Internal Revenue Service: Status of GAO Financial Audit and Related Financial Management Recommendations
Published: 2012-06-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In its role as the nations tax collector, IRS has a demanding responsibility to annually collect trillions of dollars in taxes, process hundreds of millions of tax and information returns, and enforce the nations tax laws.
Each year, as part of the annual audit of IRSs financial statements, GAO makes recommendations to address control deficiencies identified during the audit and follows up on the status of IRSs efforts to address the control deficiencies GAO identified in previous years audits. The purpose of this report is to (1) provide an overview of the financial management challenges still facing IRS, (2) provide the status of financial auditrelated recommendations and the actions needed to address them, and (3) highlight the relationship between GAOs recommendations and internal control activities central to IRSs mission and goals.
section_title: What GAO Found
paragraphs: The Internal Revenue Service (IRS) has made significant progress in improving its internal controls and financial management since its first financial statement audit in 1992, as evidenced by 12 consecutive years of clean audit opinions on its financial statements, the resolution of several material control deficiencies, and actions resulting in the closure of over 300 financial management recommendations. This progress has been the result of hard work throughout IRS and sustained commitment at the top levels of the agency. However, IRS still faces significant financial management challenges in (1) resolving its remaining material weaknesses and significant deficiency in internal control, (2) developing outcome-oriented performance metrics, and (3) correcting numerous other control deficiencies, especially those relating to safeguarding tax receipts and taxpayer information. At the beginning of GAOs audit of IRSs fiscal year 2011 financial statements, 77 recommendations from prior audits remained open because IRS had not fully addressed the underlying issues. During the fiscal year 2011 financial audit, IRS took actions that GAO considered sufficient to close 38 recommendations. At the same time, GAO identified additional control deficiencies resulting in 30 new recommendations. In total, 69 recommendations remain open. GAO has also identified numerous control deficiencies and made recommendations related to information security that have been reported separately and are not included in this report because of the sensitive nature of many of those control deficiencies.
To assist IRS in evaluating and improving internal controls, GAO categorized the 69 open recommendations by various internal control activities, which, in turn, were grouped into three broad control categories. The continued existence of control deficiencies that gave rise to these recommendations represents a serious challenge for IRS. Effective implementation of GAOs recommendations could greatly assist IRS in improving its internal controls and achieving sound financial management, which are integral to effectively carrying out its tax administration responsibilities.
section_title: What GAO Recommends
paragraphs: GAO is not making any recommendations in this report. In commenting on a draft of this report, the IRS Commissioner stated that the agency is committed to implementing appropriate improvements to maintain sound financial management practices.

section_title: Letter
paragraphs: In its role as the nation’s tax collector, the Internal Revenue Service (IRS)  has a demanding responsibility to collect taxes, process tax returns, and  enforce the nation’s tax laws. In fiscal year 2011, IRS collected about   $2.4 trillion in tax payments, processed hundreds of millions of federal tax  and information returns, and paid about $416 billion in refunds to  taxpayers. Because of its role and overall mission, IRS’s activities affect  virtually all of the nation’s citizens. It is therefore critical that the agency  strive to maintain sound internal control and financial management  practices.
IRS has made significant progress in improving its internal controls and  financial management since it was first required to prepare a set of  financial statements nearly two decades ago. This progress is reflected in  IRS’s 12-year record of clean audit opinions on its financial statements  and its resolution of several material weaknesses and significant  deficiencies in internal controls over the years. At the same time, IRS  continues to face significant financial management challenges in  achieving the overarching goals of effective federal financial  management—accountability and useful management information. To  achieve its goals of effective financial and operational management, IRS  needs to (1) address its remaining material weaknesses and its significant  deficiency in internal control, (2) fully integrate cost- and revenue-based  outcome-oriented decision making into its tax collection enforcement  operations, and (3) implement corrective actions to address other  identified control deficiencies.
An agency’s internal control serves as the first line of defense in  safeguarding its assets and in preventing and detecting errors and fraud,  as well as in helping to effectively manage its stewardship over public  resources. For many years, IRS has had control deficiencies in internal  controls over fundamental elements of its operations that leave it  vulnerable to a greater risk of fraud, waste, abuse, and mismanagement.  During our audit of IRS’s fiscal year 2011 financial statements, we found  that IRS continued to be challenged with two long-standing material  weaknesses in internal control that are at the heart of its operations— weaknesses in internal controls over unpaid tax assessments (unpaid  assessments) and over information systems security. We also found that  IRS continued to have a significant deficiency in internal control over the  processing of manually prepared tax refunds and claims for the First-time  Homebuyer Credit (FTHBC) that led to erroneous refund disbursements.  In addition, as in past years, IRS management faces a challenge in  enhancing and using its financial management capabilities to develop and  use outcome-oriented performance metricsfoundation upon which it can manage its operations for outcomes.
To assist IRS in strengthening its internal controls and improving its  operations, over the years we have made numerous recommendations as  part of our annual financial statement audits and other financial  management–related work at IRS. This report (1) provides an overview of  the continuing financial management challenges facing IRS; (2) describes  the status of financial audit–related recommendations and the actions  needed to address them, and (3) discusses how the unresolved  recommendations are integrally related to control activities central to  IRS’s mission and goals.
