IRS Lockbox Banks: More Effective Oversight, Stronger Controls, and Further Study of Costs and Benefits are Needed
Published: 2003-01-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Lockbox banks are commercial banks that process certain taxpayer receipts on behalf of the Internal Revenue Service (IRS). Following an incident at a lockbox site during 2001, which involved the loss and destruction of about 78,000 tax receipts totaling more than $1.2 billion, the Senate Committee on Finance asked GAO to examine whether (1) provisions of the contracts under which lockbox banks operate address previously identified problems or might contribute to mishandling of tax receipts, (2) oversight of lockbox banks is adequate, (3) internal controls are sufficient, and (4) IRS and Treasury's Financial Management Service (FMS) had considered the costs and benefits of contracting out the functions performed by lockbox banks.
section_title: What GAO Found
paragraphs: FMS has contractual agreements with four lockbox banks, which operate 11 lockbox sites at nine locations on IRS's behalf. Of the more than $2 trillion in tax receipts that IRS collected in fiscal year 2002, lockbox banks processed approximately $268 billion. The findings of GAO's study include the following: (1)Nothing inherent in the lockbox contractual agreements would necessarily contribute to mishandling of tax receipts. Although a desire to avoid negative consequences, such as financial or other penalties allowed for by the agreements, could motivate bank employees to make poor decisions, penalty provisions are necessary to help the government address inadequate performance. The results of an ongoing investigation of the 2001 incident may help IRS and FMS determine whether new provisions or modifications to existing provisions are needed. (2) Although IRS and FMS have significantly increased their presence at lockbox sites, oversight of lockbox banks during fiscal year 2002 was not fully effective to ensure that taxpayer data and receipts were adequately safeguarded and properly processed. Inadequate oversight resulted mainly from a lack of clear oversight directives and policies; failure to perform key oversight functions; and conflicting roles and responsibilities of IRS personnel responsible for day-to-day oversight of lockbox banks. (3) Internal controls, including physical security controls, need to be strengthened at IRS lockbox locations. In addition, the processing guidelines under which IRS lockbox banks operate need to be revised to improve receipt-processing controls, employment screening, and courier security. (4) IRS and FMS have not performed a comprehensive study of the costs and benefits of using lockbox banks. The most recent study, in 1999, omitted some costs that may have affected the result. For example, the study did not consider opportunity costs--benefits foregone that might have resulted from alternative uses of the money. Because of these omissions and several changes that have affected costs and benefits, a new study will be needed before lockbox contracts expire in 2007.

section_title: Letter
paragraphs: The Honorable Charles E. Grassley Chairman (designate), Committee on Finance United States Senate In its role as the nation’s tax collector, the Internal Revenue Service (IRS)  collected over $2 trillion during fiscal year 2002. Of that amount, $1.5  trillion was collected through electronic means, financial institutions  serving as lockbox banks collected more than $268 billion, and IRS offices  collected $86 billion.
A lockbox bank is a commercial bank with a designated post office box to  which taxpayers are instructed to mail their payments and related tax  documents. Lockbox banks process the documents, deposit the receipts,  and then forward the documents and data to IRS’s Submission Processing  Centers, which update taxpayers’ accounts. The Department of the  Treasury’s Financial Management Service (FMS) has contractual  agreements with four lockbox banks, which operate 11 lockbox sites at  nine locations on IRS’s behalf. The intent of the lockbox program is to  accelerate the deposit of tax receipts and increase interest savings, thus  enhancing the efficiency of government cash management. Lockbox banks  have been used since 1984 for this purpose.
Instances of fraud, waste, and abuse have occurred at IRS lockbox banks  over the years. In 2001, approximately 78,000 federal tax receipts, valued at  more than $1.2 billion, were lost or destroyed at a lockbox bank operated  by the Mellon Financial Corporation in Pittsburgh, Pennsylvania. Instances  of employees stealing and cashing taxpayer receipts have also occurred at  lockbox banks. Although FMS and IRS have taken steps to increase  monitoring of and internal controls at lockbox banks as a result of the loss  and destruction of tax receipts at the Pittsburgh lockbox site, we and  others, including the Treasury Inspector General for Tax Administration  (TIGTA) and offices within IRS and FMS, continue to find internal control  weaknesses at lockbox banks.
The purpose of this report is to respond to your request that we review  existing and planned security and internal control measures at all lockbox  banks that have agreements with FMS to provide tax receipt processing  services for IRS. Specifically, you asked that we  determine whether the new lockbox agreements in effect beginning in  2002 address previously identified problems and whether contract  provisions may contribute to improper handling of taxpayer returns,  determine the adequacy of FMS’s and IRS’s oversight in monitoring  lockbox banks’ adherence to the contractual agreements and lockbox  processing guidelines,   determine whether controls over processing and safeguarding of  taxpayer receipts and data are in place and are working effectively, and  assess the extent to which IRS and FMS considered the costs and  benefits of contracting out the functions performed by the lockbox  banks instead of using IRS employees.
To meet these objectives, we (1) reviewed reports relevant to oversight and  management of the lockbox program, (2) reviewed laws, regulations, and  guidance related to federal cash management activities, (3) interviewed  FMS and IRS officials, (4) compared the 1993 and 2002 lockbox bank  contractual agreements, and (5) reviewed FMS and IRS policies, guidelines,  checklists, and reports from oversight reviews. We also visited two IRS  Submission Processing Centers and all nine lockbox locations, and  reviewed and discussed with FMS and IRS studies on the costs and benefits  of processing tax receipts by lockbox banks. As agreed with your office, we  did not specifically review the mishandling incident at the Pittsburgh  lockbox site since an ongoing investigation was in process.
subsections: section_title: Background
paragraphs: In an effort to expedite receipt processing, the IRS conducted its first pilot  project to obtain lockbox services from a commercial bank in 1984. The  receipts processed were limited to tax receipts for estimated tax payments,  which are typically paid by taxpayers on a quarterly basis. The bank was  compensated from the interest it earned on a compensating balance— funds placed in the bank’s account by FMS. Since that time, the IRS  lockbox program has expanded to cover taxpayers in all states and receipts  for individual income tax returns, employment tax returns, and other  miscellaneous types of taxes. Most of the returns are received during the  April peak processing period and the smaller peak periods during January,  June, and September. Certain taxpayers who owe money and are making  payments are instructed to mail returns and payments to post office boxes  maintained by the lockbox banks. The lockbox sites deposit the receipts to  an account with Treasury and send processed documents (tax return forms  and payment vouchers), computer tapes containing taxpayer data, and  unprocessable receipts to IRS Submission Processing Centers for further  processing and recording in the taxpayer accounts (see fig. 1).
FMS formalized the lockbox processing arrangements in 1993 by  establishing contractual agreements with commercial banks to process tax  receipts on behalf of IRS. In 2002, new, but similar, agreements were  established. Like the 1993 agreements, the 2002 agreements are 5-year  agreements with two 1-year extension options. The current lockbox  network consists of four banks, three of which operate multiple sites that support the 10 IRS Submission Processing Centers across the country. The  agreements with FMS require that these banks operate their sites according  to IRS’s Lockbox Processing Guidelines (LPG). The LPGs provide the  detailed procedures the banks are required to follow in providing lockbox  services for IRS and are updated as needed. Both FMS and IRS monitor  lockbox bank compliance with the agreements and the LPGs, and each  lockbox site has an IRS employee who serves as a lockbox coordinator.  For fiscal year 2002, IRS lockbox banks processed more than 66 million  receipts, totaling about $268 billion, which accounted for approximately 13  percent of total tax receipts in dollars and 32 percent in volume.
The intent of the lockbox program is to enhance federal cash management  by accelerating the deposit of tax receipts, which would increase interest  float savings (or interest cost avoidance) to the government and reduce the  amount Treasury would have to borrow to pay government obligations. The  estimate of interest float savings resulting from IRS’s use of lockbox banks  has varied throughout the years. In calculating interest float savings, IRS  and FMS assumed, based on a 1988 joint IRS/FMS study, that lockbox  banks could process receipts and deposit the funds to a Treasury account 3  days faster than IRS. However, in a 1998 report, the Treasury Office of  Inspector General (OIG) questioned the validity of this assumption and  recommended that IRS acquire relevant and reliable comparative cost data on all aspects of the lockbox program to identify the most cost-effective  option to use for processing and depositing tax receipts.
In response to the Treasury OIG report, IRS and FMS hired a contractor to  compare lockbox bank processing to IRS processing for individual tax  (Form 1040) receipts. The contractor reported in July 1998 that lockbox  banks could make funds available to the federal government an average of  2 days faster than IRS. In 1999, IRS and FMS formed a taskforce to study  the costs and benefits of continuing to use lockbox banks for processing  Form 1040 receipts. Based on its study, the IRS/FMS taskforce  recommended that such processing remain with the lockbox banks rather  than be returned to IRS for fiscal years 2001-2007.
section_title: Scope and Methodology
paragraphs: To accomplish our work, we reviewed reports relevant to oversight and  management of the lockbox program, including reports prepared by FMS,  IRS, GAO, the Treasury OIG, TIGTA, and internal and external auditors  from several lockbox banks. We reviewed laws, regulations, and guidance  related to the cash management activities of the federal government. We  also interviewed FMS and IRS officials from several headquarters divisions.  As agreed with your office, we did not review the incident involving the  loss and destruction of taxpayer receipts and data at the Pittsburgh  lockbox, since an ongoing investigation was in process. The following  procedures were also performed for each of the objectives:   To determine if new contractual agreements address previously  identified problems and correct provisions that could contribute to  improper handling of taxpayer returns, we reviewed and analyzed the  provisions in the 1993 and 2002 lockbox bank contractual agreements.  We also compared the agreements to determine whether changes had  been made.
To determine the adequacy of FMS’s and IRS’s oversight of lockbox  banks, we reviewed FMS and IRS policies, guidelines, checklists,  schedules of site visits, and reports from oversight reviews. We  performed site visits at two IRS Submission Processing Centers to  observe IRS reviews of documentation received from the lockbox  banks. At each Submission Processing Center, we interviewed relevant  management and staff concerning lockbox bank oversight policies,  procedures, and practices.
To determine if lockbox banks’ security and internal controls to  safeguard taxpayer receipts and returns are sound and properly  implemented, we observed physical security and internal controls and  interviewed lockbox personnel at all nine lockbox locations during the  April 2002 peak processing period and at two lockbox sites during the  June 2002 peak processing period. At each site, we also reviewed  lockbox bank employee personnel records for a nonrepresentative  selection of permanent and temporary lockbox employees. In addition,  we compared the 2001 and 2002 LPGs for changes related to  safeguarding tax receipts and data, receipt processing, employee  screening, and courier requirements. We also compared IRS’s Internal  Revenue Manual (IRM) and other directives, which are IRS’s detailed  policies, with the 2002 LPGs.
To determine whether the costs and benefits of processing tax receipts  through lockbox banks instead of processing them at IRS were  considered, we reviewed federal guidance and economic literature on  cost-benefit and cost-effectiveness analyses of federal programs and  policies. In addition, we analyzed prior FMS and IRS studies and the  support for the data, assumptions, and methodology used in the 1999  report to estimate the costs and benefits of processing tax receipts  through lockbox banks versus processing them at IRS.
We performed our work from April 2002 through November 2002 in  accordance with U.S. generally accepted government auditing standards.  We requested written comments on a draft of this report from the Secretary  of the Department of the Treasury or his designee. These comments are  discussed in the Agency Comments and Our Evaluation section of this  report, incorporated in the report as applicable, and reprinted in appendix  III.
section_title: It Is Not Known Whether Contract Provisions Could Contribute to Improper Handling of Taxpayer Receipts
paragraphs: We found nothing inherent in the new 2002 lockbox bank contractual  agreements or the prior agreements that would necessarily contribute to  mishandling of taxpayer receipts. The agreements contain penalty  provisions that can result in negative consequences if banks do not perform  work that meets quality standards or do not perform work within required  time frames. The consequences range from financial penalties to  termination of the lockbox agreement. Although a desire to avoid negative  consequences could motivate lockbox bank employees to make poor  decisions in their handling of taxpayer receipts, the penalty and  termination provisions are necessary to help the federal government  address inadequate contractor performance on the two performance  dimensions—quality and timeliness—deemed critical by IRS and FMS.
FMS and IRS made some enhancements to the 2002 agreements, such as  the addition of a new performance penalty and clarification of other  provisions. Because TIGTA’s investigation of the incident involving the loss  and destruction of tax receipts by employees at the Pittsburgh lockbox site  during the 2001 April peak processing period is still ongoing, it is unclear  whether any provisions in the lockbox agreements may have contributed to  the mishandling incident. When the results of the investigation are known,  FMS and IRS should determine whether contract provisions need to be  modified or whether additional controls need to be implemented.
subsections: section_title: Lockbox Bank Agreements Contain Timeliness and Quality Factors to Assess Performance
paragraphs: Factors used to assess contractor performance are cost, timeliness, and  quality of service provided. Contracts often contain specific standards for  acceptable performance as well as provisions for rewarding or penalizing  contractors according to their performance in these areas. Such provisions  may inadvertently encourage contractors to focus their efforts on one area  to the detriment of their performance in other areas. For example, if a  contract’s provisions reward timely performance more than they reward  high-quality performance, contractors may be encouraged to take shortcuts  that improve timeliness but detract from quality of work. As a result, it is  important that contract incentives be appropriately designed and balanced  to obtain acceptable levels of performance in all relevant areas. To ensure  that contract provisions are operating as intended, effective oversight of  contractors is essential.
