration: Opportunities Exist 

to Improve Monitoring and 

Transparency of Appeal Resolution 

Timeliness 

GAO-18-659 10/22/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Chief of Appeals to 

regularly report and share with each compliance unit the data on the time 

elapsed between when a taxpayer requests an appeal to when it is received in 

the Office of Appeals.

IRS PCA Due Date: Mar-2021

Tax Administration: Opportunities Exist 

to Improve Monitoring and 

Transparency of Appeal Resolution 

Timeliness 

GAO-18-659 10/22/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Chief of Appeals, 

in coordination with the IRS Human Capital Office, to conduct a skills gap 

analysis specific to Appeals mission needs, and develop a strategy for 

mitigating any identified gaps. 

IRS PCA Due Date: Apr-2021

Tax Administration: Opportunities Exist 

to Improve Monitoring and 

Transparency of Appeal Resolution 

Timeliness 

GAO-18-659 10/22/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should establish timeframes and 

monitoring procedures for the timely transfer of taxpayer appeal requests by 

examination compliance units to the Office of Appeals. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Administration: Opportunities Exist 

to Improve Monitoring and 

Transparency of Appeal Resolution 

Timeliness 

GAO-18-659 10/22/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should evaluate the existing 

monitoring for collection due process appeal requests and address 

deficiencies in collection staff meeting the requirement for timely transfer to 

the Office of Appeals. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Administration: Opportunities Exist 

to Improve Monitoring and 

Transparency of Appeal Resolution 

Timeliness 

GAO-18-659 10/22/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should provide more transparency to 

taxpayers on historical average total appeal resolution times. This could 

include publishing average total resolution times by work stream on an 

Office of Appeals web page, as well as including total expected times in the 

Appeals welcome letter. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Administration: Opportunities Exist 

to Improve Monitoring and 

Transparency of Appeal Resolution 

Timeliness 

GAO-18-659 10/22/2018 Tax Administration and 

Compliance

The Secretary of the Treasury, consistent with its responsibilities under 

GPRAMA and Executive Orders for customer service, should ensure that the 

Commissioner of Internal Revenue takes action to develop a mechanism to 

solicit and consider public input and customer feedback on a regular basis on 

current and proposed IRS appeal policies and procedures. This could include 

leveraging existing IRS advisory bodies or establishing an Office of Appeals 

advisory body representing the taxpaying public, the tax practitioner 

community, and businesses to solicit customer perspectives. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Administration: Opportunities Exist 

to Improve Monitoring and 

Transparency of Appeal Resolution 

Timeliness 

GAO-18-659 10/22/2018 Tax Administration and 

Compliance

The Secretary of the Treasury, consistent with its responsibilities under 

GPRAMA and Executive Orders for customer service, should ensure that the 

Commissioner of Internal Revenue takes action to make Appeals customer 

service standards and performance results more transparent to the public. 

This could include publishing customer service standards and related 

performance measure results on the Office of Appeals web page on IRS.gov.

IRS Implemented and Awaiting Auditor 

Verification

Page 23 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Whistleblower Program: IRS Needs to 

Improve Data Controls for Some Award 

Determinations

GAO-18-698 10/29/2018 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that the Deputy 

Commissioner for Services and Enforcement develops and documents 

improved controls for the validity, completeness, and accuracy of data on 

FBAR exams and enforcement actions.

IRS Implemented and Awaiting Auditor 

Verification

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets

GAO-19-49DO 11/13/2018 Information 

Technology

The Secretary of the Treasury should direct the department CIO to establish, 

for any OMB common baseline requirements that are related to IT budgeting 

that have been delegated, a plan that specifies the requirement being 

delegated, demonstrates how the CIO intends to retain accountability for the 

requirement, and ensures through quality assurance processes that the 

delegated official will execute such responsibilities with the appropriate level 

of rigor.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets

GAO-19-49DO 11/13/2018 Information 

Technology

The Secretary of the Treasury should direct the Office of the CIO and other 

offices, as appropriate, to take steps to ensure that the actions taken to 

comply with OMB's common baseline for implementing FITARA on 

individual investments are adequately documented. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets

GAO-19-49DO 11/13/2018 Information 

Technology

The Secretary of the Treasury should ensure that the Office of the CIO and 

other offices, as appropriate, address gaps in the department's FITARA plans 

by developing and implementing policies and procedures that document the 

process for the CIO's review and approval of the major IT investments 

portion of the budget request. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets

GAO-19-49DO 11/13/2018 Information 

Technology

The Secretary of the Treasury should ensure that the Office of the CIO and 

other offices, as appropriate, address gaps in the department's FITARA plans 

by developing and implementing policies and procedures that document the 

steps the CIO is to take to ensure whether the IT portfolio includes 

appropriate estimates of all IT resources included in the budget request. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets

GAO-19-49DO 11/13/2018 Information 

Technology

The Secretary of the Treasury should ensure that the Office of the CIO and 

other offices, as appropriate, address gaps in the department's FITARA plans 

by developing and implementing policies and procedures that establish 

department-wide policy for the level of detail of planned expenditure 

reporting to the CIO for all transactions that include IT resources. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets

GAO-19-49DO 11/13/2018 Information 

Technology

The Secretary of the Treasury should ensure that the Office of the CIO and 

other offices, as appropriate, address gaps in the department's FITARA plans 

by developing and implementing policies and procedures that include the 

CIO as a member of governance boards that inform decisions regarding all 

IT resources, including component-level boards. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets

GAO-19-49DO 11/13/2018 Information 

Technology

The Secretary of the Treasury should ensure that the Office of the CIO and 

other offices, as appropriate, address gaps in the department's FITARA plans 

by developing and implementing policies and procedures that include the 

CIO in the planning and budgeting stages for all programs that are fully or 

partially supported with IT resources. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Page 24 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets

GAO-19-49DO 11/13/2018 Information 

Technology

The Secretary of the Treasury should ensure that the Office of the CIO and 

other offices, as appropriate, establish quality assurance processes--such as 

data quality checks, reviews of estimation methods, linkages between the IT 

portfolio and procurement system data, and linkages between the IT portfolio 

and financial system data--for ensuring the annual IT budget is informed by 

complete and reliable information on anticipated government labor, contract, 

and other relevant IT expenditures.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Information Technology: Departments 

Need to Improve Chief Information 

Officers' Review and Approval of IT 

Budgets 

GAO-19-49IRS 11/13/2018 Information 

Technology

The Commissioner of Internal Revenue should direct the Office of the CIO 

and other offices, as appropriate, to take steps to ensure that the actions taken 

to comply with OMB's common baseline for implementing FITARA on 

individual investments are adequately documented.

IRS Implemented and Awaiting Auditor 

Verification

Treasury Judgment Fund--Transparency 

and Reliability Needed in Reporting 

Fund Balances and Activities

GAO-19-44 12/07/2018 Financial Statements The Commissioner of the Bureau of the Fiscal Service should take steps to 

ensure that information provided to Congress undergoes a documented 

review to ensure the quality and responsiveness of the information provided.

Fiscal Service Implemented and Awaiting Auditor 

Verification

Open Data: Treasury Could Better Align 

USAspending.gov With Key Practices 

and Legal Requirements

GAO-19-72 12/13/2018 Information 

Technology

The Secretary of the Treasury should fully comply with OMB's requirements 

by providing metadata in a single location that are easy to find on the 

USAspending.gov website. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Troubled Asset Relief Program: 

Monitoring of Hardest Hit Fund 

Program Could Be Strengthened

GAO-19-100 12/21/2018 Administration of 

Program Operations

The Assistant Secretary for Financial Institutions should annually collect and 

evaluate HFAs' risk assessments, which include HFAs' risk levels. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Troubled Asset Relief Program: 

Monitoring of Hardest Hit Fund 

Program Could Be Strengthened

GAO-19-100 12/21/2018 Administration of 

Program Operations

The Assistant Secretary for Financial Institutions should ensure that the 

documentation listing the HFA staff responsible for internal control 

execution is updated routinely. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Large Bank Supervision: OCC Could 

Better Address Risk of Regulatory 

Capture

GAO-19-69 01/24/2019 Banking and Lending The Comptroller of the Currency should revise Large Bank Supervision's 

policy to require documentation of examination teams' internal deliberations 

that lead to consequential decisions for the bank, such as the decision to 

issue a Matter Requiring Attention, among others.

OCC Rejected. OCC disagreed with the 

recommendation. The supervisory conclusions 

of individual examiners are recorded in their 

workpapers and conclusion memos. The 

conclusions reached as a result of internal 

deliberation and consequential decisions are 

fully explained in communications to the bank. 

The ongoing nature of supervision of large 

banks results in a significant amount of 

dialogue among OCC staff and between OCC 

staff and bank management. Spending time 

documenting those discussions would be 

extremely time consuming and result in OCC 

conducting fewer supervisory activities.

Page 25 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Large Bank Supervision: OCC Could 

Better Address Risk of Regulatory 

Capture

GAO-19-69 01/24/2019 Banking and Lending The Comptroller of the Currency should revise Large Bank Supervision's 

policy to require that bank examination teams retain drafts of key documents, 

including the conclusion memo and supervisory letter that document the 

supervisory review process.

OCC Rejected. OCC disagreed with the 

recommendation. Initial impressions or early 

assessments of a bank’s process or practice 

often change as examiners gather more facts 

and develop their analyses over the course of a 

supervisory activity. Retaining early drafts of 

conclusion memos and supervisory letters that 

might not have fully informed conclusions 

serves little purpose. The risk of regulatory 

capture is controlled through subjecting 

supervisory decisions to multiple levels of 

quality review. Should examiners have 

concerns regarding the integrity of supervisory 

matters, established processes exist for having 

those concerns investigated internally within 

OCC.

Large Bank Supervision: OCC Could 

Better Address Risk of Regulatory 

Capture

GAO-19-69 01/24/2019 Banking and Lending The Comptroller of the Currency should systematically track and monitor 

LBS's use of informal recommendations.

OCC Rejected. OCC disagreed with the 

recommendation. This audit and OCC’s 

independent Enterprise Governance reviews 

did not identify instances of inappropriate use 

of recommendations. Examiners make 

informal recommendations for bank policies 

that are already acceptable or for products or 

services that are already satisfactorily 

governed, constructed, and delivered to 

customers in compliance with laws and 

regulations. The suggested enhancement is 

not an action or change that affects bank safety 

and soundness, prudent risk management, or 

compliance with laws and regulations, and 

therefore tracking and monitoring those 

recommendations would not be beneficial.

Large Bank Supervision: OCC Could 

Better Address Risk of Regulatory 

Capture

GAO-19-69 01/24/2019 Banking and Lending The Comptroller of the Currency should revise Large Bank Supervision's 

policy to require documentation of communications with banks, including 

those between executive and senior management and banks that inform 

decisions.

OCC Rejected. OCC disagreed with the 

recommendation. OCC cannot conclude that 

extensive documentation of conversations and 

meeting minutes would improve supervision, 

or that without such, examiners and 

management are not considering pertinent 

information when reaching supervisory 

conclusions. The influence of meetings and 

interactions with bankers and other parties 

during the course of supervisory activities is 

reflected in the supervisory decisions and 

conclusions, and documented in supervisory 

activity procedures, conclusion memos, 

supervisory letters, reports of examination, and 

when applicable, in enforcement actions.

Page 26 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Large Bank Supervision: OCC Could 

Better Address Risk of Regulatory 

Capture

GAO-19-69 01/24/2019 Banking and Lending The Comptroller of the Currency should develop a policy for Large Bank 

Supervision to check employees' active conflict of interests during the 

staffing process for examinations and other supervisory activities and for 

documenting the results of this check. 

OCC Rejected. OCC disagreed with the 

recommendation. The recommendation shifts 

responsibility for ensuring compliance with 

recusal requirements from employees to 

personnel managing the exam staffing process. 

Such a shift runs the risk of undermining the 

expectations of personal responsibility that 

serves as the core of a government ethics 

program and a vigilant supervision program. 

OCC provides training to all employees on the 

government ethics standards, which includes 

employees’ responsibility to comply with the 

recusal requirements. 

RETIREMENT ACCOUNTS: Federal 

Action Needed to Clarify Tax 

Treatment of Unclaimed 405(k) Plan 

Savings Transferred to States 

GAO-19-88 02/19/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should work with the Department of 

the Treasury to consider adding retirement savings transferred to states from 

terminating DC plans to the list of permitted reasons for rolling over savings 

after the 60-day rollover period, in a form consistent with the rules adopted 

on the taxation of transfers of unclaimed retirement savings. 

IRS Implemented and Awaiting Auditor 

Verification

RETIREMENT ACCOUNTS: Federal 

Action Needed to Clarify Tax 

Treatment of Unclaimed 405(k) Plan 

Savings Transferred to States 

GAO-19-88 02/19/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should work with the Department of 

the Treasury to consider clarifying if transfers of unclaimed savings from 

employer-based plans (such as 401(k) plans) to states are distributions, what, 

if any, tax reporting and withholding requirements apply, and when they 

apply. 

IRS Implemented and Awaiting Auditor 

Verification

Financial Technology: Agencies Should 

Provide Clarification on Lenders' Use of 

Alternative Data [Reissued with 

revisions on Mar. 12, 2019.]

GAO-19-111 03/12/2019 Banking and Lending The Comptroller of the Currency should, in coordination with the other 

federal banking regulators and the Bureau of Consumer Financial Protection 

and with input from relevant stakeholders, communicate in writing to banks 

that engage in third-party relationships with fintech lenders on the 

appropriate use of alternative data in the underwriting process, including 

issues to consider when selecting types of alternative data to use.

OCC Implemented and Awaiting Auditor 

Verification

Cybersecurity Workforce: Agencies 

Need to Accurately Categorize Positions 

to Effectively Identify Critical Staffing 

Needs

GAO-19-144 03/12/2019 Human Capital To complete the appropriate assignment of codes to their positions 

performing IT, cybersecurity, or cyber-related functions, in accordance with 

the requirements of the Federal Cybersecurity Workforce Assessment Act of 

2015, the Secretary of Treasury should take steps to review the assignment 

of the "000" code to any positions in the department in the 2210 IT 

management occupational series and assign the appropriate NICE framework 

work role codes.

Treasury - DO Implemented and Awaiting Auditor 

Verification

Internal Revenue Service: Strategic 

Human Capital Management is Needed 

to Address Serious Risks to IRS's 

Mission 

GAO-19-176 03/26/2019 Human Capital The Commissioner of Internal Revenue should ensure the Human Capital 

Officer and Deputy Commissioner for Services and Enforcement collaborate 

to develop a work plan or other mechanism that prioritizes and schedules 

skills assessments for mission critical occupations at highest risk of skills 

gaps, such as those identified by Treasury or where key activities have been 

scaled back, for the purposes of developing a strategy to close the gaps. 

IRS Implemented and Awaiting Auditor 

Verification

Internal Revenue Service: Strategic 

Human Capital Management is Needed 

to Address Serious Risks to IRS's 

Mission 

GAO-19-176 03/26/2019 Human Capital The Commissioner of Internal Revenue should ensure the Human Capital 

Officer and Deputy Commissioner for Services and Enforcement report the 

results of efforts to close skills gaps among revenue agents, including lessons 

learned, that may help inform strategies for conducting skills gap assessment 

efforts for other mission critical occupations.

IRS PCA Due Date: Dec-2021

Page 27 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Internal Revenue Service: Strategic 

Human Capital Management is Needed 

to Address Serious Risks to IRS's 

Mission 

GAO-19-176 03/26/2019 Human Capital The Commissioner of Internal Revenue should ensure the Human Capital 

Officer improves reporting for its Workforce Planning initiative in its bimonthly HRstat information submissions to Treasury. The submissions 

should include the original implementation schedule, changes to the original 

schedule, delays in implementation and each of their causes, and IRS's 

strategy to address the causes of those delays.

IRS Implemented and Awaiting Auditor 

Verification

Internal Revenue Service: Strategic 

Human Capital Management is Needed 

to Address Serious Risks to IRS's 

Mission 

GAO-19-176 03/26/2019 Human Capital The Commissioner of Internal Revenue should fully implement the 

workforce planning initiative, including taking the following actions: (1) 

conducting enterprise strategy and planning, (2) conducting workforce 

analysis, (3) creating a workforce plan, (4) implementing the workforce plan, 

and (5) monitoring and evaluating the results.

