Internal Revenue Service: Status of GAO Financial Audit and Related Financial Management Report Recommendations
Published: 2010-06-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In its role as the nation's tax collector, the Internal Revenue Service (IRS) has a demanding responsibility to annually collect trillions of dollars in taxes, process hundreds of millions of tax and information returns, and enforce the nation's tax laws. Since its first audit of IRS's financial statements in fiscal year 1992, GAO has identified a number of weaknesses in IRS's financial management operations. In related reports, GAO has recommended corrective actions to address those weaknesses. Each year, as part of the annual audit of IRS's financial statements, GAO makes recommendations to address any new weaknesses identified and follows up on the status of IRS's efforts to address the weaknesses GAO identified in previous years' audits. The purpose of this report is to (1) provide an overview of the financial management challenges still facing IRS, (2) provide the status of financial audit and financial management-related recommendations and the actions needed to address them, and (3) highlight the relationship between GAO's recommendations and internal control activities central to IRS's mission and goals.
section_title: What GAO Found
paragraphs: IRS has made progress in improving its internal controls and financial management since its first financial statement audit in 1992, as evidenced by 10 consecutive years of clean audit opinions on its financial statements, the resolution of several material internal control weaknesses, and actions resulting in the closure of over 250 financial management recommendations. This progress has been the result of hard work throughout IRS and sustained commitment at the top levels of the agency. However, IRS still faces significant financial management challenges in (1) resolving its remaining material weaknesses in internal control, (2) developing outcome-oriented performance metrics, and (3) correcting numerous other internal control issues, especially those relating to safeguarding tax receipts and taxpayer information. At the beginning of GAO's audit of IRS's fiscal year 2009 financial statements, 62 financial management-related recommendations from prior audits remained open because IRS had not fully addressed the issues that gave rise to them. During the fiscal year 2009 financial audit, IRS took actions that GAO considered sufficient to close 18 recommendations. At the same time, GAO identified additional internal control issues resulting in 41 new recommendations. In total, 85 recommendations remain open. To assist IRS in evaluating and improving internal controls, GAO categorized the 85 open recommendations by various internal control activities, which, in turn, were grouped into three broad control categories: safeguarding of assets and security activities; proper recording and documenting of transactions; and effective management review and oversight. The continued existence of internal control weaknesses that gave rise to these recommendations represents a serious obstacle that IRS needs to overcome. Effective implementation of GAO's recommendations can greatly assist IRS in improving its internal controls and achieving sound financial management and can help enable it to more effectively carry out its tax administration responsibilities. Most can be addressed in the short term (the next 2 years). However, a few recommendations, particularly those concerning the functionality of IRS's automated systems, are complex and will require several more years to effectively address.
section_title: What GAO Recommends
paragraphs: GAO is not making any recommendations in this report. In commenting on a draft report, IRS stated that it is committed to implementing appropriate improvements to maintain sound financial management practices.

section_title: Letter
paragraphs: In its role as the nation’s tax collector, the Internal Revenue Service (IRS)  has a demanding responsibility to collect taxes, process tax returns, and  enforce the nation’s tax laws. In fiscal year 2009, IRS collected about   $2.3 trillion in tax payments, processed hundreds of millions of tax and  information returns, and paid about $438 billion in refunds to taxpayers.  Because of its role and overall mission, IRS’s activities affect virtually all  of the nation’s citizens. It is therefore critical that the agency strive to  maintain sound internal control and financial management practices.
IRS has made much progress in improving its financial management since  it was first required to prepare a set of financial statements nearly two  decades ago. This progress is reflected in IRS’s 10-year record of obtaining  a clean audit opinion on its financial statements and correcting several  material internal control weaknesses and significant deficiencies in  internal controls over the years. At the same time, IRS continues to face  significant financial management challenges in achieving the overarching  goals of federal financial management—accountability and useful  management information. To enable more effective financial and  operational management, IRS needs to (1) address its remaining   long-standing material internal control weaknesses, (2) develop data and  performance metrics that will enhance its ability to manage for outcomes,  and (3) implement corrective actions to address other identified internal  control issues.
An agency’s internal control serves as the first line of defense in  safeguarding its assets and in preventing and detecting errors and fraud, as  well as in helping to effectively manage its stewardship over public  resources. For many years, IRS has had weaknesses in internal controls  over fundamental elements of its operations that leave it vulnerable to a  greater risk of fraud, waste, abuse, and mismanagement. Specifically,  during our audit of IRS’s fiscal year 2009 financial statements, we found  that IRS continued to be challenged with two long-standing material  weaknesses in internal control that are at the heart of its operations— weaknesses in internal controls over unpaid tax assessments and over  information systems security. We also found that IRS faces a significant  management challenge in enhancing and using its financial management  capabilities to develop outcome-oriented performance metrics critical to  providing the foundation upon which an agency can manage its operations  for outcomes. Finally, we found that IRS has other internal control issues  that need management attention, especially those that relate to  safeguarding tax receipts and taxpayer information.
To assist IRS in strengthening its internal controls and improving its  operations, we have made numerous recommendations as part of our prior  annual financial statement audits and other financial management–related  work at IRS. This report (1) provides an overview of financial management  challenges still facing IRS; (2) describes the status of financial audit and  financial management–related recommendations and the actions needed  to address them, as presented in appendix I; and (3) discusses how the  unresolved recommendations relate to control activities central to IRS’s  mission and goals. To assist IRS in addressing those control activities,  appendix II provides summary information regarding the primary internal  control issue to which each open recommendation is related. This report  does not include our recommendations related to information systems  security even though they also are the result of our annual financial audits  and are financial management–related; those recommendations are  reported separately because of the sensitive nature of many of the issues  that give rise to the recommendations. We are not making any new  recommendations in this report.
