Information Security: IRS Needs to Further Improve Controls over Taxpayer Data and Continue to Combat Identity Theft Refund Fraud
Published: 2016-04-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In collecting taxes, processing returns, and providing taxpayer service, IRS relies extensively on computerized systems. Thus it is critical that sensitive taxpayer and other data are protected. Recent data breaches at IRS highlight the vulnerability of taxpayer information. In addition, identity theft refund fraud is an evolving threat to honest taxpayers and tax administration. This crime occurs when a thief files a fraudulent return using a legitimate taxpayer's identity and claims a refund. In 2015, GAO added identity theft refund fraud to its high-risk area on the enforcement of tax laws and expanded its government-wide high-risk area on federal information security to include the protection of personally identifiable information.
This statement discusses (1) IRS information security controls over financial and tax processing systems, (2) IRS actions to address identity theft refund fraud, and (3) the status of selected IRS filing season operations. This statement is based on previously published GAO work as well as an update of selected data.
section_title: What GAO Found
paragraphs: In March 2016, GAO reported that the Internal Revenue Service (IRS) had instituted numerous controls over key financial and tax processing systems; however, it had not always effectively implemented other controls intended to properly restrict access to systems and information, among other security measures. In particular, while IRS had improved some of its access controls, weaknesses remained in key controls for identifying and authenticating users, authorizing users' level of rights and privileges, encrypting sensitive data, auditing and monitoring network activity, and physically securing facilities housing its information technology resources. These weaknesses were due in part to IRS's inconsistent implementation of its agency-wide security program, including not fully implementing prior GAO recommendations. GAO concluded that these weaknesses collectively constituted a significant deficiency for the purposes of financial reporting for fiscal year 2015. As a result, taxpayer and financial data continue to be exposed to unnecessary risk.
Identity theft refund fraud also poses a significant challenge. IRS estimates it paid $3.1 billion in these fraudulent refunds in filing season 2014, while preventing $22.5 billion (see figure). The full extent is unknown because of the challenges inherent in detecting this form of fraud.
IRS has taken steps to combat identity theft refund fraud such as improving phone service for taxpayers to report suspected identity theft and working with industry, states, and financial institutions to detect and prevent it. However, as GAO reported in August 2014 and January 2015, additional actions can further assist the agency in addressing this crime, including pre-refund matching of taxpayer returns with information returns from employers, and assessing the costs, benefits, and risks of improving methods for authenticating taxpayers. In addition, the Consolidated Appropriations Act 2016 includes a provision that would help IRS with pre-refund matching and also includes an additional $290 million to enhance cybersecurity, combat identity theft refund fraud, and improve customer service.
According to IRS and industry partners, the 2016 filing season has generally gone smoothly, with about 95 million returns and $215 billion in refunds processed through April 1, 2016. In addition, IRS increased its level of phone service to taxpayers, although it has not developed a comprehensive strategy for customer service as GAO recommended in December 2015.
section_title: What GAO Recommends
paragraphs: In addition to 49 prior recommendations that had not been implemented, GAO made 45 new recommendations to IRS to further improve its information security controls and the implementation of its agency-wide information security program. GAO has also made recommendations to help IRS combat identity theft refund fraud, such as assessing costs, benefits, and risks of taxpayer authentication options.

section_title: Letter
paragraphs: Thank you for the opportunity to testify on cybersecurity and protecting  taxpayer information. As taxpayers file their returns for 2015, it is  especially important that the Internal Revenue Service (IRS) ensure that  adequate protections are in place to secure the sensitive information  entrusted to the agency by members of the public.
The federal government faces an evolving array of cyber-based threats to  its systems and data. Reported incidents and data breaches at federal  agencies, including IRS, have affected millions of people through the  compromise of sensitive personal information and underscore the  continuing and urgent need for effective information security. We initially  designated federal information security as a government-wide high-risk  area in 1997, and in 2003 we expanded this area to include computerized  systems supporting the nation’s critical infrastructure. In 2015 we added  the protection of personally identifiable information (PII) that is collected,  maintained, and shared by both federal and nonfederal entities.
