The IRS balanced measurement system measures customer satisfaction, business results, and employee satisfaction. IRS management is using surveys as the measurement of taxpayers opinions on service provided. Eight surveys involve FTI data that the vendor receives from the IRS and forwards to one of its subcontractors to generate the survey samples. In Calendar Year 1999, the vendor received slightly less than 1 million taxpayer records from the IRS to be processed for the customer satisfaction surveys. Due to the private and personal nature of the FTI, Internal Revenue Code 6103 requires the data to be protected from unauthorized disclosure.
Unauthorized disclosure is subject to both civil and criminal penalties.
We reviewed six key security processes that covered physical and logical accesses, hiring and termination procedures, security awareness, and contingency planning. Three of the security processes were adequate, while the remaining three need to be improved. The vendor and its subcontractors were not meeting some of the security requirements in the contract and the IRS had not conducted a review of the safeguard measures employed by the vendor and its subcontractors. Although there were security weaknesses, the audit found no evidence of improper disclosure of FTI by the vendor or its subcontractors. We identified three security controls that need to be enhanced to ensure the protection of FTI from unauthorized disclosure during the survey process.