IRS Return Selection: Wage and Investment Division Should Define Audit Objectives and Refine Other Internal Controls
Published: 2015-12-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Audit activities help ensure taxpayers pay the right amount of tax and help address the net $385 billion tax gap—the difference between the amount of taxes paid voluntarily and on time, and the amount owed. Audit programs in W&I mainly cover refundable credits reported on the Form 1040, Individual Income Tax Return. The hundreds of thousands of taxpayers whom W&I interacts with annually during audits make it critical to apply the tax law fairly. Unfair selection would increase burden on taxpayers and reduce public confidence in IRS.
GAO was asked to review W&I's audit selection process. This report (1) describes the W&I process for selecting tax returns for audit, and (2) determines how well W&I's audit selection procedures support its mission and goal to apply the tax law with integrity and fairness to all. GAO reviewed documentation on program procedures, an audit work plan, and various Internal Revenue Manual sections; analyzed audit data from fiscal years 2013 and 2014; and interviewed relevant IRS officials.
section_title: What GAO Found
paragraphs: Three offices in the Internal Revenue Service's (IRS) Wage and Investment division (W&I) are responsible for selecting returns for audit. Most returns are selected via computer systems that automatically send notices to taxpayers based on certain criteria, such as the validity of dependents. W&I program officials annually review the criteria and apply updates to the following filing season's returns. In 2014, about 59 percent of all W&I audits—more than 516,000—were selected with a specialized computer tool called the Dependent Database, while the remainder was selected through a combination of referrals and manual selection methods.
W&I generally has established a positive environment for internal controls but could improve several areas in its audit selection procedures to support its mission. GAO found several procedures that establish a positive environment for promoting internal controls, such as ethics training. In addition, IRS has guidance to help ensure that decisions about updates to audit selection criteria are correctly implemented in its automated systems. However, W&I does not have established objectives for its audit selection process, and existing performance measures focus on audit results rather than audit selection. In addition, W&I has not defined key terms such as “fairness and integrity,” as required by internal control standards. Documented objectives and key terms would help W&I hone the measures it uses to assess its audit selection efforts and bring a consistent understanding of “fairness and integrity” to audit selection staff.
GAO also found that not all elements of the selection process were appropriately documented. For example, W&I does not have clear documentation about how the three offices that select the majority of returns W&I audits interact with one another. Additionally, one guidance document notes that returns with the highest audit potential should be marked, but it does not describe how audit potential is determined or any related internal controls. Further, W&I also did not provide support showing that changes to automated audit selection processes and procedures were appropriately implemented in a timely manner. Moreover, the documentation indicates that W&I conducts an annual—rather than continuous—review of its audit selections and results as part of an annual 3-day working session. Strengthening controls in these areas would help provide greater assurance that W&I is fulfilling its mission to select tax returns with fairness and integrity. Additionally, the absence of a fully documented selection process may make it difficult for W&I to defend against accusations that it is not appropriately following its processes and procedures.
section_title: What GAO Recommends
paragraphs: GAO recommends, among other things, that IRS establish program objectives and definitions of key terms such as “fairness” that apply to audit selection and use those definitions in assessing its selection performance; document selection processes more thoroughly; and document that changes to procedures are done in a timely manner. IRS generally agreed with all seven recommendations and provided additional comments reprinted in appendix II.

section_title: Letter
paragraphs: The Internal Revenue Service’s (IRS) Wage and Investment (W&I)  division audited more than 516,000 individual tax returns in fiscal year  2014—accounting for 42 percent of IRS’s efforts to review individual  taxpayers’ returns in terms of audit volume. Audits help ensure that  taxpayers comply with tax laws and help address the tax gap—the  estimated difference between the amount of taxes that taxpayers pay  voluntarily and on time and those they owe. IRS estimated that for tax  year 2006, the net tax gap of $385 billion included $235 billion from  underreporting of individual income tax.
W&I’s broad scope and the number of taxpayers it audits raise stakes for  properly selecting tax returns for audit. Unfair selection for audit could  place extra burden on taxpayers and reduce the public’s confidence in  IRS, which could undercut voluntary tax compliance and reduce federal  revenue. Unfairly selected audits also could waste IRS resources.
We recently have reported on IRS’s internal controls for other IRS  selection programs. For example, in July 2015, we reported that the  Exempt Organizations unit within the Tax Exempt and Government  Entities division had several areas where its controls were not well  designed or implemented. The control deficiencies increase the risk of  selecting organizations for audit in an unfair manner—for example, based  on an organization’s religious, educational, political, or other views. We  recommended that IRS take 10 actions to improve selection control  design and implementation, to which IRS generally agreed. Similarly, in  July and in September 2015, we found that IRS did not clearly define  program objectives and key terms in its collection programs, which could  undercut IRS’s ability to assess risks and monitor performance. We  recommended that IRS improve collection controls and procedures, and  periodically evaluate the controls’ effectiveness. IRS generally agreed  with the recommendations.