In carrying out its mission to collect taxes, process tax returns, and  enforce U.S. tax laws, IRS relies extensively on computerized systems  and on information security controls to protect the confidentiality, integrity,  and availability of sensitive personal and financial information for each  U.S. taxpayer. Recent information security incidents at IRS further  highlight the importance of ensuring that these controls are effectively  implemented.
As you know, the filing season is the time when most taxpayers interact  with IRS. As in previous years, a major challenge during the filing season  is protecting taxpayers’ information and addressing identity theft (IDT)  refund fraud, which occurs when a refund-seeking fraudster obtains an  individual’s Social Security number, date of birth, or other PII and uses it  to file a fraudulent tax return seeking a refund. This crime burdens  honest taxpayers because authenticating their identities is likely to delay  processing their returns and refunds. Moreover, the victim’s PII can  potentially be used to commit other crimes. Given current and emerging  risks, in 2015 we expanded the enforcement of our tax laws high-risk area  to include IRS’s efforts to address IDT refund fraud.
My statement today focuses on opportunities to assist IRS in addressing  (1) information security weaknesses we have identified and (2) the  challenge of identity theft refund fraud. I will also discuss the status of  selected IRS filing season operations.
Within the context of my testimony, it is important to note that, for fiscal  year 2016, IRS received about $290 million in additional funding to  support these areas. Specifically, the funding was intended to improve  customer service, IDT identification and prevention, and cybersecurity  efforts. According to IRS’s spending plan this funding will be used to  invest in (1) increased telephone level of service, including reduced wait  times and improved performance on IRS’s Taxpayer Protection  Program/Identity Theft Toll Free Line ($178.4 million); (2) cybersecurity  including network security improvements, protection from unauthorized  access, and enhanced insider threat detection ($95.4 million); and (3) IDT  refund fraud prevention ($16.1 million).
My statement is based in part on our previous reports issued between  August 2014 and March 2016. We updated selected data in this  statement with 2016 data from IRS on individual income tax return  processing and telephone service, as well as IRS’s fiscal year 2016  spending plan for the additional $290 million in appropriated funds. We  also incorporated IRS statements on recent data breaches and IRS  actions to address our past recommendations. To assess data reliability,  we reviewed IRS data and documentation and assessed documentation  for data limitations. We found the data to be sufficiently reliable for our  purposes. All the work on which this statement is based was conducted in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform audits to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: IRS’s mission is to provide America’s taxpayers top-quality service by  helping them to understand and meet their tax responsibilities and to  enforce the law with integrity and fairness to all. During fiscal year 2015,  IRS collected more than $3.3 trillion; processed more than 243 million tax  returns and other forms; and issued more than $403 billion in tax refunds.  IRS employs about 90,000 people in its Washington, D.C., headquarters  and at more than 550 offices in all 50 states, U.S. territories, and some  U.S. embassies and consulates. Each filing season IRS provides  assistance to tens of millions of taxpayers over the phone, through written  correspondence, online, and face-to-face. The scale of these operations  alone presents challenges.
In carrying out its mission, IRS relies extensively on computerized  information systems, which it must effectively secure to protect sensitive  financial and taxpayer data for the collection of taxes, processing of tax  returns, and enforcement of federal tax laws. Accordingly, it is critical for  IRS to effectively implement information security controls and an agency- wide information security program in accordance with federal law and  guidance.
Cyber incidents can adversely affect national security, damage public  health and safety, and compromise sensitive information. Regarding IRS  specifically, two recent incidents illustrate the impact on taxpayer and  other sensitive information:  In June 2015, the Commissioner of the IRS testified that unauthorized  third parties had gained access to taxpayer information from its Get  Transcript application. According to officials, criminals used taxpayer- specific data acquired from non-department sources to gain  unauthorized access to information on approximately 100,000 tax  accounts. These data included Social Security information, dates of  birth, and street addresses. In an August 2015 update, IRS reported  this number to be about 114,000, and that an additional 220,000  accounts had been inappropriately accessed. In a February 2016  update, the agency reported that an additional 390,000 accounts had  been accessed. Thus, about 724,000 accounts were reportedly  affected. The online Get Transcript service has been unavailable  since May 2015.