The lockbox banks are paid a fixed price for each item they process, and  their total compensation depends on the number of each type of receipt  they process. Lockbox banks have no direct influence over the volume of  receipts. The compensation paid is therefore not a factor in measuring IRS  lockbox performance, and the lockbox contractual agreements contain no  direct incentives, positive or negative, related to cost. Lockbox bank  performance is measured on timeliness and quality factors, specifically  focusing on expediting the flow of funds to Treasury and ensuring that  receipts are accurately processed.
Because the basis for using lockbox banks was IRS’s and FMS’s belief that  the banks could process tax receipts faster than IRS could, timeliness is a  key measure of lockbox bank performance. Except during peak processing  periods, the agreements require that lockbox banks deposit receipts within  24 hours of their receipt at the lockbox bank. During peak processing  periods, all receipts must be processed and ready for deposit by the  assigned program completion date (PCD). According to the terms of the  lockbox contractual agreements, FMS may assess banks penalties or  terminate their contractual agreements if they fail to meet these deadlines.  The agreements also provide that the amount of any penalty assessed for  late deposit of tax receipts shall be based on the amount of interest  Treasury lost because of the delay. FMS imposed financial penalties on two  lockbox banks for not meeting the PCD during the April 1997 peak  processing period.
Meeting quality standards is another critical aspect of IRS lockbox banks’  performance. Processing errors can place unnecessary burdens on  taxpayers and delay processing of tax receipts. For example, a processing  error might cause a lockbox bank to withdraw more funds from a  taxpayer’s account than the amount actually written on the check. If the  taxpayer’s account contained inadequate funds to cover the incorrect  withdrawal amount, the taxpayer’s bank could assess penalties for  insufficient funds. If the error caused the bank to withdraw less than the  amount owed, IRS might erroneously assess the taxpayer interest and  penalties for an incomplete payment. The lockbox agreement provisions  allow FMS to assess lockbox banks financial penalties or to terminate an  agreement for poor performance. FMS added a new provision to the 2002  lockbox agreements that is designed to facilitate reimbursement to IRS and  FMS for costs they incur due to specific failures in performance, such as  costs resulting from lockbox banks’ errors in processing tax receipts. In  addition, the 2002 agreements clarified certain existing penalty provisions.
We found nothing inherent in the 1993 or 2002 lockbox contractual  agreements that would necessarily contribute to mishandling of taxpayer  receipts. Although a desire to avoid negative consequences, such as  financial penalties or contract termination, could cause lockbox bank  employees to make poor decisions, penalty and termination provisions are  necessary to help the federal government address inadequate contractor  performance. To help ensure that contractors are adhering to contract  terms and to reduce the risk that lockbox banks might compromise  taxpayer data, effective oversight of lockbox sites is essential.
section_title: Cause of the 2001 Incident Remains Under Investigation
paragraphs: The exact cause of the 2001 incident involving the loss and destruction of  taxpayer data and receipts at the Pittsburgh lockbox site has yet to be  officially reported. The site had a history of performance problems for  which the bank had been assessed financial and other penalties. In 1997,  FMS assessed the bank that operated the Pittsburgh site more than $1.4  million in penalties for failing to meet the assigned PCD and therefore  delaying availability of funds to the Treasury. In September 2000, FMS  placed the site on probation because of numerous uncorrected security  violations, including commingling of corporate and other government  agency processing with IRS processing. FMS, with IRS’s concurrence,  removed the site from probationary status 2 ½ months later, after a site  review conducted during the probationary period indicated that bank  management had corrected all but one of the security violations. A  subsequent, unannounced review by FMS and IRS 3 ½ months after the site  was taken off probation also found that past violations of security  requirements had not recurred and that the site was, for the most part, in  compliance with security requirements. Nevertheless, approximately 2  months after this review, the Pittsburgh site was found to have lost or  destroyed tens of thousands of tax returns, and, as a result, FMS  terminated its contractual agreement for the site. As of September 30, 2002,  IRS had spent over $4 million to obtain duplicate receipts and returns from  the affected taxpayers, and the federal government had lost an estimated  $13.5 million in interest as a result of the incident.
In October 2002, Mellon Bank agreed to pay the government $18.1 million  to cover administrative costs and expenses associated with the incident.  However, TIGTA is still investigating the incident to determine whether  criminal charges should be filed against any of the bank employees. As of  November 2002, TIGTA and the applicable U.S. Attorney’s Office were  unable to discuss this investigation with us. Until the investigation is  completed, we cannot determine whether the site’s interpretation of  contract provisions was a contributing factor to the 2001 incident or  whether provisions need to be added or revised to help prevent a similar  incident from occurring.
section_title: Oversight of Lockbox Banks Was Not Fully Effective
paragraphs: FMS and IRS oversight of lockbox bank operations is a key control for  ensuring that funds collected through the lockbox banks are protected  against fraud and mismanagement. The oversight functions performed by  FMS and IRS include various on-site and off-site reviews to ensure  compliance with LPGs and contract terms, evaluation of requests for  waivers from LPG requirements and proposed compensating controls, and  enforcement of penalties against banks that fail to meet LPG and contract  terms. In calendar year 2002, the agencies made significant improvements  to their oversight of lockbox operations, mostly in response to the  Pittsburgh lockbox incident. However, we found that the oversight of  lockbox banks was not fully effective in protecting the government’s  interests due to (1) a lack of clear directives and documented policies and  procedures for various oversight functions, (2) key oversight functions not  being performed, and (3) conflicting roles and responsibilities for IRS  lockbox coordinators. These issues reduce the overall effectiveness of IRS  and FMS oversight of lockbox banks. Additionally, the lack of clearly  defined oversight requirements increases the risk that the oversight  improvements made during 2002 may not continue in the future. According  to IRS officials, they are in varying stages of completing several  memoranda of understanding to identify and document oversight roles and  responsibilities. Until these roles and responsibilities are agreed to and  documented, however, oversight weaknesses are likely to continue to exist.
subsections: section_title: FMS and IRS Improved Oversight in 2002 but Have Not Incorporated Improvements in Agency Policies and Procedures
paragraphs: FMS and IRS made significant improvements to the oversight of lockbox  banks in 2002 compared with prior years. These improvements include (1)  enhanced monitoring of peak processing operations, (2) involvement of  key IRS officials in security reviews, (3) establishment of a new office with  a full-time FMS official responsible for oversight of lockbox security, and  (4) establishment of a new performance penalty provision to reimburse the  government for poor quality performance. However, many of the  improvements have not yet been institutionalized in the form of agency  policies and procedures. As such, there is less assurance that this increased  oversight will continue in the future.
subsections: section_title: Monitoring of Peak Period Operations Was Enhanced
paragraphs: Prior to 2002, FMS’s on-site presence during peak processing periods was  limited to only a few days each year and occurred near the end of the peak  periods to ensure that production goals were achieved. IRS’s on-site  presence at lockbox banks was generally limited to a lockbox coordinator,  who was present for the duration of the peak period. However, these  coordinators face competing demands of ensuring that lockbox sites  promptly deposit tax payments, performing quality and compliance  reviews, and assisting with other processing issues, such as training  lockbox staff.
In reaction to the Pittsburgh incident, FMS and IRS concluded that they  needed more on-site presence at lockbox banks during peak operations. In  April 2002, each lockbox site had at least one FMS official, one IRS  headquarters official, and the site’s designated lockbox coordinator present  for the entire April peak processing period. This increased on-site presence  provided IRS and FMS with more comprehensive coverage of April peak  operations.
During 2002, FMS and IRS also placed a heavier emphasis on monitoring  lockbox sites’ daily production status. According to IRS and FMS officials,  their focus historically has been on monitoring a lockbox site’s ability to  meet the overall April peak processing period’s PCD. IRS and FMS found  that this approach presented problems because lockbox banks tended to  address production problems during the peak processing period only when  meeting the PCD was questionable. The solution employed by the banks  was to bring in additional temporary staff near the end of the peak period  to be able to meet the PCD. FMS and IRS officials indicated that their  limited on-site presence affected the agencies’ ability to detect production  problems on a real-time basis. Only after the peak period did the lockbox  banks bring production issues to the attention of IRS and FMS.
In 2002, FMS and IRS officials focused on monitoring lockbox banks’ daily  production by reviewing production reports, observing production activity  on the processing floor, and reporting production issues to IRS and FMS  headquarters as soon as issues arose. During April 2002 and subsequent  smaller peak periods in June and September 2002, each lockbox site also  submitted, on a daily basis, an “FMS Daily Status Report.” These reports  noted the daily status of critical production issues, such as staffing  shortages and equipment problems, that could cause delays in the timely  deposit of tax receipts or could affect performance. FMS and IRS  headquarters officials reviewed these reports for potential problems and  contacted lockbox management and on-site agency officials for follow-up  and to facilitate timely resolutions of the problems.
While these changes enhanced monitoring of peak operating periods, these  improvements have not yet been incorporated into agency policies.  Currently, only the lockbox coordinator is required by IRS policies to be  on-site during the peak processing period. Personnel from FMS and IRS  headquarters are not mandated by agency policies to be at lockbox sites  during this time. Additionally, IRS officials indicated that they might not  have adequate headquarters staff to assist with future on-site reviews. As a  result, there is less assurance that increased on-site presence of staff at  lockbox sites during peak processing periods will continue.
section_title: IRS Personnel with Physical Security Expertise Now Perform Security Reviews
paragraphs: After the 2001 Pittsburgh incident, IRS concluded that its participation in  joint IRS/FMS annual unannounced security reviews should be performed  by IRS staff with security expertise. Prior to 2002, personnel from IRS’s  Wage and Investment Division, who have primary responsibility to manage  the lockbox program, performed physical security reviews but did not have  physical security expertise. During 2002, IRS’s Agency-Wide Shared  Services (AWSS), which has staff with physical security expertise and  performs physical security reviews at IRS Submission Processing Centers,  began participating in the joint IRS/FMS unannounced security reviews.  However, IRS policies only require the Wage and Investment Division to  perform unannounced security reviews. AWSS’s participation in lockbox  reviews is based only on an oral agreement to perform such reviews. As  such, there is less assurance that AWSS will continue to perform lockbox  security reviews in the future.
section_title: FMS Established the Bank Review Office
paragraphs: Prior to 2002, FMS’s Financial Services Division (FSD), which had the  administrative responsibility for negotiating and entering into lockbox  contracts with financial institutions, also had the responsibility to oversee  lockbox banks’ compliance with contract terms, such as security  requirements. To effectively perform its oversight responsibilities, FMS  recognized a need to establish a full-time position responsible for oversight  of lockbox security. In August 2002, FMS formally established the Bank  Review Office. The director and staff of this office are now responsible for  FMS’s oversight of the security of federal government lockbox banks. Their  responsibilities now include performing on-site reviews, following up on  corrective actions to address review findings, and reviewing the adequacy  of security requirements for lockbox banks. The director of this office now  serves as the main FMS contact point on most oversight issues for IRS and  lockbox banks.
section_title: New Performance Penalty Provision Established
paragraphs: A new provision was added to the 2002 contractual agreements to assist the  government in obtaining reimbursement from lockbox banks for direct  costs incurred by IRS to correct performance failures on the part of  lockbox banks. This provision enhances the government’s ability to  penalize lockbox banks for poor quality work and be reimbursed for the  additional costs IRS incurs to rework transactions erroneously processed  by lockbox banks. Effective use of this provision requires additional  guidelines and procedures to help management decide whether certain  situations merit pursuing the penalty provision. Such guidelines and  procedures should include (1) IRS’s expectations for unacceptable error  rates, (2) procedures to identify and document lockbox errors, and (3)  procedures to track IRS costs incurred as a result of rework.
During 2002, IRS had not established guidelines and procedures for  effective use of the new performance penalty provision. IRS cited three  reasons why guidelines and procedures had not yet been established. First,  IRS has not yet determined thresholds for unacceptable error rates.  Second, IRS officials indicated that the agency had spent significant  resources to document and build a legally defensible case to obtain  reimbursement of costs related to the 2001 incident. Based on lessons  learned from this case, IRS concluded that it needed to establish a more  cost-effective means to accurately identify and document lockbox errors,  as opposed to errors caused by taxpayers or IRS. During 2001, IRS tested a  process to identify and document lockbox errors but concluded that the  process was too labor-intensive and might not provide accurate and legally  defensible data. Therefore, IRS is still exploring other methods to obtain  these data. Finally, IRS officials explained that by law, reimbursements  from lockbox banks would have to be remitted to the U.S. Treasury general  fund and that they had explored legal options to keep the reimbursed funds  for IRS’s own use.
The reimbursement provision is a critical tool available to the government  as a means to recover from lockbox banks costs incurred as a result of  poor quality work and as an enforcement tool to encourage banks to  implement effective controls and procedures to accurately process  receipts. However, until the necessary guidelines and procedures are  established, IRS and FMS cannot effectively use this oversight tool. As a  result, the government may be paying for poor quality work and incurring  additional costs to correct errors.
section_title: FMS and IRS Did Not Perform Certain Key Oversight Functions
paragraphs: Despite significant improvements, we found several instances where key  oversight functions were not performed, which resulted in an increased  risk of loss to the government and taxpayers. Specifically, (1) IRS and FMS  did not take timely action on lockbox sites’ requests for waivers from LPG  requirements, (2) IRS did not always participate in unannounced security  reviews, (3) FMS did not always obtain formal responses from lockbox  bank management to unannounced security reviews, and (4) IRS lockbox  coordinators did not always complete reviews for peak processing periods.  Additionally, the guidance used for these reviews needs to be strengthened.
subsections: section_title: IRS and FMS Did Not Take Timely Action on Formal Requests for Waivers
paragraphs: The LPGs set forth security and processing requirements for lockbox sites.  They also allow deviations from these requirements if bank management  submits a written waiver request to IRS and FMS. The bank must  demonstrate its site’s legitimate inability to meet a requirement and must  implement an alternate procedure or compensating control. In practice,  after a bank submits a written waiver request stating the reason for its site’s  inability to meet the LPG requirement and explaining its compensating  control to mitigate risks of loss to the government, IRS and FMS allow the  site to operate with its compensating control while they review the waiver  request. However, because some waiver requests will eventually be denied  after FMS and IRS conclude that the compensating controls are not  adequate, some sites with inadequate controls are, in effect, allowed to  operate in noncompliance with the LPGs until their waiver is officially  denied. Therefore, to protect the government from losses resulting from a  site’s noncompliance, FMS and IRS have a fiduciary duty to approve or  disapprove waiver requests and effectively and promptly communicate  final decisions.