IRS PCA Due Date: Dec-2021

Internal Revenue Service: Strategic 

Human Capital Management is Needed 

to Address Serious Risks to IRS's 

Mission

GAO-19-176DO 03/26/2019 Human Capital The Secretary of the Treasury should issue clarifying guidance to IRS about 

the Integrated Talent Management system, including when the workforce 

planning and talent management modules will be deployed and available for 

IRS's use, the functions it will include, and how IRS's existing systems and 

processes within business divisions and program offices will be affected. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Foreign Asset Reporting: Actions 

Needed to Enhance Compliance Efforts, 

Eliminate Overlapping Requirements, 

and Mitigate Burdens on U.S. Persons 

Abroad

GAO-19-180DO 04/01/2019 Tax Administration and 

Compliance

The Secretary of the Treasury should lead efforts, in coordination with the 

Secretary of State and Commissioner of Social Security, to establish a formal 

means to collaboratively address ongoing issues-including issues accessing 

financial services and employment and obtaining Social Security Numbers 

(SSNs) -that U.S. persons living abroad encounter from implementation of 

FATCA reporting requirements.

Treasury - DO On hold. Agreed with the recommendation. 

Due to outside of Treasury's purview, the 

recommendation is put on hold.

Foreign Asset Reporting: Actions 

Needed to Enhance Compliance Efforts, 

Eliminate Overlapping Requirements, 

and Mitigate Burdens on U.S. Persons 

Abroad 

GAO-19-180IRS 04/01/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should assess factors contributing to 

unnecessary Form 8938 reporting and take steps, as appropriate, to address 

the issue. Depending on the results of the assessment, potential options may 

include: (1) identifying and implementing steps to further clarify IRS Form 

8938 instructions and related guidance on IRS's website on determining what 

foreign financial assets to report, and how to calculate and report asset values 

subject to reporting thresholds; and (2) conducting additional outreach to 

educate taxpayers on required reporting thresholds, including notifying 

taxpayers that may have unnecessarily filed an IRS Form 8938 to reduce 

such filings.

IRS Rejected. IRS disagreed with the 

recommendation. IRS will continue to 

observe filings of Form 8938 and, to the extent 

that there are unnecessary filings, assess 

options to inform account holders to reduce 

reporting and filing burdens followed by 

appropriate steps to implement any selected 

options.

Foreign Asset Reporting: Actions 

Needed to Enhance Compliance Efforts, 

Eliminate Overlapping Requirements, 

and Mitigate Burdens on U.S. Persons 

Abroad 

GAO-19-180IRS 04/01/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should develop a plan to mitigate 

risks with compliance activities due to the lack of accurate and complete 

Taxpayer Identification Numbers of U.S. account holders collected from 

FFIs. 

IRS Implemented and Awaiting Auditor 

Verification

Foreign Asset Reporting: Actions 

Needed to Enhance Compliance Efforts, 

Eliminate Overlapping Requirements, 

and Mitigate Burdens on U.S. Persons 

Abroad 

GAO-19-180IRS 04/01/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should employ a comprehensive plan 

for managing efforts to leverage FATCA data in agency compliance efforts. 

The plan should document and track activities over time to (1) ensure 

individuals and FFIs comply with FATCA reporting requirements; (2) assess 

and mitigate data quality risks from FFIs; (3) improve the quality, 

management, and accessibility of FATCA data for compliance, research, and 

other purposes; and (4) establish, monitor, and evaluate compliance efforts 

involving FATCA data intended to improve voluntary compliance and 

address noncompliance with FATCA reporting requirements.

IRS Rejected. IRS disagreed with the 

recommendation. IRS believes the resources 

required to update a comprehensive plan 

unique to the FATCA (akin to the FATCA 

Roadmap) are better spent on enforcement 

activities. IRS’s LB&I Division has overall 

responsibility for these activities and their 

approach is expected to achieve the broader 

objective of improving financial institution 

and U.S. account holder compliance with 

FATCA.

Page 28 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Foreign Asset Reporting: Actions 

Needed to Enhance Compliance Efforts, 

Eliminate Overlapping Requirements, 

and Mitigate Burdens on U.S. Persons 

Abroad 

GAO-19-180IRS 04/01/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that appropriate 

business units conducting compliance enforcement and research have access 

to consistent and complete data collected from individuals' electronic and 

paper filings of Form 8938 and elements of parent individual tax returns. As 

part of this effort, the Commissioner should ensure that IRS provides clear 

guidance to the business units for accessing such data in IRS's Compliance 

Data Warehouse. 

IRS Implemented and Awaiting Auditor 

Verification

Data Center Optimization: Additional 

Agency Actions Needed to Meet OMB 

Goals

GAO-19-241 04/11/2019 Information 

Technology

The Secretary of Treasury should take action to meet the data center 

optimization metric targets established under Data Center Optimization 

Initiative (DCOI) by OMB. 

Treasury - DO On Hold. Agreed with the recommendation. 

Due to funding constraints, the 

recommendation is put on hold.

Tax Administration: Opportunities Exist 

to Improve IRS's Management of 

International Tax Dispute Resolution 

GAO-19-81 04/12/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should ensure that APMA analyzes 

trends in case characteristics as part of routine program management 

activities.

IRS PCA Due Date: Jul-2021

Tax Administration: Opportunities Exist 

to Improve IRS's Management of 

International Tax Dispute Resolution 

GAO-19-81 04/12/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should direct USCA to ensure that 

APMA identify and record categories of the tax issue relevant in the dispute. 

IRS PCA Due Date: Jul-2021

Tax Administration: Opportunities Exist 

to Improve IRS's Management of 

International Tax Dispute Resolution 

GAO-19-81 04/12/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should direct USCA to ensure that 

APMA identify and record the dates of key milestones throughout MAP case 

resolutions.

IRS PCA Due Date: Jul-2021

Tax Administration: Opportunities Exist 

to Improve IRS's Management of 

International Tax Dispute Resolution 

GAO-19-81 04/12/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should direct USCA to ensure that 

APMA puts procedures in place to review the quality of inventory data.

IRS PCA Due Date: Jul-2021

Tax Administration: Opportunities Exist 

to Improve IRS's Management of 

International Tax Dispute Resolution 

GAO-19-81 04/12/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should direct USCA to ensure that 

APMA records the dollar amounts of MAP case outcomes in its database.

IRS PCA Due Date: Jul-2021

Tax Administration: Opportunities Exist 

to Improve IRS's Management of 

International Tax Dispute Resolution 

GAO-19-81 04/12/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should direct USCA to ensure that 

APMA staff record and track contact with taxpayers.

IRS PCA Due Date: Jul-2021

Tax Administration: Opportunities Exist 

to Improve IRS's Management of 

International Tax Dispute Resolution 

GAO-19-81 04/12/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue should direct USCA to ensure that 

APMA staff record and track the hours they spend on MAP cases.

IRS PCA Due Date: Jul-2021

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should analyze Private Debt 

Collection (PDC) program results and the cases not assigned to the PDC 

program to identify the types of inactive cases IRS will not pursue that could 

be assigned to collection agencies to improve PDC program results.

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should analyze Private Debt 

Collection (PDC) program results to identify the types of cases that are not 

potentially collectible and should not be assigned to collection agencies.

IRS Rejected. IRS disagreed with the 

recommendation. The statute requires the 

assignment of all inactive tax receivables to 

the private collection agencies; therefore, no 

collectability analysis is required or necessary.

Page 29 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should clearly document an 

assessment of fraud risks related to the PDC program. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should clearly document and 

distinguish the complete list of identified risks to taxpayers in the PDC 

program risk register, and align the risks with PDC program objectives. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should clearly document how each 

risk response aligns with specific taxpayer risks in the PDC program risk 

register. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should clearly document the severity 

of impacts of the taxpayer risks, as well as the likelihood of each taxpayer 

risk after responding to it, in the PDC program risk register, and use this 

information to prioritize risks to address and guide selection of risk 

responses. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should document how IRS's 

monitoring of the PDC program provides information on specific taxpayer 

risks and how well specific responses are working to address each risk, and 

should supplement IRS's monitoring of taxpayer complaints with Federal 

Trade Commission (FTC) complaint data.

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that its printed 

guidance to PDC taxpayers includes information about reporting scams to 

TIGTA.

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should finalize the PDC program 

objectives so that they are clearly defined in consistent terms, and assure that 

the key program risks, measures, and targets are linked with the objectives. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should include the Department of the 

Treasury Inspector General for Tax Administration (TIGTA) costs in IRS's 

reporting of PDC program costs.

IRS Rejected. IRS disagreed with the 

recommendation. Per Internal Revenue Code 

(IRC) 6306 (j)(1)(B), program costs are those 

costs incurred directly or indirectly by IRS. 

This does not include costs incurred by 

TIGTA, which is not part of IRS. 

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should more fully seek and 

document feedback from external stakeholders representing vulnerable 

taxpayers to identify and appropriately respond to possible PDC taxpayer 

risks. 

IRS Implemented and Awaiting Auditor 

Verification

Tax Debt Collection Contracts: IRS 

Analysis Could Help Improve Program 

Results and Better Protect Taxpayers 

GAO-19-193 04/29/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should report the amount of 

collected revenue sent to the general fund of the Treasury and amounts 

retained by IRS to pay its costs.

IRS Implemented and Awaiting Auditor 

Verification

Cloud Computing: Agencies Have 

Increased Usage and Realized Benefits, 

but Cost and Savings Data Need to be 

Better Tracked 

GAO-19-58 05/06/2019 Information 

Technology

The Secretary of the Treasury should ensure that the CIO of Treasury 

completes an assessment of all IT investments for suitability for migration to 

a cloud computing service, in accordance with OMB guidance. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Page 30 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Cloud Computing: Agencies Have 

Increased Usage and Realized Benefits, 

but Cost and Savings Data Need to be 

Better Tracked 

GAO-19-58 05/06/2019 Information 

Technology

The Secretary of the Treasury should ensure that the CIO of Treasury 

establishes a consistent and repeatable mechanism to track savings and cost 

avoidances from the migration and deployment of cloud services. 

Treasury - DO No Action Taken

Taxpayer Information: IRS Needs to 

Improve Oversight of Third-Party 

Cybersecurity Practices 

GAO-19-340 05/09/2019 Information 

Technology

The Commissioner of Internal Revenue should require that all tax software 

providers that participate in the Authorized e-file Provider program follow 

the subset of NIST Special Publication 800-53 controls that were agreed 

upon by the Security Summit participants.

IRS Rejected. IRS agrees with the intent of this 

recommendation; however, doesn't agree with 

the stated implementation method. IRS does 

not have the statutory authority to require 

Authorized e-file Provider program 

participants to comply with the NIST Special 

Publication 800-53. 

Taxpayer Information: IRS Needs to 

Improve Oversight of Third-Party 

Cybersecurity Practices 

GAO-19-340 05/09/2019 Information 

Technology

The Commissioner of Internal Revenue should conduct a risk assessment to 

determine whether different monitoring approaches are appropriate for all of 

the provider types in the IRS's Authorized e-file Provider program. If 

changes are needed, IRS should make appropriate revisions to the 

monitoring program, internal guidance, job aids, and staff training, as 

necessary. 

IRS Rejected. IRS agrees with the intent of this 

recommendation; however, doesn't agree with 

the stated implementation method. Absent 

requisite statutory authority and funding, an 

assessment of different monitoring approaches 

is moot. 

Taxpayer Information: IRS Needs to 

Improve Oversight of Third-Party 

Cybersecurity Practices 

GAO-19-340 05/09/2019 Information 

Technology

The Commissioner of Internal Revenue should develop a governance 

structure or other form of centralized leadership, such as a steering 

committee, to coordinate all aspects of IRS's efforts to protect taxpayer 

information while at third-party providers. 

IRS Rejected. IRS agrees with the intent of this 

recommendation; however, doesn't agree with 

the stated implementation method. As 

recognized by the GAO, IRS does not have 

clear and explicit authority to establish 

security requirements for the information 

systems of paid preparers and others who 

electronically file returns.

Taxpayer Information: IRS Needs to 

Improve Oversight of Third-Party 

Cybersecurity Practices 

GAO-19-340 05/09/2019 Information 

Technology

The Commissioner of Internal Revenue should document intake, storage, and 

sharing of the security incident data across IRS offices. 

IRS Implemented and Awaiting Auditor 

Verification

Taxpayer Information: IRS Needs to 

Improve Oversight of Third-Party 

Cybersecurity Practices 

GAO-19-340 05/09/2019 Information 

Technology

The Commissioner of Internal Revenue should modify the Authorized e-file 

Provider program's requirements to explicitly state the required elements of 

an information security program as provided by the FTC Safeguards Rule.

IRS Implemented and Awaiting Auditor 

Verification

Taxpayer Information: IRS Needs to 

Improve Oversight of Third-Party 

Cybersecurity Practices 

GAO-19-340 05/09/2019 Information 

Technology

The Commissioner of Internal Revenue should regularly review and update 

the security requirements that apply to tax software providers and other 

Authorized e-file Providers. 

IRS Implemented and Awaiting Auditor 

Verification

Taxpayer Information: IRS Needs to 

Improve Oversight of Third-Party 

Cybersecurity Practices 

GAO-19-340 05/09/2019 Information 

Technology

The Commissioner of Internal Revenue should standardize the incident 

reporting requirements for all types Authorized e-file Providers.

IRS Implemented and Awaiting Auditor 

Verification

Taxpayer Information: IRS Needs to 

Improve Oversight of Third-Party 

Cybersecurity Practices 

GAO-19-340 05/09/2019 Information 

Technology

The Commissioner of Internal Revenue should update IRS's monitoring 

programs for electronic return originators to include techniques to monitor 

basic information security and cybersecurity issues. Further, IRS should 

make the appropriate revisions to internal guidance, job aids, and staff 

training, as necessary.

IRS Rejected. IRS agrees with the intent of this 

recommendation; however, doesn't agree with 

the stated implementation method. IRS does 

not have the statutory authority to establish 

policy on information security and 

cybersecurity issues, nor to enforce 

compliance if non-compliance is observed. 

Page 31 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that appropriate IRS 

officials determine the reasons staff did not consistently comply with IRS's 

existing requirement for maintaining an emergency contact list at all of its 

facilities and, based on this determination, establish a process to enforce 

compliance with the requirement. 

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that appropriate IRS 

officials establish and implement policies and procedures requiring that 

corrective actions be documented in the Alarm Maintenance and Testing 

Certification Report for malfunctioning alarms identified in the annual alarm 

tests. 

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials (1) identify the reason IRS's policies and procedures related to 

the transmittal forms were not always followed and (2) design and 

implement actions to provide reasonable assurance that SB/SE units comply 

with these policies and procedures. 

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials document and implement a formal comprehensive strategy to 

provide reasonable assurance concerning its nationwide coordination, 

consistency, and accountability for internal control over key areas of physical 

security. This strategy should include nationwide improvements for (1) 

coordinating among the functional areas involved in physical security; (2) 

implementing and monitoring the effectiveness of physical security policies, 

procedures, and internal controls; and (3) ongoing communication in 

identifying, documenting, and taking corrective action to resolve underlying 

control issues that affect IRS's facilities. 

IRS PCA Due Date: Mar-2021

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials establish and implement a review process to provide 

reasonable assurance that the RSNs that Data Conversion key entry operators 

enter into the ISRP system and post to the master files are correct. 

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials establish and implement policies or procedures to provide 

reasonable assurance that the video surveillance systems at all IRS facilities 

record activity at the correct time and are properly secured. The policies or 

procedures should include periodic checks and adjustments, as needed, as 

part of the annual service and maintenance of security equipment and 

systems. 

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials implement a validity check in the ISRP system to confirm that 

RSNs that Data Conversion key entry operators enter into the system have 

the required 14 digits. 

IRS On Hold. Agreed with the recommendation. 

Due to funding constraints, the 

recommendation is put on hold.

