Internal Revenue Service: Status of GAO Financial Audit and Related Financial Management Report Recommendations
Published: 2011-06-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In its role as the nation's tax collector, the Internal Revenue Service (IRS) has a demanding responsibility to annually collect trillions of dollars in taxes, process hundreds of millions of tax and information returns, and enforce the nation's tax laws. Since its first audit of IRS's financial statements in fiscal year 1992, GAO has identified a number of weaknesses in IRS's financial management operations. In related reports, GAO has recommended corrective actions to address those weaknesses. Each year, as part of the annual audit of IRS's financial statements, GAO makes recommendations to address any new weaknesses identified and follows up on the status of IRS's efforts to address the weaknesses GAO identified in previous years' audits. The purpose of this report is to (1) provide an overview of the financial management challenges still facing IRS, (2) provide the status of financial audit and financial management-related recommendations and the actions needed to address them, and (3) highlight the relationship between GAO's recommendations and internal control activities central to IRS's mission and goals.
section_title: What GAO Found
paragraphs: IRS has made progress in improving its internal controls and financial management since its first financial statement audit in 1992, as evidenced by 11 consecutive years of clean audit opinions on its financial statements, the resolution of several material internal control weaknesses, and actions resulting in the closure of nearly 300 financial management recommendations. This progress has been the result of hard work throughout IRS and sustained commitment at the top levels of the agency. However, IRS still faces significant financial management challenges in (1) resolving its remaining material weaknesses and significant deficiency in internal control, (2) developing outcome-oriented performance metrics, and (3) correcting numerous other internal control issues, especially those relating to safeguarding tax receipts and taxpayer information. At the beginning of GAO's audit of IRS's fiscal year 2010 financial statements, 85 financial management-related recommendations from prior audits remained open because IRS had not fully addressed the underlying issues. During the fiscal year 2010 financial audit, IRS took actions that GAO considered sufficient to close 37 recommendations. At the same time, GAO identified additional internal control issues resulting in 29 new recommendations. In total, 77 recommendations remain open. To assist IRS in evaluating and improving internal controls, GAO categorized the 77 open recommendations by various internal control activities, which, in turn, were grouped into three broad control categories. The continued existence of internal control weaknesses that gave rise to these recommendations represents a serious obstacle for IRS. Effective implementation of GAO's recommendations can greatly assist IRS in improving its internal controls and achieving sound financial management, which are integral to effectively carrying out its tax administration responsibilities. Most recommendations can be addressed within the next year or two. However, a few recommendations, particularly those concerning the functionality of IRS's automated systems, are complex and will require several more years to effectively address.
section_title: What GAO Recommends
paragraphs: GAO is not making any recommendations in this report. In commenting on a draft of this report, IRS stated that it is committed to implementing appropriate improvements to maintain sound financial management practices.

section_title: Letter
paragraphs: In its role as the nation’s tax collector, the Internal Revenue Service (IRS)  has a demanding responsibility to collect taxes, process tax returns, and  enforce the nation’s tax laws. In fiscal year 2010, IRS collected about   $2.3 trillion in tax payments, processed hundreds of millions of tax and  information returns, and paid nearly $470 billion in refunds to taxpayers.  Because of its role and overall mission, IRS’s activities affect virtually all  of the nation’s citizens. It is therefore critical that the agency strive to  maintain sound internal control and financial management practices.
IRS has made much progress in improving its financial management since  it was first required to prepare a set of financial statements nearly two  decades ago. This progress is reflected in IRS’s 11-year record of clean  audit opinions on its financial statements and correcting several material  weaknesses and significant deficiencies in internal controls over the  years. At the same time, IRS continues to face significant financial  management challenges in achieving the overarching goals of effective  federal financial management—accountability and useful management  information. To enable more effective financial and operational  management, IRS needs to (1) address its remaining material weaknesses  and its significant deficiency in internal control, (2) develop performance  metrics that will enhance its ability to manage for outcomes, and   (3) implement corrective actions to address other identified internal  control issues.
An agency’s internal control serves as the first line of defense in  safeguarding its assets and in preventing and detecting errors and fraud, as  well as in helping to effectively manage its stewardship over public  resources. For many years, IRS has had weaknesses in internal controls  over fundamental elements of its operations that leave it vulnerable to a  greater risk of fraud, waste, abuse, and mismanagement. During our audit  of IRS’s fiscal year 2010 financial statements, we found that IRS  continued to be challenged with two long-standing material weaknesses i internal control that are at the heart of its operations—weaknesses in   and over information  internal controls over unpaid tax assessments systems security. We also found that IRS had a new significant defici in internal control over tax refund disbursements. In addition, as in pas years, IRS management faces a challenge in enhancing and using its  financial management capabilities to develop and use outcome-oriented  performance metrics critical to providing the foundation upon which an  agency can manage its operations for outcomes. Finally, we identified  other internal control issues that need management attention, in particular  several that relate to safeguarding tax receipts and taxpayer information.
To assist IRS in strengthening its internal controls and improving its  operations, over the years we have made numerous recommendations as  part of our annual financial statement audits and other financial  management–related work at IRS. This report (1) provides an overview of  financial management challenges still facing IRS; (2) describes the status  of financial audit and financial management–related recommendations and  the actions needed to address them, as summarized in appendix I; and   (3) discusses how the unresolved recommendations relate to control  activities central to IRS’s mission and goals. To assist IRS in addressing  those control activities, appendix II provides summary information  regarding the primary internal control issue to which each open  recommendation is related. This report does not include our  recommendations related to IRS’s information systems security even  though they also are the result of our annual financial audits and are  financial management–related; those recommendations are reported  separately because of the sensitive nature of many of the issues that give  rise to the recommendations. We are not making any new  recommendations in this report.
subsections: section_title: Background
paragraphs: Internal control is not one event, but a series of activities that occur  throughout an entity’s operations and on an ongoing basis. Internal control  should be an integral part of each system that management uses to  regulate and guide its operations rather than as a separate system within  an agency. In this sense, internal control is management control that is  built into the entity as a part of its infrastructure to help managers run the  entity and achieve their goals on an ongoing basis.
Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the  Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires  agencies to establish and maintain effective internal control. The agency  head must annually evaluate and report on the control and financial  systems that protect the integrity of its federal programs. The  requirements of FMFIA serve as an umbrella under which other reviews,  evaluations, and audits should be coordinated and considered to support  management’s assertion about the effectiveness of internal control over  operations, financial reporting, and compliance with laws and regulations.