Prior to April 2002, IRS and FMS approved and disapproved waiver  requests orally. To better coordinate their efforts, the agencies decided to  develop a written joint process to assess waiver requests in April 2002.  However, this process was never formalized in agency policies. IRS  provided us a draft document of the joint waiver assessment process.  According to the draft document, lockbox banks would submit a waiver  request form to FMS. FMS would assess the waiver request and forward the  request with FMS’s recommendations to an IRS waiver coordinator. The  IRS waiver coordinator would disseminate the waiver requests to various  units within IRS responsible for assessing the waiver requests. Once  appropriate IRS officials had made their decisions and signed off on the  waiver forms, the IRS waiver coordinator would forward the waiver form  with IRS’s decision to FMS. FMS would notify the bank of the joint decision  by returning the waiver request form with both agencies’ responses. The  draft document indicates that the whole process should take about 6 days  from FMS’s receipt of the waiver request form.
According to our review of waiver requests made from April 16 through  April 22, 2002, FMS forwarded to IRS its recommendations on most of the  requests within 5 days of receiving them from lockbox banks. However, IRS  took 5 months to officially sign half of the waivers. According to IRS  officials, this delay resulted from a misunderstanding on the part of some  IRS officials about whether IRS had to complete the waiver forms if IRS  had already orally informed FMS of its decision. FMS postponed notifying  the banks of a decision on their requests because it was waiting to receive a  formal written decision from IRS for each request. However, 4 months after  FMS received the requests for waivers and with no official decision from  IRS, FMS decided to inform the lockbox sites of its unilateral disapproval  of the banks’ waiver requests to mitigate the risk of loss to the government  from lockbox sites not operating in compliance with the LPGs.
Although most of the waiver requests were not related to critical  requirements, one lockbox waiver pertained to a critical LPG security  requirement. Under this requirement, temporary employees must provide  photo identifications to the guards in exchange for badges allowing them  access to the processing area. This control procedure was designed to  validate the identity of individuals claiming to be employees before they  enter the processing area. Bank management at one lockbox bank believed  that its automated entry system provided adequate compensating controls  against unauthorized access to tax data and receipts and that the manual  verification of each employee’s identity was unnecessary. The bank  therefore did not perform the procedure. FMS and IRS eventually denied  the request, stating that the lockbox bank’s compensating controls did not  provide sufficient protection against unauthorized entry. However, because  of the breakdown in the joint waiver assessment process and the resulting  delay in notifying the bank of the agencies’ decision, tax receipts and data  were unnecessarily exposed to an increased risk of theft. Bank  management had informally requested a waiver for the same issue in  August 2001, before FMS and IRS established their formal waiver process  in April 2002. IRS officials indicated that they had already orally informed  the bank that its initial request for a waiver was denied and had also  informed FMS during a meeting that the subsequent request submitted on  the official waiver request form in April 2002 was denied. Therefore, IRS  officials concluded that it was not necessary to review the April 2002  formal waiver request. FMS postponed notifying the banks of the decision  because it was waiting for IRS’s decision in writing. After FMS decided to  inform banks of its unilateral decisions on their formal waiver requests, it  notified this site of its decision to deny the waiver request in mid-August  2002. As a result, the site operated in noncompliance with this security  requirement for over 7 months, from January through August 2002. This  period included the April 2002 peak period, when the bank operated in  three shifts with as many as 300 employees per shift. IRS and FMS officials  indicated that they are developing several memoranda of understanding  between the two agencies to better coordinate oversight efforts, including  the joint waiver assessment process.
section_title: IRS Did Not Always Participate in Unannounced Security Reviews
paragraphs: In response to a Treasury OIG recommendation, IRS and FMS began  performing unannounced security reviews of lockbox bank sites. IRS’s IRM  requires its Wage and Investment Division to conduct joint unannounced  security reviews with FMS. However, IRS did not participate in the first  three unannounced security reviews in 2002. The IRS official who would  have participated in these security reviews had an extensive technical  background in physical security, which would have been helpful in  detecting physical security deficiencies. According to IRS officials, IRS did  not participate in the reviews because the units responsible for performing  various security reviews for both agencies were reorganizing during early  2002 and the agencies had failed to effectively communicate who would be  the responsible parties to perform the unannounced security reviews. IRS  officials indicated that they plan to include coordination of security  reviews between the two agencies in a memorandum of understanding  currently being developed.
section_title: FMS Did Not Always Obtain Responses from Lockbox Bank Management to Unannounced Reviews
paragraphs: Effective oversight of lockbox banks requires appropriate follow-up on  corrective actions taken to address deficiencies found during on-site  reviews. As part of its follow-up procedures, FMS requires lockbox bank  management to provide an official management response to reports on its  unannounced reviews. In their response, bank managers are to indicate  whether corrective actions have been taken or propose corrective actions  and the dates by which the bank intends to implement them. Personnel  from FMS’s FSD are responsible for obtaining management responses.  However, FSD failed to obtain formal management responses for three  unannounced security review reports issued in 2001 because FSD staff  were preoccupied with the Pittsburgh lockbox incident and with  implementing the 2002 lockbox network. Additionally, the tracking  procedure in place to remind staff to obtain management responses was  ineffective. As a result, FMS did not have sufficient information to assess  the adequacy or timeliness of proposed corrective actions or corrective  actions already taken.
FMS and IRS found the same security problems identified by these reviews  several months later. Although two of the three locations had closed after  2001, bank managers from one of the closed locations were transferred to  manage a new lockbox location in the 2002 lockbox network. In a  subsequent visit to this new location, FMS found the same security  violation that it had found in 2001 at the closed site regarding the lack of a  seeding program. Additionally, a subsequent visit by FMS and IRS to the  location that continued to operate in 2002 revealed problems with  malfunctioning perimeter door alarms that were similar to problems  identified during the previous unannounced security review. The lack of  effective controls to ensure that bank managers take corrective actions  increases the risk that identified security weaknesses will not be corrected.  According to FMS officials, the recently created Bank Review Office,  whose staff have full-time responsibility for security oversight, is now  responsible for following up on management responses to security reviews.  Additionally, FMS officials indicated that they plan to create an automated  tracking system to better track the status of management responses.
section_title: Lockbox Coordinators’ Reviews Were Not Adequately Performed
paragraphs: The IRM specifically directs lockbox coordinators to perform on-site  reviews of lockbox banks during peak processing periods. The scope of  these on-site reviews includes assessments of the lockbox site’s  compliance with critical processing and security requirements. Lockbox  coordinators record the results of their reviews on forms specifically  designed to show results of observations and sampling of transactions to  determine the lockbox site’s compliance with specific security and  processing requirements.
However, for the January and April 2002 peak processing periods, lockbox  coordinators did not adequately perform these reviews. Specifically,  coordinators did not perform reviews for four lockbox sites for the January  2002 peak processing period. In addition, some of the information to be  recorded on the forms used by the coordinators to document their reviews  was not provided. For the April 2002 peak period, all the coordinators  submitted the results of their reviews, but some of the reviews and the  forms used to document them were only partially completed. IRS officials  explained that the reviews could not be completed because several  lockbox sites were new to the lockbox network during 2002 and therefore  required full-time support from their lockbox coordinators. Because the  reviews were not always completed, IRS may not have detected instances  of noncompliance and therefore would not have been able to take  immediate corrective actions.
The guidelines for the reviews conducted by lockbox coordinators also  need to be strengthened. To provide adequate oversight of lockboxes,  lockbox coordinator reviews should include steps to assess critical  controls and procedures for lockbox security and processing. In general,  the lockbox coordinators’ reviews provide coverage for most of these  areas. However, we found other critical controls and procedures not  sufficiently covered by lockbox coordinator reviews because the guidelines  and review procedures were either unclear or did not require these  controls and procedures to be subject to review. These deficiencies could  lead to IRS’s failure to detect significant instances of noncompliance.
For example, while TIGTA found that couriers with criminal records at one  lockbox location were given access to taxpayer data before their FBI  fingerprint checks were completed, the lockbox coordinator’s review  found the same location to be in compliance with courier requirements. We  found that there is no specific step in the lockbox coordinator review  procedures to determine whether all couriers given access to taxpayer data  have completed favorable FBI fingerprint checks, as required by the LPGs.
The review procedures only broadly ask whether the courier service is in  compliance with the LPGs. Additionally, while the review procedures  require coordinators to sample employee files to determine lockbox  compliance with FBI fingerprinting requirements, there is no similar review  step to determine lockbox compliance with FBI fingerprint checks for  couriers and contractors. Lockbox coordinators we interviewed stated that  during their on-site reviews, they did not verify whether couriers had  completed favorable FBI fingerprint checks before they were given access  to taxpayer data.
As discussed later in this report, we also found problems with some  lockbox sites’ controls to account for cash payments received from  taxpayers and items found during candling. For example, the internal logs  used by some lockbox sites to record cash received and items found during  candling did not reconcile with the logs they submitted to IRS, raising  questions about possible missing payments. Lockbox coordinators did not  detect this problem because they are not required to and do not review  internal lockbox logs for cash payments and candled items.
section_title: Lockbox Coordinators’ Conflicting Roles and Responsibilities Could Impair Their Objectivity
paragraphs: IRS lockbox coordinators are responsible for the day-to-day administration  of the lockbox program, including providing guidance and training to  lockbox staff and ensuring that the lockbox banks promptly address  production problems that may delay the deposit of funds to the Treasury.  Lockbox coordinators are also responsible for performing on-site reviews  to assess work quality and the bank’s compliance with security  requirements. This creates a situation in which lockbox coordinators have  multiple and conflicting responsibilities.
When faced with competing demands, the likelihood increases that the day- to-day pressures of administering the lockbox program will take  precedence over oversight responsibilities. For example, according to IRS  officials, the lockbox coordinators’ failure to complete their peak period  reviews resulted from competing demands. Lockbox coordinators are  responsible for performing quality reviews and for assisting lockbox banks  with processing issues. IRS Wage and Investment officials indicated that  some of the lockbox coordinators could not complete their reviews  because more pressing matters concerning lockbox operations,  particularly at new lockbox sites, required most of their attention.
The close working relationship with bank management that lockbox  coordinators develop while helping bank management meet processing  goals could also impair coordinators’ objectivity and independence when  they are evaluating the bank’s compliance with LPG requirements. The  Treasury OIG raised this issue in 1998 when it recommended that  coordinators periodically rotate out of their coordinator positions to help  maintain independence. However, IRS has not yet addressed this issue,  citing its need to retain experienced lockbox coordinators to assist with the  implementation of the 2002 lockbox network. IRS officials indicated that  there are plans to reorganize positions of lockbox coordinators to address  the independence issue. Until this issue is addressed, IRS has no  independent overseers with sole responsibility for monitoring lockbox  bank compliance during peak processing periods.
section_title: Lockbox Banks’ Internal Control Deficiencies Expose the Federal Government to Theft and Loss
paragraphs: The Comptroller General’s Standards for Internal Control in the Federal  Government require that access to resources and records, such as IRS  receipts and taxpayer data, be limited to authorized individuals to reduce  the risk of unauthorized use or loss to the government. Lockbox banks,  working as financial agents of the federal government, have a responsibility  to protect taxpayer receipts and data entrusted to them. Tax receipts, such  as cash and checks, are highly susceptible to theft, and unauthorized use of  taxpayer data could result in identity theft and financial fraud. For  example, from October 1, 2000, to April 30, 2002, TIGTA initiated  investigations of theft of receipts valued at almost $2 million from the IRS  lockbox network. It is therefore critical that lockbox banks implement a  strong system of internal controls for the lockbox sites they operate.
Prior audits by GAO and TIGTA have noted internal control weaknesses at  lockbox sites. For example, in fiscal year 2000, we found that background  screening for a temporary lockbox employee’s criminal history was limited  to a local police records check and that some employees were given access  to taxpayer data and receipts before completion of their background  screening. We also found that lockbox couriers were subject to less  stringent standards than IRS couriers. For example, lockbox couriers were  not required to travel in pairs when transporting taxpayer data. We  reported that these control weaknesses could lead to thefts of taxpayer  receipts and data at lockbox banks.
IRS and lockbox banks have implemented several additional safeguarding  controls in response to audit findings and the 2001 incident at the  Pittsburgh site. For example, IRS now requires lockbox employees to have  obtained favorable results on their FBI fingerprint checks, which are  nationwide checks of criminal records, before they receive access to tax  data. IRS has also enhanced lockbox courier security guidelines.  Nevertheless, during our recent visits to all nine lockbox locations, we  found internal control deficiencies in the areas of (1) physical security, (2)  processing controls, (3) courier security, and (4) employment screening.  These control weaknesses, if uncorrected, could lead to significant losses  to the government and taxpayers because they increase the risk of loss,  theft, or mishandling of taxpayer receipts and data. Table 1 demonstrates  the pervasiveness of the internal control issues found during calendar year  2002. These issues are discussed briefly below and are discussed in more  detail in appendix I.
subsections: section_title: Physical Security Weaknesses Could Allow Unauthorized Access to Taxpayer Data and Receipts
paragraphs: Given the large volume and assembly-line nature of tax receipt processing,  lockbox operations generally occur in areas with open floor plans, where  taxpayer data and receipts are easily accessible to individuals on the  processing floor. Thus, the vulnerability of sensitive tax data and receipts  to theft or misuse is heightened. This vulnerability underscores the need  for effective controls to deter and detect unauthorized access to taxpayer  data and receipts. However, during our visit to lockbox locations, we  observed numerous physical security breaches. Of the nine lockbox  locations we visited, we found the following:  At four locations, perimeter doors leading into processing areas were  unlocked or door alarms did not function effectively.