Appendix I provides a summary of the status of GAO recommendations.  To assist IRS in addressing those control activities, appendix II provides  summary information regarding the primary control deficiencies to which  each open recommendation is related. Our recommendations related to  IRS’s information systems security are reported separately because of  the sensitive nature of many of the control deficiencies that give rise to  the recommendations. However, we do provide summary data on the  number of information security–related recommendations and their  general makeup. We are not making any new recommendations in this  report.
subsections: section_title: Background
paragraphs: Internal control is not one event, but rather a series of activities that  should occur throughout an entity’s operations and on an ongoing basis.  Internal control should be an integral part of each system that  management uses to regulate and guide its operations, rather than as a  separate system within an agency. In this sense, internal control is  management control that should be built into the entity as a part of its  infrastructure to help managers run the entity and achieve their goals on  an ongoing basis.
Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the  Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires  agencies to establish and maintain effective internal control. The agency  head must annually evaluate and report on the control and financial  systems that protect the integrity of its federal programs. The  requirements of FMFIA serve as an umbrella under which other reviews,  evaluations, and audits should be coordinated and considered to support  management’s assertion about the effectiveness of internal control over  operations, financial reporting, and compliance with laws and regulations.
Office of Management and Budget (OMB) Circular No. A-123,  Management’s Responsibility for Internal Control, provides the  implementing guidance for FMFIA, and prescribes the specific  requirements for assessing and reporting on internal controls consistent  with the Standards for Internal Control in the Federal Government  (internal control standards) issued by the Comptroller General of the  United States. The circular defines management’s responsibilities related  to internal control and the required process for assessing internal control  effectiveness, and provides specific requirements for conducting  management’s assessment of the effectiveness of internal control over  financial reporting. The circular requires management to annually provide  assurances on internal control and emphasizes the need for integrated  and coordinated internal control assessments that synchronize all internal  control–related activities.
FMFIA requires GAO to issue standards for internal control in the federal  government. The internal control standards provide the overall framework  for establishing and maintaining effective internal control and for  identifying and addressing major performance and management  challenges and areas at greatest risk of fraud, waste, abuse, and  mismanagement.
As summarized in the internal control standards, internal control in the  government is defined by the following five elements, which also provide  the basis against which internal controls are to be evaluated:
Control environment: Management and employees should establish  and maintain an environment throughout the organization that sets a  positive and supportive attitude toward internal control and  conscientious management.
Risk assessment: Internal control should provide for an assessment of  the risks the agency faces from both external and internal sources.
Control activities: Internal control activities help ensure that  management’s directives are carried out. The control activities should  be effective and efficient in accomplishing the agency’s control  objectives.
Information and communication: Information should be recorded and  communicated to management and others within the entity who need  it and in a form and within a time frame that enables them to carry out  their internal control and other responsibilities.
Monitoring: Internal control monitoring should assess the quality of  performance over time and ensure that the findings of audits and  other reviews are promptly resolved.
A key objective in our annual audits of IRS’s financial statements is to  obtain reasonable assurance that IRS maintained effective internal  control with respect to financial reporting. While we use all five elements  of internal control, including risk assessment and monitoring, as a basis  for evaluating the effectiveness of IRS’s internal controls, our ongoing  evaluations and tests have focused heavily on control activities, where we  have identified numerous control deficiencies and have provided  recommendations for corrective action. Control activities are the policies,  procedures, techniques, and mechanisms that are intended to enforce  management’s directives. In other words, they are the activities  conducted in the everyday course of business that are intended to  accomplish a control objective, such as ensuring IRS employees  successfully complete background checks prior to being granted access  to taxpayer information and receipts. Control activities are an integral part  of an entity’s planning, implementing, reviewing, and accountability for  stewardship of government resources and achievement of effective  results.
section_title: Scope and Methodology
paragraphs: To accomplish our objectives, we evaluated the effectiveness of  corrective actions IRS implemented during fiscal year 2011 in response to  open recommendations as part of our fiscal years 2011 and 2010  financial audits. To determine the status of the recommendations, we   (1) obtained IRS’s reported status of each recommendation and  corrective action taken or planned as of March 2012, (2) compared IRS’s  reported status to our fiscal year 2011 audit findings to identify any  differences between IRS’s and our conclusions regarding the status of  each recommendation, and (3) performed additional follow-up work to  assess IRS’s actions taken to address the open recommendations.  Because of the sensitive nature of many of the issues related to our  recommendations regarding information security, we have reported our  recommendations for corrective action related to information security  issues to IRS separately.
GAO, Management Report: Improvements Are Needed to Enhance the Internal  Revenue Service’s Internal Controls and Operating Effectiveness, GAO-12-683R  (Washington, D.C.: June 25, 2012).
IRS had addressed, in whole or in part, the underlying control deficiencies  that gave rise to the recommendations; and other legal requirements and  implementing guidance, such as FMFIA and OMB Circular No. A-123.
Our work was performed from December 2011 through April 2012 in  accordance with generally accepted government auditing standards.
section_title: IRS Faces Continuing Significant Financial Management Challenges
paragraphs: IRS continues to make progress in resolving its control deficiencies and  addressing outstanding recommendations, but continues to face  significant financial management challenges. Since we first began  auditing IRS’s financial statements in fiscal year 1992, IRS has taken a  significant number of actions that were sufficient to resolve several  material weaknesses and significant control deficiencies and to close over  300 of our previously reported recommendations. This includes   38 recommendations we are closing with this report based on actions IRS  took through March 2012.