In March 2016, IRS stated that as part of its ongoing security review, it  had temporarily suspended the Identity Protection Personal  Identification Number (IP PIN) service on IRS.gov. The IP PIN is a  single-use identification number provided to taxpayers who are victims  of identity theft (IDT) to help prevent future IDT refund fraud. The  service on IRS’s website allowed taxpayers to retrieve their IP PINs  online by passing IRS’s authentication checks. These checks confirm  taxpayer identity by asking for personal, financial and tax-related  information. The IRS stated that it was conducting further review of  the IP PIN service and is looking at further strengthening the security  features before resuming service. As of April 7, the online service was  still suspended.
The Commissioner of Internal Revenue has overall responsibility for  ensuring the confidentiality, integrity, and availability of the information  and systems that support the agency and its operations. Within IRS, the  senior agency official responsible for information security is the Associate  CIO, who heads the IRS Information Technology Cybersecurity  organization.
section_title: Although IRS Has Made Improvements, Information Security Weaknesses Continue to Place Taxpayer and Financial Data at Risk
paragraphs: As we reported in March 2016, IRS has implemented numerous controls  over key financial and tax processing systems; however, it had not always  effectively implemented access and other controls, including elements  of its information security program.
Access controls are intended to prevent, limit, and detect unauthorized  access to computing resources, programs, information, and facilities.  These controls include identification and authentication, authorization,  cryptography, audit and monitoring, and physical security controls, among  others. In our most recent review we found that IRS had improved access  controls, but some weaknesses remain.
Identifying and authenticating users—such as through user  account-password combinations—provides the basis for establishing  accountability and controlling access to a system. IRS established  policies for identification and authentication, including requiring  multifactor authentication for local and network access accounts and  establishing password complexity and expiration requirements. It also  improved identification and authentication controls by, for example,  expanding the use of an automated mechanism to centrally manage,  apply, and verify password requirements. However, weaknesses in  identification and authentication controls remained. For example, the  agency used easily guessable passwords on servers supporting key  systems.
Authorization controls limit what actions users are able to perform  after being allowed into a system and should be based on the concept  of “least privilege,” granting users the least amount of rights and  privileges necessary to perform their duties. While IRS established  policies for authorizing access to its systems, it continued to permit  excessive access in some cases. For example, users were granted  rights and permissions in excess of what they needed to perform their  duties, including for an application used to process electronic tax  payment information and a database on a human resources system.
Cryptography controls protect sensitive data and computer  programs by rendering data unintelligible to unauthorized users and  protecting the integrity of transmitted or stored data. IRS policies  require the use of encryption and it continued to expand its use of  encryption to protect sensitive data. However, key systems we  reviewed had not been configured to encrypt sensitive user  authentication data.
Audit and monitoring is the regular collection, review, and analysis  of events on systems and networks in order to detect, respond to, and  investigate unusual activity. IRS established policies and procedures  for auditing and monitoring its systems and continued to enhance its  capability by, for example, implementing an automated mechanism to  log user activity on its access request and approval system. But it had  not established logging for two key applications used to support the  transfer of financial data and access and manage taxpayer accounts;  nor was the agency consistently maintaining key system and  application audit plans.
Physical security controls, such as physical access cards, limit  access to an organization’s overall facility and areas housing sensitive  IT components. IRS established policies for physically protecting its  computer resources and physical security controls at its enterprise  computer centers, such as a dedicated guard force at each of its  computer centers. However, the agency had yet to address  weaknesses in its review of access lists for both employees and  visitors to sensitive areas.