At two locations, guards were not responsive to alarms.
At one location, employee identification was not adequately verified.
At two locations, employment status of temporary employees was not  adequately verified.
At two locations, visitor access to and activity in processing areas were  not adequately controlled.
At six locations, guards did not closely monitor items brought into or  out of the processing areas or prevent unauthorized items, such as  personal belongings, in the processing area.
At seven locations, camera surveillance needed to be improved.
These security weaknesses increase the risk of theft and mishandling of  taxpayer data and receipts and reduce the possibility of the timely  detection of such incidents.
section_title: Processing Controls Need Improvement to Better Account for and Protect Taxpayer Data and Receipts
paragraphs: In addition to physical security controls, lockbox banks are required to  implement processing controls to maintain accountability for and security  over transactions as they are processed in the normal course of operations.  During our visits, we found deficiencies in processing controls designed to  account for or protect tax data and receipts at most of the lockbox  locations. Specifically, of the nine locations we visited, we found the  following:   At four locations, candling procedures were not adequate to minimize  the risk of accidental destruction of tax data and receipts.
At four locations, lockbox bank management did not reconcile candling  logs to properly account for all items found during candling.
At six locations, lockbox bank managers did not perform required  reviews of the candling process or did not adequately document results  of their reviews.
At three locations, controls were not in place to adequately safeguard  and account for cash receipts.
At seven locations, returned refund checks were not adequately  protected against theft.
At one location, timely payments were incorrectly processed as  delinquent.
Inadequate accounting and safeguarding of tax payments and related  vouchers or returns could lead to taxpayer burden, such as penalties and  interest for failure to pay tax liabilities, if these items are accidentally  destroyed, stolen, or incorrectly processed. Additionally, inadequate  processing controls could result in errors not being detected promptly or  additional work for IRS employees who must correct taxpayer accounts as  a result of errors.
section_title: Courier Security Weaknesses Expose Tax Data and Receipts to Theft and Loss
paragraphs: Lockbox banks employ courier services to deliver (1) mail from post  offices to lockbox processing sites, (2) processed checks to depository  banks, and (3) tax data and unprocessable receipts to IRS Submission  Processing Centers. During peak processing periods, couriers are entrusted  with transporting thousands of pieces of mail each day that contain tax  data, cash, checks, and deposits worth millions of dollars. Given the  susceptibility of these items to theft and loss, it is important that they be  carefully safeguarded while in transit to and from lockbox locations.  However, our review and reviews conducted by TIGTA and IRS found  several problems with courier security during calendar year 2002. These  problems relate to failure to comply with courier security requirements as  well as deficiencies in the current requirements. Specifically, at the nine  locations, we and other reviewers found the following:  At one location, couriers with criminal records were given access to tax  data before bank management received results of their FBI fingerprint  checks.
At two locations, couriers were not properly identified.
At two locations, courier vehicles containing tax data and receipts were  not locked.
At all locations, background screening requirements for lockbox  couriers were less stringent than screening requirements for IRS  couriers.
At all locations, courier requirements did not prohibit unauthorized  individuals in courier vehicles or require lockbox staff to inspect courier  vehicles for unauthorized passengers.
Until these courier security weaknesses are addressed, tax data and  receipts in transit to and from lockbox locations are exposed to higher  risks of theft and loss.
section_title: Background Screening of Lockbox Employees Needs Further Improvement
paragraphs: Because lockbox employees are entrusted with handling sensitive taxpayer  information and billions of dollars in receipts annually, ensuring worker  integrity through a carefully managed recruiting and hiring process is an  area that demands special attention from IRS, FMS, and lockbox  management. However, during our review and those performed by TIGTA  and IRS, we found that lockbox banks did not always comply with the FBI  screening requirements and that further refinements to background  investigation requirements for lockbox employees are needed. Specifically,  for the nine locations, we and other reviewers found the following:   At five locations, employees were given access to taxpayer data and  receipts before bank management received results of their FBI  fingerprint checks.
At all locations, requirements for background investigations of lockbox  permanent employees were unclear and resulted in variations in the  scope and documentation of background investigations conducted on  them.
At all locations, FBI fingerprint checks for lockbox employees who are  not U.S. citizens with lawful permanent residence status may not be  adequate to disclose criminal histories for individuals who have only  recently established residence in the United States.
These weaknesses increase the risk of theft of tax data and receipts by  individuals who may be unsuitable to work at IRS lockbox sites.
section_title: A Comprehensive Study Evaluating Costs for IRS Processing Versus Using Lockbox Banks for All Types of Tax Receipts Has Not Been Performed
paragraphs: IRS and FMS have not performed a comprehensive study evaluating the full  range of costs and benefits of IRS processing tax receipts versus the  lockbox banks processing the receipts for all types of tax receipts  processed by the banks. Over the years, several studies have been  performed evaluating the degree of interest float savings resulting from the  use of lockbox banks. IRS and FMS jointly performed the most recent  study in 1999 in response to a Treasury OIG recommendation. In the 1999  joint study, IRS and FMS considered the costs and benefits to the federal  government of using lockbox banks rather than IRS to process Form 1040  tax receipts more quickly. Having adopted this perspective in accordance  with Treasury regulations, IRS and FMS did not consider some costs, such  as opportunity costs, or the results from alternative uses of the money  spent to achieve speedier deposits. Foregoing speedier deposit of tax  receipts and using the funds elsewhere could, according to recent IRS data,  result in financial benefits to the government that could be greater,  depending on the study assumptions used. In effect, IRS and FMS did not  consider the implications of such alternatives available to IRS. In addition,  the study did not clearly define the type of analysis done. Differing types of  analysis would require consideration of differing costs and benefits and  could result in different decisions than were made on the basis of the 1999  study.
Due to changes in IRS, the lockbox bank network, and other factors, the  1999 study will not be useful to support IRS and FMS officials’ future  decision about whether to continue the lockbox arrangement when the  current agreements expire in 2007. IRS and FMS officials initially stated  that they had not planned to conduct a new study before the lockbox  agreements expire in 2007, but that a new study might be appropriate given  many changes and the passage of time since 1999.
subsections: section_title: The 1999 Study Results Did Not Consider All Costs and Benefits
paragraphs: In keeping with instructions in the Treasury Financial Manual (TFM), the  purpose of the IRS/FMS study was to determine whether using lockbox  banks or IRS to process most individual income tax receipts would  minimize the total cost to the federal government. The TFM defines total  cost to include agency costs, the cost of purchased services, and any loss of  interest earnings to the government due to delays in depositing receipts.
The study described three scenarios (described in app. II) in comparing  estimated lockbox bank and IRS processing costs for fiscal years 2001  through 2007 based on different assumptions. The study used scenario I,  the most conservative scenario, to support the decision to continue using  lockbox banks. This scenario showed that IRS could spend about $56  million to internally process tax receipts, or could join with FMS to spend a  total of $144.9 million to use lockbox banks to process tax receipts more  quickly. The study concluded that the lockbox processing would be more  costly but would save the government $100.5 million in interest that  otherwise would be lost due to slower deposits if IRS processed the  receipts. These interest savings more than offset the additional processing  costs, producing net savings over 7 years of $11.6 million to the federal  government from using lockbox banks rather than IRS to process tax  receipts. Scenario I is used throughout this report in the cost comparisons  shown, unless otherwise noted. Table 2 shows these cost comparisons.
However, IRS and FMS did not consider various costs in these estimates.  Most notably, they did not consider opportunity costs related to alternate  uses of IRS funds to accelerate tax deposits. Each year, the Congress  approves a budget for an agency and provides discretion, within certain  constraints, on agency spending. Given resource constraints, IRS must  effectively choose how to spend its fixed budget. IRS and FMS decided that  it would be worth spending $4.4 million more out of IRS’s budget to use  lockbox banks to process tax receipts compared to IRS’s slower process  because net savings to the government would reach $11.6 million over the 7  years.
IRS and FMS did not consider whether greater financial benefits could  accrue to the government if IRS processed receipts and used the estimated  extra $4.4 million from IRS’s budget to generate higher revenues through  other programs or activities. Recent estimates by IRS’s Research Division  have pointed to other activities—such as tax enforcement—in which  spending the extra $4.4 million would have generated from at least $44  million to well over $100 million. For example, in some enforcement  programs for just individual taxpayers, the ratio of estimated marginal tax  revenue gained to additional spending was  13:1 to pursue known tax debts through phone calls,  32:1 to identify unreported income by computer matching tax returns  and information returns, such as Forms W-2 and 1099, and  11:1 to audit tax returns through correspondence.
Our reference to these alternate uses and ratios is for illustrative purposes.  We did not analyze the basis for IRS’s estimates that produced these ratios.  However, we have found over the years that IRS has had difficulty readily  accumulating the costs of various activities because IRS lacks a cost  accounting system. Despite these caveats, if these estimated ratios and  scenario I estimates are approximately accurate, IRS and FMS might have  made a different decision by considering opportunity costs.
Although opportunity costs may be the most significant costs not  considered, the study also excluded certain direct IRS and FMS costs, as  discussed below.
IRS and FMS costs to oversee lockbox bank processing: As discussed  earlier in this report, these agencies use staff to oversee and review  operations of lockbox banks.
Costs to reduce the risk in processing tax receipts: This risk became  evident during the 2001 filing season, with the incident at the Pittsburgh  lockbox affecting about 78,000 taxpayer receipts. As of September 30,  2002, the government had lost an estimated $13.5 million in interest  from missing tax receipts, and IRS has spent about $4.3 million to  resolve problems with taxpayer accounts. In October 2002, Mellon Bank  agreed to pay the government $18.1 million to cover administrative costs  and expenses associated with the incident; however, these costs  continue to grow as IRS is still resolving some issues.
Costs to process different types of receipts: The study only considered  Form 1040 tax receipts in response to a Treasury OIG report that  questioned having lockbox banks rather than IRS process such tax  receipts. Lockbox banks are also paid to process other types of tax  receipts related to more than 10 other tax forms, such as Forms 1041  and 941.
It is not known if these costs would be significant enough to change the  study’s conclusions. It is also not known to what extent such costs would  be offset by additional direct costs to IRS associated with returning the  receipt processing function to IRS.
section_title: Alternate Study Approaches Could Affect the Costs and Benefits Considered and the Study Results
paragraphs: IRS and FMS characterized the study at various times as a cost-benefit  analysis and as a cost-effectiveness analysis. These types of studies would  include different costs and benefits from those included in the 1999 study.  If IRS and FMS had done a cost-benefit or cost-effectiveness study, the  resulting conclusions may have differed. Being clear about the type of  analyses being done and the limitations and uses of the related results  helps decision makers to interpret and use those results.
The 1999 study was neither a cost-benefit nor a cost-effectiveness analysis  in economic terms. Cost-benefit and cost-effectiveness analyses are two  tools that are commonly used to determine whether government  investments or programs can be justified on economic principles. These  tools also help to identify the best alternative from a range of competing  investment alternatives. Economists commonly agree that, when either of  these two analyses is used to evaluate federal programs that affect private citizens or other entities, the analysis should include costs and  benefits to individuals and entities outside of the federal government.
The IRS/FMS study was not a cost-benefit analysis because it did not  consider costs or benefits to individuals or entities outside the federal  government, such as taxpayers. By considering costs and benefits beyond  the government, the study should address whether the benefits gained by  the federal government (on behalf of society as a whole) outweigh the  costs imposed on certain members of society, such as taxpayers. The  lockbox program affects taxpayers and/or their banks by reducing their  interest float benefits through quicker depositing of their tax receipts. The  additional interest gained by the federal government through accelerated  tax deposits comes with a similar loss of interest to taxpayers who mail in  payments. The acceleration of deposits largely shifts who benefits. This  shifting of interest benefits may have some value to society in terms of a  more equitable sharing of the costs of government; however, it is difficult to  put a dollar value on improved equity and that value is not necessarily equal  to the dollar amount of interest that is transferred from taxpayers and/or  banks to the government. Since these interest gains by the federal  government made the use of lockbox banks beneficial, a different valuation  of these gains could have resulted in a different decision about whether to  contract with the banks.
The study also is not a cost-effectiveness analysis because it did not  compare program alternatives that had the same objectives. Instead, the  alternatives of using lockbox banks or IRS staff to deposit tax receipts  assumed that lockbox banks would achieve a faster speed of depositing  receipts than IRS. In order to determine the cost-effectiveness of the  lockbox program, the analysts would have had to compare the costs of that  program to the costs of one or more IRS alternatives that would achieve the  same speed of depositing. It is not clear that a cost-effectiveness study  comparing like processing speeds would have yielded the same result as  the 1999 study.