Nevertheless, IRS continues to face challenges in establishing effective  controls over its financial and operational management. Specifically, IRS  continues to face management challenges in (1) resolving its two material  weaknesses and one significant deficiency in internal control and   (2) developing performance measures necessary to managing  operational performance outcomes. Further, as in previous years’ audits,  our fiscal year 2011 audit continued to identify additional internal control  deficiencies, resulting in 30 new recommendations for corrective action.  These deficiencies and related recommendations are discussed in detail  in our June 2012 management report to IRS. In addition, as noted  earlier, we also identified control deficiencies related to information  security during our fiscal year 2011 audit that we reported separately with  limited distribution because of the sensitive nature of many of those  control deficiencies.
subsections: section_title: Challenges in Resolving Two Long-standing Material Weaknesses and One Significant Deficiency in Internal Control
paragraphs: As in past years, IRS continued to face significant challenges in resolving  its remaining long-standing material weaknesses in internal control  concerning (1) unpaid assessmentsyear 2011.   and (2) information security in fiscal  IRS’s continuing challenge in addressing its material weakness in internal  control over unpaid assessments results from its (1) inability to rely on its  general ledger and underlying subsidiary records to report federal taxes  receivable, compliance assessments, and writeoffs in accordance with  federal accounting standards without significant compensating  procedures; (2) inability to trace reported taxes receivable to supporting  transactions and maintain an effective transaction-based subledger for  unpaid assessment transactions; and (3) inability to effectively prevent or  timely detect and correct errors in taxpayer accounts. These control  deficiencies are caused primarily by IRS’s continued reliance on software  applications that were not designed to provide accurate, complete, and  timely transaction-level financial information, as well as errors in taxpayer  accounts. Consequently, IRS management is impaired in its ability to  make well-informed decisions and to accumulate and report financial  information in accordance with federal accounting standards. These  problems are likely to continue to exist until these software applications  are either significantly enhanced or replaced, and IRS remedies the  control deficiencies that continue to result in significant errors in taxpayer  accounts.
IRS’s continuing challenge in addressing its material weakness in internal  control over information systems security is primarily due to both  continuing and newly identified control deficiencies. As in past years, IRS  continued to (1) rely on a procurement system that lacks reliable controls  due to access control deficiencies and database maintenance that was  not performed; (2) use unencrypted protocols for a sensitive tax  processing application; and (3) have unresolved physical security control  deficiencies. Further, in fiscal year 2011, we identified control deficiencies  in IRS’s (1) system access and configuration controls and (2) controls  intended to compensate and mitigate for known information security  deficiencies. As a result of these control deficiencies considered  collectively, IRS was (1) unable to rely upon its systems or compensating  and mitigating controls to provide reasonable assurance that its financial  statements were fairly presented, (2) unable to ensure the reliability of  other financial management information produced by its systems, and   (3) at increased risk of compromising confidential IRS and taxpayer  information.
In addition to the continuing challenges posed by the two long-standing  material weaknesses concerning unpaid assessments and information  security, our audit of IRS’s fiscal year 2011 financial statements also  identified a continuing significant deficiency in IRS’s internal control over  tax refund disbursements, specifically, controls over the processing of  claims for the First-time Homebuyer Credit (FTHBC) and over manual  refunds. These control deficiencies related to the documentation of  FTHBC claims, monitoring of manual refunds, and training of staff having  key roles in refund processing.
section_title: Challenges in Developing and Implementing Performance Metrics to Assist in Managing for Outcomes
paragraphs: As in past years, IRS continues to face challenges in developing and  institutionalizing the use of financial management information to assist it  in making operational decisions and in measuring the effectiveness of its  programs. IRS made progress during fiscal year 2011 in developing and  integrating cost-based performance information into its operational  decision-making processes. However, IRS has not yet fully integrated  outcome-oriented cost-based performance data into each business  units’ routine decision-making processes. IRS has also not yet integrated  outcome-oriented performance data into its externally-reported  performance metrics.
During fiscal year 2011, IRS continued to add to the number of programs  and activities for which full cost, and applicable return on investment  (ROI), information has been developed. Further, for the past several  years, IRS has annually updated the data for each set of such  information. Additionally during fiscal year 2011, management teams in  several of IRS’s business units began to implement the use of available  full cost information for decision making.
However, this progress in the use of programmatic full cost and ROI  information, and related performance metrics, had not yet extended to  IRS’s primary business unit responsible for developing and directing  IRS’s corporate-wide enforcement activities to collect unpaid taxes. The  integration of such information into both IRS’s strategic and routine  enforcement-related management decisions could greatly enhance IRS’s  ability to manage for outcomes by evaluating the efficiency and cost- effectiveness of its programs and activities, including comparing the  efficiency and effectiveness of various existing enforcement collection  strategies, staffing levels, and proposed changes.
Developing informative and reliable outcome-oriented performance  metrics based on specific enforcement programs’ costs and revenues  would assist IRS in improving its ability to (1) establish measurable  outcome goals, (2) evaluate the relative merits of various program  options, and (3) highlight opportunities for optimizing the allocation of  resources. They could also assist IRS in more credibly demonstrating to  Congress and the public that it is using its appropriations cost-effectively.
A lack of outcome-oriented performance metrics is inconsistent with  federal financial management concepts as embodied in the Federal  Accounting Standards Advisory Board’s (FASAB) Statement of Federal  Financial Accounting Concepts No. 1, Objectives of Federal Financial  Reporting. Specifically, in its discussion of financial reporting concepts,  FASAB notes that federal financial data should provide accountability and  decision-useful information on the costs of programs and the outputs and  outcomes achieved, and it should provide data for evaluating service  efforts, costs, and accomplishments.