Office of Management and Budget (OMB) Circular No. A-123,  Management’s Responsibility for Internal Control, provides the  implementing guidance for FMFIA, and prescribes the specific  requirements for assessing and reporting on internal controls consistent  with the Standards for Internal Control in the Federal Government  (internal control standards) issued by the Comptroller General of the  United States. The circular defines management’s responsibilities related  to internal control and the process for assessing internal control  effectiveness, and provides specific requirements for conducting  management’s assessment of the effectiveness of internal control over  financial reporting. The circular requires management to annually provide  assurances on internal control and emphasizes the need for integrated and  coordinated internal control assessments that synchronize all internal  control–related activities.
FMFIA requires GAO to issue standards for internal control in the federal  government. The internal control standards provide the overall framework  for establishing and maintaining effective internal control and for  identifying and addressing major performance and management  challenges and areas at greatest risk of fraud, waste, abuse, and  mismanagement.
As summarized in the internal control standards, internal control in the  government is defined by the following five elements, which also provide  the basis against which internal controls are to be evaluated:    Control environment: Management and employees should establish  and maintain an environment throughout the organization that sets a  positive and supportive attitude toward internal control and  conscientious management.
Risk assessment: Internal control should provide for an assessment of  the risks the agency faces from both external and internal sources.
Control activities: Internal control activities help ensure that  management’s directives are carried out. The control activities should  be effective and efficient in accomplishing the agency’s control  objectives.
Information and communication: Information should be recorded  and communicated to management and others within the entity who  need it and in a form and within a time frame that enables them to  carry out their internal control and other responsibilities.
Monitoring: Internal control monitoring should assess the quality of  performance over time and ensure that the findings of audits and other  reviews are promptly resolved.
A key objective in our annual audits of IRS’s financial statements is to  obtain reasonable assurance that IRS maintained effective internal control  with respect to financial reporting. While we use all five elements of  internal control as a basis for evaluating the effectiveness of IRS’s internal  controls, our ongoing evaluations and tests have focused heavily on  control activities, where we have identified numerous internal control  weaknesses and have provided recommendations for corrective action.  Control activities are the policies, procedures, techniques, and  mechanisms that enforce management’s directives. In other words, they  are the activities conducted in the everyday course of business that are  intended to accomplish a control objective, such as ensuring IRS  employees successfully complete background checks prior to being  granted access to taxpayer information and receipts. Control activities are  an integral part of an entity’s planning, implementing, reviewing, and  accountability for stewardship of government resources and achievement  of effective results.
section_title: Scope and Methodology
paragraphs: To accomplish our objectives, we evaluated the effectiveness of corrective  actions IRS implemented during fiscal year 2010 in response to open  recommendations as part of our fiscal years 2010 and 2009 financial audits.  To determine the current status of the recommendations, we (1) obtained  IRS’s reported status of each recommendation and corrective action taken  or planned as of March 2011, (2) compared IRS’s reported status to our  fiscal year 2010 audit findings to identify any differences between IRS’s  and our conclusions regarding the status of each recommendation, and   (3) performed additional follow-up work to assess IRS’s actions taken to  address the open recommendations. For our recommendations to IRS  regarding information security, this report includes only summary data on  the number of those recommendations and their general makeup. Because  of the sensitive nature of many of the issues related to our  recommendations regarding information security, we have reported our  recommendations for corrective action to IRS separately.
In order to determine how IRS’s open recommendations, including those  identified in our June 2011 management report, fit within the agency’s  management and internal control structure, we compared the open  recommendations and the issues that gave rise to them to the (1) control  activities listed in the internal control standards, (2) list of major factors  and examples outlined in our Internal Control Management and Evaluation  Tool, and (3) criteria and objectives for federal financial management as  discussed in the Chief Financial Officers Act of 1990 Federal Accounting Standards Advisory Board’s (FASAB) Statement of  Federal Financial Accounting Concepts No. 1, Objectives of Federal  Financial Reporting. We also considered whether IRS had addressed, in  whole or in part, the underlying control issues that gave rise to the  recommendations; and other legal requirements and implementing  guidance, such as OMB Circular No. A-123 and FMFIA.  (CFO Act) and the  Our work was performed from December 2010 through April 2011 in  accordance with generally accepted government auditing standards.
section_title: IRS Faces Significant Financial Management Challenges
paragraphs: IRS continues to make progress in resolving its internal control  weaknesses and addressing outstanding recommendations, but it still  faces significant financial management challenges. Since we first began  auditing IRS’s financial statements in fiscal year 1992, IRS has taken a  significant number of actions that enabled us to conclude that it had  effectively resolved several material weaknesses and significant  deficiencies and to close almost 300 of our previously reported financial  management–related recommendations. This includes 37  recommendations we are closing with this report based on actions IRS  took through March 2011.
Nevertheless, IRS continues to face challenges in improving the  effectiveness of its financial and operational management. Specifically,  IRS continues to face management challenges in (1) resolving its two  material weaknesses and one significant deficiency in internal control,   (2) developing performance measures and managing for outcomes, and   (3) addressing its remaining internal control issues, particularly those  dealing with safeguarding of taxpayer receipts and information. Further,  as in previous years’ audits, our fiscal year 2010 audit continued to identify  additional internal control issues, resulting in 29 new recommendations  for corrective action. These issues are discussed in detail in our June 2011  management report to IRS. In addition, as noted earlier, we also  identified numerous issues related to information security during our  fiscal year 2010 audit that we reported separately because of the sensitive  nature of many of those issues.
We have made numerous recommendations to IRS over the years— including new recommendations resulting from our fiscal year 2010  financial audit—to address the issues comprising these weaknesses in  internal control. Successfully implementing these recommendations would  assist IRS in fully resolving these weaknesses. To its credit, IRS continues  to work to address the issues underlying these and other internal control  weaknesses.
subsections: section_title: Challenges in Resolving Two Long-standing Material Weaknesses and One Significant Deficiency in Internal Control
paragraphs: As we reported in our audit of IRS’s fiscal year 2010 financial statements,  IRS continues to face significant challenges in resolving its two remaining  long-standing material weaknesses in internal control concerning   (1) unpaid tax assessments and (2) information security.