The specific type of study that should be done to support a decision about  whether to accelerate the deposit of tax receipts through lockbox banks is  a matter of judgment. However, because the type of analysis that flows  from the decision about the type of study to do can affect the study results,  it is important that study leaders clearly define the type of analysis to be  undertaken and why.
section_title: 1999 Study Will Not Support IRS’s and FMS’s Future Decision about Continuing the Lockbox Bank Arrangement beyond 2007
paragraphs: Since 1999, many changes have occurred at IRS and the lockbox bank  network that could affect processing and future cost comparisons. For  example, IRS began moving to a new organizational structure in October  2000, which has changed where and how IRS processes certain types of tax  returns and receipts. In addition, the network of lockbox banks (in terms of  how many and which banks are involved) has changed. Starting in 2002,  processing also included new security requirements, such as having FBI  fingerprint checks done for each employee or contractor, to reduce the  risks of thefts. Finally, changes in the 1999 study assumptions would be  likely by 2007. Such assumptions involve  the number of days of interest float;   the number of tax receipts and number of Forms 1040 filed  electronically;  IRS labor, computer, and space costs;   lockbox bank charges; and   interest rates.
For example, IRS and FMS assumed that lockbox banks would process tax  receipts 1.384 days faster than IRS under scenario I based on a 1998 study  by a contractor. However, IRS and FMS cannot be certain that any  advantage that lockbox banks might have had in 1999 still exists due to the  changes to IRS’s structure and the lockbox bank network.
IRS and FMS officials stated that they had not planned to conduct a new  study before the lockbox agreements expire in 2007. However, they have  indicated that such a study may be warranted given many changes and the  passage of time since 1999.
section_title: Conclusions
paragraphs: Approximately $268 billion in tax receipts IRS collected in fiscal year 2002  were processed through lockbox banks. Given the significance of tax  receipts processed by lockbox banks, effective oversight and sound  internal controls at lockbox sites are critical to protect taxpayer data and  receipts. The loss and destruction of tax receipts at the Pittsburgh lockbox  site highlighted the need for increased scrutiny and oversight of these  banks.
Our review of the 1993 and 2002 lockbox contractual agreements revealed  nothing inherent in their provisions that would necessarily encourage  lockbox employees to mishandle taxpayer receipts. It is possible that in an  effort to avoid penalties allowed under the agreements, such as financial  penalties or contract termination, lockbox bank employees might make  poor decisions about handling taxpayer receipts; however, these are  important provisions designed to help the government address inadequate  contractor performance.
While FMS and IRS significantly improved their oversight of lockbox banks  during 2002, oversight and internal control deficiencies impeded the  effectiveness of this oversight in minimizing the risk to the federal  government and taxpayers. These deficiencies need to be addressed to  provide increased assurance that taxpayer data and receipts are properly  safeguarded. IRS’s and FMS’s oversight of lockbox banks has not been fully  effective primarily because their oversight roles and responsibilities have  not been sufficiently defined and documented. Additionally, numerous  internal control weaknesses need to be corrected and certain provisions of  the lockbox processing guidelines need to be revised. Until these oversight  and internal control deficiencies are addressed, the security of taxpayer  data and receipts may be compromised.
The most recent study done by IRS and FMS in 1999 followed Treasury  regulations in considering only the costs and benefits to the federal  government of achieving speedier tax deposits by using lockbox banks to  process individual tax receipts (Form 1040). In doing so, the study did not  consider other types of receipts processed by the lockbox banks or some  relevant direct costs in comparing lockbox and IRS processing costs nor  did it consider opportunity costs. Accounting for opportunity costs would  be consistent with agencies’ responsibility to use budget funds  economically and efficiently and should be considered regardless of the  type of analysis that IRS and FMS undertake. However, the type of analysis  affects other types of cost and benefit data that should be considered and  therefore may affect the study results. IRS and FMS were not clear on the  type of analysis done in 1999. Because certain data and assumptions from  the 1999 study are now obsolete, IRS and FMS will need to conduct another  study to determine whether to continue using lockbox banks when the  agreement expires in 2007.
section_title: Recommendations for Executive Action
paragraphs: To decrease the likelihood that further incidents involving the loss and  destruction of taxpayer receipts and data will occur, we recommend that  the Commissioner of FMS and Acting Commissioner of IRS thoroughly  review the results of TIGTA’s investigation of the 2001 incident at the  Pittsburgh lockbox site when it is completed and, if the results warrant,  implement additional controls and modify the lockbox contractual  agreements as appropriate.
To improve the effectiveness of government oversight of lockbox banks,  we recommend that the Commissioner of FMS and the Acting  Commissioner of IRS  document IRS’s and FMS’s oversight roles and responsibilities in agency  policy and procedure manuals and determine the appropriate level of  IRS and FMS oversight of lockbox sites throughout the year, particularly  during peak processing periods;  establish and document guidelines and procedures in IRS and FMS  policy and procedure manuals for implementing the new penalty  provision for lockbox banks to reimburse the government for direct  costs incurred in correcting errors made by lockbox banks;  finalize and document the recently developed waiver process in IRS and  FMS policy and procedure manuals and ensure that decisions on  requests for waivers are formally and promptly communicated to  lockbox management; and  establish and document a process in IRS and FMS policy and procedure  manuals to ensure that lockbox bank management formally responds to  IRS and FMS oversight findings and recommendations promptly and  that corrective actions taken by lockbox bank management are  appropriate.
To improve the effectiveness of government oversight of lockbox banks,  we also recommend that the Acting Commissioner of IRS  establish and document a process in IRS policy and procedure manuals  to ensure that IRS officials with the appropriate levels of expertise  continue to participate in announced and unannounced security reviews  of lockbox banks;  ensure that the results of on-site compliance reviews are completed and  promptly submitted to IRS’s National Office;  revise the guidance used for compliance reviews so it requires reviewers  to (1) determine whether lockbox contractors, such as couriers, have  completed and obtained favorable results on IRS fingerprint checks and  (2) obtain and review all relevant logs for cash payments and candled  items to ensure that all payments are accounted for; and   assign individuals, other than the lockbox coordinators, responsibility  for completing on-site performance reviews.
To improve internal controls at lockbox banks, we recommend that the  Commissioner of FMS and the Acting Commissioner of IRS  require that internal control deficiencies are corrected by lockbox bank  management and that IRS and FMS take steps through ongoing  monitoring to ensure that the following LPG requirements are routinely  adhered to:   perimeter doors are locked and alarms on perimeter doors are   guards are responsive to alarms,  employees’ identity and employment status are verified prior to  granting access to the processing floor,   visitor access to and activity in the processing area are adequately   employee access and items brought into and out of processing areas  are closely monitored by guards,  surveillance cameras and monitors are installed in ways that allow  for effective, real-time monitoring of lockbox operations,  envelopes are properly candled,  lockbox bank management perform and adequately document   returned refund checks are restrictively endorsed immediately upon   lockbox couriers are properly identified prior to granting them  access to taxpayer data and receipts, and  employees have received favorable results on fingerprint checks  before they are granted access to taxpayer data and receipts.  revise the lockbox processing guidelines to require that   before lockbox bank couriers receive access to taxpayer data and  receipts they undergo and receive favorable results on background  investigations that are deemed appropriate by IRS and are consistent  across lockbox banks,  before permanent lockbox bank employees receive access to  taxpayer data and receipts they undergo and receive favorable  results on background investigations that are deemed appropriate by  IRS and are consistent across lockbox banks,   lockbox bank guards inspect courier vehicles for unauthorized  passengers and unlocked doors,  candling procedures for the various types of extraction methods be   during candling, lockbox bank employees record which machines  and which extraction clerks missed items,  lockbox bank management reconcile items found during candling to   lockbox bank management reconcile cash payments to internal cash  logs and the cash logs they provide to IRS, and  lockbox employees immediately seek processing guidance from the  lockbox coordinator if envelopes with timely postmark dates are  received after the postmark review period has ended.
Because IRS and FMS must decide before 2007 whether to continue using  lockbox banks to process tax receipts or to return that function to IRS, we  recommend to the Secretary of the Treasury that a study be done in time  (1) for its findings to be considered in the decision-making process and (2)  to make any improvements to lockbox processing that the study indicates  are necessary or to return the processing to IRS. Regardless of the type of  analysis chosen, we recommend that the Secretary of the Treasury  clearly define the type of analysis being done and why, and follow  through to identify and analyze costs and benefits relevant to the type of  analysis,  consider the opportunity costs associated with the proposed  investment in using lockbox banks to accelerate the deposit of tax  receipts, and  include the direct costs associated with oversight, risk reduction, and  non-Form 1040 tax receipts.
section_title: Agency Comments and Our Evaluation
paragraphs: Treasury’s response to a draft of this report was jointly prepared by IRS and  FMS. In responding to the report, IRS and FMS agreed with our findings  and recommendations and stated that they have initiated or plan to initiate  actions to implement our recommendations. IRS and FMS agreed to  continually monitor lockbox banks’ adherence to internal controls and to  modify the LPGs to improve consistency standards and clarify instructions.  IRS and FMS also agreed to complete an analysis of lockbox processing  prior to the expiration of the current lockbox agreements to determine how  best to satisfy IRS’s remittance processing needs. In their response, IRS and  FMS indicated many actions they have taken since October 2001 to  improve lockbox operations. We identified many of these improvements  during our review and documented them in our report, such as the  establishment of the Bank Review Office within FMS and the development  of memoranda of understanding concerning oversight roles and  responsibilities. These actions and agreements will need to be promptly  completed and thoroughly documented to satisfactorily address many of  the issues raised in this report. The complete text of Treasury’s response is  reprinted in appendix III.
As agreed with your office, unless you announce its contents earlier, we  plan no further distribution of this report until 30 days after its issuance  date. At that time, we will send copies to the Chairmen and Ranking  Minority Members of the Senate Committee on Appropriations; Senate  Committee on Governmental Affairs; Senate Committee on the Budget;  Subcommittee on Treasury, General Government, and Civil Service, Senate  Committee on Appropriations; Subcommittee on Oversight of Government  Management, Restructuring, and the District of Columbia, Senate  Committee on Governmental Affairs; House Committee on Appropriations;  House Committee on Ways and Means; House Committee on Government  Reform; House Committee on the Budget; Subcommittee on Government  Efficiency, Financial Management, and Intergovernmental Relations, House  Committee on Government Reform; and Subcommittee on Oversight,  House Committee on Ways and Means. We will also provide copies to the  Chairman and Vice-Chairman of the Joint Committee on Taxation, the  Secretary of the Treasury, the Commissioner of FMS, the Acting  Commissioner of IRS, the Director of the Office of Management and  Budget, the Chairman of the IRS Oversight Board, and other interested  parties. Copies will be made available to others upon request. In addition,  the report will be made available to others at no charge on GAO’s Web site  at http://www.gao.gov.
If you have any questions about this report, please contact Steve Sebastian  at (202) 512-3406 (SebastianS@gao.gov) or Mike Brostek at (202) 512-9110  (BrostekM@gao.gov). Additional key contributors to this assignment are  listed in appendix IV.
section_title: Internal Control Weaknesses
paragraphs: During calendar year 2002, we visited all nine lockbox locations to review  their internal controls designed to protect taxpayer data and receipts.  TIGTA auditors and IRS reviewers also performed reviews of lockbox  controls in 2002. Below are the specific internal control issues with  (1) physical security, (2) processing controls, (3) courier security, and  (4) employee screening, that we and other reviewers found at lockbox  sites.
subsections: section_title: Physical Security Weaknesses Could Allow Unauthorized Access to Taxpayer Data and Receipts
paragraphs: The Lockbox Processing Guidelines (LPG) establish physical security and  other processing requirements. Lockbox banks are required by their  agreements with FMS to abide by these guidelines. However, during our  visit to lockbox locations, we observed numerous physical security  breaches in violation of the LPGs. We also identified areas where the LPGs  could be strengthened. These matters are discussed in the following  sections.
subsections: section_title: Perimeter Doors Were Unlocked and Alarms Did Not Function
paragraphs: To detect attempted breaches into secured space, lockbox guidelines  require all perimeter doors leading into IRS lockbox space to be equipped  with alarms. The guidelines also require guards to ensure that such doors  are locked. However, at four lockbox locations, we noted problems with  perimeter door security. At one location, we found a perimeter door  unlocked. At another location, a perimeter door was not equipped with an  audible alarm during operating hours. Bank management did not think an  audible alarm was necessary because an additional interior door that was  locked during the day controlled access to the processing area. However,  we observed that this interior door was propped open during our visit. At  this location, we also found that the alarm for another door was barely  audible over the noise from the production floor and immediately ceased  when the door was closed, limiting the opportunity for security personnel  to determine which door opened and to investigate any possible  unauthorized entrance or exit. At a third location, the alarms for one set of  doors were not turned on during operating hours, and the alarm for another  perimeter door failed to activate because, according to a bank official, the  alarm had not been properly set. At a fourth location, the door alarms were  not audible at the guard post because the guards had turned down the  volume. These security weaknesses could result in unauthorized entry to  and exit from the lockbox processing areas, increasing the risk of theft of  tax data and receipts.
section_title: Guards Were Not Responsive to Alarms
paragraphs: Door alarms serve to alert lockbox staff to a possible breach of security. To  be an effective physical security control, alarms require quick response  time by a security force. However, at two of the lockbox locations where  we found problems with perimeter door security, we also noted that  security guards were not responsive to alarms. For example, at one  location, we tested the alarm twice. On the first test, no guard responded to  the alarm. On the second test, it took 1 minute after the door was opened  before we saw a guard approaching the door. Bank managers believed that  their guards should have responded faster. At another location, the  perimeter door alarm sounded twice, and both times the guards did not  respond. According to the bank manager, the guards’ post orders did not  instruct guards to respond to alarms. He also added that it was difficult for  the guards to hear the alarms from the guard station.
The presence of security guards serves to detect unusual activities and to  deter crime. An ineffective security force may not only limit the overall  effectiveness of a security system but also may inadvertently encourage  security breaches from individuals who decide to take advantage of this  weakness.
section_title: Employee Identification Was Not Adequately Verified
paragraphs: Lockbox locations are set up with a main entrance where guards can  observe and control the traffic into and out of the processing area. The  LPGs require that temporary employees provide photo identification to the  guards in exchange for a badge allowing access to the processing floor.  This ensures the identity of temporary employees is validated prior to  entering the processing area.