IRS also had weaknesses in configuration management controls, which  are intended to prevent unauthorized changes to information system  resources (e.g., software and hardware) and provide assurance that  systems are configured and operating securely. Specifically, while IRS  developed policies for managing the configuration of its information  technology (IT) systems and improved some configuration management  controls, it did not, for example, ensure security patch updates were  applied in a timely manner to databases supporting 2 key systems we  reviewed, including a patch that had been available since August 2012.
To its credit, IRS had established contingency plans for the systems we  reviewed, which help ensure that when unexpected events occur, critical  operations can continue without interruption or can be promptly resumed,  and that information resources are protected. Specifically, IRS had  established policies for developing contingency plans for its information  systems and for testing those plans, as well as for implementing and  enforcing backup procedures. Moreover, the agency had documented  and tested contingency plans for its systems and improved continuity of  operations controls for several systems.
Nevertheless, the control weaknesses can be attributed in part to IRS’s  inconsistent implementation of elements of its agency-wide information  security program. The agency established a comprehensive framework  for its program, including assessing risk for its systems, developing  system security plans, and providing employees with security awareness  and specialized training. However, IRS had not updated key mainframe  policies and procedures to address issues such as comprehensively  auditing and monitoring access.
In addition, the agency had not fully addressed previously identified  deficiencies or ensured that its corrective actions were effective. During  our most recent review, IRS told us it had addressed 28 of our prior  recommendations; however, we determined that 9 of these had not been  effectively implemented.
The collective effect of the deficiencies in information security from prior  years that continued to exist in fiscal year 2015, along with the new  deficiencies we identified, are serious enough to merit the attention of  those charged with governance of IRS and therefore represented a  significant deficiency in IRS’s internal control over financial reporting  systems as of September 30, 2015.
subsections: section_title: Implementing GAO Recommendations Can Help IRS Better Protect Sensitive Taxpayer and Financial Data
paragraphs: To assist IRS in fully implementing its agency-wide information security  program, we made two new recommendations to more effectively  implement security-related policies and plans. In addition, to assist IRS in  strengthening security controls over the financial and tax processing  systems we reviewed, we made 43 technical recommendations in a  separate report with limited distribution to address 26 new weaknesses in  access controls and configuration management.
Implementing these recommendations—in addition to the 49 outstanding  recommendations from previous audits—will help IRS improve its controls  for identifying and authenticating users, limiting users’ access to the  minimum necessary to perform their job-related functions, protecting  sensitive data when they are stored or in transit, auditing and monitoring  system activities, and physically securing its IT facilities and resources.
Table 1 below provides the number of our prior recommendations to IRS  that were not implemented at the beginning of our fiscal year 2015 audit,  how many were resolved by the end of the audit, new recommendations,  and the total number of outstanding recommendations at the conclusion  of the audit.
In commenting on drafts of our reports presenting the results of our fiscal  year 2015 audit, the IRS Commissioner stated that while the agency  agreed with our new recommendations, it will review them to ensure that  its actions include sustainable fixes that implement appropriate security  controls balanced against IT and human capital resource limitations.
In addition, IRS can take steps to improve its response to data breaches.  Specifically, in December 2013 we reported on the extent to which data  breach policies at eight agencies, including IRS, adhered to requirements  and guidance set forth by the Office of Management and Budget and the  National Institute of Standards and Technology. While the agencies in  our review generally had policies and procedures in place that reflected  the major elements of an effective data breach response program,  implementation of these policies and procedures was not consistent. With  respect to IRS, we determined that its policies and procedures generally  reflected key practices, although the agency did not require considering  the number of affected individuals as a factor when determining if affected  individuals should be notified of a suspected breach. In addition, IRS did  not document lessons learned from periodic analyses of its breach  response efforts. We recommended that IRS correct these weaknesses,  but the agency has yet to fully address them.
section_title: Billions of Dollars Have Been Lost to IDT Refund Fraud, and IRS Faces Challenges in Combating This Evolving Threat
paragraphs: The importance of protecting taxpayer information is further highlighted by  the billions of dollars that have been lost to IDT refund fraud, which  continues to be an evolving threat. IRS develops estimates of the extent  of IDT refund fraud to help direct its efforts to identify and prevent the  crime. While its estimates have inherent uncertainty, IRS estimated that it  prevented or recovered $22.5 billion in fraudulent IDT refunds in filing  season 2014 (see figure 1). However, IRS also estimated, where data  were available, that it paid $3.1 billion in fraudulent IDT refunds. Because  of the difficulties in knowing the amount of undetectable fraud, the actual  amount could differ from these estimates.