Our work was performed from December 2009 through May 2010 in  accordance with generally accepted government auditing standards. For  further details regarding our approach to this audit, see the Scope and  Methodology section.
subsections: section_title: Background
paragraphs: Internal control is not one event, but a series of activities that occur  throughout an entity’s operations and on an ongoing basis. Internal control  should be an integral part of each system that management uses to  regulate and guide its operations rather than as a separate system within  an agency. In this sense, internal control is management control that is  built into the entity as a part of its infrastructure to help managers run the  entity and achieve their goals on an ongoing basis.
Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the  Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires  agencies to establish and maintain effective internal control. The agency  head must annually evaluate and report on the control and financial  systems that protect the integrity of its federal programs. The  requirements of FMFIA serve as an umbrella under which other reviews,  evaluations, and audits should be coordinated and considered to support  management’s assertion about the effectiveness of internal control over  operations, financial reporting, and compliance with laws and regulations.
Office of Management and Budget (OMB) Circular No. A-123,  Management’s Responsibility for Internal Control, provides the  implementing guidance for FMFIA, and prescribes the specific  requirements for assessing and reporting on internal controls consistent  with the Standards for Internal Control in the Federal Government  (internal control standards) issued by the Comptroller General of the  United States. The circular defines management’s responsibilities related  to internal control and the process for assessing internal control  effectiveness, and provides specific requirements for conducting  management’s assessment of the effectiveness of internal control over  financial reporting. Specifically, the circular requires management to  annually provide assurances on internal control in its performance and  accountability report, and, for each of the 24 Chief Financial Officers  (CFO) Act agencies, to include a separate assurance on internal control  over financial reporting, along with a report on identified material  weaknesses and corrective actions. The circular also emphasizes the  need for integrated and coordinated internal control assessments that  synchronize all internal control–related activities.
FMFIA requires GAO to issue standards for internal control in the federal  government. The internal control standards provide the overall framework  for establishing and maintaining effective internal control and for  identifying and addressing major performance and management  challenges and areas at greatest risk of fraud, waste, abuse, and  mismanagement.
As summarized in the internal control standards, internal control in the  government is defined by the following five elements, which also provide  the basis against which internal controls are to be evaluated:    Control environment: Management and employees should establish  and maintain an environment throughout the organization that sets a  positive and supportive attitude toward internal control and  conscientious management.
Risk assessment: Internal control should provide for an assessment of  the risks the agency faces from both external and internal sources.
Control activities: Internal control activities help ensure that  management’s directives are carried out. The control activities should  be effective and efficient in accomplishing the agency’s control  objectives.  Information and communication: Information should be recorded and  communicated to management and others within the entity who need it  and in a form and within a time frame that enables them to carry out  their internal control and other responsibilities.
Monitoring: Internal control monitoring should assess the quality of  performance over time and ensure that the findings of audits and other  reviews are promptly resolved.
A key objective in our annual audits of IRS’s financial statements is to  obtain reasonable assurance that IRS maintained effective internal control  with respect to financial reporting. While we use all five elements of  internal control as a basis for evaluating the effectiveness of IRS’s internal  controls, our ongoing evaluations and tests have focused heavily on  control activities, where we have identified numerous internal control  weaknesses and have provided recommendations for corrective action.  Control activities are the policies, procedures, techniques, and  mechanisms that enforce management’s directives. In other words, they  are the activities conducted in the everyday course of business that are  intended to accomplish a control objective, such as ensuring IRS  employees successfully complete background checks prior to being  granted access to taxpayer information and receipts. As such, control  activities are an integral part of an entity’s planning, implementing,  reviewing, and accountability for stewardship of government resources  and achievement of effective results.
section_title: Scope and Methodology
paragraphs: To accomplish our objectives, we evaluated the effectiveness of corrective  actions IRS implemented during fiscal year 2009 in response to open  recommendations as part of our fiscal years 2009 and 2008 financial audits.
To determine the current status of the recommendations, we (1) obtained  IRS’s reported status of each recommendation and corrective action taken  or planned as of April 2010, (2) compared IRS’s reported status to our  fiscal year 2009 audit findings to identify any differences between IRS’s  and our conclusions regarding the status of each recommendation, and   (3) performed additional follow-up work to assess IRS’s actions taken to  address the open recommendations. For our recommendations to IRS  regarding information security, this report includes only summary data on  the number of those recommendations and their general nature. We have  reported the objectives and results of our information security work  separately to IRS because of the sensitive nature of many of the issues  identified for which we have made recommendations for corrective  action.
In order to determine how IRS’s open recommendations, including the  latest ones in our June 2010 management report, fit within the agency’s  management and internal control structure, we compared the open  recommendations and the issues that gave rise to them to the (1) control  activities listed in the internal control standards, (2) list of major factors  and examples outlined in our Internal Control Management and  Evaluation Tool, and (3) criteria and objectives for federal financial  management as discussed in the CFO Act of 1990 and the Federal  Accounting Standards Advisory Board’s (FASAB) Statement of Federal  Financial Accounting Concepts No. 1, Objectives of Federal Financial  Reporting. We also considered whether IRS had addressed, in whole or in  part, the underlying control issues that gave rise to the recommendations;  and other legal requirements and implementing guidance, such as OMB  Circular No. A-123 and FMFIA.