We found that at one location, guards did not routinely verify temporary  employee identification when they entered the processing area. Bank  management believed that manual, daily verification of temporary  employee identification was not necessary because the location’s  automated entry system (AES) provided sufficient controls to limit access  to authorized individuals. The AES allowed entry into the building and  processing floor to individuals with AES cards, which control the door and  turnstile locks. AES cards are issued to temporary employees after the  guards have verified the employees’ identities with valid photo  identification cards on their first day of work. Once these employees are  issued AES cards, guards no longer verify the employees’ identification  before they enter the building and processing floor. Temporary employees  wear handwritten name tags with no photo identification to easily verify  their identity. As a result, if an unauthorized individual obtains an AES  card, the lack of routine verification of employee identification increases  the likelihood that an individual could gain unauthorized access to the  building and the processing floor, thereby increasing the risk of theft of tax  data and receipts.
section_title: Employment Status of Temporary Employees Was Not Adequately Verified
paragraphs: Effectively limiting access at lockbox locations to authorized individuals  requires controls that not only verify the identity of employees, but also  determine whether individuals who present themselves as employees are  currently authorized to have access to the site. We found controls over  verification of employment status to be ineffective at two locations.
At one location, the controls implemented to validate an individual’s  current employment were ineffective. The two-step manual process to  identify temporary employees and check their current employment status  before issuing access badges could have allowed unauthorized individuals  to enter the processing area. The first step required temporary employees  to obtain name tags from one station. Staff at this station checked the  employees’ identification cards against a roster of current employees and  issued them handwritten name tags. The second step required temporary  employees to obtain access badges from the guard station. The guards  issued access badges to anyone with a valid photo identification and  handwritten name tag, making an assumption that those with name tags  were current employees. As a result, an unauthorized individual could have  circumvented these controls and gained access to the processing floor by  making a name tag and presenting it to the guards. At another location,  guards did not compare temporary employees’ identification cards to the  temporary agency’s list of current employees until after the employees  were given access to the processing area. This increases the risk that  unauthorized individuals could gain access to taxpayer data and receipts  and not be promptly detected.
section_title: Visitor Access to and Activity in Processing Area Were Not Adequately Controlled
paragraphs: Anyone entering the lockbox processing area must wear an identification  badge. In addition, individuals who have not had an FBI fingerprint check,  but require access to the processing floor, must be escorted by a guard.  However, at one lockbox location, we observed a copy machine repairman  with no identification badge who was unescorted in the processing area.  The guards indicated they were unaware whether the contractor had  received an FBI fingerprint and therefore one of the guards had escorted  the repairman into the processing area. However, during our observation,  the guard was across the room, too far away to effectively observe what the  repairman was doing. We also observed that none of the employees near  the repairman challenged his presence. Bank managers later showed us  proof that the repairman had successfully completed an FBI fingerprint  check and explained that the guards should have given him a visitor badge,  but did not need to escort him. Although in this case the contractor turned  out to have an adequate security clearance, our observation indicated a  need for guards to be better trained on procedures for granting access to  contractors and for guards and employees to be more alert to activities on  the processing floor.
We also found malfunctioning AESs designed to control entrance into and  exit from processing areas. Two lockbox locations use an AES to control  access to the processing area. According to bank management for these  two locations, the AES must register an exit for a specific badge before it  can be used again to enter the processing area. In addition, the AES should  not allow an individual to exit without a registered entry. In other words, in  order for anyone to use an access badge to exit the processing area through  the controlled access points, the system must first have a record of that  badge as having been used to enter, otherwise exit from the area would be  denied. However, due to a programming error, we found that the AES did  not function as intended. Specifically, we found that a single visitor badge  could be used repeatedly by different individuals, one after another, to gain  access to the processing area, because the AES did not require a registered  exit between registered entries. Moreover, we found that the badges  allowed individuals to exit the processing area even though the AES did not  initially record their entrance. This AES deficiency compromised the  lockbox banks’ ability to control and monitor visitors’ entrance into and  exit from the processing floors. At one location, managers corrected the  error before we left; at the other location, managers agreed to correct the  error. As a result of these weaknesses, tax receipts and data are exposed to  an increased risk of theft from visitors who are not adequately monitored.
section_title: Items Brought Into and Out of Processing Areas Were Not Closely Monitored
paragraphs: The LPGs prohibit individuals from bringing personal belongings, such as  purses and shopping bags, into processing areas. The guidelines also  prohibit individuals from wearing baggy clothing or bulky outerwear inside  processing areas. Guards stationed at the main entrance of processing  areas enforce this rule.
However, at five lockbox locations, we found that the guards did not  effectively monitor individuals entering the processing floors to enforce  this requirement. At three of these locations, we observed employees bring  personal belongings or wear bulky outerwear inside the processing area. In  one instance, a guard brought a purse inside the processing area. At four of  these locations, we were able to bring personal belongings, such as purses,  into the processing floor and were not challenged by the guards. The  guards we interviewed informed us that they either failed to observe  personal belongings brought into the processing area or did not know the  requirements of the lockbox guidelines concerning personal belongings.
Guards are also required to question individuals who attempt to remove  property from the lockbox locations. However, at one location, the guards  failed to search papers we carried out of the processing area. At another  location, we found that on the day of our visit there were no guards present  to observe employees leaving the processing area because bank  management had not informed the guards that several employees would be  working beyond their normal work hours. The guards finished their shift  and left before the employees were dismissed.
As a result of these security breaches, individuals could have used personal  belongings and bulky clothing to conceal and remove tax data and receipts  from lockbox locations undetected.
section_title: Camera Surveillance Needs Improvement
paragraphs: The LPGs require surveillance cameras to be installed at lockbox locations  and security guards to monitor the cameras to observe critical areas, such  as the loading docks, secure storage areas, mailroom, and extraction area.  However, we found that the camera surveillance at seven lockbox locations  we visited could be improved.
At two locations, the cameras were stationary and did not have zoom  capability to effectively monitor critical areas. At another three locations,  camera monitors to survey activities on the processing floor were located  in the managers’ offices; however, because of other duties, the managers  were frequently on the processing floor and were not able to observe the  monitors. FMS visited one of these three locations in early 2002 to  perform an unannounced security review and also reported this as a  finding. Additionally, at another of these three locations, there were no  surveillance cameras in the former administrative offices located within  the processing area. Lockbox managers recently vacated this area and did  not consider installing surveillance cameras because no processing activity  occurred there. However, this area housed unused file cabinets and desks  with drawers where tax data and checks could be hidden. One of the  offices was also used by a computer contractor while on site. At the two  other locations, we found that the monitors used to display the images  from surveillance cameras were ineffective. Specifically, the monitors  displayed up to 16 images on one screen making each individual image  barely visible to effectively monitor or detect illegal activities. Additionally,  since these monitors were visible to employees and visitors, they were  ineffective deterrent controls to those who noticed that the surveillance  could not effectively monitor activities on the processing floor. The images  would be more effective in deterring criminal activities if they were more  visible.
As a result of these weaknesses, lockbox camera surveillance was not  capable of consistently and effectively detecting unusual activity or unsafe  practices and providing early warning of possible security compromises.
section_title: Processing Controls Need Improvement to Better Account for and Protect Taxpayer Data and Receipts
paragraphs: In addition to physical security controls, the lockbox guidelines also  provide requirements for processing controls to maintain accountability  for, and security over, transactions as they are processed through the  normal course of operations. During our visits to lockbox locations, we  found deficiencies in processing controls designed to account for or  protect tax data and receipts at several of the lockbox sites. Specifically,  taxpayer information and receipts particularly vulnerable to theft, such as  cash, were not carefully processed and safeguarded. Moreover, the records  to account for items found during candling, a process to detect overlooked  items remaining in envelopes, and cash payments were inadequate to allow  lockbox managers to easily and promptly detect lost or stolen items.
subsections: section_title: Candling Procedures and Review Were Not Adequate
paragraphs: To prevent the accidental destruction of taxpayer data and receipts,  lockbox guidelines require envelopes to undergo a candling process. The  LPGs also require lockbox site managers to periodically review the  effectiveness of their site’s candling procedures. During our review of  lockbox operations, we found that at some lockbox locations (1)  deficiencies in the candling processes may lead to the accidental  destruction of tax data and receipts, (2) accounting for found items was  insufficient to detect missing checks within a reasonable time, and (3)  management review of candling processes was either lacking or not clearly  documented.
Inadequate Candling Procedures Could Lead to Accidental  Destruction of Tax Data and Receipts Lockbox staff open envelopes manually by hand or with the assistance of a  mail extraction machine. Some mail extraction machines slit envelopes on  one side, allow employees to extract their contents, and have the capability  to electronically detect overlooked items remaining in the envelopes. More  advanced machines slit envelopes on three sides and extract the contents.  The method used to open the envelopes determines how the envelopes  should be candled. The LPGs provide guidance on candling procedures and  require all envelopes to be candled twice before destruction. Envelopes  opened with the assistance of a mail extraction machine are considered to  have gone through the first candling. After processing, employees are  required to review each envelope through a source of light, such as a  candling table, to determine if any contents remain in the envelope. This is  considered the second candling. For manually opened envelopes,  envelopes that are slit on three sides and flattened sufficiently meet  candling requirements without further light source viewing. Envelopes that  are manually slit on only one side are reviewed twice on the candling table.
During our visits to lockbox locations, we found that at four locations,  envelopes were not sufficiently candled to prevent the accidental  destruction of tax data and receipts because of malfunctioning machines,  careless candling practices, and ineffective candling guidelines.
At one location, we found two mail extraction machines that  malfunctioned and failed to detect checks remaining in the envelopes.  Additionally, some envelopes were only candled once because  employees often used the mail extraction machines as desks.  Employees manually opened the envelopes, completely bypassing the  first candling step to be performed by the machines. These envelopes  were then candled only once on the candling table. We also observed  that employees were inattentive when candling envelopes on the  candling table, allowing envelopes to overlap and making it difficult to  fully illuminate each envelope or all parts of an envelope.
At a second location, envelopes that were manually opened were not slit  on three sides or candled twice.
Two other locations did not properly candle all envelopes because the  candling requirements in the LPGs do not specify procedures to be used  with more advanced extraction machines that slit the envelopes on  three sides and extract the contents. Management at these locations  believed that because the envelopes were opened on three sides, they  met the candling guidelines for manually opened envelopes. Therefore,  they concluded that no further candling was required. However, an IRS  official subsequently explained that envelopes opened by these types of  machines should be subject to a second candling until IRS performs a  study to determine their effectiveness. The fact that we found a $3,300  check that had not been detected by one of these advanced machines,  located in another site, indicates that they can also malfunction and  result in the destruction of taxpayer data and receipts. As a result,  candling procedures did not effectively reduce the risk of accidental  destruction of tax receipts and data.
Accounting for Items Found During Candling Was Insufficient Lockbox guidelines require lockbox employees to account for each item  found during candling. Some lockbox locations use two forms to record  items found--an internal candling log and a Form 9535 or equivalent,  which is required to be submitted to the lockbox coordinator each month  for IRS review. Employees prepare the internal log while candling and later  transfer the data onto the Form 9535. Since all items found during candling  must be reported to IRS, the Form 9535 should record the same number  and amounts of checks found as noted on the internal log being maintained  as processing is occurring. However, the lockbox guidelines do not require  a reconciliation of one set of records to the other, nor do they require a  reconciliation of items found during candling to their candling records.
During our review, we found that lockbox banks did not always have  procedures to ensure that all items found were accurately recorded on both  sets of logs and that bank managers could not properly account for all  items found. At one location, the two sets of logs that bank management  provided to us could not be reconciled. For example, a check was recorded  on the internal log but not on the Form 9535. Management could not  provide an adequate explanation or documentation to explain the  discrepancy. At this location, we also noted delays of up to 6 days in  transferring records of items found from the internal log to the Form 9535.  Lockbox management explained that because of the volume of work during  the April peak, the Form 9535 could not always be completed or the checks  could not always be processed the same day they were found during  candling. Another location’s internal log only recorded tallies of the  quantity of items found, which did not match the number of items listed on  the log provided to IRS. Because there was not enough information on the  internal log, we could not determine whether items, such as checks,  recorded on the internal log but not on the Form 9535, were ever processed  and credited to the taxpayers’ accounts. We identified this same issue  during a visit to this location in October 2001 as part of our audit of IRS’s  fiscal year 2001 financial statements. After this visit, lockbox management  and IRS agreed to address this problem. However, as of April 2002, this  problem had not been corrected. IRS indicated that it plans to address this  issue in the January 2003 revisions to LPGs. At two other locations, we also  found that no reconciliation occurred between items found during candling  and the candling log. As a result of these weaknesses, lockbox management  and IRS may not promptly detect missing checks.
We also noted that the lockbox guidelines do not specifically require the  banks to determine which machine or which extraction clerk missed  items that were subsequently found during candling. Such information  would help lockbox bank managers promptly track and repair  malfunctioning machines and provide performance feedback to extraction  clerks.