IRS has taken steps to address IDT refund fraud; however, it remains a  persistent and continually changing threat. IRS recognized the challenge  of IDT refund fraud in its fiscal year 2014-2017 strategic plan and  increased resources dedicated to combating IDT and other types of  refund fraud. In fiscal year 2015, IRS reported that it staffed more than  4,000 full-time equivalents and spent about $470 million on all refund  fraud and IDT activities. As described above, IRS received an additional  $290 million for fiscal year 2016 to improve customer service, IDT  identification and prevention, and cybersecurity efforts and the agency  plans to use $16.1 million of this funding to help prevent IDT refund fraud,  among other things. The administration requested an additional $90  million and an additional 491 full-time equivalents for fiscal year 2017 to  help prevent IDT refund fraud and reduce other improper payments. IRS  estimates that this $90 million investment in IDT refund fraud and other  improper payment prevention would help it protect $612 million in  revenue in fiscal year 2017, as well as protect revenue in future years.
IRS has taken action to improve customer service related to IDT refund  fraud. For example, between the 2011 and 2015 filing seasons, IRS  experienced a 430 percent increase in the number of telephone calls to  its Identity Theft Toll Free Line—as of March 19, 2016, IRS had received  over 1.1 million calls to this line. Moreover, 77 percent of callers seeking  assistance on this telephone line received it compared to 54 percent  during the same period last year. Average wait times during the same  period have also decreased—taxpayers are waiting an average of 14  minutes to talk to an assistor, a decrease from 27 minutes last year.
IRS also works with third parties, such as tax preparation industry  participants, states, and financial institutions to try to detect and prevent  IDT refund fraud. In March 2015, the IRS Commissioner convened a  Security Summit with industry and states to improve information sharing  and authentication. IRS officials said that 40 state departments of  revenue and 20 tax industry participants have officially signed a  partnership agreement to enact recommendations developed and agreed  to by summit participants. IRS plans to invest a portion of the $16.1  million it received in fiscal year 2016 into identity theft prevention and  refund fraud mitigation actions from the Security Summit. These efforts  include developing an Information Sharing and Analysis Center where  IRS, states, and industry can share information to combat IDT refund  fraud.
Even though IRS has prioritized combating IDT refund fraud, fraudsters  adapt their schemes to identify weaknesses in IDT defenses, such as  gaining access to taxpayers’ tax return transcripts through IRS’s online  Get Transcript service. According to IRS officials, with access to tax  transcripts, fraudsters can create historically consistent returns that are  hard to distinguish from a return filed by a legitimate taxpayer, potentially  making it more difficult for IRS to identify and detect IDT refund fraud.
subsections: section_title: Implementing Past GAO Recommendations Could Help IRS Combat IDT Refund Fraud
paragraphs: Without additional action by IRS and Congress, the risk of issuing  fraudulent IDT refunds could grow. We previously made  recommendations to IRS to help it better combat IDT refund fraud:
Authentication. In January 2015, we reported that IRS’s  authentication tools have limitations and recommended that IRS  assess the costs, benefits and risks of its authentication tools. For  example, individuals can obtain an e-file PIN by providing their name,  Social Security number, date of birth, address, and filing status for  IRS’s e-file PIN application. Identity thieves can easily find this  information, allowing them to bypass some, if not all, of IRS’s  automatic checks, according to our analysis and interviews with tax  software and return preparer associations and companies. After filing  an IDT return using an e-file PIN, the fraudulent return would proceed  through IRS’s normal return processing.