Page 32 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials implement the necessary actions to effectively address the two 

primary causes of the significant deficiency in IRS's internal control over 

unpaid assessments. These actions should (1) resolve the system limitations 

affecting the recording and maintenance of reliable and appropriately 

classified unpaid assessments and related

taxpayer data to support timely and informed management decisions, and 

enable appropriate financial reporting of unpaid assessment balances 

throughout the year, and (2) identify the control deficiencies that result in 

significant errors in taxpayer accounts and implement control procedures to 

routinely and effectively prevent, or detect and correct, such errors. 

IRS On Hold. Agreed with the recommendation. 

Due to funding constraints, the 

recommendation is put on hold.

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials update and implement policies or procedures, or both, to clarify 

(1) who is responsible for conducting the annual review of the visitor access 

logs, (2) the date by which the review is to be conducted, and (3) how the 

review should be documented.

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials update and implement policies or procedures, or both, to clearly 

define the roles and responsibilities of second-level managers and IDRS 

security account administrators for validating the information on USR 

designation forms, including specifying how the information should be 

validated. 

IRS PCA Due Date: Nov-2020

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should ensure that the appropriate 

IRS officials update and implement policies or procedures, or both, to 

require that reviewers follow up with tax examiners to verify the errors that 

tax examiners made in working on cases related to suspicious or 

questionable tax returns are corrected. 

IRS Implemented and Awaiting Auditor 

Verification

Management Report: Improvements Are 

Needed to Enhance the Internal 

Revenue Service's Internal Control over 

Financial Reporting

GAO-19-412R 05/09/2019 Financial Statements The Commissioner of Internal Revenue should, ensure that the appropriate 

IRS officials update and implement procedures to clearly specify the tax 

refund data elements that PVS COs are required to verify before certifying 

the tax refunds in SPS. 

IRS Implemented and Awaiting Auditor 

Verification

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should develop and implement a 

mechanism to reasonably assure that all the journal entries recorded in the 

Schedules of the General Fund general ledgers can be readily identified and 

traced, such as through a unique identifier, to determine the effect of a 

transaction on all applicable general ledger accounts and line items of the 

Schedules of the General Fund, including the budget deficit.

Fiscal Service PCA Due Date: Mar-2025

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should develop and implement a 

mechanism to reasonably assure that payment transactions recorded in the 

Schedules of the General Fund general ledgers capture all of the key 

information needed, including payment schedules if applicable, to readily 

trace transactions to the information certified by the federal agency.

Fiscal Service PCA Due Date: Oct-2021

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should develop and implement 

additional reporting requirements with related guidance for federal agencies 

that better align with the General Fund financial reporting objectives and 

enable Fiscal Service to capture the effect of a transaction on all applicable 

general ledger accounts and line items of the Schedules of the General Fund, 

including the budget deficit. 

Fiscal Service PCA Due Date: Mar-2023

Page 33 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should develop and implement a 

process that would enable Fiscal Service to obtain the information necessary 

to effectively assess the effect of the Statement of Difference on the 

Schedules of the General Fund for those federal agencies that have not 

implemented the Central Accounting and Reporting System. 

Fiscal Service PCA Due Date: Jan-2021

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should design and implement 

procedures to evaluate risks and monitor internal controls over financial 

reporting relevant to the Schedules of the General Fund. 

Fiscal Service PCA Due Date: May-2021

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should enhance guidance available to 

federal agencies to comprehensively define and describe the proper use and 

related accounting implications of each Business Event Type Codes (BETC). 

Fiscal Service Implemented and Awaiting Auditor 

Verification

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should develop and implement a 

mechanism for evaluating agencies' use of BETCs based on the enhanced 

guidance. 

Fiscal Service PCA Due Date: Jan-2021

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should design and implement 

procedures to (1) obtain and review supporting documentation for reported 

activity included on Agency Submission Forms and (2) assess the overall 

completeness of federal agency activity reported on Agency Submission 

Forms. 

Fiscal Service PCA Due Date: Mar-2022

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should enhance journal voucher review 

procedures to include a review of relevant accounting criteria before 

recording transactions based on Agency Submission Forms. 

Fiscal Service Implemented and Awaiting Auditor 

Verification

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should design and implement 

procedures to periodically review all active Treasury accounts to determine 

whether they are valid and the related General Fund account balances are 

consistent with federal agency records. 

Fiscal Service PCA Due Date: Mar-2021

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements The Commissioner of Fiscal Service should enhance current procedures for 

reviewing negative balances to include Treasury accounts with indefinite 

periods of availability. 

Fiscal Service PCA Due Date: Mar-2021

Financial Audit: Bureau of the Fiscal 

Service's Fiscal Year 2018 Schedules of 

the General Fund

GAO-19-185 05/15/2019 Financial Statements We recommend that the Commissioner of Fiscal Service enhance the 

standard operating procedures for prior period transactions to include a 

requirement for Fiscal Service to assess the materiality of transactions to 

determine the appropriateness of recording them as a current year adjustment 

or restating the prior period.

Fiscal Service Implemented and Awaiting Auditor 

Verification

Federal Contracting: Opportunities to 

Improve Compliance with Regulations 

and Enhance Tax Collections 

GAO-19-243 05/15/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should evaluate options to obtain 

comprehensive contract payment data above the existing Federal 

Procurement Data System-Next Generation (FPDS-NG) reporting threshold 

of $10,000, including assessing the costs and benefits of changing the 

current threshold for contracts that agencies are required to report to the IRS 

through Form 8596 information returns to be consistent with the existing 

reporting threshold for FPDS-NG, determine whether regulatory revisions 

are necessary, and change the reporting threshold, if appropriate.

IRS Implemented and Awaiting Auditor 

Verification

Individual Retirement Accounts: 

Formalizing Labor's and IRS's 

Collaborative Efforts Could Strengthen 

Oversight of Prohibited Transactions

GAO-19-495 07/08/2019 Administration of 

Program Operations

The Commissioner of Internal Revenue, in consultation with the Secretary of 

Labor, should establish a formal means, such as a memorandum of 

understanding or other mechanism, to support and guide DOL's and IRS's 

collaborative efforts to oversee IRA prohibited transaction exemptions. 

IRS PCA Due Date: Nov-2021

Page 34 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Cybersecurity: Agencies Need to Fully 

Establish Risk Management Programs 

and Address Challenges

GAO-19-384 07/25/2019 Information 

Technology

The Secretary of the Treasury should develop a cybersecurity risk 

management strategy that includes the key elements identified in this report 

(GAO-19-384). 

Treasury - DO On Hold. Agreed with the recommendation. 

Due to funding constraints, the 

recommendation is put on hold.

Cybersecurity: Agencies Need to Fully 

Establish Risk Management Programs 

and Address Challenges

GAO-19-384 07/25/2019 Information 

Technology

The Secretary of the Treasury should establish a process for conducting an 

organization-wide cybersecurity risk assessment.

Treasury - DO On Hold. Agreed with the recommendation. 

Due to funding constraints, the 

recommendation is put on hold.

Cybersecurity: Agencies Need to Fully 

Establish Risk Management Programs 

and Address Challenges

GAO-19-384 07/25/2019 Information 

Technology

The Secretary of the Treasury should establish and document a process for 

coordination between cybersecurity risk management and enterprise risk 

management functions.

Treasury - DO On Hold. Agreed with the recommendation. 

Due to funding constraints, the 

recommendation is put on hold.

SOCIAL SECURITY AND 

MEDICARE: Improved Schedule 

Management Needed for More Timely 

Trust Fund Reports 

GAO-19-596 08/14/2019 Administration of 

Program Operations

The Secretary of the Treasury, as Chairperson of the Boards of Trustees, 

should work with the other trustees to establish a policy to inform 

Congressional committees of jurisdiction when the trustees determine that 

the reports are expected to miss the issuance deadline. This outreach should 

include 1) the factors that are contributing to delays, and 2) the reports' 

expected issuance dates. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

SOCIAL SECURITY AND 

MEDICARE: Improved Schedule 

Management Needed for More Timely 

Trust Fund Reports 

GAO-19-596 08/14/2019 Administration of 

Program Operations

The Secretary of the Treasury, as Chairperson of the Boards of Trustees, 

should work with the other trustees to take steps in consultation with the 

chief actuaries of Social Security Administration and Centers for Medicare & 

Medicaid Services to improve the management of the report development 

schedule in order to provide the Trustees reports to Congress by the statutory 

deadline. These steps could include regularly updating the schedule using 

actual progress and archiving the final iteration of the schedules.

Treasury - DO PCA Due Date: Apr-2021

Management Report: Improvements 

Needed in Controls over the Processes 

Used to Prepare the U.S. Consolidated 

Financial Statements

GAO-19-624 09/04/2019 Financial Statements The Secretary of the Treasury should ensure that the Fiscal Assistant 

Secretary enhances existing procedures for Treasury management to perform 

additional reviews for restatements, reclassifications, and adjustments to 

beginning net position to reasonably assure that they are properly supported 

and accurately reported.

Fiscal Service PCA Due Date: Sep-2021

Management Report: Improvements 

Needed in Controls over the Processes 

Used to Prepare the U.S. Consolidated 

Financial Statements

GAO-19-624 09/04/2019 Financial Statements The Secretary of the Treasury should ensure that the Fiscal Assistant 

Secretary, working in coordination with the Controller of OMB, establishes 

effective processes and procedures to reasonably assure that appropriate 

information regarding legal contingency losses is reported in the CFS.

Fiscal Service PCA Due Date: Sep-2021

Bank Secrecy Act: Agencies and 

Financial Institutions Share Information 

but Metrics and Feedback Not Regularly 

Provided

GAO-19-582 09/26/2019 Terrorism and Financial 

Crime

The Director of FinCEN, after consulting with Commodity Futures Trading 

Commission (CFTC), should consider prioritizing the inclusion of the 

primary Self-Regulatory Organization (SRO) conducting BSA examinations 

in the futures industry in the Bank Secrecy Act Advisory Group (BSAAG) 

on a more consistent basis and also making the primary futures industry 

association a concurrent member. 

FinCEN Rejected. FinCEN disagreed with the 

recommendation. While the primary futures 

SRO is presently a member of the BSAAG, 

only Federal agencies are considered 

permanent members. Therefore, FinCEN 

cannot make future membership commitments 

to any specific SRO or any other non-federal 

organization. 

Bank Secrecy Act: Agencies and 

Financial Institutions Share Information 

but Metrics and Feedback Not Regularly 

Provided

GAO-19-582 09/26/2019 Terrorism and Financial 

Crime

The Director of FinCEN should, after consulting with CFTC, should take 

steps to explore providing direct BSA data access to National Futures 

Association (NFA). 

FinCEN Rejected. FinCEN disagreed with the 

recommendation as FinCEN has not received a 

request from the CFTC or the NFA to engage 

on this matter. FinCEN would review any 

future request for direct access in accordance 

with established procedures. 

Page 35 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Bank Secrecy Act: Agencies and 

Financial Institutions Share Information 

but Metrics and Feedback Not Regularly 

Provided

GAO-19-582 09/26/2019 Terrorism and Financial 

Crime

The Director of FinCEN should review options for FinCEN to more 

consistently and publicly provide summary data on the usefulness of BSA 

reporting. This review could either be concurrent with FinCEN's BSA value 

study or through another method. 

FinCEN Implemented and Awaiting Auditor 

Verification

Bank Secrecy Act: Agencies and 

Financial Institutions Share Information 

but Metrics and Feedback Not Regularly 

Provided

GAO-19-582 09/26/2019 Terrorism and Financial 

Crime

The Director of FinCEN should review options for establishing a mechanism 

through which law enforcement agencies may provide regular and institutionspecific feedback on BSA reporting. Options should take into consideration 

providing such feedback to cover different types of financial institutions and 

those with significant financial activity. This review could either be part of 

FinCEN's BSA value study or through another method. 

FinCEN Implemented and Awaiting Auditor 

Verification

Tax-Law Enforcement: IRS Could 

Better Leverage Existing Data to 

Identify Abusive Schemes Involving 

Tax-Exempt Entities

GAO-19-491 10/07/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should develop guidance to help 

managers ensure referrals about abusive schemes involving tax-exempt 

entities are made across operating divisions. This could be accomplished by, 

for example, adopting specific guidance for audit managers to look for 

referral accuracy in their reviews of case closings.

IRS PCA Due Date: Jun-2021

Tax-Law Enforcement: IRS Could 

Better Leverage Existing Data to 

Identify Abusive Schemes Involving 

Tax-Exempt Entities

GAO-19-491 10/07/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should link audit data on abusive tax 

schemes involving tax-exempt entities across operating divisions and use the 

linked data to assess emerging issues and develop policy responses. 

IRS PCA Due Date: Jun-2021

Tax-Law Enforcement: IRS Could 

Better Leverage Existing Data to 

Identify Abusive Schemes Involving 

Tax-Exempt Entities

GAO-19-491 10/07/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should test the ability of the Return 

Inventory Classification System (RICS) to facilitate analysis and monitoring 

of audit data across the operating divisions and support the IRS's 

enforcement objectives. 

IRS PCA Due Date: Mar-2022

Tax-Law Enforcement: IRS Could 

Better Leverage Existing Data to 

Identify Abusive Schemes Involving 

Tax-Exempt Entities

GAO-19-491 10/07/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should undertake a risk-assessment 

of tax-exempt Form 8886-T filings. Based on the findings of the risk 

assessment, IRS should then determine whether steps are needed to increase 

compliance, such as, for example through increased outreach to tax-exempt 

entities or assessment of non-filing penalties. 

IRS PCA Due Date: Nov-2020

Tax-Law Enforcement: IRS Could 

Better Leverage Existing Data to 

Identify Abusive Schemes Involving 

Tax-Exempt Entities

GAO-19-491 10/07/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should use existing data analytic 

tools to further mine Form 8886 and Form 8918 data; which could be used to 

find audit leads on tax-exempt entity involvement in potentially abusive tax 

schemes. 

IRS PCA Due Date: Mar-2022

DATA ACT: Quality of Data Has 

Improved, but Action is Needed to 

Improve Completeness and Accuracy 

and to Better Disclose Known Data 

Limitations

GAO-20-75 11/08/2019 Administration of 

Program Operations

The Secretary of the Treasury should ensure that information about the 90-

day delay for displaying DOD procurement data on USAspending.gov is 

transparently communicated to users of the site. Approaches for doing this 

could include prominently displaying this information on the DOD agency 

profile page, in the unreported data section, and in search results that include 

DOD data. 

Treasury - DO PCA Due Date: Mar-2021

DATA ACT: Quality of Data Has 

Improved, but Action is Needed to 

Improve Completeness and Accuracy 

and to Better Disclose Known Data 

Limitations

GAO-20-75 11/08/2019 Administration of 

Program Operations

The Secretary of the Treasury should ensure that information regarding how 

the Primary Place of Performance Address for Medicare payment data are 

reported is transparently communicated to the users of USAspending.gov. 

Treasury - DO PCA Due Date: Feb-2021

Bank Secrecy Act: Examiners Need 

More Information on How to Assess 

Banks¿ Compliance Controls for Money 

Transmitter Accounts

GAO-20-46 12/03/2019 Terrorism and Financial 

Crime

The Comptroller of the Currency should, in coordination with the other 

federal banking regulators, and with input from BSA/AML examiners and 

other relevant stakeholders, take steps to improve examiners' ability to 

evaluate the effectiveness of banks' BSA/AML compliance controls with 

respect to money transmitter accounts. Steps may include providing updates 

to examination procedures, examiner training, or a combination of methods.

OCC PCA Due Date: Sep-2020

Page 36 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Taxpayer Input Could Strengthen IRS's 

Online Services

GAO-20-71 12/20/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Chief Information 

Officer and the Director of OLS to ensure that planned future capabilities of 

digital communication

platforms are tested or piloted before deployment with a focus on mitigating 

the risks

that were identified in prior pilots of digital communication services, such as 

challenges

in establishing common objectives and enrolling taxpayers.

IRS PCA Due Date: Nov-2020

Taxpayer Input Could Strengthen IRS's 

Online Services

GAO-20-71 12/20/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Commissioner of 

W&I to work with the Director of OLS to ensure that future decisions 

regarding whether to renew the Free File agreement incorporate findings 

from a comprehensive examination of the benefits and costs of the 

agreement as it relates to long term plans for IRS's online services, including 

plans to file amended returns electronically.