The absence of outcome metrics is also inconsistent with the objectives  of the CFO Act. A key objective of the act was for agencies to routinely  develop and use appropriate financial management information to  evaluate program effectiveness, make fully informed operational  decisions, and ensure accountability. While obtaining a clean audit  opinion on its financial statements is important in itself, it is not the CFO  Act’s end goal. Rather, the act’s end goal is modern financial  management systems that provide reliable, timely, and useful financial  information to support day-to-day decision making and oversight. Such  systems and practices should also provide for the systematic  measurement of both program outputs and outcomes.
We have made several recommendations to IRS over the years to  address its financial management challenges in developing internal full  cost data for its programs and activities and for outcome-oriented  performance measures. Successfully addressing the remaining open  recommendations would enhance IRS’s ability to effectively manage for  outcomes.
section_title: Status of Recommendations Based on the Fiscal Year 2011 Financial Statement Audit
paragraphs: In June 2011, we reported on the status of IRS’s efforts to implement  corrective actions to address recommendations stemming from our fiscal  year 2010 and prior years’ financial statement audits and other financial  management–related work. In that report, we identified 77 audit  recommendations that remained open and thus required corrective action  by IRS. A significant number of these recommendations had been open  for several years, either because IRS had not taken corrective action or  because the actions taken had not yet effectively resolved the control  deficiencies that gave rise to the recommendations.
IRS has continued to work to address many of the control deficiencies  related to these previously reported open recommendations. In the  course of performing our fiscal year 2011 financial audit, we determined  IRS took actions sufficient to address 38 of our prior years’  recommendations. However, a total of 39 recommendations from prior  years remain open, a significant number of which have been outstanding  for several years. IRS considers 16 of the prior years’ recommendations  to be effectively addressed and therefore closed. However, we consider  them to remain open. For 14 of the 16, in our view, IRS’s actions did not  fully address the control deficiencies that gave rise to the  recommendations. For the remaining two, we have not yet been able to  verify the effectiveness of IRS’s actions. The “Status per IRS” and “Status  per GAO” sections of appendix I provide a summary of both IRS’s and our  assessment of IRS’s actions on each recommendation.
During our audit of IRS’s fiscal year 2011 financial statements, we  identified additional control deficiencies that require corrective action. In  our June 2012 management report to IRS, we discussed these control  deficiencies, and made 30 new recommendations to address them.  Consequently, a total of 69 financial management–related  recommendations need to be addressed—39 from prior years and   30 new recommendations resulting from our fiscal year 2011 audit. We  consider all of the new recommendations to be correctible in the short  term. We also consider the majority of the recommendations  outstanding from prior years to be correctible in the short term. However,  a few, particularly those concerning the functionality of IRS’s automated  systems, are complex and may reasonably require several more years to  fully and effectively address.
In addition to the 69 open recommendations from our financial audits,  there are 118 additional open recommendations stemming from our  assessment of IRS’s information security controls over key financial  systems, information, and interconnected networks conducted as an  integral part of our annual financial audits. The control deficiencies that  led to our previously reported and our newly identified recommendations  related to information security increase the risk of unauthorized  disclosure, modification, or destruction of financial and sensitive taxpayer  data. Collectively, they constitute material weakness in IRS’s internal  control over information security for its financial and tax processing  systems. As discussed previously, we are reporting our recommendations  resulting from the information security control deficiencies identified in our  annual audits of IRS’s financial statements separately because of the  sensitive nature of many of these control deficiencies.
Appendix I presents a summary of the status of IRS actions to address  107 GAO non-information security-related recommendations based on  our financial audits–77 from our audits prior to fiscal year 2011 and   30 new recommendations based on the results of our fiscal year 2011  financial audit. Appendix I consists of the (1) recommendation, (2) GAO  report in which the recommendation was made, (3) IRS-reported status of  corrective actions taken or planned as of March 2012, and (3) our  analysis of the status of IRS actions as to whether those actions  effectively addressed the deficiencies that gave rise to the  recommendation. Appendix I lists the recommendations by the year in  which the recommendation was made and by GAO report number.
Appendix II presents the 69 open recommendations that remained at the  end of our fiscal year 2011 audit as a result of closing the aforementioned  38 recommendations and adding 30 new recommendations, grouped by  related material weakness, significant deficiency, and compliance issue  as described in our audit report on IRS’s financial statements, as well as  other control deficiencies we have identified and discussed in our annual  management reports to IRS.
section_title: Open Recommendations Grouped by Internal Control Activity
paragraphs: Linking the open recommendations from our financial audits, and the  control deficiencies that gave rise to them, to internal control activities that  are central to IRS’s tax administration responsibilities provides insight  regarding their significance to accomplishing IRS’s mission.
As discussed earlier, internal control standards define internal control as  consisting of five elements—control environment, risk assessment,  control activities, information and communication, and monitoring. For  the control activities element, the internal control standards explain that  an agency’s system of internal control should provide for an assessment  of the risks the agency faces from both external and internal sources and  that internal control activities should help ensure that management’s  directives and related control objectives are carried out. The control  activities element identified 11 specific control activities, which we have  grouped into three categories, as shown in table 1. Each of the  unresolved recommendations from our financial audits, and the  underlying control deficiencies that gave rise to them, can be grouped into  one of the 11 specific control activities as shown in table 1.
As shown in table 1, 18 (26 percent) of the unresolved recommendations  relate to IRS’s controls over safeguarding of assets and security activities,  29 (42 percent) relate to control deficiencies associated with IRS’s ability  to properly record and document transactions, and 22 (32 percent) relate  to control deficiencies associated with IRS’s management review and  oversight.