In November 2015, IRS officials told us that the agency had  developed guidance for its Identity Assurance Office to assess costs,  benefits, and risk, and that its analysis will inform decision-making on  authentication-related issues. IRS also noted that the methods of  analysis for the authentication tools will vary depending on the  different costs and other factors for authenticating taxpayers in  different channels, such as online, phone, or in-person. In February  2016, IRS officials told us that the Identity Assurance Office plans to  complete a strategic plan for taxpayer authentication across the  agency in September 2016. While IRS is taking steps, it will still be  vulnerable until it completes and uses the results of its analysis of  costs, benefits, and risk to inform decision-making.
Form W-2, Wage and Tax Statement (W-2) Pre-refund Matching.
In August 2014 we reported that the wage information that employers  report on Form W-2 is not available to IRS until after it issues most  refunds, and that if IRS had access to W-2 data earlier, it could match  such information to taxpayers’ returns and identify discrepancies  before issuing billions of dollars of fraudulent IDT refunds.  We  recommended that IRS assess the costs and benefits of accelerating  W-2 deadlines.
In response to our recommendation, IRS provided us with a report in  September 2015 discussing (1) adjustments to IRS systems and work  processes needed to use accelerated W-2 information, (2) the  potential impacts on internal and external stakeholders, and (3) other  changes needed to match W-2 data to tax returns prior to issuing  refunds, such as delaying refunds until W-2 data are available. In  December 2015, the Consolidated Appropriations Act of 2016  amended the tax code to accelerate W-2 filing deadlines to January  31. IRS’s report will help IRS determine how to best implement pre- refund W-2 matching, given the new January 31st deadline for filing  W-2s. Additionally, we suggested that Congress should consider  providing the Secretary of the Treasury with the regulatory authority to  lower the threshold for electronic filing of W-2s, which could make  more W-2 information available to IRS earlier.
External Leads. IRS partners with financial institutions and other  external parties to obtain information about emerging IDT refund  trends and fraudulent returns that have passed through IRS detection  systems. In August 2014, we reported that IRS provides limited  feedback to external parties on IDT external leads they submit and  offers external parties limited general information on IDT refund fraud  trends and recommended that IRS provide actionable feedback to all  lead generating third parties.
In November 2015, IRS reported that it had developed a database to  track leads submitted by financial institutions and the results of those  leads. IRS also stated that it had held two sessions with financial  institutions to provide feedback on external leads provided to IRS. In  December 2015, IRS officials stated that the agency sent a customer  satisfaction survey asking financial institutions for feedback on the  external leads process and was considering other ways to provide  feedback to financial institutions. In April 2016, IRS officials stated  they plan to analyze preliminary survey results by mid-April 2016.  Additionally, IRS officials reported that the agency shared information  with financial institutions in March 2016 and plans to do so on a  quarterly basis, with the next information sharing session scheduled in  June 2016.
section_title: The 2016 Filing Season Has Generally Been Smooth, and Telephone Service Has Improved
paragraphs: IRS and industry partners have characterized that returns processing and  refund issuance during this filing season has been generally smooth.  Through April 1, 2016, IRS had processed about 95 million returns and  issued 76 million refunds totaling about $215 billion. While IRS  experienced a major system failure in February that halted returns  processing for about a day, the agency reported that it had minimal effect  on overall processing of returns and refunds.
In addition to filing returns, many taxpayers often call IRS for assistance.  IRS’s telephone service has generally improved in 2016 over last year.  From January 1 through March 19, 2016 IRS received about 35.4 million  calls to its automated and live assistor telephone lines, about a 2 percent  decrease compared to the same period last year. Of the 13.4 million  calls seeking live assistance, IRS had answered 9.1 million calls—a 75  percent increase over the 5.2 million calls answered during the same  period last year.