IRS’s continuing challenge in addressing its material weakness in internal  control over unpaid tax assessments results from its (1) inability to use its  general ledger and underlying subsidiary records to report federal taxes  receivable, compliance assessments, and writeoffs in accordance with  federal accounting standards without significant compensating  procedures; (2) lack of transaction traceability for the reported balance in  taxes receivable that comprises over 80 percent of IRS’s total assets as of  September 30, 2010, and an effective transaction-based subledger for  unpaid tax assessment transactions; and (3) inability to effectively prevent  or timely detect and correct errors in taxpayer accounts. These control  deficiencies are caused primarily by IRS’s continued reliance on software  applications that were not designed to provide the accurate, complete, and  timely transaction-level financial information that management needs to  make well-informed decisions or to accumulate and report financial  information in accordance with federal accounting standards. These  problems are likely to continue to exist until these software applications  are either significantly enhanced or replaced. Successfully addressing  these issues is vital and is one of the goals of IRS’s ongoing   systems-modernization effort.
IRS’s continuing challenge in addressing its material weakness in internal  control over the management of information systems security is primarily  due to IRS not having fully implemented key components of its  information security program. Although IRS has processes in place  intended to monitor and assess its internal controls, these processes were  not always effective. For example, (1) IRS’s testing did not detect many of  the vulnerabilities we identified and did not assess a key application in its  current environment, and (2) IRS had not effectively validated corrective  actions reported to resolve previously identified weaknesses. As we  reported in our audit of IRS’s fiscal year 2010 financial statements, IRS  has made progress in addressing numerous weaknesses in information  security internal control. However, many of the weaknesses we reported  in previous years remain unresolved and continue to place IRS systems at  risk. For example, IRS (1) continued to allow individuals more access to  sensitive information contained on its network than needed to perform  their assigned duties, (2) had not completed actions to address a  vulnerability in its procurement system that allowed users to enter  commands that bypassed normal application security controls, and   (3) continued to allow visitors unnecessary access to secured areas at one  data center. In addition to unresolved issues, we identified additional  internal control deficiencies, that, along with the unresolved deficiencies,  continued to jeopardize the confidentiality, integrity, and availability of  information processed by IRS’s key systems, and increased the risk of  material misstatement for financial reporting. For example, IRS had not  (1) appropriately secured the database associated with the online system  IRS used to support and manage its computer access request, approval,  and review process; (2) appropriately restricted permissions on the  database that supported an application used for cost allocation of   rent-related data, allowing database users to run operating system  commands; (3) tested the Redesigned Revenue Accounting Control System  (RRACS) application security in its current production environment,  which would have enabled IRS to identify weaknesses compromising IRS’s  ability to segregate incompatible duties and jeopardize the integrity of the  application’s data, and (4) used encrypted protocols on a server  supporting the Electronic Federal Tax Payment System and several  internal routers, potentially exposing user IDs and passwords transmitted  in clear text across the network to inappropriate disclosure and  unauthorized use. Until IRS takes additional steps to implement more  comprehensive testing and effective validation processes, its facilities,  computing resources, and information will remain vulnerable to  inappropriate use, modification, or disclosure, and agency management  will have limited assurance of the integrity and reliability of its financial  and taxpayer information.
In addition to the continuing challenges posed by the two long-standing  material weaknesses concerning unpaid tax assessments and information  security, our audit of IRS’s fiscal year 2010 financial statements also  identified a significant deficiency in IRS’s internal control over tax refund  disbursements. This significant deficiency, which is the collective result of  (1) a multiyear pattern of our identifying and reporting deficiencies in  IRS’s internal control over the processing of manual refunds; (2) the  increasing magnitude of manual refunds disbursed; and (3) new  deficiencies associated with the internal controls over the First-Time  Home Buyer Credit (FTHBC), increases the risk that IRS may pay out  duplicate or otherwise erroneous tax refunds to which individuals or  businesses are not entitled and for which IRS must use resources  attempting to recover. This new significant deficiency is an example of the  danger of not effectively addressing control deficiencies as soon as they  are identified so that they do not become a more serious problem. We  have reported numerous control deficiencies associated with manual  refund processing since 1999. Nine of those deficiencies and their  associated recommendations remain open, two of which have been open  since 2005.
section_title: Challenges in Developing and Implementing Performance Metrics to Assist in Managing for Outcomes
paragraphs: As we reported in our audit of IRS’s fiscal year 2010 financial statements,  IRS continues to face challenges in developing and instutionalizing the use  of financial management information to assist it in making operational  decisions and in measuring the effectiveness of its programs. IRS has not  developed cost-based (and when appropriate, revenue-based) outcome- oriented performance measures that would enhance its ability to manage  for outcomes and integrated them into its routine management and  decision-making processes or its externally reported performance  metrics. Although IRS has developed projected direct tax return on  investment estimates for new enforcement (tax collection) initiatives in  its annual budget submissions, it has not developed similar direct tax  return on investment outcome-oriented performance metrics to determine  whether funded initiatives achieve their originally projected outcomes.  Lacking such performance metrics inhibits IRS’s ability to more fully  assess and monitor the relative merits of its existing programs, to evaluate  new initiatives, or to consider alternatives and adjust its strategies as  needed. Outcome-oriented performance metrics based on specific  enforcement programs’ costs and revenues would assist IRS in improving  its ability to (1) establish measurable outcome goals, (2) evaluate the  relative merits of various program options, and (3) highlight opportunities  for optimizing the allocation of resources. They could also assist IRS in  more credibly demonstrating to Congress and the public that it is using its  appropriations wisely.
IRS’s existing metrics focus on process-oriented workload measures of  program outputs rather than on measuring program outcomes. For  example, for its enforcement programs, IRS focuses on measuring discrete  activities within its overall tax collection efforts, such as the percentage of  various types of tax returns examined, criminal investigations completed,  and the number of tax returns examined and closed. While such output  measures can be useful elements in assessing performance, they are not  designed to measure the contribution each of these activities makes to the  collection of unpaid taxes, nor do they compare the cost of collection  activities to the tax revenue generated. IRS’s enforcement metrics do not  include revenue collected—a measure of outcome—compared to the cost  of collection, which could provide useful information on the benefits of  the enforcement programs. In addition, IRS’s publicly available  performance metrics do not measure the internal cost of IRS’s programs  either in the aggregate or per service or activity performed.