To better understand how individual tax returns are chosen for audit and  whether those procedures were fair, you asked us to review W&I audit  selection procedures. This report (1) describes the W&I process for  selecting tax returns for audit, and (2) determines how well W&I’s  procedures for selecting returns for audit support its mission and goal to  apply the tax law with integrity and fairness to all.
To describe the W&I process for selecting returns for audit, we reviewed  documentation on program procedures from the Internal Revenue Manual  (IRM) and other IRS documentation describing audit procedures. We also  interviewed relevant IRS audit officials. For context, we compiled  statistical information from fiscal years 2013 and 2014 about W&I audit  programs from IRS’s Compliance Data Warehouse—which provides a  variety of tax return, enforcement, compliance, and other data—and the  Examination Operational Automation Database, which contains  information on audit adjustments relating to specific audit issues. For the  purposes of this review, we determined that the data used in our analysis  were reliable. Our data reliability assessment included reviewing relevant  documentation, interviewing knowledgeable IRS officials, and reviewing  the data to identify obvious errors or outliers.
To determine how well W&I’s procedures for selecting tax returns for  audit support its mission, we reviewed W&I’s audit selection procedures  and related internal controls intended to help W&I achieve its stated  mission of “applying the tax law with integrity and fairness to all.” We then  assessed whether these relevant W&I procedures followed selected  internal control standards from Standards for Internal Control in the  Federal Government. The controls we chose applied to the processes  and procedures that W&I officials described or for which they provided  documentation regarding how audits were selected. We also relied on the  Internal Control Management and Evaluation Tool to identify specific  factors that could be used to operationalize the internal control  standards. In addition, we also reviewed Internal Revenue Service’s  Strategic Plan FY2014-2017; IRM sections related to W&I’s mission  statement and program objectives; IRS’s policy statement for audits and  information technology controls; W&I’s fiscal year 2014 program letter;  and other IRS documentation related to W&I’s audit selection process,  including internal risk assessment documents and annual meeting notes.  We also interviewed relevant IRS officials concerning their understanding  of the mission, objectives, and internal controls for audit selection  procedures. While we relied on documentation demonstrating whether the  standards were addressed, we did not test whether they were  systemically applied. For additional details on our scope and  methodology, see appendix I.
We conducted this performance audit from October 2014 to December  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: W&I supports IRS’s mission by maintaining an enforcement presence and  encouraging the correct reporting of income tax to instill the highest  degree of public confidence in the tax system’s integrity, fairness, and  efficiency. Audit programs in W&I cover mainly refundable credits on the  Form 1040 U.S. Individual Income Tax Return.
All W&I’s audits are correspondence audits—a type of audit conducted  through the mail. Audits have two compliance effects. First, they directly  detect and correct noncompliance by the audited taxpayers. Second,  audits indirectly encourage nonaudited taxpayers to comply voluntarily.
W&I’s audit responsibilities generally concern refundable credits claimed  on individual income tax returns. A refundable credit can give taxpayers a  refund even if they owe no tax and are not otherwise required to file a tax  return. Nonrefundable credits also can reduce taxpayers’ tax, but any  excess is not refunded.
The most common refundable credit that W&I audits is the Earned  Income Tax Credit (EITC), which is a benefit for working people with low  to moderate income. EITC will cost an estimated $58 billion in federal  outlays in fiscal year 2016, according to the Office of Management and  Budget (OMB). IRS measures noncompliance in claiming EITC and also  uses those measures to estimate its portion of federal improper  payments. EITC was the second biggest contributor to the federal  government’s estimated $124.7 billion in improper payments in fiscal year  2014. Specifically, EITC accounted for an estimated $17.7 billion in  improper payments, which is approximately 27 percent of its outlays  during fiscal year 2014. OMB has established guidance for federal  agencies on reporting, reducing, and recovering improper payments as  required by the Improper Payments Information Act of 2002, as  amended. Other refundable credits that W&I covers include the  Additional Child Tax Credit, American Opportunity Tax Credit, and  Premium Tax Credit.
IRS also operates other compliance programs that may lead to tax  returns being referred to the audit function but are not audit programs.  Examples of these programs include the following.
The math error program corrects certain obvious errors on tax returns  at the time they are filed, such as claiming a credit above the allowed  income threshold.
The Automated Underreporter program matches income data  reported on a tax return with third-party information about income and  expenses provided to IRS by employers and financial institutions.  Mismatches can result in IRS asking the taxpayer to successfully  explain the discrepancy or pay additional tax.
The nonfiler program uses third-party information to identify people  who do not file a required tax return. Some nonfiler cases may be  forwarded for audit, according to IRS officials.
The unallowables program identifies items reported on a tax return  that are specifically disallowed by law or rule and result in the tax  return not being accepted by IRS. These can include taxpayers’  claims of deductions, items exceeding statutory limits, or items not  supported by the proper information or schedule.