IRS PCA Due Date: Nov-2020

Taxpayer Input Could Strengthen IRS's 

Online Services

GAO-20-71 12/20/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Director of OLS 

and the Chief Research and Analytics Officer to work together to analyze the 

potential effects of online services on taxpayer burden.

IRS PCA Due Date: Dec-2021

Taxpayer Input Could Strengthen IRS's 

Online Services

GAO-20-71 12/20/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that information 

collected on taxpayers' experience with online services is summarized in the 

document serving as IRS's performance plan and report.

IRS PCA Due Date: Nov-2022

Taxpayer Input Could Strengthen IRS's 

Online Services

GAO-20-71 12/20/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that information is 

collected on taxpayers' experiences with all online services and the extent to 

which the services are meeting taxpayers' needs.

IRS PCA Due Date: Dec-2021

Taxpayer Input Could Strengthen IRS's 

Online Services

GAO-20-71 12/20/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should ensure that taxpayer input is 

included as an element of IRS's identification and prioritization process for 

new online services.

IRS PCA Due Date: Dec-2021

Taxpayer Input Could Strengthen IRS's 

Online Services

GAO-20-71 12/20/2019 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should work with relevant officials 

to set a target to reduce taxpayer burden through the development of new 

online services.

IRS Rejected. IRS disagreed with the 

recommendation. IRS’s current taxpayer 

burden measurement methodology is not 

designed to evaluate the effect of specific 

online services or web site enhancements. The 

methodology captures respondents’ estimated 

time and cost at a high level for a series of 

interrelated tasks but is not closely tied to 

specific interaction or transaction types. As 

such, burden measures are often impacted by 

systemic-level changes in tax administration 

(such as the Tax Cut and Jobs Act (TCJA) 

reduction in the proportion of filers who 

itemize deductions) but they are typically not 

sensitive to the impact of smaller 

programmatic improvements.

Counternarcotics: Treasury Reports 

Some Results from Designating Drug 

Kingpins, but Should Improve 

Information on Agencies' Expenditures

GAO-20-112 01/15/2020 Terrorism and Financial 

Crime

The Secretary of the Treasury should ensure that the Office of Foreign 

Assets Control discloses information about limitations in the consistency and 

reliability of the agency expenditure data in its annual reports to Congress. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

Page 37 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

Counternarcotics: Treasury Reports 

Some Results from Designating Drug 

Kingpins, but Should Improve 

Information on Agencies' Expenditures

GAO-20-112 01/15/2020 Terrorism and Financial 

Crime

The Secretary of the Treasury should ensure that the Office of Foreign 

Assets Control provides its partner agencies more specific guidance 

regarding Kingpin Act-related expenditure data to improve the consistency 

of data submitted by these agencies. This could include, for example, how 

agencies account for expenditures that support Kingpin Act investigations 

when they are not the lead and for what types of activities resource 

expenditure data are required. 

Treasury - DO Implemented and Awaiting Auditor 

Verification

2019 Tax Filing: IRS Successfully 

Implemented Tax Law Changes but 

Needs to Improve Service for Taxpayers 

with Limited-English Proficiency

GAO-20-55 01/15/2020 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should collect and use employee 

input on the strengths and weaknesses of its customer service training, 

including on whether training is effective in improving CSRs' performance, 

to inform changes to its training program and strategy under the Taxpayer 

First Act.

IRS PCA Due Date: Aug-2021

2019 Tax Filing: IRS Successfully 

Implemented Tax Law Changes but 

Needs to Improve Service for Taxpayers 

with Limited-English Proficiency

GAO-20-55 01/15/2020 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should conduct the four-factor 

assessment of its language services to persons with LEP for its most 

commonly used vital tax products to determine (1) which products should be 

translated and into what languages, and (2) what interpretation assistance 

will be provided to arrive at the appropriate mix of translation and 

interpretation services. IRS should document these assessments, including 

the determinations it made, and take action as appropriate based on these 

assessments.

IRS PCA Due Date: Jan-2022

2019 Tax Filing: IRS Successfully 

Implemented Tax Law Changes but 

Needs to Improve Service for Taxpayers 

with Limited-English Proficiency

GAO-20-55 01/15/2020 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should direct the Wage and 

Investment division to develop and implement a strategy, in collaboration 

with its strategic workforce planning initiative, for the efficient use of 

overtime. 

IRS Rejected. IRS disagreed with the 

recommendation. The Wage and Investment 

Division (W&I) has an existing process for the 

use and approval of overtime that is reevaluated annually. Overtime is used to 

accomplish mission critical requirements such 

as meeting processing milestones and 

responding to taxpayer calls and 

correspondence. The use of overtime goes 

through multiple layers of management review 

and concurrence with the final approval 

authority residing with the W&I Division 

Commissioner, the Deputy Commissioner, or 

their designee. This process is sufficient for 

ensuring overtime is used efficiently.

2019 Tax Filing: IRS Successfully 

Implemented Tax Law Changes but 

Needs to Improve Service for Taxpayers 

with Limited-English Proficiency

GAO-20-55 01/15/2020 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should further assess the increase in 

"system downtime" and identify possible solutions to mitigate any problems 

and reduce system downtime.

IRS PCA Due Date: May-2021

2019 Tax Filing: IRS Successfully 

Implemented Tax Law Changes but 

Needs to Improve Service for Taxpayers 

with Limited-English Proficiency

GAO-20-55 01/15/2020 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should make publicly available, such 

as on its website, a list of tax topics considered out of scope for CSRs to 

answer on the telephone, as well as include references for how and where to 

find information about these topics. 

IRS Implemented and Awaiting Auditor 

Verification

2019 Tax Filing: IRS Successfully 

Implemented Tax Law Changes but 

Needs to Improve Service for Taxpayers 

with Limited-English Proficiency

GAO-20-55 01/15/2020 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should perform regular monitoring 

of fluctuations in system downtime charges, such as increases overall or by 

specific units, to determine what, if any, factors are interrupting CSRs' work. 

IRS PCA Due Date: May-2021

Page 38 of 67
Report Title Report Number Issue Date Audit Area GAO Recommendation Bureau/Office Implementation Status

2019 Tax Filing: IRS Successfully 

Implemented Tax Law Changes but 

Needs to Improve Service for Taxpayers 

with Limited-English Proficiency

GAO-20-55 01/15/2020 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should reconcile authority and 

implement procedures for routinely reviewing its multilingual web pages to 

effectively prevent, or detect and correct, errors such as incorrect or outdated 

information. For example, these procedures could call for the divisions to 

work with the Linguistics, Policy, Tools, & Services (LPTS) section 

whenever the English version of translated content is updated. 

IRS PCA Due Date: Oct-2022

2019 Tax Filing: IRS Successfully 

Implemented Tax Law Changes but 

Needs to Improve Service for Taxpayers 

with Limited-English Proficiency

GAO-20-55 01/15/2020 Tax Administration and 

Compliance

The Commissioner of Internal Revenue should reconcile authority and 

implement procedures for routinely reviewing the English versions of IRS's 

most commonly used vital tax products and web pages to ensure that 

information is included in commonly encountered languages about where 

taxpayers with LEP can obtain the translated content. If such content is not 

translated, the products and web pages should include information about 

where taxpayers with LEP can obtain language assistance from IRS.

IRS PCA Due Date: Mar-2021

IRS Needs to Better Assess the Risks of 

Refund Fraud on Business-Related 

Returns

GAO-20-174 01/30/2020 Improper Payments The Commissioner of Internal Revenue should designate a dedicated entity 

to provide oversight of agency-wide efforts to detect, prevent, and resolve 

business identity theft (IDT), consistent with leading practices. This may 

involve designating one business unit as a lead entity or leveraging 

cooperative relationships between business units to establish a business IDT 

leadership team. This entity should have defined responsibilities and 

authority for managing fraud risk.

IRS Rejected. IRS disagreed with the 

recommendation. IRS's Services and 

Enforcement Executive Steering Committee 

(SE ESC) provides agency-wide oversight of 

detection, prevention, and resolution activities 

associated with business identity theft (IDT) 

refund fraud. The SE ESC will continue to 

serve as the lead oversight body for agencywide efforts to detect, prevent, and resolve 

business IDT.

IRS Needs to Better Assess the Risks of 

Refund Fraud on Business-Related 

Returns

GAO-20-174 01/30/2020 Improper Payments The Commissioner of Internal Revenue should develop a fraud risk profile 

for business IDT that aligns with leading practices. This should include (1) 

identifying inherent fraud risks of business IDT, (2) assessing the likelihood 

and impact of inherent fraud risks, (3) determining fraud risk tolerance, and 

(4) examining the suitability of existing fraud controls.

IRS PCA Due Date: Apr-2021

IRS Needs to Better Assess the Risks of 

Refund Fraud on Business-Related 

Returns

GAO-20-174 01/30/2020 Improper Payments The Commissioner of Internal Revenue should develop, document, and 

implement a strategy for addressing fraud risks that will be identified in its 

fraud risk profile.

IRS PCA Due Date: Oct-2021

IRS Needs to Better Assess the Risks of 

Refund Fraud on Business-Related 

Returns

GAO-20-174 01/30/2020 Improper Payments The Commissioner of Internal Revenue should ensure that IRS collects 

additional data on business IDT by identifying and implementing new fraud 

filters consistent with its fraud risk profile. This should include prioritizing 

IDT filters for tax forms determined to be most at risk based on an analysis 

of risk tolerances.

IRS PCA Due Date: Feb-2022

IRS Needs to Better Assess the Risks of 

Refund Fraud on Business-Related 

Returns

GAO-20-174 01/30/2020 Improper Payments The Commissioner of Internal Revenue should establish customer serviceoriented performance goals for resolving business IDT cases. IRS PCA Due Date: Sep-2021

IRS Needs to Better Assess the Risks of 

Refund Fraud on Business-Related 

Returns

GAO-20-174 01/30/2020 Improper Payments The Commissioner of Internal Revenue should identify and implement 

methods to address delays in resolving business IDT cases due to 

correspondence-based authentication. This could involve using different 

methods for taxpayer authentication based on the risk level of the return.

IRS PCA Due Date: Oct-2021

Page 39 of 67
APPENDIX 2

Good Accounting Obligation in Government Act Report for Fiscal Year 2022 Budget Justification Submission

Implementation Status of Treasury Office of the Inspector General (OIG) Recommendations

Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

GENERAL MANAGEMENT: Treasury Has 

Policies and Procedures to Safeguard 

Classified Information but They Are Not 

Effectively Implemented

OIG-16-059 09/29/2016 Administration of 

Program Operations

The Assistant Secretary for Intelligence and Analysis should direct the 

Deputy Assistant Secretary for Security to update the Treasury Security 

Manual to include procedures requiring the Office of Security Programs to 

follow-up and obtain all bureau self-inspection reports.

Treasury - DO PCA Due Date: Aug-2020

TERRORIST FINANCING/MONEY 

LAUNDERING: Federal Agencies Are 

Generally Satisfied with TFFC's Collaboration 

Efforts, but Enhancements Can Be Made

OIG-17-044 05/23/2017 Terrorism and Financial 

Crime

The Assistant Secretary for Terrorist Financing should address areas of 

concern expressed by Federal agencies regarding the Office of Terrorist 

Financing and Financial Crimes' (TFFC) collaboration that includes 

feedback, intersessional meetings, and invitations to participate in bilateral 

meetings with foreign countries during the Financial Action Task Force 

(FATF) Plenary.

Treasury - DO No Action Taken

TERRORIST FINANCING/MONEY 

LAUNDERING: Federal Agencies Are 

Generally Satisfied with TFFC's Collaboration 

Efforts, but Enhancements Can Be Made

OIG-17-044 05/23/2017 Terrorism and Financial 

Crime

The Assistant Secretary for Terrorist Financing should develop policies and 

procedures to ensure continuity and consistency in collaboration efforts with 

interagency task forces and workgroups.

Treasury - DO No Action Taken

TERRORIST FINANCING/MONEY 

LAUNDERING: Federal Agencies Are 

Generally Satisfied with TFFC's Collaboration 

Efforts, but Enhancements Can Be Made

OIG-17-044 05/23/2017 Terrorism and Financial 

Crime

The Assistant Secretary for Terrorist Financing should develop and 

implement a mechanism to monitor, evaluate, and report on the effectiveness 

of the Office of Terrorist Financing and Financial Crimes' (TFFC) 

interagency collaboration.

Treasury - DO No Action Taken

TERRORIST FINANCING/MONEY 

LAUNDERING: Federal Agencies Are 

Generally Satisfied with TFFC's Collaboration 

Efforts, but Enhancements Can Be Made

OIG-17-044 05/23/2017 Terrorism and Financial 

Crime

The Assistant Secretary for Terrorist Financing should develop meaningful 

performance measures specific to the Office of Terrorist Financing and 

Financial Crimes (TFFC) collaboration.

Treasury - DO No Action Taken

TERRORIST FINANCING/MONEY 

LAUNDERING: OFAC Human Resources 

Practices Need Improvement

OIG-18-018 11/27/2017 Human Capital The Office of Foreign Assets Control (OFAC) Director should ensure that 

legacy employees' current position descriptions are evaluated to ensure that 

the documented promotion potential of these non-supervisory employees is 

consistent with OFAC's current promotion practices.

Treasury - DO PCA Due Date: Dec-2020

TERRORIST FINANCING/MONEY 

LAUNDERING: OFAC's Licensing Program 

Would Benefit From System Enhancements

OIG-18-043 04/03/2018 Administration of 

Program Operations

The Director of the Office of Foreign Assets Control (OFAC) should 

develop performance measures specific for the licensing division.

Treasury - DO PCA Due Date: Dec-2021

TERRORIST FINANCING/MONEY 

LAUNDERING: Audit of the Office of 

Intelligence and Analysis' Authorities and 

Actions Related to U.S. Persons' Financial 

Information

OIG-18-044 04/09/2018 Terrorism and Financial 

Crime

The Under Secretary for Terrorism and Financial Intelligence should ensure 

that the Office of Intelligence and Analysis' (OIA) U.S. Persons (USP) 

Procedures are finalized and submitted for approval to the Attorney General.

Treasury - DO PCA Due Date: Mar-2021

TERRORIST FINANCING/MONEY 

LAUNDERING: Audit of the Office of 

Intelligence and Analysis' Authorities and 

Actions Related to U.S. Persons' Financial 

Information

OIG-18-044 04/09/2018 Terrorism and Financial 

Crime

The Under Secretary for Terrorism and Financial Intelligence should ensure 

that the Office of Intelligence and Analysis (OIA) implement a compliance 

monitoring program to assess whether intelligence analysts' activities are 

conducted in accordance with OIA authorities, and electronic searches and 

other queries are performed in a manner that fully protects the rights of U.S. 

persons.

Treasury - DO PCA Due Date: Mar-2021

Page 40 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2018 Performance Audit

OIG-19-007TIG 10/31/2018 Information 

Technology

Treasury Inspector General for Tax Administration (TIGTA) management 

should establish a current enterprise baseline of software and related 

configurations for the TIGTA System. 

TIGTA PCA Due Date: Jan-2021

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2018 Performance Audit

OIG-19-007TIG 10/31/2018 Information 

Technology

Treasury Inspector General for Tax Administration (TIGTA) management 

should develop and disseminate to TIGTA personnel a TIGTA System 

Information System Contingency Plan (ISCP) that addresses purpose, scope, 

roles, responsibilities, management commitment, coordination, and 

compliance to facilitate the implementation of the contingency planning 

policy and associated contingency planning controls. TIGTA should conduct 

disaster recovery and business continuity testing for the TIGTA System on 

the frequency stipulated by a Business Impact Analysis. 

TIGTA PCA Due Date: Jun-2022

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2018 Performance Audit

OIG-19-007TIG 10/31/2018 Information 

Technology

Treasury Inspector General for Tax Administration (TIGTA) management 

should obtain and issue full Authority to Operate (ATO) to include the 

following:

a. Ensure that the TIGTA System's current System Security Plan (SSP) is 

finalized and updated according with Treasury Directive Publication 85-01 

and National Institute of Standards and Technology (NIST) Special 

Publication 800-53 Revision 4 guidance.

b. Develop Plan of Action and Milestones (POA&M) for the security 

controls that were not implemented or were partially implemented.

c. Complete the Security Assessment and Authorization (SA&A) package for 

the TIGTA System in accordance with NIST Special Publication 800-37 

Revision 1, Guide for Applying the Risk Management Framework to Federal 

Information Systems.