In the following section, we group the 69 open recommendations under  the specific control activity to which the condition that gave rise to each  recommendation most appropriately fits. We define each control activity  as presented in the internal control standards and briefly identify some of  the key IRS operations that fall under that control activity. Although not  comprehensive, the descriptions are intended to help explain why actions  to strengthen these control activities are important for IRS to efficiently  and effectively carry out its overall mission.
Each control activity description includes a table of the related open  recommendations. The tables list the recommendations by the year in  which we made them (ID no.). At the end of our description of each  recommendation, we also provide an assessment of whether the  recommendation can be addressed in the short term or long term. We  judged a recommendation to be correctible in the short term when we  believe that IRS had the capability to implement solutions within 2 years  of the year in which we first reported the control deficiency and made the  recommendations.
subsections: section_title: Safeguarding of Assets and Security Activities
paragraphs: Given IRS’s mission, the sensitivity of the data it maintains, and its  responsibility for processing trillions of dollars of tax receipts each year,  one of the most important control activities at IRS is safeguarding assets.  Internal control in this important area should be designed to provide  reasonable assurance regarding prevention or prompt detection of  unauthorized acquisition, use, or disposition of an agency’s assets. IRS  has outstanding recommendations in the following three control activities  related to safeguarding and securing assets: (1) physical control over  vulnerable assets, (2) segregation of duties, and (3) access restrictions  to, and accountability for, resources and records.
Internal control standard: An agency must establish physical control to  secure and safeguard vulnerable assets. Examples include security for  and limited access to assets such as cash, securities, inventories, and  equipment which might be vulnerable to risk of loss or unauthorized  use. Such assets should be periodically counted and compared to  control records.
Of the trillions of dollars in taxes that IRS collects each year, hundreds of  billions is collected in the form of checks and cash accompanied by tax  returns and related information. IRS collects taxes both at its own  facilities as well as at lockbox banks. IRS acts as custodian for (1) tax  payments it receives until they are deposited in the General Fund of the  U.S. Treasury and (2) tax returns and related information it receives until  they are either sent to the Federal Records Center or destroyed. IRS is  also charged with controlling many other assets, such as computers and  other equipment. IRS’s legal responsibility to safeguard tax returns and  the confidential information taxpayers provide on those returns makes the  effectiveness of IRS’s internal controls over physical security essential to  accomplishing its mission.
While effective physical safeguards over receipts should exist throughout  the year, such safeguards are especially important during the peak tax  filing season. Each year during the weeks preceding and shortly after   April 15, an IRS service center or lockbox bank may receive and process daily over 100,000 pieces of mail containing returns, receipts, or  both. The dollar value of receipts each service center and lockbox bank  processes increases to hundreds of millions of dollars a day during this  time frame.
The following 13 open recommendations in table 2 are designed to  improve IRS’s physical controls over vulnerable assets. They include  recommendations for IRS to improve controls over physical security at its  Taxpayer Assistance Centers (TAC) and courier activities. We consider  all of these recommendations to be correctable in the short term.
Internal control standard: Key duties and responsibilities need to be  divided or segregated among different people to reduce the risk of error  or fraud. This should include separating the responsibilities for  authorizing transactions, processing and recording them, reviewing the  transactions, and handling any related assets. No one individual should  control all key aspects of a transaction or event.
As discussed previously, IRS employees process hundreds of billions of  dollars in tax receipts in the form of cash and checks. Consequently, it is  critical that IRS maintain appropriate separation of duties so that no single  individual would be in a position of causing an error or irregularity, or  potentially converting the asset to personal use, and then concealing it.  For example, when an IRS field office receives taxpayer receipts and  returns, it is responsible for depositing the cash and checks in a  depository institution and forwarding the related taxpayer information  received for further processing, including updating the taxpayer’s tax  account records. In order to adequately safeguard receipts from theft, the  person responsible for recording the information from the taxpayer  receipts on a voucher should not also update the taxpayer’s tax records.
Implementing the following recommendation in table 3 would help IRS  improve its separation of duties, which will in turn strengthen controls over  tax receipts. This recommendation is correctible in the short-term.
Internal control standard: Access to resources and records should be  limited to authorized individuals, and accountability for their custody  and use should be assigned and maintained. Periodic comparison of  resources with the recorded accountability should be made to help  reduce the risk of errors, fraud, misuse, or unauthorized alteration.
Because IRS is responsible for maintaining accountability over a large  volume of cash and checks, it is imperative that it maintain strong controls  to appropriately restrict access to those assets, the records relied on to  track those assets, and sensitive taxpayer information. Our financial  audits over the years have identified control deficiencies related to   (1) individuals having direct access to cash and checks receiving  appropriate background investigations before being granted access to  taxpayer receipts and information and (2) maintaining effective access  security control. The following four short term recommendations in table 4  are intended to help IRS improve its access restrictions to assets and  records.
IRS has a number of control deficiencies related to recording  transactions, documenting events, and tracking the processing of  taxpayer receipts or information. IRS has outstanding recommendations  in the following three control activities related to proper recording and  documenting of transactions: (1) appropriate documentation of  transactions and internal controls, (2) accurate and timely recording of  transactions and events, and (3) proper execution of transactions and  events.
Internal control standard: Internal control and all transactions and other  significant events need to be clearly documented, and the  documentation should be readily available for examination. The  documentation should appear in management directives, administrative  policies, or operating manuals and may be in paper or electronic form.  All documentation and records should be properly managed and  maintained.