In November 2014, IRS realigned its tax compliance organizations that  served individual and small business taxpayers to improve efficiency and  identify emerging compliance issues more quickly, as well as streamline  decision making and resources in audit and collection while avoiding  duplication. The realignment changed what the W&I and Small Business  and Self-Employed (SB/SE) divisions audit. W&I kept work focused on  EITC. Most post-refund discretionary programs moved from W&I to  SB/SE except EITC post-refund work. Under the realignment, W&I also  took on new responsibilities, such as certain audits of returns reporting  income on Schedule C Profit or Loss from Business.
section_title: Three Offices Have Responsibility for Audit Selection, but Automated Programs Select the Majority of Returns That W&I Audits
subsections: section_title: Three W&I Offices Largely Determine What Returns Get Selected for Audit
paragraphs: W&I’s audit programs are managed out of an office called Return Integrity  and Compliance Services (RICS), which operates three other offices that  directly or indirectly review tax return data for potential audits. These  other three offices include:
Refundable Credits Policy and Program Management (RCPPM);
Deputy Director’s Return Integrity, and Compliance Services; and
Refundable Credits Examination Operations.
Figure 1 shows how RICS’s audit offices are connected to the W&I  Commissioner’s office in W&I’s organization.
RCPPM: This office oversees refundable credit enforcement and  establishes filters for computerized selection of returns for audit. The  main tools RCPPM uses for selecting returns for audit are filters from the  Dependent Database (DDb). These filters identify returns and use risk- based scoring to select the returns. DDb creates the scores after W&I  enters tax return data but before refunds are issued. Some of the  rules/criteria include the use of taxpayer’s dependent information, such as  related children data, qualifying children claimed with multiple taxpayers,  birth parents, and birth parents’ Social Security numbers and dates of  birth. If information from a tax return creates a high enough score, the  return may be made available for audit in Refundable Credits  Examination Operations. If the return is audited, letters will systemically  be issued to the taxpayers asking them to explain an issue on the tax  return.
W&I holds an annual 3-day working session to set and evaluate the  effectiveness of its DDb filters for selecting returns for possible audit. W&I  conducts analyses throughout the year in support of this meeting, which  includes W&I research, the Information Technology (IT) Office, and RICS.  The May 2015 working session included more than two dozen officials,  including two executives. The officials review new laws and audit results  to help evaluate the effectiveness of the business rules. An example of a  law that W&I discussed during its annual working session included the  Patient Protection and Affordable Care Act, which created the Premium  Tax Credit. Audit results that the officials also consider during the  meeting include no-change rates, defined as the proportion of audits that  resulted in no changes to the assessed tax amount for the tax return).  Modifications to the selection criteria are incorporated into a unified work  request for W&I’s IT Office. The request is reviewed and approved by the  Business Modernization Office, IT, and stakeholder division executives  before programming is done to incorporate the new criteria.
Deputy Director’s RICS office: This office operates the Integrity and  Verification Operations (IVO), which is not an audit program, but may  refer returns with refundable credits for audit. IVO uses several computer  systems, including DDb, to identify fraud and refund abuse across many  types of taxes, including refundable credits. W&I annually reviews  tolerances that IVO uses to search tax return data for potential fraud,  abuse, or other noncompliance. IVO also has a program that processes  leads from external stakeholder partners, such as financial institutions,  state agencies, or other third parties. This program focuses on stopping  fraudulent refunds from issuing and/or recovering fraudulent refunds that  were issued and are identified via external sources.
Refundable Credits Examination Operations: The Refundable Credits  Examination Operations office performs classification duties and conducts  audits. Classification is the process of determining whether a return has  potential noncompliance worth auditing and what issues should be  audited. The criteria that classifiers use to decide what issues should be  sent for audit are listed in IRM 4.1.5 and 4.19.11.
In W&I, classification is conducted on Form 1040x Amended Return  submissions or returns that were referred from other parts of IRS. The  returns referred from other parts of IRS that W&I classifies generally do  not meet existing DDb criteria for return selection or were amended  returns submitted to IRS on paper. Referrals from other business units  are one of IRS’s priority audit categories, which also includes new  employee audits and mandatory work, such as nationally coordinated  research projects. Once a classifier classifies the return and identifies the  issues, the letter is generated and the audit is started. This inventory is  not assigned to an auditor until correspondence is received. In some  cases, W&I classifiers may send a return to another business unit, such  as SB/SE. W&I also classifies returns filed with an Individual Tax  Identification Number (ITIN) to check for tax noncompliance. For  example, returns that are filed with an ITIN and that meet audit referral  criteria for the refundable Additional Child Tax Credit are set aside for  classification.
section_title: Automated System Led to the Most W&I Audit Selections
paragraphs: In fiscal year 2014, DDb selected 59 percent of W&I’s audit inventory, as  shown in figure 2. The next largest source of audits was referrals from  IVO. Manual classification of ITIN and amended returns, as well as other  referrals, together accounted for a relatively smaller fraction of the overall  number of W&I audits in fiscal year 2014—meaning that most W&I case  selection was computer driven. W&I audits resulted in $2.5 billion in  recommended additional tax in fiscal year 2014, down from $3.3 billion in  fiscal year 2013. W&I also had $49 million and $69 million in revenue  protection in 2014 and 2013 respectively. IRS did not have reliable data  to analyze the number of audits or assessments in prior years. However,  these totals include audits of issues that W&I is no longer responsible for  addressing, such as referrals from state agencies. IRS officials told us  that they did not have reliable data for the most recent fiscal year at the  time of our audit.
section_title: Audit Start Management Effectively Acts as an Additional Return Selection Method
paragraphs: In addition to setting criteria for automated systems to apply to tax return  data, managers at W&I’s headquarters set the number of audit starts at  the beginning of the fiscal year and make weekly adjustments in the  number of returns selected for audit that will be worked by audit staff.  Because IRS does not audit every return identified by the automated  systems, this workload management is a form of audit selection.