Our work was performed from December 2009 through May 2010 in  accordance with generally accepted government auditing standards.
section_title: IRS Faces Significant Financial Management Challenges
paragraphs: IRS continues to make progress in resolving its internal control  weaknesses and addressing outstanding recommendations, but it still  faces significant financial management challenges. Since we first began  auditing IRS’s financial statements in fiscal year 1992, IRS has taken a  significant number of actions that enabled us to eliminate several material  weaknesses and significant deficiencies and to close over 250 of our  previously reported financial management–related recommendations. This  includes 18 recommendations we are closing with this report based on  actions IRS took through April 2010. Nevertheless, IRS continues to face  significant challenges in improving the effectiveness of its financial and  operational management. Specifically, IRS continues to face management  challenges in (1) resolving its two remaining material weaknesses in  internal control, (2) developing performance measures and managing for  outcomes, and (3) addressing its remaining internal control issues,  particularly those dealing with safeguarding of taxpayer receipts and  information. Further, as in previous years’ audits, our fiscal year 2009 audit  continued to identify additional internal control issues, resulting in 41 new  recommendations for corrective action we discussed in detail in our June  2010 management report to IRS. In addition, as noted earlier, we also  identified several issues related to information security during our fiscal  year 2009 audit that we reported separately because of the sensitive nature  of many of those issues.
subsections: section_title: Challenges in Resolving Two Long-standing Material Internal Control Weaknesses
paragraphs: As we reported in our audit of IRS’s fiscal year 2009 financial statements,  IRS’s efforts to address its internal control weaknesses resulted in our  closure of a material weakness in internal control over financial reporting  and a significant deficiency in internal control over tax revenue and  refunds. However, as we also reported in that audit, IRS continues to face  significant challenges in resolving its two remaining material weaknesses  in internal control concerning (1) unpaid tax assessments and   (2) information security.
IRS’s continuing challenge in addressing its material weakness in internal  control over unpaid tax assessments results from its (1) inability to use its  core general ledger system for tax administration–related transactions to  support its reported balances for taxes receivable and other unpaid  assessments, (2) lack of a subsidiary ledger for unpaid tax assessments  that would allow it to produce reliable, useful, and timely information with  which to manage and report externally on these key transactions, and   (3) errors and delays in recording taxpayer information, payments, and  other activities. These control deficiencies impede IRS’s ability to properly  manage and routinely report certain information on unpaid tax  assessments and lead to increased taxpayer burden.
IRS’s continuing challenge in addressing its material weakness in internal  control over information security is primarily due to IRS not having fully  implemented its information security program. As we reported in our audit  of IRS’s fiscal year 2009 financial statements, IRS has not (1) restricted  users’ ability to bypass application controls, (2) removed separated  employees’ system access in a timely manner, (3) followed required  procedures to timely review employee access to sensitive areas at data  centers, (4) restricted system access to only those who needed it,   (5) instituted adequate separation of duties for its procurement system,  and (6) developed adequate encryption controls over user login. IRS’s  deficiencies in internal control over information security result in IRS’s  inability to rely on the controls embedded in its automated financial  management systems to provide reasonable assurance that its (1) financial  statements are fairly stated in accordance with U.S. generally accepted  accounting principles, (2) financial information that management relies on  to support day-to-day decision making is current, complete, and accurate,  and (3) proprietary information processed by these automated systems is  appropriately safeguarded. These deficiencies also increase the risk that  unauthorized individuals could access, alter, or abuse proprietary IRS  programs and electronic data and taxpayer information without detection.
We have made numerous recommendations to IRS over the years— including new recommendations resulting from our fiscal year 2009  financial audit—to address the issues constituting these two material  internal control weaknesses. Successfully implementing these  recommendations would assist IRS in fully resolving these weaknesses. To  its credit, IRS continues to work to address the issues underlying these  two material weaknesses.
section_title: Challenges in Developing and Implementing Performance Metrics to Assist in Managing for Outcomes
paragraphs: As we reported in our audit of IRS’s fiscal year 2009 financial statements,  IRS continues to face significant challenges in developing and  instutionalizing the use of financial management information to assist it in  making operational decisions and in measuring the effectiveness of its  programs. IRS’s management has not developed the data or   outcome-oriented performance measures that would enhance its ability to  manage for outcomes. For example, it has not integrated the use of   cost-based (and when appropriate, revenue-based) performance metrics  into its routine management and decision-making processes or externally  reported performance metrics. Although IRS has developed projected  return on investment estimates for new enforcement (tax collection)  initiatives in its annual budget submissions, it has not developed similar  outcome-oriented performance metrics to determine whether funded  initiatives achieve their estimated goals. IRS has also not developed  outcome-oriented performance metrics for its existing enforcement  programs. These limitations inhibit IRS’s ability to more fully assess and  monitor the relative merits of its existing programs, to evaluate new  initiatives, or to consider alternatives and adjust its strategies as needed.  Outcome-oriented performance metrics based on specific enforcement  programs’ costs and revenues should improve IRS’s ability to (1) establish  measurable outcome goals, (2) evaluate the relative merits of various  program options, and (3) highlight opportunities for optimizing the  allocation of resources. They can also help IRS more credibly demonstrate  to Congress and the public that it is spending its appropriations wisely.
IRS’s existing metrics focus on process-oriented workload measures of  program outputs rather than on measuring program outcomes. For  example, for its enforcement programs, IRS focuses on measuring discrete  activities within its overall tax collection efforts, such as the percentage of  various types of tax returns examined, criminal investigations completed,  and the number of tax returns examined and closed. While such output  measures can be useful elements in assessing performance, they are not  designed to measure the contribution each of these activities makes to the  collection of unpaid taxes, nor do they compare the cost of collection  activities to the tax revenue generated. IRS’s enforcement metrics do not  include revenue collected—a measure of outcome—compared to the cost  of collection that could show the net monetary benefits of the  enforcement programs. In addition, IRS’s publicly available performance  metrics do not measure the cost of IRS’s programs either in the aggregate  or per service or activity performed.
As we report in the “Status per IRS” section of appendix I in this report,  IRS has reported that it considers our recommendation to develop  outcome-oriented performance measures and related performance goals  for IRS’s enforcement programs and activities to be closed. We do not  agree. Part of IRS’s justification for closing the recommendation is that  IRS uses cost-benefit return on investment analysis to evaluate future  scenarios and to support funding requests for new initiatives in its annual  budget submissions. Such prospective return on investment information is  useful for budgetary decision making, but our recommendation is for IRS  to develop outcome data on the actual results of its programs and  activities. We have also previously recommended that IRS (1) extend the  use of return on investment in future budget proposals to include major  enforcement programs and (2) develop return on investment data for its  enforcement programs using actual revenue and full cost data and  compare actual results to the projected return on investment data  included in its budget request. Our recommendations regarding  development of outcome-oriented performance metrics remain open  because, as noted above, IRS does not develop such data for either funded  initiatives or for ongoing enforcement programs and activities and it has  not deployed outcome-oriented performance measures.