TIGTA PCA Due Date: Jun-2021

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2018 Performance Audit

OIG-19-007TIG 10/31/2018 Information 

Technology

Treasury Inspector General for Tax Administration (TIGTA) management 

should develop a plan that incorporates and takes into account interruptions 

in TIGTA System funding. 

TIGTA Management is in the process of 

developing PCAs. 

Domestic and International Assistance 

Programs: Audit of ASI Federal Credit 

Union's CDFI Program Awards

OIG-19-038 07/11/2019 Administration of 

Program Operations

The Director of the Community Development Financial Institutions (CDFI) 

Fund should determine whether ASI Federal Credit Union (ASI) was in 

default of its 2006 through 2009, 2011, and 2012 Assistance Agreements as 

a result of submitting invalid information in its Certification Application and 

Assistance Applications for FYs 2006 through 2009, 2011, and 2012 and its 

failure to deploy all HFFI-FA awards; and as such, take appropriate action 

which may include requiring ASI to reimburse the CDFI Fund all Financial 

Assistance (FA) and Healthy Food Financing Initiative (HFFI)-FA awards, 

and suspending or revoking ASI's CDFI certification.

Treasury - DO PCA Due Date: Dec-2020 

Domestic and International Assistance 

Programs: Audit of ASI Federal Credit 

Union's CDFI Program Awards

OIG-19-038 07/11/2019 Administration of 

Program Operations

The Director of the Community Development Financial Institutions (CDFI) 

Fund should re-evaluate ASI Federal Credit Union's (ASI) FY 2013 

Certification Application and FY 2013 Assistance Application to determine 

if the information submitted was valid and complete and if ASI met all 

eligibility requirements to be re-certified as a CDFI and to receive its 

$1,347,000 Financial Assistance (FA) award.

Treasury - DO PCA Due Date: Dec-2020 

Page 41 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

Interim Audit Update - Matters for 

Consideration Prior to Fiscal Service's 

Selection of the Direct Express® Debit Card 

Program Financial Agent

OIG-19-041 07/29/2019 Procurement 

Management

The Commissioner of the Fiscal Service should periodically request access to 

the Regulation E compliance reviews related to Direct Express conducted by 

the banking regulators under the provisions outlined in 12 CFR 261 or other 

relevant provisions related to the regulator. This information should be used 

by the Bureau of the Fiscal Service to monitor the financial agent's 

compliance with the federal agency agreement (FAA) and Service Level 

Requirements (SLR) or to improve Direct Express.

Fiscal Service PCA Due Date: Jan-2021

DATA Act: Treasury's Efforts to Increase 

Transparency Into Federal Spending Continue, 

But Further Refinement is Needed

OIG-19-040 07/30/2019 Administration of 

Program Operations

The Fiscal Assistant Secretary should develop an internal reference 

document for the DATA Act Program Management Office development 

team that explains why a designation of warning versus fatal error was 

assigned to each rule.

Treasury - DO PCA Due Date: Mar-2021

DATA Act: Treasury's Efforts to Increase 

Transparency Into Federal Spending Continue, 

But Further Refinement is Needed

OIG-19-040 07/30/2019 Administration of 

Program Operations

The Fiscal Assistant Secretary should either expand the Interface Definition 

Document (IDD) or create a complementary document that includes all 

elements used for validation, derivation, and display purposes from external 

tables that interface with the Broker and USAspending.gov. Documentation 

should include the cadence on which the tables are pulled or referenced by 

the DATA Act Broker.

Treasury - DO PCA Due Date: Mar-2021

DATA Act: Treasury's Efforts to Increase 

Transparency Into Federal Spending Continue, 

But Further Refinement is Needed

OIG-19-040 07/30/2019 Administration of 

Program Operations

The Fiscal Assistant Secretary should enhance generic disclaimers on 

USAspending.gov and expand the use of limitation statements on pages with 

known and potential display issues so that the public has a clear 

understanding of known limitations when using the data as displayed and 

available for download.

Treasury - DO PCA Due Date: Mar-2021

DATA Act: Treasury's Efforts to Increase 

Transparency Into Federal Spending Continue, 

But Further Refinement is Needed

OIG-19-040 07/30/2019 Administration of 

Program Operations

The Fiscal Assistant Secretary should perform testing and provide 

documentation assuring that the limited validation rules identified as having 

inconsistencies operate as intended in the DATA Act Broker with accurately 

displayed output.

Treasury - DO PCA Due Date: Mar-2021

DATA Act: Treasury's Efforts to Increase 

Transparency Into Federal Spending Continue, 

But Further Refinement is Needed

OIG-19-040 07/30/2019 Administration of 

Program Operations

The Fiscal Assistant Secretary should develop procedures to ensure changes 

to rules implemented during coding are subsequently captured in official 

DATA Act Information Model Schema (DAIMS) documentation.

Treasury - DO PCA Due Date: Mar-2021

DATA Act: Treasury's Efforts to Increase 

Transparency Into Federal Spending Continue, 

But Further Refinement is Needed

OIG-19-040 07/30/2019 Administration of 

Program Operations

The Fiscal Assistant Secretary should incorporate sub-rules that already 

appear in Broker output (i.e.,C23.1, C23.2, C23.3) and an explanation of 

potential formatting violations (with appropriate error designations) into the 

DATA Act Information Model Schema (DAIMS) Validation Rules v1.1.2 

and Financial Assistance Broker Submission (FABS) Validation Checklist 

v1.1 (or the most updated versions of these).

Treasury - DO PCA Due Date: Mar-2021

DATA Act: Treasury's Efforts to Increase 

Transparency Into Federal Spending Continue, 

But Further Refinement is Needed

OIG-19-040 07/30/2019 Administration of 

Program Operations

The Fiscal Assistant Secretary should update the DATA Act Program 

Management Office's resource documentation to give prompt attention to 

staffing and succession planning for DATA Act implementation efforts to 

mitigate against resource gaps.

Treasury - DO PCA Due Date: Mar-2021

DATA Act: Treasury's Efforts to Increase 

Transparency Into Federal Spending Continue, 

But Further Refinement is Needed

OIG-19-040 07/30/2019 Administration of 

Program Operations

The Fiscal Assistant Secretary should either develop an instruction guide to 

interpret DATA Act Broker output or incorporate mechanisms in the output 

itself to aid user interpretation when multiple fields are impacted by the same 

rule.

Treasury - DO PCA Due Date: Mar-2021

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

The Bureau of the Fiscal Service management should enforce encryption of 

databases to protect the confidentiality of Fiscal Service Systems 1

and 2 as required by NIST 800-53, Rev. 4. 

Fiscal Service PCA Due Date: Jan-2021

Page 42 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

Fiscal Service management should protect the confidentiality and integrity of 

transmissions by encrypting Fiscal Service System 2 data in transit as 

required by NIST 800-53, Rev. 4. 

Fiscal Service Management is in the process of 

developing PCAs. 

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

Bureau of Engraving and Printing (BEP) management should assess and 

remediate vulnerabilities identified during Security Content Automation 

Protocol (SCAP) configuration baseline compliance and vulnerability 

scanning within the required timeframes specified in the BEP Minimum 

Standard Parameters.

BEP Management is in the process of 

developing PCAs. 

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

Departmental Offices (DO) management should develop and implement a 

process to ensure that periodic user access reviews are completed for DO 

System 2, documented, and all unnecessary access is removed in accordance 

with NIST SP 800-53 and TD P 85-01.

Treasury - DO Management is in the process of 

developing PCAs. 

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

United States Mint (Mint) management should establish a quality control 

process to ensure that user access to Mint System 1 and other Mint 

information systems follow the access management process requiring the 

completed background investigations, signed non-disclosure agreements 

(NDA), signed rules of behavior (ROB), and completion of the security 

awareness training. 

Mint Management is in the process of 

developing PCAs. 

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

Mint management should clearly document and formally approve exemptions 

to the Mint's access authorization process when a business justification 

exists. 

Mint Management is in the process of 

developing PCAs. 

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

Mint management should update the Mint Information Security Policy to 

meet TD P 85-01 and NIST requirements related to access agreements and 

ROB. 

Mint Management is in the process of 

developing PCAs. 

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

Mint management should finalize and implement its bureau-wide privacy 

program that includes a strategic organizational privacy plan for 

implementing applicable privacy control and procedures in accordance with 

NIST 800-53. 

Mint Management is in the process of 

developing PCAs. 

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

Mint management should implement mechanisms to monitor and audit on a 

regular basis the effectiveness of its privacy controls and internal privacy 

policy at the bureau-level.

Mint Management is in the process of 

developing PCAs. 

INFORMATION TECHNOLOGY: 

Department of the Treasury Federal 

Information Security Modernization Act Fiscal 

Year 2019 Performance Audit

OIG-20-003 10/25/2019 Information 

Technology

Mint management should establish sufficient controls to ensure 

supervisors/managers are held accountable for the completion of the rolebased specialized information technology security training by their 

employees with security roles and responsibilities. 

Mint Management is in the process of 

developing PCAs. 

DATA ACT: Treasury Continues to Make 

Progress in Meeting its DATA Act Reporting 

Requirements

OIG-20-007 11/08/2019 Administration of 

Program Operations

The Treasury's Assistant Secretary for Management, working as needed with 

Treasury's Senior Accountable Official, the Senior Procurement Executive, 

reporting entities, the Program Management Office (PMO), and the Office of 

Management and Budget should request that Treasury's PMO ensures File 

D2 data is properly extracted from appropriate sources within System for 

Award Management (SAM) for publication on USAspending.gov.

Treasury - DO PCA Due Date: Dec-2020

Page 43 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

DATA ACT: Treasury Continues to Make 

Progress in Meeting its DATA Act Reporting 

Requirements

OIG-20-007 11/08/2019 Administration of 

Program Operations

The Treasury's Assistant Secretary for Management, working as needed with 

Treasury's Senior Accountable Official, the Senior Procurement Executive, 

reporting entities, the Program Management Office, and the Office of 

Management and Budget should develop and implement a method and 

procedures to submit Treasury Forfeiture Fund financial assistance award 

data to the Financial Assistance Broker Submission in accordance with the 

reporting submission specifications established by the DATA Act 

Information Model Schema.

Treasury - DO PCA Due Date: Oct-2023

FINANCIAL MANAGEMENT: Management 

Letter for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-015 12/06/2019 Financial Statements Departmental Offices (DO) management should communicate the timeframe 

required to disable or remove the access of terminated employees and 

contractors from DO systems to the appropriate staff, and communicate the 

timeframe required to disable or remove the access of terminated employees 

and contractors from the Treasury-wide Financial Analysis and Reporting 

System (FARS) application, which includes the Treasury Information 

Executive Repository (TIER) and TIER Financial Statements (TFS), to the 

appropriate staff.

Treasury - DO Implemented and Awaiting Auditor 

Verification

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should address the mainframe 

operating system vulnerabilities noted in the condition as soon as possible.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should create a policy to 

require a formal review, approval, and documentation of the results for the 

Segregation of Duties (SD) matrix review on an annual basis or when there 

is a significant change.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should define and document 

the segregation of functions and privileges based on the principle of least 

privilege for mainframe security software and operating system.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop and implement 

a policy and a control to ensure the complete and accurate transfer of user 

account information from IDAM to Lightweight Directory Access Protocol 

(LDAP) on an ongoing basis for CIR, TCIS, and Judgment Fund Internet 

Claim System (JFICS).

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop and 

implement a quality control process to ensure that Payment Information 

Repository (PIR) emergency change approvals are consistently obtained, 

documented, and retained by the Change Control Board (CCB) prior to 

implementing changes into the PIR production environment.

Fiscal Service PCA Due Date: Mar-2022

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop and implement 

documentation to assign responsibility for ensuring adequacy of UNIX and 

database security and baseline settings.

Fiscal Service PCA Due Date: Mar-2021

Page 44 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop, document 

and implement policies, procedures, and controls for comprehensive logging 

and monitoring of events. Procedures and controls should include an annual 

re-assessment of whether logging and reporting is adequate.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should finalize policies and 

procedures to review audit logs of production DB2 servers.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should identify, document, 

and assess the mainframe security controls affecting the system software, to 

fully describe how mainframe security is provided. These Fiscal Service 

management controls should include:

a. Specific assignment of responsibility for maintaining operating security,

b. Skill assessment and remediation for operating system security 

maintenance,

c. Baseline documents for mainframe configuration files,

d. Standard procedures for review and maintenance of operating system 

security, and

e. Standard procedures to compare actual configuration settings to baseline 

documents.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should implement an 

oversight process to determine that designated Fiscal Service personnel 

reviews and reevaluates privileges associated with the UNIX production 

environment semi-annually for privileged accounts.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should prioritize and 

reevaluate its procedures to outline a process to complete the application 

security log reviews over the Secure Payment System (SPS) application and 

establish a process to perform the review at a defined frequency and update 

the procedures when changes occur.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should remove and disable the 

two users' access immediately.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should remove users' access 

once validated by the Federal Program Agency (FPA), during the Secure 

Payment System (SPS) annual user access review.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should review and enhance 

the manual processes and procedures to ensure that user access to all 

resources as defined for Treasury Web Application Infrastructure (TWAI) 

users are accurately and completely identified and evaluated during the 

course of the General Support System 1 (GSS1) and General Support System 

2 (GSS2) TWAI User Privilege Recertification cycles.

Fiscal Service PCA Due Date: Mar-2022

Page 45 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should review and update the 

Enterprise Information Technology Infrastructure (EITI) System Security 

Plans (SSP), Attachment A-Security Control Matrix (A-SCM), to be 

consistent with the Fiscal Service Baseline Security Requirements (BLSR) 

and the Chief Information Officer (CIO) Publication Information System 

Security (ISS) Internal Standard Operating Procedure (SOP) 8.3.6.60 

UNIX/LINUX Account Management.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Fiscal Service management should update its current Payment 

Information Repository (PIR) security procedures to require that 

management obtain current PIR developer access requirement listings from 

the service provider and use them when validating the appropriateness of 

PIR developer access during the semi-annual access reviews and 

recertification of the PIR and UNIX environments.

Fiscal Service PCA Due Date: Mar-2022

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop, document, 

and implement policies, procedures, and controls to conduct periodic reviews 

of actual mainframe security software settings against the security baseline.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should complete the General 

Support System 1 (GSS1) Treasury Web Application Infrastructure (TWAI) 

User Access Recertification cycle within the time intervals set by Fiscal 

Service Baseline Security Requirements (BLSR) requirements.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should configure the six 

UNIX servers to enforce the minimum password as stated in the Fiscal 

Service Baseline Security Requirements (BLSR) and ensure that the default 

password configuration settings for the production Unix environments 

comply with the minimum requirements specified in the BLSR.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Fiscal Service management should configure the systems-management 

software agents to include all UNIX servers, databases, and users' accounts 

within the UNIX environment when generating the users' lists for the semiannual review and recertification process so that all privileged and nonprivileged users' access is reviewed.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop a tailored 

mainframe operating system security configuration baseline that specifies 

how security configuration options are to be set based on the selected 

industry guidance.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop, approve, and 

promulgate control standards that address the purpose, scope, roles, 

responsibilities, management commitment, coordination among 

organizational entities, and compliance processes.

Fiscal Service PCA Due Date: Mar-2021

Page 46 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should document in a 

Segregation of Duties (SD) or Access Management Matrix the Treasury 

Managed Accounts (TMA) SD responsibilities for Fiscal Accounting 

Operations and maintain the supporting documentation used to review and 

approve the SD matrix in accordance with the policy.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should implement a quality 

control process to ensure that Payment Information Repository (PIR) 

application accounts defined to the PIR production environment that have 

been inactive for over 120 days are disabled.

Fiscal Service PCA Due Date: Mar-2022

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should implement an 

oversight process to ensure that designated Fiscal Service personnel:

a. Reviews the security logs for the UNIX and DB2 servers hosting the 

Payment Information Repository (PIR), Judgment Fund Internet Claim 

System (JFICS), and Security Payment System (SPS) applications on a predefined frequency, as indicated in the Fiscal Service Baseline Security 

Requirements (BLSR).

b. Formally documents completion of their reviews and any escalations to the 

Information System Security Office (ISSO), and

c. Retains the audit logs and documentation of its reviews for 18 months, as 

required by the BLSR.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should include provisions in 

their process oversight so that at no time the weekly Secure Payment System 

(SPS) log reviews are not assigned.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should maintain the 

documentation used to review and recertify the access of the known Payment 

Information Repository (PIR) service provider developers evidencing that 

their access to the UNIX environments is commensurate with their job 

functions and responsibilities.