The tool that W&I officials use to manage the audit starts is the work plan,  a spreadsheet with the projected number of audits by type of tax that W&I  managers write before cases are selected at the beginning of the fiscal  year. Audit managers use the spreadsheet to allocate returns audit starts  based on the goals W&I has set for closing cases, work already in  process, and the available number of auditors. Auditors then generally  work returns on a first in, first out basis. At the end of fiscal year 2015,  W&I reported having 683 tax examiners of which about 584 conducted  correspondence audits and the others did support work, including  taxpayers’ requests to reconsider previous audit findings. W&I also  reported having 47 tax compliance officers. In developing the work plan,  W&I managers said they also take overall compliance strategies for  specific refundable credits into account that include audit as one  component. Figure 3 shows where RICS’s audit processes operate in a  simplified illustration of return processing.
Beyond available resources, another measure that W&I officials say they  use to review their audit selection methods is the no-change rate. As an  example, W&I requested changing criteria on qualifying children for EITC  reviews for fiscal year 2015 to reduce no-change rates. Audits that end  with no change to the reported tax assessment on the return impose  burdens on compliant taxpayers. W&I officials also said a low no-change  rate reflects more efficient use of IRS resources. IRS officials said they  calculated W&I’s overall no-change rate as 10.1 percent for work  compiled through September of fiscal year 2015, with the no-change rate  specifically for DDb selections under the realignment as 12.5 percent.
section_title: W&I Designed and Implemented Certain Controls for Audit Selection, but Should Develop and Strengthen Others to Reduce Risk of Unfair Practices
paragraphs: Implementation of an effective internal control system can improve  accountability in achieving an entity’s mission. As set forth in Standards  for Internal Control in the Federal Government, internal control is a major  part of managing an organization as it comprises the plans, methods, and  procedures used to meet missions, goals, and objectives, which support  performance-based management. In addition, internal controls help  agency program managers achieve desired results and provide  reasonable assurance through the effectiveness and efficiency of  operations, among other things. Further, internal control is not one  singular event, but a series of actions and activities that occur throughout  an entity’s operations and on an ongoing basis. Examples of internal  controls include establishing clear, consistent agency objectives,  documenting significant events, and ongoing monitoring. While W&I has  documented how some of its procedures meet the internal control  standards, we found some potential issues that increase the risk that W&I  audit selection activities may not fully contribute to its mission to treat all  taxpayers fairly and with integrity.
subsections: section_title: W&I Generally Has Established a Positive Environment for Promoting Internal Controls
paragraphs: Internal control standards require that management and employees  establish and maintain a positive and supportive environment toward  internal control and conscientious management. Several key factors  affect the control environment such as ethical values maintained and  demonstrated by management and staff, management’s philosophy  towards performance-based management, and delegation of authority  and responsibility, among others.
We found several IRS procedures that demonstrated some factors of a  positive environment for promoting internal controls. First, IRS’s IRM  includes various ethics guidance for all staff. For example, IRM cross- references federal and IRS agency ethics regulations that include 14  principles of ethical conduct, such as conflicts of interest and political  activities of staff. IRS requires all managers to hold an annual ethics  discussion with their staff and all IRS staff to certify that they attended the  discussion. While the code of conduct does not specifically address audit  selection, IRS provided sufficient documentation to demonstrate that staff  should be aware of the need to act ethically when conducting their  duties—such as by not letting personal biases affect audit selection. In  addition, W&I officials stated that they were not aware of any staff  responsible for audit selection violating the code of conduct.
Second, IRS staff are rated annually on their performance, including  whether they met the retention standard for the fair and equitable  treatment of taxpayers. IRM requires supervisors to brief staff on what  types of behaviors would meet or not meet the standard. For instance, if  a staff member’s communications with taxpayers are professional and  courteous and accurately state the facts, the standard would be met.  While the performance appraisal criteria do not specifically address  fairness for audit selection, IRS has documentation to demonstrate that  staff should conduct their duties according to the standard.
Third, W&I has clearly assigned authority and responsibility for its audit  selection processes. W&I demonstrated this by providing a list of (1) IRS  stakeholders who participated in W&I’s annual meetings to discuss any  revisions to audit selection criteria for fiscal year 2015, 2) program  analysts involved in modifying audit selection rules, and 3) Submissions  Processing staff tasked with referring returns that meet certain criteria to  staff classifying tax returns, such as amended individual tax returns that  include certain tax credits. In addition, staff who are responsible for  modifying audit selection criteria do not audit returns. Similarly, staff who  classify a return cannot audit that return.