Management Review of Candling Process Was Insufficient or Not  Adequately Documented Because IRS officials are not at lockbox locations daily, IRS relies on  lockbox managers to ensure that their staff complies with lockbox  guidelines. In the case of candling requirements, IRS guidelines require  lockbox managers to sample candled items to determine the effectiveness  of the candling process and to report results of the reviews to IRS.  However, at four locations, we found that lockbox managers, who  indicated they had performed these reviews, failed to document or clearly  document the results. At two additional locations, managers stated that  they did not sample candled envelopes. The manager at one of these  locations believed that her frequent observation of the candling process  was sufficient to ensure that the envelopes were properly candled. Given  the problems we observed with the candling process at several of the  locations we visited, management reviews and proper documentation of  such reviews are critical to help ensure that problems are promptly  identified and corrected.
section_title: Controls Were Not in Place to Adequately Safeguard and Account for Cash Receipts
paragraphs: Lockbox sites receive tax receipts in the form of cash as well as checks.  Cash receipts are highly susceptible to theft, and lockbox guidelines have  specific requirements for safeguarding and accounting for cash receipts.  The guidelines require cash to be stored in locked containers to prevent  theft. The keys to these containers must not be left in unsecured places,  such as desk drawers. The guidelines also require cash receipts to be  recorded on a log. At three lockbox locations, we noted weaknesses in the  safeguarding and accounting for cash.
At one location, the locked cash box was stored in a locked drawer.  However, the keys to both the cash box and the locked drawer were stored  in an open drawer because bank management wanted supervisors to have  quick access to the cash box to expedite the deposit of cash. At another  location, cash for the business and individual tax payments were stored in  two separate safes. Three staff members had keys to the safes, which could  be opened by individuals acting alone. Additionally, the safe used for  business payments was small and moveable. The individual access to the  safes and the ease of mobility of one of the safes compromised the security  of the stored cash.
At two locations, we noted discrepancies between the bank’s safe log and  the log that the lockbox managers were required to provide to IRS. A safe  log is an internal lockbox document that employees complete before they  place cash in the safe or cash box. The safe log should identify the  taxpayer, the amount paid, and date cash was discovered. When we  reviewed the two sets of logs we found that the dates, amounts, item  counts, and taxpayer identification information in the logs did not agree,  and bank managers could not reconcile some of the discrepancies. For  example, at one location, five items on the safe log were not on the IRS log.  One of the items was a $140 cash receipt. Because the safe log did not  record taxpayer information for any of the receipts, we could not verify  whether the receipt was ever posted to the taxpayer’s account. There is  currently no requirement in the LPGs for bank managers to reconcile their  internal cash logs to the cash log sent to IRS. Such reconciliation could  have quickly detected the discrepancies we noted. Bank management  attributed some of these discrepancies to human error, inexperienced staff,  and staff failure to take the accounting for cash seriously because the  amounts found are typically small. However, individual taxpayers have  made cash payments totaling hundreds of dollars. Failure to properly  secure and account for cash receipts could result in theft, the untimely  detection of theft, inaccurate posting of tax receipts, and unnecessary  burden on taxpayers whose cash receipts are lost or incorrectly posted.  Therefore, it is critical for lockbox banks to diligently safeguard and  account for cash receipts.
section_title: Returned Refund Checks Were Not Adequately Protected Against Theft
paragraphs: Lockbox banks sometimes receive federal tax refund checks that have  been returned by taxpayers as payment against other tax liabilities. Some  of these checks have been endorsed by taxpayers and are therefore  negotiable. As a safeguard against theft and misuse of returned refund  checks, lockbox guidelines require lockbox extraction clerks to promptly  stamp a restrictive endorsement on returned refund checks. These checks  are subsequently forwarded to IRS for further processing.
At seven locations, however, we observed that returned refund checks  were not always stamped upon extraction and at some locations were set  aside, unsecured, to be stamped later by a different individual. At two  locations, we found the returned refund checks without the required  stamps ready to be shipped to IRS. Lockbox management attributed many  of these exceptions to staff oversight or inadequate training. Several years  ago, IRS investigators discovered the theft of seven returned refund checks  totaling $300,000 at one IRS Submission Processing Center. Such thefts can  also occur at lockbox sites. Thus, it is critical that restrictive endorsements  be placed on returned refund checks as soon as they are extracted.
section_title: Timely Payments Were Incorrectly Processed As Delinquent
paragraphs: The LPGs, as currently written, have resulted in timely tax payments being  processed as delinquent. To determine timeliness, lockbox employees are  required to examine the postmarks on envelopes in which tax receipts  were received. If the postmark indicates that the receipt is delinquent (i.e.,  the postmark is subsequent to the return or payment due date), the receipt  should be processed as delinquent and the envelope should be attached to  the corresponding document and forwarded to IRS. If lockbox employees  determine that the receipt is timely (i.e., the postmark is prior to the return  or payment due date), the envelope need not be retained. However,  beginning with the first day of the month following the month the payment  is due, lockbox guidelines require lockbox employees to use the date the  mail is received as the transaction date to be recorded in the taxpayer’s  account as the payment date. Furthermore, the lockbox guidelines do not  require lockbox employees to review and retain the envelopes in which the  tax receipts were enclosed.
At one lockbox location we visited, we observed that on May 1, 2002,  lockbox employees received and extracted tax receipts from two  envelopes postmarked prior to or on the April 15 payment due date.  Because it was already past the period during which lockbox employees  were required to examine postmarks and retain envelopes, lockbox  employees processed the payments as delinquent and would have  discarded the envelopes even though they were aware that the envelopes  were postmarked on or before the payment due date. When we brought  these two transactions to the lockbox coordinator’s attention, the lockbox  coordinator concluded that, in these instances, the taxpayers had made  timely payments. The lockbox coordinator subsequently adjusted the  taxpayers’ accounts to reflect these as timely payments. We recognize that  careful examination of postmarks on envelopes for all receipts received  after the payment due dates slows down the payment processing and we  recognize the need to establish reasonable cut-off dates for this review  process. However, lockbox employees should immediately seek processing  guidance from the lockbox coordinator when incidents such as the ones  noted above come to their attention to avoid burdening taxpayers with  erroneous penalties and interest for late payments. Additionally, as written,  the LPGs could lead to potential taxpayer burden and unnecessary costs to  IRS associated with correcting the status of taxpayer’s accounts.
section_title: Courier Security Is Inadequate to Protect Tax Data and Receipts from Theft or Loss
paragraphs: Lockbox banks entrust courier employees with transporting thousands of  pieces of mail containing tax data, cash, checks, and deposits worth  millions of dollars per day. Given the susceptibility of these items to theft  and loss, it is extremely important that they be carefully safeguarded while  in transit to and from lockbox sites.
We previously reported on weaknesses in lockbox courier security and  noted that lockbox courier guidelines were not as stringent as IRS courier  guidelines. For example, unlike IRS courier requirements, the LPGs did  not require courier employees to pass a limited background investigation,  thus increasing the risk of theft of tax data and receipts by couriers with  past criminal histories. The LPGs also did not require lockbox couriers to  be insured for $1 million and to travel in pairs while transporting IRS data.  In fact, in past audits, we found that lockbox banks used only one courier  employee to transport IRS data. These weaknesses in courier security  increased the risk of theft and loss of taxpayer data and receipts.
In response to our audit findings, IRS enhanced the lockbox courier  requirements. The 2002 LPGs now require that couriers used by lockboxes  pass favorable FBI fingerprint checks, be bonded for $1 million, travel in  pairs, transport IRS data from the lockbox facility to its destination with no  stops in between, provide dedicated service to IRS, and lock and attend  courier vehicles while IRS data are contained within the vehicles. Despite  these enhancements, we and other auditors continue to find weaknesses  in lockbox courier security because of the lockbox sites’ failure to  consistently comply with the revised guidelines. In addition, lockbox  courier guidelines could be further refined to improve the security of tax  data and receipts.
subsections: section_title: Couriers Given Access to Tax Data Before Fingerprint Check Results Received
paragraphs: IRS recently revised the background screening requirements for lockbox  couriers. The revised LPGs, effective January 2002, prohibit couriers from  having access to IRS data until lockbox managers have received results of  their FBI fingerprint checks and resolved any questionable fingerprint results. However, during a recent TIGTA audit of one lockbox site,  auditors found that three couriers were allowed access to taxpayer  information before the lockbox received the results of their fingerprint  checks. Lockbox managers subsequently received results of the FBI  fingerprint checks, which indicated that two of these couriers had criminal  histories. Nevertheless, TIGTA found that lockbox management continued  to allow the two couriers and an additional courier, whose FBI fingerprint  check also indicated a criminal history, access to taxpayer data while  follow-up investigations, which subsequently cleared them, were  underway. TIGTA auditors attributed this weakness to lockbox  management’s failure to develop and implement procedures to ensure that  couriers are granted proper clearance before they receive access to IRS  data.
section_title: Lockbox Couriers Not Properly Identified
paragraphs: Lockbox courier standards require courier employees to wear  identification badges and lockbox banks to implement procedures to  properly identify couriers. However, at two lockbox locations, we found  that couriers did not wear their identification badges. At one of these  locations, lockbox employees did not verify the courier’s identification  before entrusting him with taxpayer data because the employees indicated  that they were familiar with the courier. Additionally, at this location, the  courier access list, which lists couriers authorized to access tax data and  photo identification of couriers, was maintained at the guard station and  not easily accessible to employees who must verify couriers’ identities  daily. Although not a requirement in the LPGs, some locations have posted  the courier access lists by loading dock doors to facilitate the identification  of couriers. Unless lockbox employees diligently perform their duties to  properly identify couriers, tax receipts and data are exposed to higher risk  of theft from former couriers who have recently been terminated or  unauthorized individuals posing as couriers.
section_title: Courier Vehicle Containing Tax Data and Receipts Was Not Locked
paragraphs: The LPGs require courier vehicles to be locked whenever IRS data are  contained in the vehicle until it reaches its destination. Additionally, the  vehicle must always be under the supervision of one of the couriers and  never left unattended. At one lockbox site, we observed that couriers did  not lock the courier vehicle containing tax data. The couriers stated that  they generally did not lock the doors because they never left the IRS  packages unattended. The lockbox guard did not check to see if the vehicle  was locked because there is no requirement to do so. IRS reviewers also  observed couriers failing to lock courier vehicles during their review of  another lockbox location in April 2002. Failure to ensure that courier  vehicles are locked while in possession of taxpayer data and receipts  increases the risk of loss of such items.
section_title: Background Screening of Lockbox Couriers Are Less Stringent Than Requirements for IRS Couriers
paragraphs: We also found that background screening requirements continue to be less  stringent for lockbox couriers than for IRS couriers. IRS couriers are  subject to both an FBI fingerprint check and a basic background  investigation for contractors before they are given access to tax receipts.  This background investigation includes a check of other federal agency and  defense clearance investigation databases for results of previous  background investigations and a check for any outstanding tax liabilities.  In contrast, lockbox couriers are only required to favorably clear an FBI  fingerprint check and are subject to no further background investigations.  As a result, IRS may not discover information, such as outstanding tax  liabilities, that might cause IRS to deny them access to taxpayer data. IRS is  aware of the risks associated with lockbox couriers and is considering  enhancing the lockbox guidelines to require lockbox couriers to undergo  basic background investigations similar to those required of IRS couriers.
section_title: Unauthorized Individuals Not Prohibited From Courier Vehicles
paragraphs: IRS courier standards specifically prohibit the presence of unauthorized  individuals in courier vehicles and require IRS personnel to inspect courier  vehicles daily to ensure that no unauthorized passengers are in the vehicle.  The LPGs, on the other hand, contain no prohibition of unauthorized  individuals in courier vehicles and do not require lockbox staff or guards to  inspect courier vehicles for unauthorized passengers. The guidelines state  only that IRS reserves the right to inspect courier vehicles and drivers.  Because IRS representatives are not on-site every day and there is no  requirement for lockbox employees to inspect vehicles, unauthorized  individuals could ride in courier vehicles and have access to taxpayer data  and receipts without lockbox management’s knowledge.
section_title: Further Improvements Needed on Background Screening of Lockbox Employees
paragraphs: Because lockbox employees are entrusted with handling sensitive taxpayer  information and billions of dollars in receipts annually, ensuring worker  integrity through a carefully managed recruiting and hiring process is an  area that demands special attention from IRS, FMS, and lockbox  management. We previously reported that the screening of permanent and temporary lockbox employees was inadequate and untimely. Specifically,  instead of referring to a national database to check for criminal records,  lockbox banks limited the screening of criminal background investigations  for temporary employees to police records checks in counties that  individuals voluntarily disclosed as prior residences. Therefore, the police  records checks may be incomplete for some individuals who chose not to  disclose counties in which they committed a crime and have criminal  records. In addition, lockbox permanent employees were allowed to handle  cash, checks, and taxpayer data before their fingerprint checks were  completed.
IRS management has been responsive to our recommendations and has  enhanced its policy on screening of permanent and temporary lockbox  employees. The LPGs now require permanent and temporary employees to  undergo FBI fingerprint checks. In contrast to the previous police records  checks performed by county, FBI fingerprint checks are national in scope.  An individual’s fingerprints are matched against fingerprints maintained in  the FBI’s national database of criminal records. As a result, criminal  records checks performed for lockbox applicants are no longer dependent  on the applicant to accurately and completely disclose prior residences.  The guidelines have also been updated to prohibit access to taxpayer data  and receipts until lockbox management receives the results of an  individual’s fingerprint checks. Results that show a possible criminal  history must be resolved before the individual in question is allowed access  to the lockbox site. The guidelines also require permanent lockbox  employees to undergo an appropriate background investigation, as  determined by an IRS security officer, in addition to an FBI fingerprint  check. Despite these policy improvements, we found that lockbox banks  did not always comply with the FBI fingerprint requirements and that  further refinements are needed regarding background investigation  requirements for lockbox employees.
subsections: section_title: Employees Given Access to Taxpayer Data and Receipts Before Fingerprint Check Results Received
paragraphs: Based on our review of lockbox personnel files, we found that lockbox  banks are generally complying with the new guidelines. However, we and  IRS reviewers nonetheless found instances of noncompliance at lockbox  banks. This shows a need for IRS and FMS to ensure that lockbox  management clearly understand the screening requirements and have  implemented effective controls to prevent permanent and temporary  employees’ access to tax data until they have favorably completed an FBI  fingerprint check.