IRS collects and processes trillions of dollars in taxpayer receipts  annually both at its own facilities and at lockbox banks under contract to  process taxpayer receipts for the federal government. Therefore, it is  important that IRS maintain effective controls to ensure that all  documents and records are properly and timely recorded, managed, and  maintained both at its facilities and at the lockbox banks. In this regard, it  is critical that IRS adequately document and disseminate its procedures  to ensure that they are available for IRS employees. IRS must also  document its management reviews of controls, such as those regarding  refunds and returned checks, document transmittals, and reviews of  Taxpayers Assistance Center (TAC) operations. To ensure future  availability of adequate documentation, IRS must ensure that (1) its  systems, particularly those now being developed and implemented, have  appropriate capability to identify and trace individual transactions and (2)  all critical steps in its accounting processes are adequately documented.  Resolving the following eight recommendations in table 5 would assist  IRS in improving its documentation of transactions and related internal  control procedures. All of these recommendations are correctible in the  short term.
Internal control standard: Transactions should be promptly recorded to  maintain their relevance and value to management in controlling  operations and making decisions. This applies to the entire process or  life cycle of a transaction or event from the initiation and authorization  through its final classification in summary records. In addition, control  activities help to ensure that all transactions are completely and  accurately recorded.
IRS has stewardship responsibility for maintaining sensitive records of  tens of millions of taxpayers in addition to its responsibility for maintaining  its own financial records. To maintain these records, IRS often has to rely  on outdated computer systems or manual work-arounds. Unfortunately,  some of IRS’s recordkeeping difficulties we have reported on over the  years will not be fully addressed until it can replace its aging systems; an  effort that is long term and, in part, dependent on obtaining future funding.
Implementation of the following 16 recommendations in table 6 would  strengthen IRS’s recordkeeping abilities. Fifteen of these  recommendations are short term, and one is long term regarding  requirements for new systems for maintaining taxpayer records. Several  of the recommendations listed deal with financial reporting processes,  such as maintaining subsidiary records, recording budgetary transactions,  and tracking program costs. Some of the control deficiencies that gave  rise to several of our recommendations directly affect taxpayers, such as  those involving duplicate assessments and errors in calculating and  reporting interest and penalties. One of these recommendations has  remained open for over 10 years, reflecting the complex nature of the  underlying systems control deficiencies that must be resolved to fully  address some of these control deficiencies.
Internal control standard: Transactions and other significant events  should be authorized and executed only by persons acting within the  scope of their authority. This is the principal means of ensuring that  only valid transactions to exchange, transfer, use, or commit resources  and other events are initiated or entered into. Authorizations should be  clearly communicated to managers and employees.
IRS has thousands of leases that must be managed and properly  recorded in its property records. IRS also has thousands of employees  whose time and attendance must be properly recorded and approved so  that IRS can appropriately manage its payroll expenditures. The following  five short term recommendations in table 7 would improve IRS’s controls  over those areas.
All personnel within IRS have an important role in establishing and  maintaining effective internal control, but IRS’s managers have additional  review and oversight responsibilities. Management must monitor and  evaluate controls to ensure that they are followed. Without adequate  monitoring by managers, there is a risk that internal control activities may  not be carried out effectively and in a timely manner. IRS has outstanding  recommendations in the following three control activities related to  effective management review and oversight: (1) reviews by management  at the functional or activity level, (2) establishment and review of  performance measures and indicators, and (3) management of human  capital.
Internal control standard: Managers need to compare actual  performance to planned or expected results throughout the organization  and analyze significant differences.
IRS is responsible for managing a large, complex organization. It employs  and must oversee the activities of over 100,000 full-time and seasonal  employees, which includes managing related personnel actions. IRS is  also responsible for overseeing lockbox banks that process tens of  thousands of individual receipts totaling hundreds of billions of dollars,  monitoring the work of hundreds of contractors and numerous off-site  processing facilities, issuing tax refunds, managing tax liens, and  preparing financial records.
Effective management oversight of such large, complex operations is  imperative for IRS to effectively and efficiently accomplish its mission.  Implementing the following 17 short term and 1 long term  recommendations in table 8 would improve IRS’s management oversight  of its operations. One of these recommendations has remained open for  over 10 years, reflecting the complexities of the deficiencies involved in  ensuring that tax liens are released timely.
Internal control standard: Activities need to be established to monitor  performance measures and indicators. These controls could call for  comparisons and assessments relating different sets of data to one  another so that analyses of the relationships can be made and  appropriate actions taken. Controls should also be aimed at validating  the propriety and integrity of both organizational and individual  performance measures and indicators.
IRS’s operations include a wide range of activities, including educating  taxpayers, processing taxpayer receipts and data, disbursing hundreds of  billions of dollars in refunds to millions of taxpayers, maintaining extensive  information on tens of millions of taxpayers, and seeking collection from  individuals and businesses that fail to comply with the nation’s tax laws.  Within its compliance function, IRS has numerous activities, including  identifying businesses and individuals that underreport income, collecting  from taxpayers who do not pay taxes, and collecting from those receiving  refunds to which they are not entitled. Consequently, it is vitally important  for IRS to have sound performance measures and related data to assist it  in assessing its performance and targeting resources to maximize the  return on investment.
The following long term recommendation in table 9 is designed to assist  IRS in evaluating its operations and determining which activities are the  most beneficial. This recommendation is directed at improving IRS’s  ability to measure and evaluate program performance costs, benefits, and  operational outcomes—particularly with regard to identifying   its most cost-effective tax collection activities.