Fiscal Service PCA Due Date: Mar-2022

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should perform an analysis for 

all financial system, mixed systems, and supporting general support systems 

to identify instances where user account information in IDAM and 

Lightweight Directory Access Protocol (LDAP) do not match and implement 

corrective actions to remediate these instances.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should retain evidence of 

recertification of all users.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should review and determine 

which profiles, applications, databases, and other processes on the 

mainframe will be logged and reviewed.

Fiscal Service PCA Due Date: Mar-2021

Page 47 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should review and establish 

access permissions to the mainframe system and security software based on 

the principle of least privilege access.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should update existing UNIX 

and database configuration security baseline documents to ensure that these 

documents fully incorporate and enforce the components of the Defense 

Information Systems Agency (DISA) Security Technical Implementation 

Guides (STIG). Management should document any deviations from the 

STIGs and note compensating controls that mitigate the security risk to an 

acceptable level.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop a mainframe 

security software risk assessment process using the Defense Information 

Systems Agency (DISA) Security Technical Implementation Guide (STIG) 

as a guideline.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should assess all mainframe 

logs to determine which logs should be evaluated by the incident 

management tool.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop, document, 

and implement policies, procedures, and controls to conduct periodic reviews 

of actual UNIX and database settings against the security configuration 

baselines.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should ensure that developers 

do not have the ability to make changes to the Payment Information 

Repository (PIR) production environment.

Fiscal Service PCA Due Date: Mar-2022

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should ensure that the chief 

information security officer assign specific responsibility for providing 

controls over operating system security, including access permissions to all 

system datasets and all security-related option settings.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should identify and document 

the person responsible for approving each access permission.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should maintain the 

supporting documentation used to review and document the results, as well 

as approve Segregation of Duties (SD) responsibility matrices for 

Departmental Offices (DO) and Government-Wide Cash (GWC) Treasury 

Managed Accounts (TMA) in accordance with the policy.

Fiscal Service PCA Due Date: Mar-2021

Page 48 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should oversee the 

recertification process and ensure that access corrections are processed once 

received from the Federal Program Agency (FPA).

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should periodically review 

Fiscal Service management's implementation and operation of the review the 

security audit logs for the UNIX and DB2 servers hosting the Payment 

Information Repository (PIR), Judgment Fund Internet Claim System 

(JFICS), and Secure Payment System (SPS) applications to determine that 

Fiscal Service management completes the reviews on a pre-defined basis, 

documents completion of the reviews and escalations, and maintains such 

documentation.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Fiscal Service management should update mainframe documentation to 

be consistent with Fiscal Service and Treasury Directive Publication (TD P) 

85-01 requirements.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should update UNIX semiannual account review and recertification procedures to include quality 

control steps to validate that systems-management software is generating 

complete and accurate account listings for all UNIX servers and databases 

privileged and non-privileged user accounts within the UNIX environment 

prior to completing the review and recertification process.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop a tailored 

mainframe security software configuration baseline that specifies how 

security configuration options should be set based on the industry guidance. 

As part of this action, management should develop and document a baseline 

specifying for each possible setting in the security software control file how 

the option should be set and who is responsible for approving the setting.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop and document 

controls over changes and monitor update access to all key system datasets.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of Fiscal Service management should develop procedures and 

documentation to establish who is responsible and how effective security is 

achieved for controls.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should establish an effective 

enforcement process or mechanism to ensure that (a) UNIX and DB2 events 

and monitoring controls are followed, and (b) Fiscal Service management 

has confidence it consistently reviews for potential unauthorized or 

inappropriate activity.

Fiscal Service PCA Due Date: Mar-2021

Page 49 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should establish appropriate 

alerts and event thresholds for those mainframe logs required to be evaluated 

by the external tracking tool.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should identify conflicting 

roles and privileges in the Departmental Offices (DO), Government-Wide 

Cash (GWC), and Treasury Managed Accounts (TMA) responsibilities 

matrices that should not be assigned to an Oracle Financials user when 

access is granted and reviewed on an annual basis.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should provide logging and 

monitoring of security related events to include the retention of evidence of 

reviews performed.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should review and re-assess 

each access permission in the mainframe security software dataset and 

resource rules on a periodic basis.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of Fiscal Service management should use the mainframe security 

software configuration baseline to harden the mainframe environment, 

including the Payment Authorization Manager (PAM) and Payments, 

Claims, and Enhanced Reconciliations (PACER) production.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop a baseline of 

essential security settings and specifying that baseline as the standard to be 

observed.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop and document 

controls to prevent unauthorized, unnecessary read access to system datasets 

containing sensitive information.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop and 

implement data and analysis tools and processes for identifying event trends, 

patterns, spikes, and exceptions.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop procedures 

and documentation to establish the following for each dataset permission, 

resource permission, and mainframe security software privilege: (a) 

Responsibility for approving access and enforcing compliance with the 

principle of least privilege; (b) Actual access meets the principle of least 

privilege; and (c) Any discrepancy from approved access will be identified 

and corrected.

Fiscal Service PCA Due Date: Mar-2021

Page 50 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should remove duplicate and 

excessive permissions in the mainframe security software database.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop and document 

controls and baseline documentation of mainframe operating system options 

specified in the configuration files.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should identify non-security 

related purposes for logging and monitoring (including performance tuning, 

problem management, capacity planning, management of service level 

agreements); assign responsibility for addressing them and for integrating 

them with security uses of logging and monitoring.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should implement corrective 

actions to address all vulnerabilities associated with the baseline enforcement 

to include removing the three default user accounts on UNIX servers. 

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should perform an annual 

comparison of each actual setting in the mainframe security software control 

file to each setting specified in the baseline to verify compliance with the 

baseline.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should establish which 

techniques are to be used to control update access to key system datasets and 

to control read access to sensitive system datasets (such as the security 

software database and the page files), whether a third-party tool is to be used, 

or tailored change control mechanisms, and develop procedures and 

documentation to support their use.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should identify the possible 

sources of log information; determine how each is to be used for security 

monitoring; and develop procedures to ensure that each type of logging 

which is necessary for effective security monitoring is activated.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop and document 

procedures for controlling updates to the mainframe security software control 

file.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should annually assess the 

effectiveness of security logging and monitoring, ensuring that the volume of 

logged events is limited to just those that are needed for security, and 

ensuring that monitoring results include effective identification and response 

for any violations and for any significant trends (such as an increase in the 

number of password resets for a given group of users or repetition of the 

same attempted but failed attempt to access a productions dataset or 

resource).

Fiscal Service PCA Due Date: Mar-2021

Page 51 of 67
Report Title Report Number Issue Date Audit Area Treasury OIG Recommendation Bureau/Office Implementation Status

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should provide for annual 

review of all techniques that permit a program to obtain the privileges of the 

operating system.

Fiscal Service PCA Due Date: Mar-2021

FINANCIAL MANAGEMENT: Management 

Report for the Audit of the Department of the 

Treasury's Consolidated Financial Statements 

for Fiscal Years 2019 and 2018

OIG-20-022 12/16/2019 Financial Statements The Bureau of the Fiscal Service management should develop procedures to 

provide assurance that programs installed with the privileges of the operating 

system (whether purchased from software vendors or internally developed) 

do not introduce security weaknesses.

Fiscal Service PCA Due Date: Mar-2021

BILL AND COIN MANUFACTURING: BEP 

Improved Governance and Oversight over 

Note Development and Production But 

Challenges Remain

OIG-20-023 12/31/2019 Administration of 

Program Operations

The Director of the Bureau of Engraving and Printing (BEP) should finalize 

the required 5 year update of the memorandum of understanding (MOU) 

with the Board of Governors of the Federal Reserve System (Board) to 

formalize BEP and the Board's responsibilities and authorities related to 

notes including activities, procedures, and obligations related to the annual 

production, destruction, and research and development of notes.

BEP PCA Due Date: Mar-2021

Page 52 of 67
APPENDIX 3

Good Accounting Obligation in Government Act Report for Fiscal Year 2022 Budget Justification Submission

Implementation Status of Treasury Inspector General for Tax Administration (TIGTA) Recommendations

Report Title Report Number Issue Date Audit Area TIGTA Recommendation Bureau/Office Implementation Status

A Service-Wide Strategy Is Needed To 

Increase Business Tax Return Electronic 

Filing 

2014-40-084 09/24/2014 Administration of 

Program Operations

The Commissioner of the Wage and Investment Division should develop a 

less burdensome electronic signature process for businesses e-filing 

employment tax returns using the MeF system. 

IRS PCA Due Date: Dec-2020

Revising Tax Debt Identification 

Programming And Correcting Procedural 

Errors Could Improve The Tax Refund Offset 

Program

2016-40-028 03/31/2016 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should revise 

computer programming to ensure that credit elects are offset to any associated 

tax debt on the NMF.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Revising Tax Debt Identification 

Programming And Correcting Procedural 

Errors Could Improve The Tax Refund Offset 

Program

2016-40-028 03/31/2016 Tax Administration and 

Compliance

The Deputy Commissioner for Services and Enforcement should revise 

computer programming to use the LLC indicator on the business tax account 

to ensure that individual tax refunds are not offset to the associated LLC's 

business tax debt.

IRS PCA Due Date: Mar-2023

Revising Tax Debt Identification 

Programming And Correcting Procedural 

Errors Could Improve The Tax Refund Offset 

Program

2016-40-028 03/31/2016 Tax Administration and 

Compliance

The Deputy Commissioner for Services and Enforcement should revise 

identification processes to include sole proprietor information from Form SS4 to identify individual tax refunds to offset to business tax debt.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Employees Sometimes Did Not Adhere To EMail Policies Which Increased The Risk Of 

Improper Disclosure Of Taxpayer Information

2017-30-010 10/14/2016 Tax Administration and 

Compliance

The Chief Technology Officer should update the EEFax system to allow 

encrypted messages to be sent to the EEFax system server.

IRS PCA Due Date: Oct-2020

Improvements Are Needed To Ensure That 

Tax Accounts On The Automated Non-Master 

File Are Accurately Processed

2017-40-037 05/25/2017 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should correct 

ANMF programming to compute and assess the Failure to File penalty on 

Form 1040NR, U.S. Nonresident Alien Income Tax Return, accounts in 

which the Taxpayer Identification Number is an Employer Identification 

Number.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Improvements Are Needed To Ensure That 

Tax Accounts On The Automated Non-Master 

File Are Accurately Processed

2017-40-037 05/25/2017 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should Correct 

ANMF programming to use the correct date when computing the Failure to 

Pay penalty. In addition, programming should be corrected to ensure that the 

proper penalty rate is used to compute the penalty amount.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Information Technology: Improvements Are 

Needed In Enterprise-Wide Disaster Recovery 

Planning And Testing

2017-20-024 06/01/2017 Information Technology The Chief Information Officer should collaborate with the IRS business 

operating divisions to reach consensus regarding the maximum tolerable 

downtime or recovery time objective for each mission essential function.

IRS PCA Due Date: Jul-2022

Further Actions Are Needed To Reduce The 

Risk Of Employment Tax Fraud To 

Businesses That Use The Services Of 

Professional Employer Organizations

2017-40-085 09/13/2017 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should establish 

processes and procedures to reduce unnecessary resources expended notifying 

employers of an address change when programming incorrectly identifies an 

address change resulting from minor formatting revisions.

IRS On Hold. Agreed with the 

recommendation but currently on 

hold awaiting input from other 

agencies.

Page 53 of 67
Report Title Report Number Issue Date Audit Area TIGTA Recommendation Bureau/Office Implementation Status

The Internal Revenue Services Is Not In 

Compliance With Federal Requirements For 

Software Asset Management

2017-20-062 09/18/2017 Information Technology The Chief Information Officer should establish executive governance for 

SAM within the IRS which acts as a centralized group to ensure that effective 

and knowledgeable decisions are being made timely by authorized personnel.

IRS PCA Due Date: Sep-2021

Security Over High Value Assets Should Be 

Strengthened

2018-20-029 05/18/2018 Information Technology The Chief Information Officer should implement the OMB CSIP actions to 

identify and document current system hardware components for all IRS 

HVAs.

IRS PCA Due Date: Oct-2021

Active Directory Oversight Needs 

Improvement And Criminal Investigation 

Computer Rooms Lack Minimum Security 

Controls

2018-20-034 06/27/2018 Information Technology The Chief, CI, with assistance from the Chief Information Officer, should 

complete a cost analysis to 1) determine the efficacy of relocating CI assets in 

each of the field offices to existing IRS computer rooms versus upgrading the 

CI computer rooms to ensure that assets are protected in accordance with 

Federal and IRM security requirements and 2) implement the most cost 

effective solution.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

The Internal Revenue Service Lacks A 

Coordinated Strategy To Address Unregulated 

Return Preparer Misconduct

2018-30-042 07/25/2018 Tax Administration and 

Compliance

The Commissioner of the SB/SE Division should establish goals that support 

the Service-wide Return Preparer Strategy being developed by the Deputy 

Commissioner for Services and Enforcement and monitor progress towards 

those goals.

IRS PCA Due Date: Oct-2021

The Internal Revenue Service Lacks A 

Coordinated Strategy To Address Unregulated 

Return Preparer Misconduct

2018-30-042 07/25/2018 Tax Administration and 

Compliance

The Deputy Commissioner for Services and Enforcement should develop a 

preparer misconduct strategy that encourages programs with the authority to 

address preparer misconduct to coordinate with one another to establish 

program goals and track progress towards those goals.

IRS PCA Due Date: Jan-2021

Improved Procedures Are Needed To Prevent 

The Fraudulent Use Of Third-Party 

Authorization Forms To Obtain Taxpayer 

Information

2018-40-062 08/27/2018 Information Technology The Commissioner of the Wage and Investment Division should correspond 

with representatives and designees assigned multiple CAF numbers to inform 

them that they are permitted to have one CAF number per location. The 

correspondence should request a response from each representative and 

designee specifying the CAF number that the IRS should retain. Excess 

numbers should then be removed from the CAF.

IRS PCA Due Date: Dec-2020

Improved Controls Are Needed To Ensure 

That Corrective Actions For Reported 

Information Technology Weaknesses Are 

Documented And Fully Implemented Prior To 

Closure

2018-20-063 09/19/2018 Information Technology The Chief Financial Officer (CFO) should ensure that complete descriptions 

of the specific actions taken to close PCAs are documented on Forms 13872.

IRS PCA Due Date: Nov-2020

Improved Controls Are Needed To Ensure 

That Corrective Actions For Reported 

Information Technology Weaknesses Are 

Documented And Fully Implemented Prior To 

Closure

2018-20-063 09/19/2018 Information Technology The Chief Financial Officer (CFO) should ensure that sufficient supporting 

documentation is uploaded to the JAMES to support PCA closure.

IRS PCA Due Date: Nov-2020

Improved Controls Are Needed To Ensure 

That Corrective Actions For Reported 

Information Technology Weaknesses Are 

Documented And Fully Implemented Prior To 

Closure

2018-20-063 09/19/2018 Information Technology The Chief Financial Officer (CFO) should ensure that the Internal Revenue 

Manual and instructions for Form 13872 are updated so that both the manager 

responsible for implementing the PCA and the executive responsible for the 

PCA are required to approve Form 13872 supporting the PCA's closure.

IRS PCA Due Date: Nov-2020

Controls Continue To Need Improvement To 

Ensure That All Planned Corrective Actions 

For Security Weaknesses Are Fully 

Implemented And Documented

2018-20-066 09/20/2018 Information Technology The Chief Financial Officer should update the Internal Revenue Manual 

(IRM) to broaden the Audit Coordination and OAR offices auditing to include 

reviewing management's corrective actions to ensure that the PCAs are fully 

and appropriately implemented.