Fourth, staff that manually classify amended returns for potential audit are  to receive training to help them maintain a level of competence necessary  for assigned duties. Other IRS staff responsible for revising W&I criteria  used in automated programs do not receive any formal training in revising  the criteria. W&I officials told us they believed that most of these staff are  well versed and proficient in their respective areas of tax law because  they are either IRS executives or senior managers with at least 20 years  of experience. They said that such staff have had years of related training  in specialized areas for their former positions (e.g., revenue agents and  department managers) and use their experience as well as feedback from  W&I staff involved in the audits, research data, and audit results to help  inform their decision in revising audit selection criteria.
section_title: W&I Has Not Clearly Defined Key Terms and Program-Level Objectives to Evaluate Whether Its Audit Selection Process Is Meeting Its Mission
paragraphs: Internal control standards call for specific terms to be clearly defined and  set forth so they can be easily understood. Management should define  program objectives that align with an entity’s mission, strategic plan,  goals, and requirements of applicable laws and regulations. Clearly  defined objectives can enhance program effectiveness and efficiency.  Documenting objectives allow agency officials and staff to have a  consistent understanding of the organization’s purpose.
Internal control standard: define objectives  Program objectives are to be clearly defined in  measurable terms to enable the design of  internal control. Specific terms should be fully  defined and clearly set forth so they can be  easily understood at all levels of the  organization.
W&I has not clearly defined, documented, or communicated key terms.  For example, while the concepts of “fairness” and “integrity” are  highlighted in IRS’s mission and policy statements and W&I’s mission  statement, W&I has not defined or documented fairness and integrity,  particularly for audit selection. As a result, each staff member is left to  define these terms.
W&I officials shared views on how fairness and integrity might be defined  for audit selection. For fairness, a senior W&I official informally defined it  as having a low no-change rate and incorporating eligibility requirements  as outlined by the Internal Revenue Code or other legislation into audit  selection criteria. In addition, W&I officials said they believed that W&I’s  audit selection process is fair because all individual tax returns that run  through DDb are scored by the same audit selection criteria. Further,  Submissions Processing staff apply audit criteria for all amended returns,  which may require classification by classifiers if they are flagged for  potential audit. For integrity, W&I officials highlighted all of IRS’s six core  values, including honesty and integrity, which focuses on upholding “the  public trust” and being “honest and forthright in all internal and external  dealings.” However, they did not indicate how they know integrity is  provided in audit selection. As a result, by not communicating a clear  definition of fairness and integrity to all staff involved in audit selection,  W&I is vulnerable to inconsistent selections.
In addition, W&I has not established program-level objectives on the  selection of returns for audit that support its and IRS’s shared mission of  applying the tax law with integrity and fairness to all. Rather, W&I has four  broad audit goals, including: measuring the degree of voluntary compliance on filed returns; making quality contacts to determine the correct taxable amount.  reducing noncompliance by identifying and cost-effectively  allocating resources to those returns most in need of audit;  conducting timely and quality audits of tax returns; and  These audit goals do not refer to fairness and integrity because these  terms have not been defined by IRS or W&I. W&I officials confirmed that  they do not have program-level objectives for how returns are selected.  However, W&I has developed fiscal year 2016 activities for its annual  operations plan that has references to potential objectives. For instance,  one of RCPPM’s action item focuses on RICS reviewing and creating  workload selection filters intended to ensure fairness and integrity,  running all individual tax returns against such filters, and pursuing audits  with high probable changes with the intent of reducing no-change rates.
Internal control standards also require management to establish activities  to monitor performance measures and indicators. Performance measures  and targets are used to compare actual results to planned performance.  Without clearly defined program-level objectives on its audit selection  process, W&I cannot measure whether its selection criteria are meeting  its mission of applying the tax law with fairness and integrity. Existing  performance measures focus on audit results rather than audit selection.  W&I officials stated that the no-change rate could be viewed as a  performance measure to evaluate whether W&I was meeting its mission  of applying the tax law with integrity and fairness to all. W&I’s stated goal  is to decrease the no-change rate to assure that the right taxpayers are  claiming a credit, for example, based on its selection criteria. W&I officials  stated that they use different no-change rates by issue type, such as the  Earned Income Tax Credit, and strive to keep them as low as possible.  However, W&I has not created indicators to evaluate what no-change rate  is good or bad, or what rate would indicate fair selections. We reported in  June 2014 that IRS did not document criteria on how its managers were  to use performance data, such as the no-change rate, or to make  program decisions, such as the number of audits or tax issues to audit.
section_title: Lack of Clear Program Objectives Creates Challenges for Effective Risk Assessment in Audit Selection
paragraphs: Internal control standards state that management needs to identify and  analyze relevant internal and external risks, and then decide how to  manage those risks; a precondition to risk assessment is the  establishment of clear program objectives. The first and most critical step  of risk assessment is risk identification. Management should have well- documented procedures for regularly identifying internal and external  risks to program objectives and procedures, such as in short- and long- term forecasting and strategic planning.