IRS anticipated that 65 percent of callers seeking live assistance would  receive it this filing season, which runs through April 18, and 47 percent of  callers would receive live assistance through the entire 2016 fiscal year.  As of March 19, 2016, 75 percent of callers had received live assistance,  an increase from 38 percent during the same period last year. Further,  the average wait time to speak to an assistor also decreased from 24 to 9  minutes. As we reported in March 2016, however, IRS’s telephone level  of service for the full fiscal year has yet to reach the levels it had achieved  in earlier years.
IRS attributed this year’s service improvement to a number of factors. Of  the additional $290 million IRS received in December 2015, it allocated  $178.4 million (61.5 percent) for taxpayer services to make measurable  improvements in its telephone level of service. With the funds, IRS hired  1,000 assistors who began answering taxpayer calls in March, in addition  to the approximately 2,000 seasonal assistors it had hired in fall 2015.  To help answer taxpayer calls before March, IRS officials told us that they  detailed 275 staff from one of its compliance functions to answer  telephone calls. IRS officials said they believe this step was necessary  because the additional funding came too late in the year to hire and train  assistors to fully cover the filing season. IRS also plans to use about 600  full-time equivalents of overtime for assistors to answer telephone calls  and respond to correspondence in fiscal year 2016, compared to fewer  than 60 full-time equivalents of overtime used in fiscal year 2015.
In December 2014, we recommended that IRS systematically and  periodically compare its telephone service to the best in business to  identify gaps between actual and desired performance. IRS disagreed  with this recommendation, noting that it is difficult to identify comparable  organizations. We do not agree with IRS’s position; many organizations  run call centers that would provide ample opportunities to benchmark  IRS’s performance.
In fall 2015, Department of the Treasury (Treasury) and IRS officials said  they had no plans to develop a comprehensive customer service strategy  or specific goals for telephone service tied to the best in the business and  customer expectations. Without such a strategy, Treasury and IRS can  neither measure nor effectively communicate to Congress the types and  levels of customer service taxpayers should expect and the resources  needed to reach those levels. Therefore, in December 2015 we  suggested that Congress consider requiring that Treasury work with IRS  to develop a comprehensive customer service strategy. In April 2016,  IRS officials told us that the agency established a team to consider our  prior work in developing this strategy or benchmarking its telephone  service.
In summary, while IRS has made progress in implementing information  security controls, it needs to continue to address weaknesses in access  controls and configuration management and consistently implement all  elements of its information security program. The risks IRS and the public  are exposed to have been illustrated by recent incidents involving public- facing applications, highlighting the importance of securing systems that  contain sensitive taxpayer and financial data. In addition, fully  implementing key elements of a breach response program will help  ensure that when breaches of sensitive data do occur, their impact on  affected individuals will be minimized.
Weaknesses in information security can also increase the risk posed by  identity theft refund fraud. IRS needs to establish an approach for  addressing identity theft refund fraud that is informed by assessing the  cost, benefits, and risks of IRS’s various authentication options and  improving the reliability of fraud estimates.
While this year’s tax filing season has generally gone smoothly and IRS  has improved customer service, it still needs to develop a comprehensive  approach to customer service that will meet the needs of taxpayers while  ensuring that their sensitive information is adequately protected.
Chairman Hatch, Ranking Member Wyden, and Members of the  Committee, this concludes my statement. I look forward to answering any  questions that you may have at this time.
section_title: Contacts and Staff Acknowledgments
paragraphs: If you have any questions regarding this statement, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, Nancy  Kingsbury at (202) 512-2928 or kingsburyn@gao.gov, or James R.  McTigue, Jr. at (202) 512-9110 or mctiguej@gao.gov or Jessica K.
Lucas-Judy at (202) 512-9110 or LucasJudyJ@gao.gov. Other key  contributors to this statement include Jeffrey Knott, Neil A. Pinney, and  Joanna M. Stamatiades (assistant directors); Dawn E. Bidne; Mark  Canter; James Cook; Shannon J. Finnegan; Lee McCracken; Justin Palk;  J. Daniel Paulk; Erin Saunders Rath; and Daniel Swartz.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.