IRS PCA Due Date: Nov-2020

Page 54 of 67
Report Title Report Number Issue Date Audit Area TIGTA Recommendation Bureau/Office Implementation Status

Controls Continue To Need Improvement To 

Ensure That All Planned Corrective Actions 

For Security Weaknesses Are Fully 

Implemented And Documented

2018-20-066 09/20/2018 Information Technology The Chief Financial Officer should update the retention period in the IRM for 

maintaining documentation with the JACs to align with the Treasury 

Department's retention period for maintaining supporting documentation in 

the JAMES.

IRS PCA Due Date: Nov-2020

Improvements Are Needed In The 

Withholding Compliance Program

2018-30-072 09/20/2018 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division should 

analyze the current selection criteria used by the WHCS to determine if the 

taxpayers identified for systemic lock-in letter issuance are the best use of 

limited resources. This would include potentially identifying taxpayers with 

multiple years of underwithholding and the percentage of inventory that 

includes nonfilers.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Taxpayers Generally Comply With Annual 

Contribution Limits For 401(K) Plans; 

However, Additional Efforts Could Further 

Improve Compliance

2019-10-002 10/25/2018 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self Employed Division should take 

actions to bring taxpayers who contribute more than the annual limit to 

multiple 401(k) plans into compliance with the law.

IRS PCA Due Date: Oct-2020

The Taxpayer Advocate Service Centralized 

Case Intake Program Needs Improvement To 

Provide Better Customer Service

2019-10-009 10/31/2018 Tax Administration and 

Compliance

The National Taxpayer Advocate should develop and measure progress 

toward specific and quantifiable program goals for the CCI program that 

measure benefits to taxpayers, the TAS, and the IRS, such as increased 

customer satisfaction, reduced direct case time, or other measures of program 

impact.

IRS PCA Due Date: Dec-2020

The Taxpayer Advocate Service Centralized 

Case Intake Program Needs Improvement To 

Provide Better Customer Service

2019-10-009 10/31/2018 Tax Administration and 

Compliance

The Taxpayer Advocate should update Internal Revenue Manual 13.3 and 

provide up-to-date guidance to Wage and Investment (W&I) Division contact 

representatives who staff the NTA toll-free line pertaining to current 

procedures for the CCI program.

IRS PCA Due Date: Dec-2020

Millions Of Dollars In Potentially Erroneous 

Excess Social Security Tax Credit Claims Are 

Not Addressed

2019-40-026 03/15/2019 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division, in 

conjunction with the Commissioner of the Wage and Investment Division, 

should establish a process to send and measure the success associated with 

soft notices that alert individuals to potential errors on their tax return related 

to Excess Social Security Tax Credit claims.

IRS PCA Due Date: Oct-2020

Millions Of Dollars In Potentially Erroneous 

Excess Social Security Tax Credit Claims Are 

Not Addressed

2019-40-026 03/15/2019 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division, in 

conjunction with the Commissioner of the Wage and Investment Division, 

should evaluate current resources expended on the issuance of soft notices to 

ensure that notices are sent to those taxpayers with the highest tax assessment 

potential to maximize the use of limited resources.

IRS PCA Due Date: Oct-2020

Electronic Authentication Security Controls 

Have Improved, But Continued Progress Is 

Needed To Ensure The Protection Of PublicFacing Applications

2019-20-017 04/19/2019 Information Technology The Chief Information Officer should ensure that public-facing legacy 

applications are complying with NIST SP 800-63-3 and that an 

implementation plan includes specific timelines for accomplishing full 

compliance of legacy applications.

IRS PCA Due Date: Feb-2023

Implementation Of The Tax Cuts And Jobs 

Act Deemed Repatriation Tax Presented 

Significant Challenges

2019-34-033 05/22/2019 Administration of 

Program Operations

The Commissioner of the Wage and Investment Division should take steps to 

ensure that Section 965 payments are recorded with the correct designated 

payment code. For instance, develop a report that lists the amount recorded as 

the Section 965 net tax liability and the amount recorded as owed and 

compares the difference between the two amounts to the amount recorded as 

paid.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Software Version Control Management Needs 

Improvement

2019-20-031 06/13/2019 Information Technology The Chief Information Officer should create and execute a plan to periodically 

monitor and compare software running on the enterprise against the 

Enterprise Architecture ESP Product Catalog for accuracy.

IRS PCA Due Date: Oct-2020

Page 55 of 67
Report Title Report Number Issue Date Audit Area TIGTA Recommendation Bureau/Office Implementation Status

Software Version Control Management Needs 

Improvement

2019-20-031 06/13/2019 Information Technology The Chief Information Officer should document and approve risk acceptance 

to continue using older versions of software (i.e., sunset, archived/retired).

IRS PCA Due Date: Oct-2020

Software Version Control Management Needs 

Improvement

2019-20-031 06/13/2019 Information Technology The Chief Information Officer should remove unauthorized software or 

update the ESP Product Catalog to reflect the correct information, if 

warranted.

IRS PCA Due Date: Oct-2020

Additional Actions Are Needed To Reduce 

Alimony Reporting Discrepancies On Income 

Tax Returns

2019-40-048 08/07/2019 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should include the 

validation of the alimony recipient TINs as part of IRS's tax return processing 

systemic TIN validation process. For those TINs identified as not being 

issued by the SSA or the IRS, reject the e-filed tax returns.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Additional Actions Are Needed To Reduce 

Alimony Reporting Discrepancies On Income 

Tax Returns

2019-40-048 08/07/2019 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should modify ERS 

programming to send both e-filed and paper tax returns that contain an invalid 

recipient TIN to the Error Resolution function for review and correspondence 

with the taxpayer.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

The First Phase Of The Data Loss Prevention 

Solution Is Working As Intended, But The 

Remaining Phases Continue To Experience 

Delays

2019-20-049 08/22/2019 Information Technology The Chief Information Officer should deploy the DAR and DIU components 

of the DLP solution.

IRS PCA Due Date: Jun-2021

The First Phase Of The Data Loss Prevention 

Solution Is Working As Intended, But The 

Remaining Phases Continue To Experience 

Delays

2019-20-049 08/22/2019 Information Technology The Chief Information Officer should ensure that project documents are 

prepared and maintained as required for effective project management, which 

should help ensure the successful delivery of the final two components of the 

DLP solution.

IRS PCA Due Date: Oct-2021

Criminal Investigation Should Increase Its 

Role In Enforcement Efforts Against Identity 

Theft

2019-30-047 08/28/2019 Information Technology The Chief, CI, should request that the Director, Modernization Development 

and Delivery, W&I Division, develop a process for transferring taxpayerinitiated cases to STARS for scheme development and CI case consideration.

IRS PCA Due Date: Dec-2020

Fiscal Year 2019 Statutory Review Of 

Disclosure Of Collection Activities On Joint 

Returns

2019-30-059 09/04/2019 Tax Administration and 

Compliance

The Deputy Commissioner for Services and Enforcement should require 

I.R.C. Sections 6103(e)(7) and (e)(8) training for all employees with taxpayer 

contact regarding balance due or collection issues to remind them of the 

requirements to disclose tax return and collection activity on jointly filed 

returns when requested from individuals who are no longer married or no 

longer reside in the same household.

IRS PCA Due Date: Oct-2020

Additional Actions Are Needed To Further 

Reduce Undeliverable Mail

2019-40-074 09/11/2019 Administration of 

Program Operations

The Commissioner of the Wage and Investment Division should install and 

use hygiene software to perfect taxpayer addresses on the Individual Taxpayer 

Identification Number (ITIN) RTS system.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Additional Actions Are Needed To Further 

Reduce Undeliverable Mail

2019-40-074 09/11/2019 Administration of 

Program Operations

The Deputy Commissioner for Services and Enforcement should develop 

Service-wide processes and procedures to ensure that all operating divisions 

suppress the issuance of nonstatutory notices to taxpayers that have a UD mail 

indicator on their account; suppress the issuance of correspondence when a 

taxpayer's address of record is an IRS campus; and research and update 

taxpayer addresses for which the USPS returns undeliverable mail with a 

yellow label that provides a more current address.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Page 56 of 67
Report Title Report Number Issue Date Audit Area TIGTA Recommendation Bureau/Office Implementation Status

The Bring Your Own Device Program'S 

Security Controls Need Improvement

2019-20-046 09/12/2019 Information Technology The Chief Information Officer should ensure the retention of BYOD program 

application audit logs for the appropriate period and periodic review of the 

application audit logs by an independent source.

IRS PCA Due Date: Oct-2021

The Bring Your Own Device Program'S 

Security Controls Need Improvement

2019-20-046 09/12/2019 Information Technology The Chief Information Officer should update BYOD program procedures and 

guidelines to include: (1) Providing malware prevention training to users; (2) 

Updating the documentation for device operating system and technical 

baseline configurations; (3) Maintaining and reviewing application audit logs, 

specifically time frames for each; (4) Clarifying the Computer Security 

Incident Response Center reporting procedures for a lost or stolen device; (5) 

Informing the BYOD program when a device is lost or stolen so that the 

application data are remotely wiped; and (6) Tracking the manual and 

systemic application data wipes by the BYOD program on a periodic basis.

IRS PCA Due Date: Oct-2021

Controls Should Be Strengthened To Ensure 

Timely Resolution Of Information Technology 

Incident Tickets

2019-20-055 09/13/2019 Information Technology The Chief Information Officer should update incident management 

performance goals and renegotiate specific levels of service to better reflect 

current resource allocations.

IRS PCA Due Date: Feb-2021

Controls Should Be Strengthened To Ensure 

Timely Resolution Of Information Technology 

Incident Tickets

2019-20-055 09/13/2019 Information Technology The Chief Information Officer should update incident management 

performance metrics to better align with overall program objectives and 

expanded use in daily operations.

IRS PCA Due Date: Apr-2021

Billions Of Dollars Of Nonfiler Employment 

Taxes Went Unassessed In The Automated 

6020(B) Program Due Primarily To Resource 

Limitations

2019-30-069 09/16/2019 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division should 

consider allocating additional resources to the A6020(b) program, beginning 

with the five FTEs planned for in FY 2020, in conjunction with the SB/SE 

Division Nonfiler Strategic Plan and in consultation with the Nonfiler 

Executive Steering Committee.

IRS PCA Due Date: Nov-2020

Billions Of Dollars Of Nonfiler Employment 

Taxes Went Unassessed In The Automated 

6020(B) Program Due Primarily To Resource 

Limitations

2019-30-069 09/16/2019 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division should 

consider revising the A6020(b) manual case selection criteria to remove the 

upper dollar threshold limit.

IRS PCA Due Date: Nov-2020

Billions Of Dollars Of Nonfiler Employment 

Taxes Went Unassessed In The Automated 

6020(B) Program Due Primarily To Resource 

Limitations

2019-30-069 09/16/2019 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division should 

consider revising the A6020(b) systemic case selection criteria to remove the 

upper dollar threshold limit, revise the case assignment routing order, and 

update the prioritization to focus on the highest dollar cases.

IRS PCA Due Date: Nov-2020

Billions Of Dollars Of Nonfiler Employment 

Taxes Went Unassessed In The Automated 

6020(B) Program Due Primarily To Resource 

Limitations

2019-30-069 09/16/2019 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division should in 

preparation for the FY 2020 resumption of the program, consider transferring 

the highest dollar standalone TDI inventory from the ACS, the Collection 

queue, and Field Collection to be worked by the planned five FTEs in the 

A6020(b) program and continue to transfer higher dollar standalone TDI 

inventory manually to the A6020(b) program until the systemic criteria are 

revised.

IRS PCA Due Date: Nov-2020

Fiscal Year 2019 Statutory Review Of 

Restrictions On Directly Contacting 

Taxpayers

2019-30-076 09/17/2019 Tax Administration and 

Compliance

The Commissioner of the TE/GE Division should reemphasize the importance 

of its examiners following established guidelines and procedures on taxpayer 

representation rights, including enclosure of Publication 1 in correspondence 

and discussing rights during the initial taxpayer interview process.

IRS PCA Due Date: Jan-2021

Page 57 of 67
Report Title Report Number Issue Date Audit Area TIGTA Recommendation Bureau/Office Implementation Status

Fiscal Year 2019 Statutory Review Of 

Restrictions On Directly Contacting 

Taxpayers

2019-30-076 09/17/2019 Tax Administration and 

Compliance

The Commissioner of the TE/GE Division should update guidance to 

employees that clarifies the applicability of I.R.C. Sections 7521(b)(2) and (c) 

and develop training materials, specific to their casework, to emphasize the 

importance of protecting taxpayers' right to representation, and designate to 

whom group managers should report cases with potential violations.

IRS PCA Due Date: Jan-2021

Fiscal Year 2019 Statutory Review Of 

Compliance With Legal Guidelines When 

Issuing Levies

2019-30-070 09/19/2019 Tax Administration and 

Compliance

The Director of Collection within the Small Business/Self-Employed Division 

should determine the cause and take the appropriate corrective action(s) to 

ensure that the ACS system does not issue levies on taxpayers without a CDP 

notice.

IRS PCA Due Date: Jan-2021

Fiscal Year 2019 Statutory Review Of 

Compliance With Legal Guidelines When 

Issuing Levies

2019-30-070 09/19/2019 Tax Administration and 

Compliance

The Director of Collection within the Small Business/Self-Employed Division 

should ensure that corrective programming changes are implemented to 

effectively prevent employees from incorrectly identifying disqualified 

employment tax levies.

IRS PCA Due Date: Mar-2021

Fiscal Year 2019 Statutory Review Of 

Compliance With Legal Guidelines When 

Issuing Levies

2019-30-070 09/19/2019 Tax Administration and 

Compliance

The Director of Collection within the Small Business/Self-Employed Division 

should ensure that corrective programming is implemented so that CDP 

notices are issued for Federal contractor levies that are full paid after the levy 

issuance.

IRS PCA Due Date: Sep-2021

Some Components Of The Privacy Program 

Are Effective; However, Improvements Are 

Needed

2019-20-062 09/20/2019 Administration of 

Program Operations

The Chief Information Officer should implement a fully integrated 

information security continuous monitoring process that includes privacy 

risks.

IRS PCA Due Date: Jul-2021

Some Components Of The Privacy Program 

Are Effective; However, Improvements Are 

Needed

2019-20-062 09/20/2019 Administration of 

Program Operations

The Chief Privacy Officer should ensure that the PGLD office makes 

completion of PIAMS training courses mandatory for preparers of rejected 

PCLIAs.

IRS PCA Due Date: Nov-2020

Some Components Of The Privacy Program 

Are Effective; However, Improvements Are 

Needed

2019-20-062 09/20/2019 Administration of 

Program Operations

The Chief Privacy Officer should ensure that the PGLD office updates and 

maintains PIAMS training courses to capture PIAMS enhancements.

IRS PCA Due Date: Nov-2020

Processes Do Not Adequately Reduce The 

Risk That Outside Employment Activities 

Will Conflict With Employees' Official Duties

2019-10-080 09/25/2019 Administration of 

Program Operations

The Director of the Workforce Relations Division should revise internal 

outside employment guidelines to require employees to resubmit their outside 

employment requests at least annually and modify the OES to allow for the 

systemic closure of all requests for which a renewal was not timely received. 

OES modifications should include the ability to notify any employees whose 

request was closed. 

IRS PCA Due Date: Sep-2021

Processes Do Not Adequately Reduce The 

Risk That Outside Employment Activities 

Will Conflict With Employees' Official Duties

2019-10-080 09/25/2019 Administration of 

Program Operations

The Director of the Workforce Relations Division should work with the IRS 

Information Technology organization to create a plan for housing the OES or 

to create a new database to ensure that outside employment requests are 

tracked after the Totally Automated Personnel System is shut down. 

IRS PCA Due Date: Sep-2021

Processes And Procedures For Rehiring 

Employees With Prior Conduct Or 

Performance Issues Were Implemented But 

Not Always Followed 

2019-10-081 09/25/2019 Administration of 

Program Operations

The Human Capital Officer should update the Internal Revenue Manual to 

require Employment Talent and Security staff to review all Automated Labor 

and Employee Relations Tracking System (ALERTS) issues in the hiring tool, 

not just those within the past six years.