Because W&I does not have clearly formulated and communicated  program objectives for audit selection, W&I cannot fully implement a  process to identify potential risks in its audit selection process. Without  risk identification and assessments linked to program objectives,  vulnerabilities may go unaddressed, resulting in unfair case selection,  decreased dollars collected, greater noncompliance, or other negative  program effects.
Additionally, W&I does not have reasonable assurance that it is  appropriately assessing risk in its audit selection process in two areas in  which W&I officials believe the risks are low. First, W&I officials said that  they do not think certain internal control elements related to risk  assessment—such as downsizing operations or changing operating  processes—affect the audit selection process; however the federal  internal control tool views these factors as applicable. Second, IRS had  identified no risk of bias for automated audit selection programs because  the programs compare data on a taxpayer’s return with third-party data.  Robust internal controls to address risks that threaten the automated  selection criteria are especially important because automated programs  select the majority of returns that W&I audits.
IRS is implementing an Enterprise Risk Management (ERM) program to  consider risks more systematically across IRS. As we recently reported,  IRS implemented ERM, among other reasons, to serve as an early- warning system to identify and address emerging challenges and address  them before they affect operations. According to IRS’s Chief Risk Officer,  the goal is to embed risk management principles and practices into the  daily operations of the business units and integrate long-standing  processes into the new, more holistic ERM approach. Since the  implementation of the ERM process is ongoing, it is too early to determine  the effectiveness of ERM in identifying and managing risk. ERM is  intended to help organizations in setting strategy to consider risk and how  much risk the organization is willing to accept. According to IRS officials,  ERM is broader in scope than internal controls, focusing on agency-wide  risks. It is important for agencies to assess risk at both the agency-wide  and the program level.
section_title: W&I Assigns and Communicates Internal Control Responsibilities to Managers, but Not to Its Non-Managers, Raising the Potential Risk for Unfair Selection
paragraphs: We found that IRS has various procedures that convey the importance of  internal controls at the managerial level, such as IRM guidance on  monitoring internal controls, an annual managerial self-assessment of  adherence to internal controls, and a classification quality review process.  To the extent that managers report deficiencies and W&I uses the results,  the annual self-assessment of IRS’s internal controls can provide  assurance that the importance of internal controls is understood at the  managerial level. W&I officials provided an example of a completed fiscal  year 2014 self-assessment that included a manager’s sign-off of a  reasonable assurance that IRS’s controls are effective and operating as  intended. However, beyond “yes” and “not applicable” responses, the  documentation did not provide any detailed responses on the internal  controls assessed and their relationship to the audit selection process.
In response to how internal control responsibilities were communicated to  all staff, including non-managers, W&I officials stated that internal  controls are built into their processes, such as the annual meetings,  staffing designations and tasks, automated systems, risk identification  and assessments, and monitoring. In addition, they said that the annual  self-assessment process requires managers to certify that the operations  and staff they manage are in compliance with internal controls. The fiscal  year 2014 self-assessment includes a question regarding whether  managers communicated policies on a routine basis that enabled staff to  meet and understand their internal control and other responsibilities  effectively. Beyond a “yes” response by one of W&I’s managers, IRS did  not provide evidence that W&I directly assigned and communicated  internal control responsibilities to non-managers, such as program  analysts and classifiers who are tasked with revising or applying audit  selection criteria, respectively. By not relaying information on internal  control responsibilities to all employees, W&I has less assurance that its  employees understand internal controls and increases the risk of not  being aware of potential internal control issues that could result in unfair  audit selection.
section_title: W&I Has Guidance for Automated Systems to Control Access and Modifications to its Audit Selection Criteria
paragraphs: Internal control standard: control  activities for information systems  Access security control protects the systems  and network from inappropriate access and  unauthorized use. Application control is  designed to help ensure completeness,  accuracy, authorization, and validity of all  transactions during application processing.
Federal internal control standards require a variety of control activities for  information processing, such as controlling access to data, files, and  programs. In addition, access to resources should be limited to authorized  individuals, and accountability for their use should be assigned and  maintained. Access rights are used to implement security policies that  determine what a user can do after being allowed into the system, such  as allowing the user to read or write to a certain file or directory.  Maintaining access rights is an important aspect of administering system  security. In addition to access controls, other controls should be in place  to ensure the integrity of an organization’s information. These controls  can include, but are not limited to, policies, procedures, and techniques  for securely configuring information systems with software updates.