IRS also reported that return on investment information is but one tool  that can be utilized to improve resource-allocation decision making, and it  is not prudent to rely exclusively on return on investment as the sole  determinant of resource allocation. As we have reported previously, we  acknowledge that IRS must consider other factors besides maximizing  revenue collection and least-cost operations. The fairness of IRS’s  implementation of the tax code and treatment of all taxpayers are  important, and we are cognizant of the many factors, such as coverage,  that are important considerations when making resource-allocation  decisions. These factors, and the decisions IRS makes about how to  respond to them, have a significant effect on taxpayers, as well as on tax  collections. However, using full cost and collection outcome-oriented  performance metrics are also important to make optimum use of its  available resources and to be able to credibly demonstrate it is doing so to  Congress and the public.
For several years, IRS has been developing full cost data on its programs  and activities in response to a recommendation we made in 1999.  However, as we have reported in the past, IRS’s efforts have been slowed  because IRS cannot produce full cost information down to the program  and activity levels directly from its cost accounting system, the Integrated  Financial System (IFS). IRS has partially overcome this difficulty by  developing the ability to manually combine cost data from IFS with  personnel time-charge data from IRS’s various workload management  systems and revenue data for enforcement programs to develop full cost  (and revenue) information for selected programs.
IRS’s lack of outcome-oriented performance metrics is inconsistent with  federal financial management concepts as embodied in FASAB’s  Statement of Federal Financial Accounting Concepts No. 1, Objectives of  Federal Financial Reporting. In its discussion of financial reporting  concepts, FASAB notes that federal financial data should provide  accountability and decision-useful information on the costs of programs  and the outputs and outcomes achieved, and it should provide data for  evaluating service efforts, costs, and accomplishments.
The absence of outcome metrics is also inconsistent with the objectives of  the CFO Act of 1990. A key objective of the act was for agencies to  routinely develop and use appropriate financial management information  to evaluate program effectiveness, make fully informed operational  decisions, and ensure accountability. While obtaining a clean audit opinion  on its financial statements is important in itself, it is not the end goal  reflected in the act. The end goal is modern financial management systems  that provide reliable, timely, and useful financial information to support  day-to-day decision making and oversight. Such systems and practices  should also provide for the systematic measurement of both outputs and  outcomes.
Developing the data and performance metrics necessary for a more  outcome-oriented approach to managing operations requires active and  sustained senior management leadership. We acknowledge that without  the benefit of integrated financial management systems, IRS faces  significant challenges in developing outcome-oriented performance  metrics, including the data needed for such metrics. However, undertaking  such an effort agencywide will enhance IRS’s ability to effectively measure  and compare the benefits of its programs to make better informed  resource-allocation decisions and to better support its budget requests.
We have made several recommendations to IRS over the years to address  its financial management challenges in developing full cost data for its  programs and activities and for outcome-oriented performance measures.  Successfully addressing the remaining open recommendations would  enhance IRS’s ability to effectively manage for outcomes.
section_title: Challenges in Resolving Other Internal Control Issues
paragraphs: As discussed earlier, IRS has taken significant actions over the years to  resolve internal control weaknesses and this has enabled us to close over  250 internal control–related recommendations. The closure of such a high  number of recommendations indicates that IRS has a strong commitment  to improving its internal control. However, IRS also continues to face a  challenge in addressing numerous other unresolved internal control issues  in several aspects of its operations that, while neither individually nor  collectively representing a material weakness, nonetheless merit  management attention to ensure they are fully and effectively addressed.  IRS now has a total of 70 open audit recommendations resulting from  internal control issues that we report as “other control issues” in appendix  II of this report. While most were identified during our recent financial  audits, some were identified in our audits as far back as 1999 and 2001.
Over half of those 70 open recommendations address issues related to the  physical safeguarding of tax receipts and taxpayer information, a critical  aspect of IRS’s responsibilities. IRS processes billions of dollars annually  in checks and currency and other valuable assets, and it must physically  safeguard and account for them to prevent theft, fraud, and misuse. To do  so, IRS has established physical security, accountability, and accounting  policies, processes, and procedures to manage its activities involving the  transportation and accounting for tax receipts and for handling and  storing taxpayer information. Although IRS has made substantial  improvements in safeguarding taxpayer receipts and information since our  financial audits first began surfacing serious internal control issues in this  area, the task of ensuring ongoing control over such critical  responsibilities for IRS is a difficult one. Each year, we continue to  identify control issues related to IRS’s safeguarding of taxpayer receipts  and information. For example, based on our fiscal year 2009 audit, we  identified new internal control issues and made 19 additional  recommendations that related either directly or indirectly to the physical  safeguarding of taxpayer receipts and information. The internal control  issues encompassed in our recommendations cover critical physical  security functions, such as  transporting taxpayer receipts and sensitive taxpayer information  among IRS facilities and lockbox banks and maintaining physical  security at IRS facilities to prevent loss, theft, or the potential for fraud  regarding tax receipts and taxpayer information;    conducting inspections and audits of the design and operation of IRS’s  physical security processes and controls designed to safeguard tax  receipts and taxpayer information;    conducting appropriate background investigations and screening of  personnel, including contractors, with access to IRS facilities and  lockbox bank operations; and    ensuring the proper destruction of documents to prevent the  inappropriate release of sensitive taxpayer information.