IRS PCA Due Date: Jan-2021

Millions Of Dollars In Potentially Erroneous 

Qualified Plug-In Electric Drive Motor 

Vehicle Credits Continue To Be Claimed 

Using Ineligible Vehicles

2019-30-072 09/30/2019 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division should use 

VINs provided by taxpayers on their tax returns and readily available third 

party VIN information to identify taxpayers who are claiming the credit for 

nonqualifying vehicles, using the same VIN to obtain the credit more than 

once, using invalid VINs, and using VINs associated to previously leased 

vehicles.

IRS PCA Due Date: Nov-2020

Page 58 of 67
Report Title Report Number Issue Date Audit Area TIGTA Recommendation Bureau/Office Implementation Status

Millions Of Dollars In Potentially Erroneous 

Qualified Plug-In Electric Drive Motor 

Vehicle Credits Continue To Be Claimed 

Using Ineligible Vehicles

2019-30-072 09/30/2019 Tax Administration and 

Compliance

The Commissioner of the Small Business/Self-Employed Division should 

develop a compliance program to address the taxpayers who appear to have 

erroneously received the Plug-In Credit by using a VIN associated to a 

nonqualifying vehicle, using the same VIN more than once, using an invalid 

VIN, using VINs associated with previously leased vehicles, or claiming a 

credit above allowable thresholds (including the 68 taxpayers identified in this 

report).

IRS PCA Due Date: Feb-2021

Many Organizations Are Not Notifying The 

Internal Revenue Service Of Their Intent To 

Operate Under Internal Revenue Service Code 

Section 501(C)(4) As Required By Law

2020-10-001 01/06/2020 Tax Administration and 

Compliance

The Director of the EO function should revise the Computer Paragraph 120 

Notice to include information about the Form 8976 notification requirement 

and the Form 1024-A application for I.R.C. Section 501(c)(4) organizations.

IRS PCA Due Date: Apr-2021

Many Organizations Are Not Notifying The 

Internal Revenue Service Of Their Intent To 

Operate Under Internal Revenue Service Code 

Section 501(C)(4) As Required By Law

2020-10-001 01/06/2020 Tax Administration and 

Compliance

The Director of the EO function should update EO function examination 

procedures to include ensuring that I.R.C. Section 501(c)(4) organizations 

have met their Form 8976 notification requirement and assessing penalties 

against responsible officials when appropriate.

IRS PCA Due Date: Mar-2021

Many Organizations Are Not Notifying The 

Internal Revenue Service Of Their Intent To 

Operate Under Internal Revenue Service Code 

Section 501(C)(4) As Required By Law

2020-10-001 01/06/2020 Tax Administration and 

Compliance

The Director of the EO function should update procedures to ensure that 

Determinations Unit tax examiners do not include conflicting information in 

notices when the filer is informed about why a Form 8976 was rejected, e.g., 

develop additional standard paragraphs that would eliminate possible 

confusion.

IRS PCA Due Date: Mar-2021

Many Organizations Are Not Notifying The 

Internal Revenue Service Of Their Intent To 

Operate Under Internal Revenue Service Code 

Section 501(C)(4) As Required By Law

2020-10-001 01/06/2020 Tax Administration and 

Compliance

The Director of the EO function should use internal sources of information, 

e.g., applications for tax-exempt status filed after July 8, 2016, to assist with 

detecting I.R.C. Section 501(c)(4) organizations that have not filed Forms 

8976 and update EO function Determinations Unit procedures to include 

verifying that I.R.C. Section 501(c)(4) organizations have met their Form 

8976 notification requirement when processing applications for tax exempt 

status. In addition, develop a process for notifying identified Form 8976 

nonfiler organizations about this requirement to bring them into compliance.

IRS PCA Due Date: Mar-2021

Results Of The 2019 Filing Season 2020-44-007 01/22/2020 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should correct 

programming to no longer reject tax returns with a blank or zero amount on 

the Other Adjustments Statement.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Results Of The 2019 Filing Season 2020-44-007 01/22/2020 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should create a 

business rule to reject tax returns when a casualty and theft loss deduction is 

included on Schedule A and Form 4684 does not include the required FEMA 

disaster declaration number.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Results Of The 2019 Filing Season 2020-44-007 01/22/2020 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should implement 

programming to compute the correct allowable increase in the standard 

deduction for tax returns for which a taxpayer does not have an entry for the 

spouse but checks one or more of the checkboxes that indicate that the spouse 

was age 65 or older and/or was blind.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Page 59 of 67
Report Title Report Number Issue Date Audit Area TIGTA Recommendation Bureau/Office Implementation Status

Results Of The 2019 Filing Season 2020-44-007 01/22/2020 Tax Administration and 

Compliance

The Commissioner of the Wage and Investment Division should implement 

programming to reject tax returns with claims for the CTC and/or ACTC 

when the child claimed has an ATIN or ITIN. In addition, ensure that 

programming is corrected to reject tax returns with claims for the ACTC that 

exceed the statutory limit of $1,400 per child.

IRS On Hold. Agreed with the 

recommendation. Due to 

funding constraints, the 

recommendation is put on hold.

Page 60 of 67
APPENDIX 4

Good Accounting Obligation in Government (GAO-IG) Act Report for Fiscal Year 2022 Budget Justification Submission

Reconciliation with Treasury IGs' Semi-annual Report (SAR) to Congress

GAO-IG Act Report SAR (September, 2020 issue)

Reporting Criteria As required by the GAO-IG Act, this report includes recommendations 

that remained unimplemented for one year or more from the budget 

justification submission date. This date for the fiscal year 2022 budget 

is estimated at 1/31/2021, therefore this report includes 

recommendations that remained unimplemented since their issuance on 

or before 1/31/2020.

As required by the Inspector General Empowerment Act of 2016, SAR 

includes recommendations that remained unimplemented for six months or 

more from the SAR reporting end date. The September 2020 SAR had a 

reporting end date of 9/30/2020, and therefore includes recommendations 

that remained unimplemented since their issuance on or before 3/31/2020.

System of Records Treasury’s Joint Audit Management Enterprise System Treasury’s Joint Audit Management Enterprise System 

OIG A total of 105 recommendations with unimplemented, and implemented 

and awaiting auditor verification

A total of 129 unimplemented recommendations 

TIGTA A total of 68 unimplemented recommendations A total of 157 unimplemented recommendations 

Page 61 of 67
Appendix A: Glossary of Abbreviations

Abbreviation Description

ACA Affordable Care Act 

ACS Automated Collection System 

ACTC Additional Child Tax Credit

AEHR All Events History Report 

AFR Agency Financial Report

AMC Audit Management Checklist 

AMS Account Management Services

ANMF Automated Non-Master File

AO Approving Official 

AOTC American Opportunity Tax Credit

APMA Advance Pricing and Mutual Agreement Program

ARC Administrative Resource Center

A-SCM Attachment A-Security Control Matrix 

ASFR Automated Substitute For Return 

ASM Assistant Secretary for Management

ATAT Abusive Tax Avoidance Transactions 

ATIN Adoption Taxpayer Identification Number

ATO Authority to Operate

BEP Bureau of Engraving and Printing

BLSR Service Baseline Security Requirements 

BOD Business Operating Division

BSA Bank Secrecy Act

BSA/AML Bank Secrecy Act/Anti-Money Laundering 

BSAAG Bank Secrecy Act Advisory Group

BYOD Bring Your Own Device

CAF Centralized Authorization File 

CAP Compliance Assurance Process

CCB Change Control Board 

CCI Centralized Case Intake

CDFI Community Development Financial Institutions 

CDP Collection Due Process

CFIUS Committee on Foreign Investment in the United States

CFO Chief Financial Officer

CFS Consolidated Financial Statements of the U.S. Government 

CFTC Commodity Futures Trading Commission 

CI Criminal Investigation

CIO Chief Information Officer

CIR Collections Information Repository

CJ Congressional Justification

CMS Centers for Medicare & Medicaid Services

CO Certifying Officer

COTR Contracting Officer's Technical Representative 

CSIP Cybersecurity Strategy and Implementation Plan 

CSR Customer Service Representatives

CTC Child Tax Credit

DAIMS DATA Act Information Model Schema

DAR Data-at-Rest

DASHR/CHCO Deputy Assistant Secretary for Human Resources and Chief Human Capital Officer

Page 62 of 67
Abbreviation Description

DATA Act Digital Accountability And Transparency Act

DC Defined Contribution

DCA Georgia Department of Community Affairs

DCAA Defense Contract Audit Agency

DCFO Deputy Chief Financial Officer 

DCOI Data Center Optimization Initiative

DHS Department of Homeland Security

DIU Data-in-Use

DLP Data Loss Prevention

DO Treasury Departmental Offices

Dodd-Frank Act Dodd-Frank Wall Street Reform and Consumer Protection Act

DOL Department of Labor

E OPF electronic Official Personnel Folders

EA Enterprise Architecture 

EEFax Enterprise e-Fax 

EGRPRA Economic Growth and Regulatory Paperwork Reduction Act

EIN Employer Identification Number

EITC Earned Income Tax Credit

EITI Enterprise Information Technology Infrastructure 

ELC Enterprise Life Cycle

EO Exempt Organizations

EPA Environmental Protection Agency

ESP Enterprise Standards Profile

EUSS End User Systems and Services 

FA Financial Assistance 

FAA Federal Agency Agreement 

FABS Financial Assistance Broker Submission

FARS Treasury-wide Financial Analysis and Reporting System 

FATCA Foreign Account Tax Compliance Act 

FATF Financial Action Task Force

FBAR Report of Foreign Bank and Financial Accounts 

FCD-1 Federal Continuity Directive - 1 

FDIC Federal Deposit Insurance Corporation

FEMA Federal Emergency Management Agency

FFATA Federal Funding Accountability and Transparency Act 

FFI Foreign Financial Institution

FinCEN Financial Crimes Enforcement Network

Fiscal Service Bureau of the Fiscal Service

FISMA Federal Information Security Modernization Act 

FITARA Federal Information Technology Acquisition Reform Act

FMSS Facilities Management and Support Services

FMU Financial Market Utility

FMV Fair Market Value

FPA Federal Program Agency 

FPDS-NG Federal Procurement Data System-Next Generation 

FSOC Financial Stability Oversight Council

FTC Federal Trade Commission 

FTE Full-Time Equivalents

FUTA Federal Unemployment Tax Act 

GAAP Generally Accepted Accounting Principles

Page 63 of 67
Abbreviation Description

GAO U.S. Government Accountability Office

GPC Government Purchase Card 

GPRA Government Performance and Results Act

GPRAMA GPRA Modernization Act

GSA General Services Administration

GSS General Support System

GWC Government-Wide Cash

HAMP Home Affordable Modification Program 

HCTC Health Coverage Tax Credit 

HFA Housing Finance Agency

HHS Department of Health and Human Services

HUD Department of Housing and Urban Development 

HVA High Value Assets

IC Intelligence Community

IC PKI Intelligence Community Public Key Infrastructure 

ICMM International Compliance Management Model

ICO Input Correction Operation

ICT Image Control Team

IDD Interface Definition Document

IDRS Integrated Data Retrieval System 

IDS Inventory Delivery System 

IDT Identity Theft

IG Inspector General

IGA Intergovernmental Agreement 

IMF Individual Master File 

IP PIN Identity Protection Personal Identification Numbers

IPIA Improper Payments Information Act 

IRA Individual Retirement Account

IRC Internal Revenue Code

IRM Information Resources Management 

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISAC Information Sharing and Analysis Center 

ISCP Information System Contingency Plan

ISRP Integrated Submission and Remittance Processing 

ISS Publication Information System Security 

ISSO Information System Security Office 

IT Information Technology

ITIN Individual Taxpayer Identification Number 

JAC JAMES Audit Coordinator

JAMES Joint Audit Management Enterprise System

JFICS Judgment Fund Internet Claim System 

KISAM Knowledge Incident/Problem Service Asset Management 

KISAM-AM Knowledge Incident Problem Service Asset Management - Asset Management (module) 

LAN Local Area Network

LB&I Large Business and International division

LBS Large Bank Supervision

LDAP Lightweight Directory Access Protocol 

LDC Lead Development Center 

LEP Limited-English proficiency

Page 64 of 67
Abbreviation Description

LIHTC Low-Income Housing Tax Credit

LLC Limited Liability Company

LPTS Linguistics, Policy, Tools, & Services 

MAP Mutual Agreement Procedure

MeF Modernized e-File processing system

MHA Making Home Affordable 

Mint The United States Mint

MOU Memorandum of Understanding 

MSSS Mainframes and Servers Services and Support 

MYIP Multiyear Implementation Plan

NAP National Account Profile

NFA National Futures Association 

NIST National Institute of Standards and Technology

NIST SP National Institute of Standards and Technology Special Publication

NMF Non–Master File system

NMTC New Markets Tax Credit

NRC Nuclear Regulatory Commission

NRP National Research Program 

NSS National Security Systems

NTA National Taxpayer Advocate

NTRCP National Tip Reporting Compliance Program

OAR Outreach, Assessment, and Reporting

OBT Office of Budget and Travel

OCC Office of the Comptroller of the Currency

OES Outside Employment System

OFAC Office of Foreign Assets Control 

OFR Office of Financial Research

OIA Office of Intelligence and Analysis

OIG Office of the Inspector General

OLS Office of Online Services

OMB Office of Management and Budget

OPM Office of Personnel Management

OSP Office of Security Program

OSSP Office of Special Security Programs 

P&E Property and Equipment 

PAC Program Action Case

PACER Payments, Claims, and Enhanced Reconciliations 

PAM Payment Authorization Manager 

PBGC Pension Benefit Guaranty Corporation 

PCA Planned Corrective Action

PCLIA Privacy and Civil Liberties Impact Assessment

PDC Private Debt Collection

PDS Personal Identity Verification Data Synchronization

PGLD Privacy, Governmental Liaison and Disclosure

PIAMS Privacy Impact Assessment Management System

PII Personally Identifiable Information

PIR Payment Information Repository 

PMO Program Management Office 

PN Plan Number

POA&M Plan of Action and Milestones

Page 65 of 67
Abbreviation Description

PPACA Patient Protection and Affordable Care Act

PRISM Preparer Risk Identification and Selection Model 

PTC Premium Tax Credit

PVS Processing Validation Section

QRM Qualified Residential Mortgage

RAAS Research, Applied Analytics, And Statistics

Recovery Act American Recovery and Reinvestment Act

RESTORE Act Resources and Ecosystems Sustainability, Tourist Opportunities, and Revived Economies of the Gulf 

Coast States Act

RFA Regulatory Flexibility Act

RICS Return Inventory Classification System 

ROI Return On Investment

RRP Return Review Program

RSN Refund Schedule Number 

RTS Real-Time System

SA&A Security Assessment and Authorization

SAM System for Award Management 

SAM Software Asset Management

SAO Senior Accountable Official 

SAR Semi-annual Report to Congress

SB/SE Small Business/Self-Employed division

SBA Small Business Administration

SBU Sensitive But Unclassified

SCC Sector Coordinating Council

SCC IRS Service Center Campus

SCRO Security Regulatory Compliance Operations

SD Segregation of Duties 

SLA Service Level Agreement

SOP Standard Operating Procedures

SPS Secure Payment System 

SRO Self-Regulatory Organization 

SSA Social Security Administration

SSN Social Security Numbers

SSP System Security Plan

STARS Scheme Tracking and Referral System

TAS Taxpayer Advocate Service 

TCIS Treasury Check Information System

TD P Treasury Directive Publication

TDI Taxpayer Delinquency Investigation

TDP Testing Designated Position

TE/GE Tax Exempt and Government Entities

TFFC Office of Terrorist Financing and Financial Crimes

TFI Office of Terrorism and Financial Intelligence

TIER Treasury Information Executive Repository 

TIGTA Treasury Inspector General for Tax Administration

TIN Taxpayer Identification Number

TMA Treasury Managed Accounts 

TSS Telecommunications Systems and Support 

TWAI Treasury Web Application Infrastructure 

UD Undelivered

Page 66 of 67
Abbreviation Description

UIL Uniform Issue List 

UPS U.S. Persons

USCA U.S. Competent Authority

USPS United States Postal Service

UWR Unified Work Request

VA Department of Veterans Affairs

VIN Vehicle Identification Number

VITA Volunteer Income Tax Assistance 

W&I Wage and Investment

WAN Wide Area Network

WebTA Web Time and Attendance

WHCS Withholding Compliance System

WRMS Work Request Management System 

Page 67 of 67