We found IRM guidance that specifies procedures to restrict access to  authorized users as well as various software testing mechanisms.  Specifically, IRM sections on information technology (IT) security  documented access to data, files, and programs for modifying IT systems,  including those that cover W&I’s audit selection criteria. For example, IRS  uses a process to register all users for access to any IRS IT resource  when their access is authorized by the user’s manager. By obtaining such  access, IT programmers can utilize the official change management  system to add new or modify W&I audit selection criteria that are based  on the unified work request that is approved by IRS management.  However, we reported in March 2015 that IRS had not updated the  security authorization for IRS’s access request and approval system to  reflect significant changes made to the operating environment. As a  result, we recommended that IRS update the security authorization for the  access request as well as the approval system to reflect the significant  changes to the operating environment. In response to this  recommendation, IRS agreed to provide corrective action plans where  appropriate. In addition, the Tax Inspector General for Tax  Administration (TIGTA) has an ongoing audit related to the request and  approval process in obtaining access to IRS systems.
IRM has a section on testing procedures to ensure accurate revisions are  made, such as modifying W&I’s audit selection criteria. IT officials also  provided other guidance, such as the IT Test Reference Guide, to  address how new or revised software is to be thoroughly tested and  approved. IT officials provided examples of output reports to show how  DDb modifications to W&I audit selection criteria were tested, approved,  and working as designed.
section_title: IRS Has Documented Policies to Support Internal Controls but Shows Weaknesses in Documenting Aspects of Audit Selection
paragraphs: Internal control standards state that documentation should clearly identify  procedures and should allow agency officials and staff to understand the  purpose of internal control procedures and be readily available for audit.  Documenting procedures is evidence that the right controls are identified  and that those procedures are capable of being communicated to those  responsible for their performance, and capable of being monitored and  evaluated.
Internal control standard: document  controls to address risks to program  objectives  Procedures should be clearly documented to  ensure that management's plans, policies,  and procedures are sufficiently and fully  carried out.
IRS has documented some agency-wide policies to support internal  controls, but these are not always linked to W&I’s audit selection process.  For example, as noted previously, IRS provided sufficient documentation  to demonstrate that staff should be aware of the need to act ethically  when conducting their duties, such as not letting personal biases affect  their work (e.g. selecting returns for audit). Other IRS policies—including  the retention standard—reference the fair and equitable treatment of  taxpayers in general, but do not consistently reference audit selection in  particular.
We also found some weaknesses in documenting parts of the audit  selection plan. W&I has workload selection templates that describe the  methods that IRS uses to identify and select tax returns for audit. The  templates are intended to explain how W&I determined, tested, and  approved the steps involved in each method, as well as what types of  staff and functions are involved. While some elements of the selection  process are described in detail in the workload selection templates, not all  elements of the selection process—ranging from determining audit  potential to inter-office interactions—are covered.
For example, one workload selection template notes that returns with the  highest audit potential are marked, but it does not describe how audit  potential is determined. Additionally, the workload selection templates do  not describe how the systems and processes described in the templates  are related. For example, W&I lacks clear documentation about how the  three offices which select the majority of returns W&I audits—Refundable  Credits Policy and Program Management; the Deputy Director’s Return  Integrity, and Compliance Services; and Refundable Credits Examination  Operations—interact with one another. The lack of comprehensive  documentation to describe W&I’s audit selection process results in less  assurance that these processes effectively address risks. Additionally, the  absence of a fully documented selection process may make it difficult for  W&I to defend against accusations that it is not appropriately following its  processes and procedures, since the incomplete documentation makes it  difficult to clearly communicate about how audit selection works.
section_title: Monitoring Procedures Do Not Ensure Effective Implementation of Corrective Actions
paragraphs: Internal control standard: monitor controls  Internal control design should assure that  ongoing monitoring of controls occurs in the  course of normal operations.
According to internal control standards, program managers should have a  strategy and establish procedures for ongoing monitoring to assure the  effectiveness of its control activities, and that deficiencies found during  separate evaluations should be resolved in a timely manner. Monitoring  involves management assessing the design and operational effectiveness  of internal control systems as well as ensuring that corrective actions are  effectively implemented in a timely manner. Serious deficiencies and  internal control problems should be reported to top management in a  timely manner. Managers and supervisors should know their  responsibilities for internal control and the need to make control and  control monitoring part of their regular operating processes.
While W&I’s policy is clear that internal control issues should be reported  to the next level of management, the mechanism to elevate potential  internal control issues to management is limited. The IRM states that a  problem in the design or operation of an internal control should be  reported to the next level of management as a significant deficiency. It  does not, however, specify how non-managers should report it or that it  should be reported in a timely manner. The form that W&I staff would use  to report such deficiencies in the automated filters used for return  selection—the Compliance Data Environment Production Filter  Modification Approval form—includes space for submitting modification  requests for the automated filters, but not for reporting internal control  deficiencies that do not have a proposed solution. The form also states  that the reason for modification should be self-explanatory, which may not  appropriately highlight the deficiency the modification seeks to address.  W&I officials said that IRS has no guidance beyond the instructions on  the form to report deficiencies and that no deficiencies have been  identified with this form.
W&I officials subsequently identified general ways in which staff could  report internal control deficiencies. They said that staff can send e-mails  directly to the Commissioner, submit help desk tickets for IT issues,  provide feedback during a regularly-scheduled forum, make a submission  to the “I suggest” program to improve a program or process, or supply  feedback on IRM sections. When asked to provide examples of  employees elevating potential internal control issues, W&I officials also  provided examples of internal control issues identified during the  monitoring process.