Due to the volume of taxpayer receipts and sensitive taxpayer files that  IRS is responsible for safeguarding, and the implications for IRS’s mission  if they are lost, stolen, or the subject of fraud or misuse, it is critical that  IRS successfully resolve the internal control issues we have identified and  work toward continually improving its internal controls to prevent new  issues from arising.
section_title: Status of Recommendations Based on the Fiscal Year 2009 Financial Statement Audit
paragraphs: In June 2009, we issued a report on the status of IRS’s efforts to implement  corrective actions to address financial management recommendations  stemming from our fiscal year 2008 and prior year financial audits and  other financial management–related work. In that report, we identified   62 audit recommendations that remained open and thus required  corrective action by IRS. A significant number of these recommendations  had been open for several years, either because IRS had not taken  corrective action or because the actions taken had not yet effectively  resolved the issues that gave rise to the recommendations.
IRS continued to work to address many of the internal control issues to  which these open recommendations relate. In the course of performing  our fiscal year 2009 financial audit, we identified numerous actions IRS  took to address many of its internal control issues. On the basis of IRS’s  actions, which we were able to substantiate through our audit, we have  closed 18 of these prior years’ recommendations. However, a total of   44 recommendations from prior years remain open, a significant number  of which have been outstanding for several years. IRS considers another  21 of the prior years’ recommendations to be effectively addressed and  therefore closed. However, we consider them to remain open. For 14 of  the 21, in our view, IRS’s actions did not fully address the issue that gave  rise to the recommendations. For the remaining seven, we have not yet  been able to verify the effectiveness of IRS’s actions. (See app. I, “Status  per GAO,” for our assessment of IRS’s actions on each recommendation).
During our audit of IRS’s fiscal year 2009 financial statements, we  identified additional issues that require corrective action. In our June 2010  management report to IRS, we discussed these issues, and made 41 new  recommendations to address them. Consequently, a total of 85 financial  management–related recommendations need to be addressed—44 from  prior years and 41 new ones from our fiscal year 2009 audit. We consider  all of the new recommendations to be short-term. We also consider the  majority of the recommendations outstanding from prior years to be  short-term; however, a few, particularly those concerning the functionality  of IRS’s automated systems, are complex and will require several more  years to fully and effectively address.
In addition to the 85 open recommendations from our financial audits and  other financial management–related work, there are 88 additional open  recommendations stemming from our assessment of IRS’s information  security controls over key financial systems, information, and  interconnected networks conducted as an integral part of our annual  financial audits. The issues that led to our previously reported and our  newly identified recommendations related to information security increase  the risk of unauthorized disclosure, modification, or destruction of  financial and sensitive taxpayer data. Collectively, they constitute IRS’s  material weakness in internal control over information security for its  financial and tax processing systems. As discussed earlier in this report,  recommendations resulting from the information security issues identified  in our annual audits of IRS’s financial statements are reported separately  because of the sensitive nature of many of these issues.
Appendix I presents a combined listing of (1) the 62 non-information- systems security–related recommendations based on our financial  statement audits and other financial management–related work that we  had not previously reported as closed and the 41 new recommendations  based on our fiscal year 2009 financial audit, (2) IRS-reported corrective  actions taken or planned as of April 2010, and (3) our analysis of whether  the issues that gave rise to the recommendations have been effectively  addressed, based primarily on the work performed during our fiscal year  2009 financial statement audit. The appendix lists the recommendations by  the date on which the recommendation was made and by report number.  Appendix II presents the open recommendations arranged by related  material weakness and compliance issue as described in our opinion  report on IRS’s financial statements, as well as other control issues we  have identified and discussed in our annual management reports to IRS.
section_title: Open Recommendations Grouped by Internal Control Activity
paragraphs: Linking the open recommendations from our financial audits and other  financial management–related work, and the issues that gave rise to them,  to internal control activities that are central to IRS’s tax administration  responsibilities provides insight regarding their significance.
Internal control standards consist of five elements—control environment,  risk assessment, control activities, information and communication, and  monitoring. For the control activities element, the internal control  standards explain that an agency’s system of internal control should  provide for an assessment of the risks the agency faces from both external  and internal sources and that internal control activities help ensure that  management’s directives are carried out. The control activities should be  effective and efficient in accomplishing the agency’s control objectives.  The control activities element defines 11 specific control activities, which  we have grouped into three categories, as shown in table 1. Each of the  unresolved recommendations from our financial audits and financial  management–related work, and the underlying issues that gave rise to  them, can be traced to 1 of the 11 specific control activities as shown in  table 1.
As table 1 indicates, 19 (22 percent) of the unresolved recommendations  relate to IRS’s controls over safeguarding of assets and security activities,  39 (46 percent) relate to issues associated with IRS’s ability to properly  record and document transactions, and 27 (32 percent) relate to issues  associated with IRS’s management review and oversight.
On the following pages, we group the 85 open recommendations under the  specific control activity to which the condition that gave rise to them most  appropriately fits. We define each control activity as presented in the  internal control standards and briefly identify some of the key IRS  operations that fall under that control activity. Although not  comprehensive, the descriptions are intended to help explain why actions  to strengthen these control activities are important for IRS to efficiently  and effectively carry out its overall mission. Each control activity  description includes a table of the related open recommendations. The  tables list the recommendations by the year in which we made them   (ID no.). For each recommendation, we also indicate whether it is a short- term or long-term recommendation. We characterized a recommendation  as short-term when we believe that IRS had the capability to implement  solutions within 2 years of the year in which we first reported them.
subsections: section_title: Safeguarding of Assets and Security Activities
paragraphs: Given IRS’s mission, the sensitivity of the data it maintains, and its  processing of trillions of dollars of tax receipts each year, one of the most  important control activities at IRS is the safeguarding of assets. Internal  control in this important area should be designed to provide reasonable  assurance regarding prevention or prompt detection of unauthorized  acquisition, use, or disposition of an agency’s assets. IRS has outstanding  recommendations in the following three control activities in the internal  control standards that relate to safeguarding of assets (including buildings  and equipment as well as tax receipts) and security activities (such as  limiting access to only authorized personnel): (1) physical control over  vulnerable assets; (2) segregation of duties; and (3) access restrictions to,  and accountability for, resources and records.