Specifically at three lockbox locations, we noted noncompliance related to  the screening of permanent staff. At one location, we found that 4 out of a  nonrepresentative selection of 25 permanent employees whose personnel  files we reviewed began working at the lockbox location before bank  management received their fingerprint check results. Bank management  and IRS personnel explained that this situation occurred because IRS had  verbally waived compliance with the screening requirements due to the  fact that the bank was experiencing delays in obtaining timely responses on  fingerprint checks at the beginning of 2002. At the second location, weak  controls to ensure that all employees successfully complete FBI fingerprint  checks allowed a permanent bank employee to process receipts and  taxpayer data for 3 months before lockbox managers discovered that the  employee had not undergone a fingerprint check. The employee was  removed from the processing floor until the fingerprint check was  completed and approved. At the third location, a permanent employee was  allowed to work for several days before the FBI fingerprint check was  completed because bank management misunderstood the fingerprint check  requirement for lockbox employees. During its April 2002 peak review, IRS  officials found similar problems at two other lockbox locations. One  location allowed a temporary employee access to tax data before the  completion of the employee’s fingerprint check. At the other location, the  temporary agencies listed 12 employees as eligible to work, of which 6  were already working, even though they had not received their FBI  clearance checks or were denied clearance to access tax data.
As discussed earlier, taxpayer information and receipts are easily  accessible to anyone on the processing floor. Therefore, it is critical for  lockbox banks to ensure that these items are properly safeguarded by  diligently complying with all aspects of the LPGs, which include screening  lockbox employees. Late screening of lockbox employees could result in  theft or loss in instances where bank management unknowingly allows  individuals with criminal backgrounds access to IRS data and receipts.
section_title: Guidelines for Background Investigations of Lockbox Permanent Employees Need Improvement
paragraphs: The current LPGs require permanent lockbox employees to favorably  complete an FBI fingerprint check and an appropriate background  investigation, as determined by an IRS personnel security officer. However,  the LPGs do not define what is considered an appropriate background  investigation for permanent lockbox employees and what information  regarding the results of the background investigation should be provided to  IRS. As a result, the scope of and documentation for background  investigations performed on permanent lockbox employees varies greatly  among lockbox banks and is not consistent with background investigations  required of other IRS contractors.
According to IRS officials, while some lockbox banks subject their  permanent employees to the required FBI fingerprint check and additional  background investigation, such as county criminal records and credit  history checks, other lockbox banks subject their permanent employees to  FBI fingerprint checks with no further background screening. Additionally,  IRS officials found that investigation results they receive from banks do not  provide adequate information to determine whether the individual should  be allowed access to taxpayer data. For example, background investigation  results may indicate that a criminal records check was completed but not  whether any arrests or convictions were found. Other results of  background investigations may indicate that an arrest or conviction was  found during a criminal records check but not the basis for the arrest or  how recently or frequently the offense occurred. IRS officials also  explained that some lockbox banks could not provide documentation of  results of background investigations performed on their permanent  employees because, as a result of recent bank mergers, lockbox  management did not have access to those records.
According to IRS officials, IRS did not foresee the problems with  background investigations for permanent lockbox employees. As the  variance in the scope of background investigations and in the adequacy of  documentation of their results became evident, IRS made a decision to  accept favorable results of FBI fingerprint checks as the minimum criterion  for allowing permanent lockbox employees access to taxpayer data. As a  result, the level of background screening performed on permanent  employees is inconsistent among lockbox banks and with requirements for  other IRS contractors, such as IRS contracted couriers whose backgrounds  are checked against other investigation databases and for tax liabilities, as  previously discussed. Additionally, permanent employees who were  granted access to tax data based only on the results of favorable FBI  fingerprint checks, in effect, received the same level of background  screening as temporary employees and less than that of IRS contracted  couriers, even though permanent employees have more influence and  authority over lockbox operations, and are granted more access rights to  various sections of the lockbox sites. Because some banks subject their  permanent employees to less scrutiny when performing background  investigations than other banks, IRS may not be aware of critical  information that could have been uncovered by a more thorough  background investigation, such as recent criminal records not yet reported  to the FBI, which might cause IRS to deny them access to taxpayer data.
section_title: FBI Checks May Be Inadequate for Lockbox Employees Who Have Recently Established Residency in the United States
paragraphs: TIGTA auditors recently reported that lockbox banks often employ non- U.S. citizens with lawful permanent residence to process IRS tax  payments. Although the IRS hires only U.S. citizens, IRS and FMS have  allowed lockbox banks to hire non-U.S. citizens. TIGTA auditors found this  policy to be consistent with guidelines from the Department of the  Treasury regarding the hiring of contract employees. However, this hiring  practice may pose unnecessary risks to IRS materials because the FBI  fingerprint check, which is national in scope, may have very little  information to disclose if these individuals lived in this country for only a  short period of time. The Department of State and the Immigration and  Naturalization Service perform some background checks before issuing  visas to nonresidents or upgrading visas that may allow individuals to  achieve lawful permanent resident status. However, neither the TIGTA  auditors nor the IRS know the extent of these background checks. In  response to this finding, IRS agreed to form a task group to review the  current standards. If IRS determines that the standards do not provide  adequate protection or the risk is not reduced by other security measures,  IRS will incorporate more stringent requirements into the LPGs after  coordinating with FMS and the Department of the Treasury. The  uncertainty of criminal histories of non-U.S. citizens hired by lockbox  banks may lead to hiring of individuals with criminal histories which, in  turn, increases the risk of theft of receipts or misuse of tax data. For  instance, TIGTA auditors reported that evidence regarding the theft of  checks from one lockbox site indicates the involvement of a crime ring  from a foreign country in the negotiation of and possibly in the actual theft  of taxpayer checks.
section_title: GAO Analysis of IRS’s and FMS’s August 1999 1040 Tax Payment Comparative Cost Benefit Study
paragraphs: In August 1999, an IRS/FMS taskforce issued a study entitled 1040 Tax  Payment Comparative Cost Benefit Study. The study estimated the costs  and interest savings from processing Form 1040 tax receipts at IRS  compared to lockbox banks using three different IRS scenarios. Table 3  shows the IRS/FMS taskforce results for all three IRS scenarios for each of  7 fiscal years (fiscal years 2001 through 2007) and overall.
All three IRS scenarios used the same estimated lockbox bank processing  costs of $144.9 million. IRS interest float savings and processing costs  varied because assumptions differed across scenarios. Scenario I estimated  a 1.384 interest float savings while scenarios II and III used 3 days and 10.6  days, respectively. Processing costs for scenario I assumed additional  processing equipment, additional staff, additional space, and a 10 percent  increase in processing productivity. Scenario II assumptions were the same  as I except for assuming no increase in processing productivity. Scenario III  assumptions were the same as II except for assuming no additional  processing equipment, staff, or space.
We focused on IRS scenario I for further analysis because it was the one  used to justify the decision to continue using lockbox banks to process tax  receipts. Table 4 shows the IRS/FMS taskforce results for scenario I in  more detail for each of 7 fiscal years (2001 through 2007).
We analyzed the documented support for the data used to develop  estimates in the study. The support often came from historical data on  lockbox banks and IRS’s processing. We generally found some documented  support on the methodology and assumptions used for the costs and  revenue estimates. We could not compare support for the specific cost  estimates, however, because the lockbox banks only had a basic charge for  processing tax receipts and an additional charge to sort tax returns and  ship them to IRS.
The estimation methodology and assumptions used in the study were the  same for each year. To illustrate the methodology and assumptions, we  reviewed how the estimates were developed for the first year—fiscal year  2001. For example, as shown in table 4, the net saving of $1.2 million is the  difference between IRS and lockbox bank costs and IRS and lockbox bank  interest savings. For costs, the study estimated that processing the tax  receipts through lockbox banks would cost $11.3 million more than  processing them through IRS. For interest savings, the study estimated that  using lockbox banks would save $12.5 million more than using IRS.
For cost estimates, a key factor was the estimated number of tax receipts,  which was based on the actual number of 1998 tax receipts and projected  for future years using expected growth rates. To understand IRS’s costs for  fiscal year 2001, we analyzed its four components—labor costs, basic  support costs, equipment depreciation, and site preparation depreciation.  A discussion of each of the four cost components follows.
IRS labor costs were often estimated from IRS’s Cost Estimate Reference  guide that provides estimated costs for particular activities at IRS. The  guide includes estimated labor cost and staff hours for processing tax  returns. We traced each cost estimate in the study to the IRS cost guide.  We also discussed the cost estimates with the IRS analyst who made and  documented the computations for the study. Table 5 breaks down the IRS  labor cost estimate for fiscal year 2001.
Explanations of the other three components in IRS’s processing cost  estimates follow.
Basic support cost: $291,679  Consists of service and supplies, equipment, and printing on the basis of  rates listed in the IRS cost guide.
Equipment depreciation: $1,317,796 IRS would need to spend an estimated $6,588,980 on hardware,  furniture, and software if IRS processed Form 1040 tax receipts instead  of lockbox banks. This cost was depreciated over a 5-year period in  equal annual amounts.
Site preparation depreciation: $120,000 IRS would need to spend $600,000—$300,000 at each of two IRS  locations—to prepare space to accommodate new equipment required  to process the increased volume of tax receipts. This cost was  depreciated over a 5-year period in equal annual amounts.
We also analyzed the added interest savings if lockbox banks processed the  tax receipts instead of IRS. The IRS/FMS taskforce study followed a  formula in Treasury regulations to compute this estimate. For fiscal year  2001, the factors in that formula included  total tax receipts = $45,224,421,259 divided by  total deposit days of 250 multiplied by  interest float of 1.384 days multiplied by  an estimated federal funds rate of 5 percent.
The number of deposit days was specified in the Treasury regulations. The  interest float represents how much faster lockbox banks could process tax  receipts compared to IRS in three areas, totaling 1.384 days:  Compressing the program completion date (PCD) 1.000 day Mail float is measured from the time a taxpayer mails a payment until it  arrives at a lockbox bank or IRS. Availability float is measured from the  time a receipt is deposited until the funds are credited to the Treasury. The  PCD is the day when lockbox banks must finish processing during peak  workload periods and return to a schedule of depositing receipts within 24  hours.
We examined the basis for each of these three estimates. Mail and  availability float figures were taken from a July 1998 interest float study  done by a contractor for FMS. The PCD figure came from an agreement by  lockbox banks to compress PCD by 1 day while the study concluded that  IRS could not match the compression for a number of reasons. A new  interest float study would have to be done to know the actual float  advantage, if any, from using lockbox banks rather than IRS to process the  tax receipts.
section_title: Comments from the Department of the Treasury
paragraphs: The following are GAO’s comments on the Department of the Treasury’s  letter dated December 20, 2002.
subsections: section_title: GAO Comments
paragraphs: 1. See “Agency Comments and Our Evaluation” section. 2.
IRS and FMS indicated the need for one technical clarification  regarding our use of the terms “contracts,” “contractor,” and  “contractual agreements” with respect to lockbox banks and  recommended that we delete all references to “contracts” and  “contractors.” IRS and FMS stated that when lockbox banks perform  services for IRS, they act in a financial agent capacity on behalf of  Treasury and that this function does not constitute a procurement or  contract within the meaning of the Federal Property and Administrative  Services Act or the Federal Acquisition Regulation (FAR). We recognize  that the lockbox agreements are not procurements for purposes of the  act or the FAR, but we did not change the language used in the report  for ease of reference. It should be noted that Treasury also uses  contract terminology in discussing lockbox agreements. Specifically,  the Treasury Financial Manual gives FMS “the exclusive authority to  contract for lockbox services with the selected bank and the agency”  and further states that “an agency is prohibited from entering into new  contractual agreements … without the prior approval of FMS.” In  addition, in the IRM, IRS defines a lockbox depositary agreement as a  “contractual agreement signed by IRS, FMS and the Lockbox that  provides the requirements of the activities performed as the  commercial depositories.” Our use of contract terminology in this  report is consistent with Treasury’s use of such terminology in the TFM  and the IRM. We did add a footnote (see footnote 2) to clarify that while  the agreements with the lockbox banks are legally binding, they are not  procurements subject to the provisions of the Federal Property and  Administrative Services Act or the FAR, and to indicate that we use the  terms “contracts” and “contractors” in the report for ease of reference.
section_title: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Acknowledgments
paragraphs: In addition to those named above, Larry Dandridge, Marshall Hamlett,  Aaron Holling, Jeffrey Jacobson, Casey Keplinger, Laurie King, Delores Lee,  Yola Lewis, Larry Malenich, Julia Matta, Tom Short, and Esther Tepper  made key contributions to this report.
section_title: GAO’s Mission
paragraphs: The General Accounting Office, the investigative arm of Congress, exists to  support Congress in meeting its constitutional responsibilities and to help improve  the performance and accountability of the federal government for the American  people. GAO examines the use of public funds; evaluates federal programs and  policies; and provides analyses, recommendations, and other assistance to help  Congress make informed oversight, policy, and funding decisions. GAO’s  commitment to good government is reflected in its core values of accountability,  integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost is  through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older  products. The Web site features a search engine to help you locate documents  using key words and phrases. You can print these documents in their entirety,  including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and  correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site  daily. The list contains links to the full-text document files. To have GAO e-mail this  list to you every afternoon, go to www.gao.gov and select “Subscribe to GAO  Mailing Lists” under “Order GAO Products” heading.
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Public Affairs