As we report in the “Status per IRS” section of appendix I in this report,  IRS has reported that it considers our recommendation to develop  outcome-oriented performance measures and related performance goals  for IRS’s enforcement programs and activities to be closed. We do not  agree. Part of IRS’s justification for closing the recommendation is that it  uses estimates of the cost-benefit direct tax return on investment analysis  to evaluate future scenarios and to support funding requests for new  initiatives in its annual budget submissions. Using such estimates of  prospective return on investment information is useful for budgetary  decision making, but our recommendation is for IRS to develop outcome  data on the actual results of its programs and activities. We have also  previously recommended that IRS  extend the use of return on investment in future budget proposals to  include major enforcement programs,    develop return on investment data for its enforcement programs using  actual revenue and full cost data and compare actual results to the  projected return on investment data included in its budget request, and    provide Congress with information comparing projected savings to  actual savings in the year following the budget’s implementation.
The intent of our recommendations is to encourage IRS to develop  outcome-oriented performance metrics and to use them, along with other  metrics, in resource-allocation decisions. While IRS has not developed or  deployed such metrics for either funded initiatives or for ongoing  enforcement programs and activities, IRS officials informed us they are  considering options to collect direct tax return on investment data for  newly funded enforcement initiatives.
IRS officials also contended that it is not prudent to rely exclusively on  direct tax return on investment as the sole determinant of resource  allocation. As we have reported previously, we acknowledge that IRS  must consider other factors besides maximizing revenue collection and  least-cost operations. The fairness of IRS’s implementation of the tax code  and treatment of all taxpayers are important and we are cognizant of the  many factors, such as coverage, that are important considerations when  making resource-allocation decisions. These factors, and the decisions IRS  makes about how to respond to them, have a significant effect on  taxpayers, as well as on tax collections. We also acknowledge that IRS  faces challenges in developing outcome-oriented performance metrics,  such as return on investment, and integrating them into its resource  allocation decision-making process. Furthermore, developing such an  approach is important in order for IRS to make optimum use of its  available resources and to be able to credibly demonstrate it is doing so to  Congress and the public.
IRS’s lack of outcome-oriented performance metrics is inconsistent with  federal financial management concepts as embodied in the Federal  Accounting Standards Advisory Board’s Statement of Federal Financial  Accounting Concepts No. 1, Objectives of Federal Financial Reporting.  In its discussion of financial reporting concepts, FASAB notes that federal  financial data should provide accountability and decision-useful  information on the costs of programs and the outputs and outcomes  achieved, and it should provide data for evaluating service efforts, costs,  and accomplishments.
The absence of outcome metrics is also inconsistent with the objectives of  the CFO Act of 1990. A key objective of the act was for agencies to  routinely develop and use appropriate financial management information  to evaluate program effectiveness, make fully informed operational  decisions, and ensure accountability. While obtaining a clean audit opinion  on its financial statements is important in itself, it is not the CFO Act’s end  goal. Rather, the act’s end goal is modern financial management systems  that provide reliable, timely, and useful financial information to support  day-to-day decision making and oversight. Such systems and practices  should also provide for the systematic measurement of both outputs and  outcomes.
We have made several recommendations to IRS over the years to address  its financial management challenges in developing internal full cost data  for its programs and activities and for outcome-oriented performance  measures. Successfully addressing the remaining open recommendations  would enhance IRS’s ability to effectively manage for outcomes.
section_title: Challenges in Resolving Other Internal Control Issues
paragraphs: IRS’s actions over the years to resolve internal control weaknesses  enabled us to close nearly 300 internal control–related recommendations.  However, IRS also continues to face a challenge in addressing numerous  other unresolved internal control issues in several aspects of its operations  that, while neither individually nor collectively representing a material  weakness or significant deficiency, nonetheless merit management  attention to ensure they are fully and effectively addressed. IRS now has a  total of 57 open audit recommendations resulting from internal control  issues that we report as “other control issues” in appendix II of this report.  While most were identified during our recent financial audits, some were  identified in our audits from 2005 or earlier. It is incumbent upon IRS to  effectively address these open recommendations and to improve its  system of internal controls so that IRS can identify and correct potential  weaknesses before they can grow into more serious problems.
Forty-four—77 percent—of the 57 “other” open recommendations address  issues related either directly or indirectly to physically safeguarding of tax  receipts and taxpayer information, a critical element of IRS’s  responsibilities.
IRS processes billions of dollars annually in checks and currency and  other valuable assets, and it must safeguard and account for them to  prevent theft, fraud, and misuse. To do so, IRS has established physical  security, accountability, and accounting policies, processes, and  procedures to manage its activities involving transporting and accounting  for tax receipts and for handling and storing taxpayer information.  Although IRS has made substantial improvements in safeguarding  taxpayer receipts and information since our financial audits first began  identifying serious internal control issues in this area, the task of ensuring  ongoing control over such critical responsibilities for IRS is a difficult one  and requires constant vigilance. Each year, we continue to identify control  issues related to IRS’s safeguarding of taxpayer receipts and information.  For example, our fiscal year 2010 audit identified new internal control  issues and made 18 additional recommendations that related either  directly or indirectly to physically safeguarding taxpayer receipts and  information. The internal control issues encompassed in our open  recommendations cover critical physical security functions, such as  transporting taxpayer receipts and sensitive taxpayer information  among IRS facilities and lockbox banks and maintaining physical  security at IRS facilities to prevent loss, theft, or the potential for fraud  regarding tax receipts and taxpayer information;  conducting inspections and audits of the design and operation of IRS’s  physical security processes and controls designed to safeguard tax  receipts and taxpayer information;  conducting appropriate background investigations and screening of  personnel, including contractors, with access to taxpayer information;  and  ensuring the proper destruction of documents and equipment to  prevent the inappropriate release of sensitive taxpayer information.
In light of the volume of taxpayer receipts and sensitive taxpayer files that  IRS is responsible for safeguarding, and the implications for IRS’s mission  if they are lost, stolen, or the subject of fraud or misuse, it is critical that  IRS fully and effectively resolve the internal control issues we have  identified and work toward continually improving its internal controls to  prevent new issues from arising.
section_title: Status of Recommendations Based on the Fiscal Year 2010 Financial Statement Audit
paragraphs: In June 2010, we issued a report on the status of IRS’s efforts to implement  corrective actions to address financial management recommendations  stemming from our fiscal year 2009 and prior year financial audits and  other financial management–related work. In that report, we identified   85 audit recommendations that remained open and thus required  corrective action by IRS. A significant number of these recommendations  have been open for several years, either because IRS had not taken  corrective action or because the actions taken had not yet effectively  resolved the issues that gave rise to the recommendations.