Internal control standard: An agency must establish physical control to secure and  safeguard vulnerable assets. Examples include security for and limited access to  assets such as cash, securities, inventories, and equipment which might be vulnerable  to risk of loss or unauthorized use. Such assets should be periodically counted and  compared to control records.
Of the trillions of dollars in taxes that IRS collects each year, hundreds of  billions is collected in the form of checks and cash accompanied by tax  returns and related information. IRS collects taxes both at its own  facilities as well as at lockbox banks. IRS acts as custodian for (1) the tax  payments it receives until they are deposited in the General Fund of the  U.S. Treasury and (2) the tax returns and related information it receives  until they are either sent to the Federal Records Center or destroyed. IRS  is also charged with controlling many other assets, such as computers and  other equipment, but it is IRS’s legal responsibility to safeguard tax returns  and the confidential information taxpayers provided on those returns that  makes the effectiveness of IRS’s internal controls over physical security  essential.
While effective physical safeguards over receipts should exist throughout  the year, such safeguards are especially important during the peak tax  filing season. Each year during the weeks preceding and shortly after   April 15, an IRS service center or lockbox bank may receive and process  daily over 100,000 pieces of mail containing returns, receipts, or both. The  dollar value of receipts each service center and lockbox bank processes  increases to hundreds of millions of dollars a day during the April 15 time  frame.
The following 11 open recommendations in table 2 are designed to  improve IRS’s physical controls over vulnerable assets. They include  recommendations for IRS to improve controls over (1) physical security at  its Taxpayer Assistance Centers (TAC), (2) courier activities, and   (3) lockbox banks’ handling of unprocessable items. We consider all of  these recommendations to be correctable on a short-term basis.
Internal control standard: Key duties and responsibilities need to be divided or  segregated among different people to reduce the risk of error or fraud. This should  include separating the responsibilities for authorizing transactions, processing and  recording them, reviewing the transactions, and handling any related assets. No one  individual should control all key aspects of a transaction or event.
As noted in the previous section, IRS employees process hundreds of  billions of dollars in tax receipts in the form of cash and checks.  Consequently, it is critical that IRS maintain appropriate separation of  duties to allow for adequate oversight of staff and protection of these  vulnerable resources so that no single individual would be in a position of  causing an error or irregularity, or potentially converting the asset to  personal use, and then concealing it. For example, when an IRS field office  receives taxpayer receipts and returns, it is responsible for depositing the  cash and checks in a depository institution and forwarding the related  taxpayer information received, such as tax returns, to an IRS service  center for further processing. In order to adequately safeguard receipts  from theft, the person responsible for recording the information from the  taxpayer receipts on a voucher should be different from the individual  who prepares those receipts for transmittal to the service center for  further processing. Also, IRS employees must properly account for the  billions of dollars IRS spends each year on its operations.
Implementing the following three recommendations in table 3 would help  IRS improve its separation of duties, which will in turn strengthen its  controls over tax receipts, procurement activities, and financial  accounting processes. All are short-term in nature.
Internal control standard: Access to resources and records should be limited to  authorized individuals, and accountability for their custody and use should be assigned  and maintained. Periodic comparison of resources with the recorded accountability  should be made to help reduce the risk of errors, fraud, misuse, or unauthorized  alteration.
Because IRS handles, and is responsible for maintaining accountability  over, a large volume of cash and checks, it is imperative that it maintain  strong controls to appropriately restrict access to those assets, the records  relied on to track those assets, and sensitive taxpayer information.  Although IRS has a number of both physical and information systems  controls in place, some of the issues we have identified in our financial  audits over the years pertain to ensuring that (1) those individuals who  have direct access to cash and checks are appropriately vetted, such as  through appropriate background investigations, before being granted  access to taxpayer receipts and information and (2) IRS maintains  effective access security control. The following five short-term  recommendations in table 4 were intended to help IRS improve its access  restrictions to assets and records.
section_title: Proper Recording and Documenting of Transactions
paragraphs: Internal control standard: Internal control and all transactions and other significant  events need to be clearly documented, and the documentation should be readily  available for examination. The documentation should appear in management directives,  administrative policies, or operating manuals and may be in paper or electronic form. All  documentation and records should be properly managed and maintained.
IRS collects and processes trillions of dollars in taxpayer receipts annually  both at its own facilities and at lockbox banks under contract to process  taxpayer receipts for the federal government. Therefore, it is important  that IRS maintain effective controls to ensure that all documents and  records are properly and timely recorded, managed, and maintained both  at its facilities and at the lockbox banks. In this regard, it is critical that  IRS adequately document and disseminate its procedures to ensure that  they are available for IRS employees. IRS must also document its  management reviews of controls, such as those regarding refunds and  returned checks, credit card purchases, and reviews of TAC operations. To  ensure future availability of adequate documentation, IRS must ensure that  (1) its systems, particularly those now being developed and implemented,  have appropriate capability to identify and trace individual transactions  and (2) all critical steps in its accounting processes are adequately  documented and controlled. Resolving the following 18 recommendations  in table 5 would assist IRS in improving its documentation of transactions  and related internal control procedures. Seventeen of these  recommendations are short-term, and one is long-term.
IRS maintains records for tens of millions of taxpayers in addition to  maintaining its own financial records. To carry out this responsibility, IRS  often has to rely on outdated computer systems or manual work-arounds.  Unfortunately, some of IRS’s recordkeeping difficulties we have reported  on over the years will not be addressed until it can replace its aging  systems, an effort that is long-term and, in part, dependent on obtaining  future funding.