Internal control standard: Effective management of an organization’s  workforce—its human capital—is essential to achieving results and an  important part of internal control. Management should view human  capital as an asset rather than a cost. Only when the right personnel for  the job are on board and are provided the right training, tools, structure,  incentives, and responsibilities is operational success possible.  Management should ensure that skill needs are continually assessed  and that the organization is able to obtain a workforce that has the  required skills that match those necessary to achieve organizational  goals. Training should be aimed at developing and retaining employee  skill levels to meet changing organizational needs. Qualified and  continuous supervision should be provided to ensure that internal  control objectives are achieved. Performance evaluation and feedback,  supplemented by an effective reward system, should be designed to  help employees understand the connection between their performance  and the organization’s success. As a part of its human capital planning,  management should also consider how best to retain valuable  employees, plan for their eventual succession, and ensure continuity of  needed skills and abilities.
IRS’s operations cover a wide range of technical activities requiring  specific expertise in tax-related matters; financial management; and  systems design, development, and maintenance. Because IRS has tens  of thousands of employees spread throughout the country, it is imperative  that management establish and maintain up-to-date guidance and provide  appropriate training for its staff. Taking action to implement the following  three recommendations in table 10, which are correctible in the short  term, would assist IRS in its management of human capital.
section_title: Concluding Observations
paragraphs: Increased budgetary pressures and an increased public awareness of the  importance of maintaining effective accountability over trillions of dollars  of tax receipts and sensitive taxpayer data have served to provide  additional pressure on IRS to carry out its mission more efficiently and  effectively. As such, sound financial management and effective internal  controls are essential if IRS is to efficiently and effectively achieve its  goals.
IRS has made substantial progress in improving its financial management  and internal control since its first financial audit, as evidenced by  unqualified audit opinions on its financial statements for the past   12 years, resolution of several material internal control weaknesses,  significant deficiencies, and other control deficiencies, and actions taken  resulting in the closure of hundreds of financial management  recommendations. This progress has been the result of hard work by  many individuals throughout IRS and sustained commitment of IRS  leadership. Nonetheless, more needs to be done to fully address the  agency’s continuing financial management challenges—resolving  material weaknesses and significant deficiencies in internal control;  developing outcome-oriented performance metrics that can facilitate  managing operations for outcomes; and correcting numerous other  control deficiencies. Effective implementation of the recommendations we  have made through our financial audits and related work could greatly  assist IRS in improving its ability to effectively and efficiently carry out its  mission.
section_title: Agency Comments and Our Evaluation
paragraphs: In commenting on a draft of this report, the IRS Commissioner expressed  his appreciation for our acknowledgment of the agency’s progress in  addressing its financial management challenges as evidenced by our  closure of 38 open financial management recommendations from prior  GAO reports. The IRS Commissioner also stated that the agency is  committed to implementing appropriate improvements to ensure that it  maintains sound financial management practices. We will review the  effectiveness of further corrective actions IRS has taken or will take to  address all open recommendations as part of our audit of IRS’s fiscal  year 2012 financial statements.
We are sending copies of this report to the Chairmen and Ranking  Members of the Senate Committee on Appropriations; Senate Committee  on Finance; Senate Committee on Homeland Security and Governmental  Affairs; and Subcommittee on Taxation, IRS Oversight and Long-Term  Growth, Senate Committee on Finance. We are also sending copies to  the Chairmen and Ranking Members of the House Committee on  Appropriations; House Committee on Ways and Means; the Chairman  and Vice Chairman of the Joint Committee on Taxation; the Secretary of  the Treasury; the Acting Director of OMB; the Chairman of the IRS  Oversight Board; and other interested parties. The report is also available  at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made major contributions to  this report are listed in appendix IV.
section_title: Appendix I: Status of GAO Recommendations from Internal Revenue Service Financial Audits and Related Management Reports
paragraphs: This appendix presents a summary of (1) the 77 previous GAO  recommendations that were open as of the beginning of our fiscal year  2011 financial audit, (2) Internal Revenue Service (IRS) reported status  and corrective actions taken or planned for such recommendations as of  March 2012, and (3) our analysis of whether the control deficiencies that  gave rise to the recommendations have been effectively addressed. It  also includes a summary of the status of the 30 new recommendations  identified as part of our fiscal year 2011 financial statement audit. Table  11 lists the recommendations by the year and recommendation number  (ID no.) and also identifies the report in which the recommendation was  made.
section_title: Appendix II: Open Recommendations Arranged by Material Weakness, Significant Deficiency, Compliance, or Other Control Deficiencies
paragraphs: For several years, we have reported material weaknesses, significant  deficiencies, noncompliance with laws and regulations, and other control  deficiencies in our annual financial statement audits and related  management reports. Appendix II provides summary information  regarding the primary issue to which each open recommendation is most  closely related. To compile this summary, we analyzed the nature of the  open recommendations to relate them to the material weaknesses,  significant deficiency, compliance issue, or other control deficiencies (not  associated with a material weakness, significant deficiency, or  compliance issue) identified as part of our financial statement audit.
subsections: section_title: Material Weakness: Unpaid Assessments
paragraphs: The Internal Revenue Service (IRS) has a material weakness in its  internal control over the management of unpaid assessments resulting  from the agency’s (1) inability to rely on its general ledger for tax  transactions and underlying subsidiary records to report federal taxes  receivable, compliance assessments, and writeoffs in accordance with  federal accounting standards without significant compensating  procedures, (2) lack of transaction traceability for the reported balance in  taxes receivable that comprises over 80 percent of IRS’s total assets as  of September 30, 2011, and an effective transaction-based subledger for  unpaid tax assessment transactions, and (3) inability to effectively prevent  or timely detect and correct errors in taxpayer accounts. The  recommendations in table 12 address our related findings.