IRS has continued to work to address many of the internal control issues  to which these open recommendations relate. In the course of performing  our fiscal year 2010 financial audit, we identified numerous actions IRS  took to address many of its internal control issues. On the basis of IRS’s  actions, which we were able to substantiate through our audit, we have  closed 37 of our prior years’ recommendations. However, a total of   48 recommendations from prior years remain open, a significant number  of which have been outstanding for several years. IRS considers another  13 of the prior years’ recommendations to be effectively addressed and  therefore closed. However, we consider them to remain open. For 9 of the  13, in our view, IRS’s actions did not fully address the issue that gave rise  to the recommendations. For the remaining 4, we have not yet been able to  verify the effectiveness of IRS’s actions because IRS’s corrective actions  are ongoing. (The “Status per IRS” and “Status per GAO” sections of app. I  provide a summary of both IRS’s and our assessment of IRS’s actions on  each recommendation.)
During our audit of IRS’s fiscal year 2010 financial statements, we  identified additional issues that require corrective action. In our June 2011  management report to IRS, we discussed these issues, and made 29 new  recommendations to address them. Consequently, a total of 77 financial  management–related recommendations need to be addressed—48 from  prior years and 29 new recommendations resulting from our fiscal year  2010 audit. We consider all of the new recommendations to be short- term. We also consider the majority of the recommendations outstanding  from prior years to be short-term; however, a few, particularly those  concerning the functionality of IRS’s automated systems, are complex and  will require several more years to fully and effectively address.
In addition to the 77 open recommendations from our financial audits and  other financial management–related work, there are 105 additional open  recommendations stemming from our assessment of IRS’s information  security controls over key financial systems, information, and  interconnected networks conducted as an integral part of our annual  financial audits. The issues that led to our previously reported and our  newly identified recommendations related to information security increase  the risk of unauthorized disclosure, modification, or destruction of  financial and sensitive taxpayer data. Collectively, they constitute IRS’s  material weakness in internal control over information security for its  financial and tax processing systems. As discussed earlier in this report,  recommendations resulting from the information security issues identified  in our annual audits of IRS’s financial statements are reported separately  because of the sensitive nature of many of these issues.
Appendix I presents a summary listing of (1) the 85 non-information- systems security–related recommendations based on our financial  statement audits and other financial management–related work that we  had not previously reported as closed and the 29 new recommendations  based on our fiscal year 2010 financial audit, (2) IRS-reported corrective  actions taken or planned as of March 2011, and (3) our analysis of whether  the issues that gave rise to the recommendations have been effectively  addressed, based primarily on the work performed during our fiscal year  2010 financial statement audit. The appendix lists the recommendations by  the year in which the recommendation was made and by report number.  Appendix II presents the 77 open recommendations that remained as a  result of closing the aforementioned 37 recommendations and the addition  of 29 new recommendations from our fiscal year 2010 audit. The  recommendations have been arranged by related material weakness,  significant deficiency, and compliance issue as described in our opinion  report on IRS’s financial statements, as well as other control issues we  have identified and discussed in our annual management report to IRS.
section_title: Open Recommendations Grouped by Internal Control Activity
paragraphs: Linking the open recommendations from our financial audits and other  financial management–related work, and the issues that gave rise to them,  to internal control activities that are central to IRS’s tax administration  responsibilities provides insight regarding their significance.
Internal control standards consist of five elements—control environment,  risk assessment, control activities, information and communication, and  monitoring. For the control activities element, the internal control  standards explain that an agency’s system of internal control should  provide for an assessment of the risks the agency faces from both external  and internal sources and that internal control activities should help ensure  that management’s directives are carried out. The control activities should  be effective and efficient in accomplishing the agency’s control objectives.  The control activities element defines 11 specific control activities, which  we have grouped into three categories, as shown in table 1. Each of the  unresolved recommendations from our financial audits and financial  management–related work, and the underlying issues that gave rise to  them, can be traced to one of the 11 specific control activities as shown in  table 1.
As table 1 indicates, 29 (38 percent) of the unresolved recommendations  relate to IRS’s controls over safeguarding of assets and security activities,  30 (39 percent) relate to issues associated with IRS’s ability to properly  record and document transactions, and 18 (23 percent) relate to issues  associated with IRS’s management review and oversight.
In the following section, we group the 77 open recommendations under  the specific control activity to which the condition that gave rise to them  most appropriately fits. We define each control activity as presented in the  internal control standards and briefly identify some of the key IRS  operations that fall under that control activity. Although not  comprehensive, the descriptions are intended to help explain why actions  to strengthen these control activities are important for IRS to efficiently  and effectively carry out its overall mission. Each control activity  description includes a table of the related open recommendations. The  tables list the recommendations by the year in which we made them   (ID no.). For each recommendation, we also indicate whether it is a   short-term or long-term recommendation. We characterized a  recommendation as short-term when we believe that IRS had the  capability to implement solutions within 2 years of the year in which we  first reported the recommendations. Note that for the internal control  activity “top-level reviews of actual performance,” IRS addressed the  outstanding recommendation from prior years that related to this control  activity, and we identified no new issues during our fiscal year 2010  financial audit that relate to this control activity.
subsections: section_title: Safeguarding of Assets and Security Activities
paragraphs: Given IRS’s mission, the sensitivity of the data it maintains, and its  processing of trillions of dollars of tax receipts each year, one of the most  important control activities at IRS is the safeguarding of assets. Internal  control in this important area should be designed to provide reasonable  assurance regarding prevention or prompt detection of unauthorized  acquisition, use, or disposition of an agency’s assets. IRS has outstanding  recommendations in the following three control activities in the internal  control standards that relate to safeguarding of assets (including buildings  and equipment as well as tax receipts) and security activities (such as  limiting access to only authorized personnel): (1) physical control over  vulnerable assets, (2) segregation of duties, and (3) access restrictions to,  and accountability for, resources and records.
subsections: section_title: Physical Control over Vulnerable Assets
paragraphs: Internal control standard: An agency must establish physical control to  secure and safeguard vulnerable assets. Examples include security for  and limited access to assets such as cash, securities, inventories, and  equipment which might be vulnerable to risk of loss or unauthorized  use. Such assets should be periodically counted and compared to  control records.