Implementation of the following 20 recommendations in table 6 would  strengthen IRS’s recordkeeping abilities. Sixteen of these  recommendations are short-term, and four are long-term regarding  requirements for new systems for maintaining taxpayer records. Several of  the recommendations listed deal with financial reporting processes, such  as maintaining subsidiary records, recording budgetary transactions, and  tracking program costs. Some of the issues that gave rise to several of our  recommendations directly affect taxpayers, such as those involving  duplicate assessments, errors in calculating and reporting manual interest,  errors in calculating penalties, and collection of trust fund recovery  penalty assessments. Three of these recommendations have remained  open for over 10 years, reflecting the complex nature of the underlying  systems issues that must be resolved to fully address some of these  control deficiencies.
Internal control standard: Transactions and other significant events should be  authorized and executed only by persons acting within the scope of their authority. This  is the principal means of ensuring that only valid transactions to exchange, transfer,  use, or commit resources and other events are initiated or entered into. Authorizations  should be clearly communicated to managers and employees.
Each year, IRS spends approximately $250 million annually to cover the  cost of its employees’ travel. Failure to ensure that employees obtain  appropriate authorizations for their travel leaves the government open to  fraud, waste, or abuse. IRS actions to address the following short-term  recommendation in table 7 would improve IRS’s controls over travel costs.
section_title: Effective Management Review and Oversight
paragraphs: All personnel within IRS have an important role in establishing and  maintaining effective internal controls, but IRS’s managers have additional  review and oversight responsibilities. Management must set the objectives,  put control activities in place, and monitor and evaluate controls to ensure  that they are followed. Without adequate monitoring by managers, there is  a risk that internal control activities may not be carried out effectively and  in a timely manner. IRS has outstanding recommendations in the following  four control activities related to effective management review and  oversight: (1) reviews by management at the functional or activity level,  (2) establishment and review of performance measures and indicators,   (3) management of human capital, and (4) top-level reviews of actual  performance.
Internal control standard: Managers need to compare actual performance to planned or  expected results throughout the organization and analyze significant differences.
IRS employs over 100,000 full-time and seasonal employees. In addition, as  discussed earlier, lockbox banks process tens of thousands of individual  receipts, totaling hundreds of billions of dollars for IRS. Management  oversight of operations is important at any organization, but is imperative  at IRS given its mission.
Implementing the following 14 short-term and 1 long-term  recommendations in table 8 would improve IRS’s management oversight  of several areas of its operations, including monitoring of contractor  facilities, release of tax liens, issuance of manual refunds, and use of  appropriated funds. These recommendations were made because an  internal control activity either did not exist or the existing control was not  being adequately or consistently applied.
Internal control standard: Activities need to be established to monitor performance  measures and indicators. These controls could call for comparisons and assessments  relating different sets of data to one another so that analyses of the relationships can be  made and appropriate actions taken. Controls should also be aimed at validating the  propriety and integrity of both organizational and individual performance measures and  indicators.
IRS’s operations include a vast array of activities encompassing educating  taxpayers, processing of taxpayer receipts and data, disbursing hundreds  of billions of dollars in refunds to millions of taxpayers, maintaining  extensive information on tens of millions of taxpayers, and seeking  collection from individuals and businesses that fail to comply with the  nation’s tax laws. Within its compliance function, IRS has numerous  activities, including identifying businesses and individuals that  underreport income, collecting from taxpayers who do not pay taxes, and  collecting from those receiving refunds for which they are not entitled.  Although IRS has at its peak over 100,000 employees, it still faces resource  constraints in attempting to fulfill its duties. It is vitally important for IRS  to have sound performance measures to assist it in assessing its  performance and targeting its resources to maximize the government’s  return on investment. However, in past audits we have reported that IRS  did not capture costs at the program or activity level to assist in  developing cost-based performance measures for its various programs and  activities. As a result, IRS is unable to measure the costs and benefits of its  various collection and enforcement efforts to best target its available  resources.
The following one short-term and two long-term recommendations in table  9 are designed to assist IRS in (1) evaluating its operations,   (2) determining which activities are the most beneficial, and   (3) establishing a good system for oversight. These recommendations are  directed at improving IRS’s ability to measure, track, and evaluate the  costs, benefits, or outcomes of its operations—particularly with regard to  identifying its most cost-effective tax collection activities.
Internal control standard: Effective management of an organization’s workforce—its  human capital—is essential to achieving results and an important part of internal control.  Management should view human capital as an asset rather than a cost. Only when the  right personnel for the job are on board and are provided the right training, tools,  structure, incentives, and responsibilities is operational success possible. Management  should ensure that skill needs are continually assessed and that the organization is able  to obtain a workforce that has the required skills that match those necessary to achieve  organizational goals. Training should be aimed at developing and retaining employee  skill levels to meet changing organizational needs. Qualified and continuous supervision  should be provided to ensure that internal control objectives are achieved. Performance  evaluation and feedback, supplemented by an effective reward system, should be  designed to help employees understand the connection between their performance and  the organization’s success. As a part of its human capital planning, management should  also consider how best to retain valuable employees, plan for their eventual succession,  and ensure continuity of needed skills and abilities.
IRS’s operations cover a wide range of technical activities requiring  specific expertise needed in tax-related matters; financial management;  and systems design, development, and maintenance. Because IRS has tens  of thousands of employees spread throughout the country, it is imperative  that management keep its guidance up-to-date and its staff properly  trained. Taking action to implement the following eight short-term  recommendations in table 10 would assist IRS in its management of  human capital.
Internal control standard: Management should track major agency achievements and  compare these to the plans, goals, and objectives established under the Government  Performance and Results Act.
IRS is responsible for developing and operating a system of internal  control to ensure that it spends the billions of dollars appropriated to it  each year for operations in accordance with the directions dictated by  Congress. Implementing the following short-term recommendation in table  11 would improve IRS’s management and oversight of its performance  against legal mandates and requirements.
section_title: Concluding Observations
paragraphs: Increased budgetary pressures and an increased public awareness of the  importance of internal control require IRS to carry out its mission more  efficiently and more effectively while protecting taxpayers’ information.