section_title: Material Weakness: Information Security
paragraphs: IRS has control deficiencies over information security that result primarily  from IRS not having fully implemented key components of its information  security program. These weaknesses, collectively, represent a material  weakness. For example, (1) IRS’s testing did not detect many of the  vulnerabilities we identified and did not assess a key application in its  current environment, and (2) IRS did not effectively validate corrective  actions reported to resolve previously identified control deficiencies.  Although IRS has made some progress in addressing previous control  deficiencies we identified in its information systems and physical security  controls, as of March 2012, there were 118 open recommendations  designed to help IRS improve its information systems security controls.  Those recommendations are reported separately and are not included in  this report primarily because of the sensitive nature of some of the  issues.
section_title: Significant Deficiency: Tax Refund Disbursements
paragraphs: IRS has several control deficiencies over its tax refund disbursements. In  our audit of IRS’s fiscal year 2011 financial statements, we reported a  significant deficiency in IRS’s internal control over tax refund  disbursements that resulted from (1) IRS not having effectively addressed  the deficiencies in internal control over manual tax refunds that we have  reported in previous years, (2) additional deficiencies in internal control  over manual tax refunds we identified during our fiscal year 2011 audit,  and (3) continued deficiencies in IRS’s internal control over processing of  claims for the First-time Homebuyer Credit (FTHBC). These control  deficiencies related to the monitoring of manual refunds, training of staff  having key roles in refund processing, and documentation of FTHBC  claims. The recommendations in table 13 address our related findings.
section_title: Compliance with Laws and Regulations: Release of Federal Tax Liens
paragraphs: IRS continues to be noncompliant with the laws and regulations  governing the release of federal tax liens. We found IRS did not always  release applicable federal tax liens within 30 days of tax liabilities being  either paid off or abated, as required by the Internal Revenue Code  (section 6325). The Internal Revenue Code grants IRS the power to file a  lien against the property of any taxpayer who neglects or refuses to pay  all assessed federal taxes. The lien serves to protect the interest of the  federal government and as a public notice to current and potential  creditors of the federal government’s interest in the taxpayer’s property.  The recommendation in table 14 addresses our related finding.
section_title: Other Control Deficiencies
paragraphs: IRS’s actions over the years to resolve control deficiencies enabled us to  close over 300 internal control–related recommendations. However, IRS  also continues to face a challenge in addressing numerous other  unresolved control deficiencies in several aspects of its operations that,  while neither individually nor collectively representing a material  weakness or significant deficiency, nonetheless merit management  attention to ensure they are fully and effectively addressed. IRS now has  a total of 57 open audit recommendations resulting from control  deficiencies that we report in table 15. While most were identified during  our recent financial audits, some were identified in our audits since 2005.  It is incumbent upon IRS to effectively address these open  recommendations and to improve its system of internal controls so that  IRS can identify and correct potential control deficiencies before they can  grow into more serious problems.
Twenty-five —over 40 percent—of the 57 “other” open recommendations  address control deficiencies related either directly or indirectly to physical  safeguarding of tax receipts and taxpayer information, a critical element  of IRS’s responsibilities.
IRS processes billions of dollars annually in checks and currency, which it  must safeguard and account for to prevent theft, fraud, and misuse. To do  so, IRS has established physical security, accountability, and accounting  policies, processes, and procedures to manage its activities involving  transporting and accounting for tax receipts and for handling and storing  taxpayer information. Although IRS has made substantial improvements  in safeguarding taxpayer receipts and information since our financial  audits first began identifying serious control deficiencies in this area, the  task of ensuring ongoing control over such critical responsibilities for IRS  is a difficult one and requires constant vigilance. Each year, we continue  to identify control deficiencies related to IRS’s safeguarding of taxpayer  receipts and information. For example, our fiscal year 2011 audit  identified new control deficiencies, and we made additional  recommendations that related either directly or indirectly to physically  safeguarding taxpayer receipts and information. The control deficiencies  encompassed in our open recommendations cover critical physical  security functions, such as  transporting taxpayer receipts and sensitive taxpayer information  among IRS facilities and lockbox banks and maintaining physical  security at IRS facilities to prevent loss, theft, or the potential for fraud  regarding tax receipts and taxpayer information;  conducting inspections and audits of the design and operation of  IRS’s physical security processes and controls designed to safeguard  tax receipts and taxpayer information; and conducting appropriate background investigations and screening of  personnel, including contractors, with access to taxpayer information.
In light of the volume of taxpayer receipts and sensitive taxpayer files that  IRS is responsible for safeguarding, and the implications for IRS’s  mission if they are lost, stolen, or the subject of fraud or misuse, it is  critical that IRS fully and effectively resolve the control deficiencies we  have identified and work toward continually improving its internal controls  to prevent new issues from arising.
section_title: Appendix III: Comments from the Internal Revenue Service
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, the following individuals made  major contributions to this report: William J. Cordrey, Assistant Director;  Crystal Alfred; Ray B. Bush; Sunny Chang; Stephanie Chen; Jeremy  Choi; Nina Crocker; Doreen Eng; Charles Fox; Ted Hu; Tuan Lam;  Delores Lee; Jenny Li; Cynthia Ma; Joshua Marcus; Marc Oestreicher;  Julie Phillips; James Rinaldi; John Sawyer; Christopher Spain; Cynthia  Teddleton; Lien To; LaDonna Towler; Cherry Vasquez; and Gary  Wiggins.