Of the trillions of dollars in taxes that IRS collects each year, hundreds of  billions is collected in the form of checks and cash accompanied by tax  returns and related information. IRS collects taxes both at its own  facilities as well as at lockbox banks. IRS acts as custodian for (1) the tax  payments it receives until they are deposited in the General Fund of the  U.S. Treasury and (2) the tax returns and related information it receives  until they are either sent to the Federal Records Center or destroyed. IRS  is also charged with controlling many other assets, such as computers and  other equipment, but it is IRS’s legal responsibility to safeguard tax returns  and the confidential information taxpayers provide on those returns that  makes the effectiveness of IRS’s internal controls over physical security  essential to accomplishing its mission.
While effective physical safeguards over receipts should exist throughout  the year, such safeguards are especially important during the peak tax  filing season. Each year during the weeks preceding and shortly after   April 15, an IRS service center or lockbox bank may receive and process  daily over 100,000 pieces of mail containing returns, receipts, or both. The  dollar value of receipts each service center and lockbox bank processes  increases to hundreds of millions of dollars a day during the April 15 time  frame.
The following 22 open recommendations in table 2 are designed to  improve IRS’s physical controls over vulnerable assets. They include  recommendations for IRS to improve controls over (1) physical security at  its Taxpayer Assistance Centers (TAC), (2) courier activities, (3) lockbox  banks’ handling of unprocessable items, (4) the handling of hardcopy  cash receipts, and (5) property and equipment disposal procedures. We  consider all of these recommendations to be correctable on a short-term  basis.
Internal control standard: Key duties and responsibilities need to be  divided or segregated among different people to reduce the risk of error  or fraud. This should include separating the responsibilities for  authorizing transactions, processing and recording them, reviewing the  transactions, and handling any related assets. No one individual should  control all key aspects of a transaction or event.
As noted in the previous section, IRS employees process hundreds of  billions of dollars in tax receipts in the form of cash and checks.  Consequently, it is critical that IRS maintain appropriate separation of  duties to allow for adequate oversight of staff and protection of these  vulnerable resources so that no single individual would be in a position of  causing an error or irregularity, or potentially converting the asset to  personal use, and then concealing it. For example, when an IRS field office  receives taxpayer receipts and returns, it is responsible for depositing the  cash and checks in a depository institution and forwarding the related  taxpayer information received, such as tax returns, to an IRS service  center for further processing. In order to adequately safeguard receipts  from theft, the person responsible for recording the information from the  taxpayer receipts on a voucher should be different from the individual  who prepares those receipts for transmittal to the service center for  further processing.
Implementing the following recommendation in table 3 would help IRS  improve its separation of duties, which will in turn strengthen controls  over tax receipts. This recommendation is short-term in nature.
Internal control standard: Access to resources and records should be  limited to authorized individuals, and accountability for their custody  and use should be assigned and maintained. Periodic comparison of  resources with the recorded accountability should be made to help  reduce the risk of errors, fraud, misuse, or unauthorized alteration.
Because IRS is responsible for maintaining accountability over a large  volume of cash and checks, it is imperative that it maintain strong controls  to appropriately restrict access to those assets, the records relied on to  track those assets, and sensitive taxpayer information. Although IRS has a  number of both physical and information systems controls in place, some  of the issues we have identified in our financial audits over the years  pertain to ensuring that (1) those individuals who have direct access to  cash and checks are appropriately vetted, such as through appropriate  background investigations, before being granted access to taxpayer  receipts and information and (2) IRS maintains effective access security  control. The following six short-term recommendations in table 4 are  intended to help IRS improve its access restrictions to assets and records.
section_title: Proper Recording and Documenting of Transactions
paragraphs: IRS has a number of internal control issues related to recording  transactions, documenting events, and tracking the processing of taxpayer  receipts or information. IRS has outstanding recommendations in the  following three control activities related to proper recording and  documenting of transactions: (1) appropriate documentation of  transactions and internal controls, (2) accurate and timely recording of  transactions and events, and (3) proper execution of transactions and  events.
subsections: section_title: Appropriate Documentation of Transactions and Internal Control
paragraphs: Internal control standard: Internal control and all transactions and other  significant events need to be clearly documented, and the  documentation should be readily available for examination. The  documentation should appear in management directives, administrative  policies, or operating manuals and may be in paper or electronic form.  All documentation and records should be properly managed and  maintained.
IRS collects and processes trillions of dollars in taxpayer receipts annually  both at its own facilities and at lockbox banks under contract to process  taxpayer receipts for the federal government. Therefore, it is important  that IRS maintain effective controls to ensure that all documents and  records are properly and timely recorded, managed, and maintained both  at its facilities and at the lockbox banks. In this regard, it is critical that  IRS adequately document and disseminate its procedures to ensure that  they are available for IRS employees. IRS must also document its  management reviews of controls, such as those regarding refunds and  returned checks, document transmittals, and reviews of TAC operations.  To ensure future availability of adequate documentation, IRS must ensure  that (1) its systems, particularly those now being developed and  implemented, have appropriate capability to identify and trace individual  transactions and (2) all critical steps in its accounting processes are  adequately documented. Resolving the following 13 recommendations in  table 5 would assist IRS in improving its documentation of transactions  and related internal control procedures. All of these recommendations  have been classified as short-term.
Internal control standard: Transactions should be promptly recorded to  maintain their relevance and value to management in controlling  operations and making decisions. This applies to the entire process or  life cycle of a transaction or event from the initiation and authorization  through its final classification in summary records. In addition, control  activities help to ensure that all transactions are completely and  accurately recorded.
IRS maintains sensitive records for tens of millions of taxpayers in  addition to maintaining its own financial records. To maintain these  records, IRS often has to rely on outdated computer systems or manual  work-arounds. Unfortunately, some of IRS’s recordkeeping difficulties we  have reported on over the years will not be fully addressed until it can  replace its aging systems; an effort that is long-term and, in part,  dependent on obtaining future funding.