Sound financial management and effective internal controls are essential if  IRS is to efficiently and effectively achieve its goals. IRS has made  substantial progress in improving its financial management and internal  control since its first financial audit, as evidenced by unqualified audit  opinions on its financial statements for the past 10 years; resolution of  several material internal control weaknesses, significant deficiencies, and  other control issues; and actions taken resulting in the closure of hundreds  of financial management recommendations. This progress has been the  result of hard work by many individuals throughout IRS and sustained  commitment of IRS leadership. Nonetheless, more needs to be done to  fully address the agency’s continuing financial management   challenges—resolving material internal control weaknesses; developing  outcome-oriented performance metrics that can facilitate managing  operations for outcomes; and correcting numerous other internal control  issues. Effective implementation of the recommendations we have made  and continue to make through our financial audits and related work could  greatly assist IRS in improving its internal controls and achieving sound  financial management. While we recognize that some actions—primarily  those related to modernizing automated systems—will take a number of  years to resolve, most of the open recommendations can be addressed in  the short term.
section_title: Agency Comments and Our Evaluation
paragraphs: In commenting on a draft of this report, IRS expressed it’s appreciation for  our acknowledgment of the agency’s progress in addressing its financial  management challenges as evidenced by our closure of 18 open financial  management recommendations from prior GAO reports. IRS also  commented that it is committed to implementing appropriate  improvement to ensure that it maintains sound financial management  practices. We will review the effectiveness of further corrective actions  IRS has taken or will take to address all open recommendations as part of  our audit of IRS’s fiscal year 2010 financial statements.
We are sending copies of this report to the Chairmen and Ranking  Members of the Senate Committee on Appropriations; Senate Committee  on Finance; Senate Committee on Homeland Security and Governmental  Affairs; and Subcommittee on Taxation, IRS Oversight and Long-Term  Growth, Senate Committee on Finance. We are also sending copies to the  Chairmen and Ranking Members of the House Committee on  Appropriations; House Committee on Ways and Means; the Chairman and  Vice Chairman of the Joint Committee on Taxation; the Secretary of the  Treasury; the Director of OMB; the Chairman of the IRS Oversight Board;  and other interested parties. The report is also available at no charge on  the GAO Web site at http://www.gao.gov.
If you or your staffs have any questions concerning this report, please  contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix IV.
section_title: Appendix I: Status of GAO Recommendations from Internal Revenue Service Financial Audits and Related Management Reports
paragraphs: This appendix presents a list of (1) the 62 recommendations that we had  not previously reported as closed, (2) Internal Revenue Service (IRS)  reported corrective actions taken or planned as of April 2010, and (3) our  analysis of whether the issues that gave rise to the recommendations have  been effectively addressed. It also includes 41 recommendations based on  our fiscal year 2009 financial statement audit. The appendix lists the  recommendations by the year and recommendation number (ID no.) and  also identifies the report in which the recommendation was made.
section_title: Appendix II: Open Recommendations Arranged by Material Weakness, Compliance, or Other Control Issue
paragraphs: For several years, we have reported material weaknesses, significant  deficiencies, noncompliance with laws and regulations, and other control  issues in our annual financial statement audits and related management  reports. Appendix II provides summary information regarding the primary  issue to which each open recommendation is most closely related. To  compile this summary, we analyzed the nature of the open  recommendations to relate them to the material weaknesses, compliance  issue, and other control issues not associated with a material weakness  identified as part of our financial statement audit.
subsections: section_title: Unpaid Tax Assessments
paragraphs: The Internal Revenue Service (IRS) has serious internal control issues that  affected its management of unpaid tax assessments. Specifically, IRS   (1) reported balances for taxes receivable and other unpaid assessments  that were not supported by its core general ledger system for tax  administration, (2) lacked a subsidiary ledger for unpaid tax assessments  that would allow it to produce accurate, useful, and timely information  with which to manage and report externally, and (3) experienced errors  and delays in recording taxpayer information, payments, and other  activities.
section_title: Information Security
paragraphs: Serious weaknesses in IRS’s internal control over information security  continue to jeopardize the confidentiality, availability, and integrity of  information processed by IRS’s key systems, increasing the risk of  material misstatement for financial reporting. For example, IRS has not  restricted users’ ability to bypass application controls, removed separated  employees’ systems access in a timely manner, or restricted system access  to only those who needed it. These unresolved weaknesses increase the  risk that data processed by the agency’s financial management systems are  not reliable. Although IRS has made some progress in addressing previous  weaknesses we identified in its information systems and physical security  controls, as of March 2010, there were 88 open recommendations designed  to help IRS improve its information systems security controls. Those  recommendations are reported separately and are not included in this  report primarily because of the sensitive nature of some of the issues.
section_title: Release of Federal Tax Liens
paragraphs: IRS continues to be noncompliant with the laws and regulations governing  the release of federal tax liens. IRS did not always release applicable  federal tax liens within 30 days of tax liabilities being either paid off or  abated, as required by the Internal Revenue Code (section 6325). The  Internal Revenue Code grants IRS the power to file a lien against the  property of any taxpayer who neglects or refuses to pay all assessed  federal taxes. The lien serves to protect the interest of the federal  government and as a public notice to current and potential creditors of the  government’s interest in the taxpayer’s property.
section_title: Other Control Issues
paragraphs: The 70 recommendations listed below pertain to issues that do not rise  individually or in the aggregate to the level of a material weakness or  noncompliance with laws and regulations. However, these issues do  represent weaknesses in various aspects of IRS’s control environment that  should be addressed.
section_title: Appendix III: Comments from the Internal Revenue Service
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, the following individuals made  major contributions to this report: William J. Cordrey, Assistant Director;  Russell Brown; Ray B. Bush; Nina Crocker; Oliver Culley; Doreen Eng;  Charles Fox; Valerie Freeman; Jamie Haynes; Ted Hu; Richard Larsen;  Delores Lee; Julie Phillips; John Sawyer; Christopher Spain; Cynthia  Teddleton; LaDonna Towler; and Gary Wiggins.