Implementation of the following 15 recommendations in table 6 would  strengthen IRS’s recordkeeping abilities. Thirteen of these  recommendations are short-term, and 2 are long-term regarding  requirements for new systems for maintaining taxpayer records. Several of  the recommendations listed deal with financial reporting processes, such  as maintaining subsidiary records, recording budgetary transactions, and  tracking program costs. Some of the issues that gave rise to several of our  recommendations directly affect taxpayers, such as those involving  duplicate assessments, errors in calculating and reporting manual interest,  errors in calculating penalties, and collection of trust fund recovery  penalty assessments. Two of these recommendations have remained open  for 10 years or more, reflecting the complex nature of the underlying  systems issues that must be resolved to fully address some of these  control deficiencies.
Internal control standard: Transactions and other significant events  should be authorized and executed only by persons acting within the  scope of their authority. This is the principal means of ensuring that  only valid transactions to exchange, transfer, use, or commit resources  and other events are initiated or entered into. Authorizations should be  clearly communicated to managers and employees.
Each year, IRS spends approximately $250 million to cover the cost of its  employees’ travel in addition to entering into agreements with, and  receiving services from, vendors. Failure to ensure that employees obtain  appropriate authorizations for their travel or approval for procurements  leaves the IRS open to fraud, waste, or abuse. IRS’s actions to address the  following two short-term recommendations in table 7 would improve IRS’s  controls over travel costs and approvals for the procurement of goods and  services.
section_title: Effective Management Review and Oversight
paragraphs: All personnel within IRS have an important role in establishing and  maintaining effective internal controls, but IRS’s managers have additional  review and oversight responsibilities. Management must set the objectives,  put control activities in place, and monitor and evaluate controls to ensure  that they are followed. Without adequate monitoring by managers, there is  a risk that internal control activities may not be carried out effectively and  in a timely manner. IRS has outstanding recommendations in the following  four control activities related to effective management review and  oversight: (1) reviews by management at the functional or activity level,  (2) establishment and review of performance measures and indicators,   (3) management of human capital, and (4) top-level reviews of actual  performance.
subsections: section_title: Reviews by Management at the Functional or Activity Level
paragraphs: Internal control standard: Managers need to compare actual  performance to planned or expected results throughout the organization  and analyze significant differences.
IRS employs over 100,000 full-time and seasonal employees. In addition,  IRS is also responsible for overseeing lockbox banks processing tens of  thousands of individual receipts, totaling hundreds of billions of dollars.  Effective management oversight of operations is important at any  organization, but is imperative at IRS given its mission.
Implementing the following 12 short-term and 1 long-term  recommendations in table 8 would improve IRS’s management oversight  of several areas of its operations, including monitoring of contractor and  off-site processing facilities, release of tax liens, and issuance of manual  refunds.
Internal control standard: Activities need to be established to monitor  performance measures and indicators. These controls could call for  comparisons and assessments relating different sets of data to one  another so that analyses of the relationships can be made and  appropriate actions taken. Controls should also be aimed at validating  the propriety and integrity of both organizational and individual  performance measures and indicators.
IRS’s operations include a wide range of activities, including educating  taxpayers, processing taxpayer receipts and data, disbursing hundreds of  billions of dollars in refunds to millions of taxpayers, maintaining  extensive information on tens of millions of taxpayers, and seeking  collection from individuals and businesses that fail to comply with the  nation’s tax laws. Within its compliance function, IRS has numerous  activities, including identifying businesses and individuals that  underreport income, collecting from taxpayers who do not pay taxes, and  collecting from those receiving refunds for which they are not entitled.  Although IRS has at its peak over 100,000 employees, it still faces resource  constraints in attempting to fulfill its duties. It is vitally important for IRS  to have sound performance measures to assist it in assessing its  performance and targeting its resources to maximize the government’s  return on investment.
The following long-term recommendation in table 9 is designed to assist  IRS in (1) evaluating its operations and (2) determining which activities  are the most beneficial. This recommendation is directed at improving  IRS’s ability to measure and evaluate the internal costs, direct benefits,  and outcomes of its operations—particularly with regard to identifying   its most cost-effective tax collection activities.
Internal control standard: Effective management of an organization’s  workforce—its human capital—is essential to achieving results and an  important part of internal control. Management should view human  capital as an asset rather than a cost. Only when the right personnel for  the job are on board and are provided the right training, tools, structure,  incentives, and responsibilities is operational success possible.  Management should ensure that skill needs are continually assessed  and that the organization is able to obtain a workforce that has the  required skills that match those necessary to achieve organizational  goals. Training should be aimed at developing and retaining employee  skill levels to meet changing organizational needs. Qualified and  continuous supervision should be provided to ensure that internal  control objectives are achieved. Performance evaluation and feedback,  supplemented by an effective reward system, should be designed to  help employees understand the connection between their performance  and the organization’s success. As a part of its human capital planning,  management should also consider how best to retain valuable  employees, plan for their eventual succession, and ensure continuity of  needed skills and abilities.
IRS’s operations cover a wide range of technical activities requiring  specific expertise in tax-related matters; financial management; and  systems design, development, and maintenance. Because IRS has tens of  thousands of employees spread throughout the country, it is imperative  that management establish and maintain up-to-date guidance and provide  appropriate training for its staff. Taking action to implement the following  four short-term recommendations in table 10 would assist IRS in its  management of human capital.
section_title: Concluding Observations
paragraphs: Increased budgetary pressures and an increased public awareness of the  importance of internal control have served to provide additional pressure  on IRS to carry out its mission more efficiently and effectively while  continuing to protect taxpayers’ information.
Sound financial management and effective internal controls are essential if  IRS is to efficiently and effectively achieve its goals. IRS has made  substantial progress in improving its financial management and internal  control since its first financial audit, as evidenced by unqualified audit  opinions on its financial statements for the past 11 years, resolution of  several material internal control weaknesses, significant deficiencies, and  other control issues, and actions taken resulting in the closure of hundreds  of financial management recommendations. This progress has been the  result of hard work by many individuals throughout IRS and sustained  commitment of IRS leadership. Nonetheless, more needs to be done to  fully address the agency’s continuing financial management challenges— resolving material weaknesses and significant deficiencies in internal  control; developing outcome-oriented performance metrics that can  facilitate managing operations for outcomes; and correcting numerous  other internal control issues. Effective implementation of the  recommendations we have made through our financial audits and related  work could greatly assist IRS in improving its internal controls and  achieving sound financial management.
section_title: Agency Comments and Our Evaluation
paragraphs: In commenting on a draft of this report, IRS expressed its appreciation for  our acknowledgment of the agency’s progress in addressing its financial  management challenges as evidenced by our closure of 37 open financial  management recommendations from prior GAO reports. IRS also  commented that it is committed to implementing appropriate  improvement to ensure that it maintains sound financial management  practices. We will review the effectiveness of further corrective actions  IRS has taken or will take to address all open recommendations as part of  our audit of IRS’s fiscal year 2011 financial statements.
We are sending copies of this report to the Chairmen and Ranking  Members of the Senate Committee on Appropriations; Senate Committee  on Finance; Senate Committee on Homeland Security and Governmental  Affairs; and Subcommittee on Taxation, IRS Oversight and Long-Term  Growth, Senate Committee on Finance. We are also sending copies to the  Chairmen and Ranking Members of the House Committee on  Appropriations; House Committee on Ways and Means; the Chairman and  Vice Chairman of the Joint Committee on Taxation; the Secretary of the  Treasury; the Director of OMB; the Chairman of the IRS Oversight Board;  and other interested parties. The report is also available at no charge on  the GAO Web site at http://www.gao.gov.
If you or your staffs have any questions concerning this report, please  contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix IV.
section_title: Appendix I: Status of GAO Recommendations from Internal Revenue Service Financial Audits and Related Management Reports
paragraphs: This appendix presents a list of (1) the 85 recommendations that we had  not previously reported as closed, (2) Internal Revenue Service (IRS)  reported corrective actions taken or planned as of March 2011, and (3) our  analysis of whether the issues that gave rise to the recommendations have  been effectively addressed. It also includes 29 recommendations based on  our fiscal year 2010 financial statement audit. Table 11 lists the  recommendations by the year and recommendation number (ID no.) and  also identifies the report in which the recommendation was made.
section_title: Appendix II: Open Recommendations Arranged by Material Weakness, Significant Deficiency, Compliance, or Other Control Issue
paragraphs: For several years, we have reported material weaknesses, significant  deficiencies, noncompliance with laws and regulations, and other control  issues in our annual financial statement audits and related management  reports. Appendix II provides summary information regarding the primary  issue to which each open recommendation is most closely related. To  compile this summary, we analyzed the nature of the open  recommendations to relate them to the material weaknesses, significant  deficiency, compliance issue, or other control issues (not associated with  a material weakness, significant deficiency, or compliance issue) identified  as part of our financial statement audit.
subsections: section_title: Material Weakness: Unpaid Tax Assessments
paragraphs: The Internal Revenue Service (IRS) has weaknesses in its internal control  over the management of unpaid tax assessments resulting from the  agency’s (1) inability to use its general ledger and underlying subsidiary  records to report federal taxes receivable, compliance assessments, and  writeoffs in accordance with federal accounting standards without  significant compensating procedures, (2) lack of transaction traceability  for the reported balance in taxes receivable that comprises over   80 percent of IRS’s total assets as of September 30, 2010, and an effective  transaction-based subledger for unpaid tax assessment transactions, and  (3) inability to effectively prevent or timely detect and correct errors in  taxpayer accounts. The recommendations in table 12 address these  weaknesses.
section_title: Material Weakness: Information Security
paragraphs: IRS has serious internal control weaknesses over information security that  result primarily from IRS not having fully implemented key components of  its information security program. These weaknesses, collectively,  represent a material weakness. For example, (1) IRS’s testing did not  detect many of the vulnerabilities we identified and did not assess a key  application in its current environment, and (2) IRS did not effectively  validate corrective actions reported to resolve previously identified  weaknesses. Although IRS has made some progress in addressing previous  weaknesses we identified in its information systems and physical security  controls, as of March 2011, there were 105 open recommendations  designed to help IRS improve its information systems security controls.
Those recommendations are reported separately and are not included in  this report primarily because of the sensitive nature of some of the issues.
section_title: Significant Deficiency: Tax Refund Disbursements
paragraphs: IRS has significant internal control weaknesses over its tax refund  disbursements. In our audit of IRS’s fiscal year 2010 financial statements,  we reported a significant deficiency in IRS’s internal control over tax  refund disbursements that resulted from (1) a multiyear pattern of our  identifying deficiencies in IRS’s internal control over the processing of  manual refunds, which we have reported for several years; (2) the  increasing magnitude of manual tax refunds disbursed; and (3) new  deficiencies associated with the First-Time Home Buyer Credit (FTHBC).  This significant deficiency increases the risk that IRS may pay out  duplicate or otherwise erroneous tax refunds to which individuals or  businesses are not entitled and for which IRS must spend resources  attempting to recover.  The recommendations in table 13 address our  findings.
section_title: Release of Federal Tax Liens
paragraphs: IRS continues to be noncompliant with the laws and regulations governing  the release of federal tax liens. We found IRS did not always release  applicable federal tax liens within 30 days of tax liabilities being either  paid off or abated, as required by the Internal Revenue Code (section  6325). The Internal Revenue Code grants IRS the power to file a lien  against the property of any taxpayer who neglects or refuses to pay all  assessed federal taxes. The lien serves to protect the interest of the federal  government and as a public notice to current and potential creditors of the  government’s interest in the taxpayer’s property.  The recommendation in  table 14 addresses our finding.
section_title: Other Control Issues
paragraphs: The 57 recommendations listed in table 15 pertain to issues that do not  rise individually or in the aggregate to the level of a material weakness or  significant deficiency in internal control, or to a reportable noncompliance  with laws and regulations. However, these issues do represent weaknesses  in various aspects of IRS’s internal controls that should be addressed.
section_title: Appendix III: Comments from the Internal Revenue Service
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, the following individuals made  major contributions to this report: William J. Cordrey, Assistant Director;  Crystal Alfred; Russell Brown; Ray B. Bush; Stephanie Chen; Jeremy Choi;  Oliver Culley; Charles Ego; Doreen Eng; Charles Fox; Valerie Freeman;  Ryan Guthrie; Ted Hu; Richard Larsen; Tuan Lam; Delores Lee; Jenny Li;  Cynthia Ma; Joshua Marcus; Julie Phillips; John Sawyer; Christopher  Spain; Cynthia Teddleton; Lien To; LaDonna Towler; Cherry Vasquez; Gary  Wiggins; and Ting-Ting Wu.