This limitation in the reporting mechanism—including the limited  examples of staff reporting deficiencies—increases the risk that W&I  would not know about a potential deficiency that staff perceive or  experience. Without a clear means of elevating possible internal control  deficiencies to top management in a timely manner, W&I does not have  reasonable assurance that concerns noticed by an employee are reported  appropriately or in a timely manner.
In addition, we found some limitations in the timeliness of W&I’s  monitoring. W&I officials said that, at the beginning of each filing season,  a team made up of experienced analysts and managers reviews  selections and notices generated from the new programming to ensure  programming is working as intended, and that the generated notices are  correct. They also said that they continuously monitor audit selections  and results to ensure that implemented corrective actions were  appropriate.
However, the documentation indicates that it is an annual—rather than  continuous—review as part of W&I’s annual 3-day working session that  included evaluating the effectiveness of its criteria for selecting returns for  possible audit. Further, W&I did not clearly document what corrective  actions, if any, were taken and how they were implemented in response  to the deficiencies it identified at the annual working session. W&I officials  provided documentation of issues identified with the Premium Tax Credit;  however, the deadlines for actions items were all at least 6 months past,  and W&I did not provide support that those changes were appropriately  implemented. Because of this, W&I lacks reasonable assurance that the  issues were addressed in an appropriate or timely manner and that they  have been sufficiently resolved. Without ensuring that it has sufficient  controls to identify deficiencies and take necessary corrective action, W&I  may be missing opportunities to ensure that the changes work as  intended and lower the risk of selecting audits unfairly.
section_title: Conclusions
paragraphs: W&I auditors have interacted with hundreds of thousands of taxpayers  and assessed billions of dollars in tax changes, making W&I’s mission of  applying the tax law with fairness and integrity all the more critical. Failure  to accomplish that mission could undermine the public’s confidence in the  tax system, waste resources, and burden taxpayers. Properly designed  and maintained internal controls for audit selection can help W&I better  assure its mission. While we found that W&I had implemented some  internal controls over its array of audit selection processes, we also  identified a series of internal control weaknesses that reduce the  assurance that current or future audit.
Most importantly, IRS lacks clearly defined and documented program- level objectives, performance measures, indicators, and definitions of key  concepts such as fairness, reducing the assurance that W&I employees  are treating taxpayers equally. Without defining, documenting, and  communicating to staff these aspects of internal control, IRS cannot know  whether it is meeting its and W&I’s shared mission of applying the tax law  with fairness and integrity to all taxpayers. W&I’s use of the no-change  rate could be viewed as a performance measure, but it is not sufficient to  assure that the audit selection criteria are fair. Having program-level  objectives, performance measures, indicators, and definitions that link to  its mission and goals would enhance W&I’s ability assure that its audit  selection processes are fair and have integrity.
Having program-level objectives for audit selection in place is a  precondition to developing a risk assessment strategy for audit selection,  which W&I has not adopted. With an effective risk assessment strategy  for audit selection, W&I could gauge potential internal and external risks  that may hinder its ability to meet its mission of treating taxpayers fairly  and equally. Such a strategy would increase the assurance that W&I is  appropriately selecting returns for audit, consistent with its mission.
We also found opportunities for improvement in other areas. First, W&I  has not communicated internal control responsibilities to all staff tasked  with audit selection, including non-managers and classifiers who revise or  apply audit selection criteria, respectively. Second, W&I does not have  complete documentation its audit selection procedures; doing so would  improve the assurance that W&I staff have a common understanding of  how the selection process work and their role in the process. Third, while  W&I’s policy is clear that internal control issues should be reported to the  next level of management, the mechanism to elevate potential internal  control issues to management is limited. Lastly, W&I did not provide  support that changes to audit selection processes and procedures were  appropriately monitored and implemented in a timely manner. Taking  such actions to address these areas would help provide W&I reasonable  assurance that its audit selection criteria are fair.
section_title: Recommendations for Executive Action
paragraphs: To help ensure W&I meets its mission and selects audits fairly and with  integrity, we recommend that the Commissioner of Internal Revenue take  the following seven actions:
Clearly define and document: (1) key terms such as “fairness”; and (2)
W&I program level objectives, performance measures, and indicators  for audit selection to evaluate whether the audit selection process is  meeting its mission of applying the tax law with integrity and fairness  to all.
Clearly communicate these terms, objectives, measures, and  indicators to all staff involved in the selection of returns for audit.
Incorporate the new objective(s) into W&I risk assessments done for  audit selection processes.
Ensure that internal control responsibilities are communicated and  documented for all employees, including non-managers, tasked with  revising or applying W&I audit selection criteria for potential audits.
Develop and implement procedures to ensure that all criteria or  methods used in programs to select returns for audit are consistently  documented and approved.
Develop and document a clear means for IRS staff members to  promptly elevate to top management possible internal control issues  related to audit selection in a timely manner.
Develop, document, and implement additional monitoring procedures  to ensure audit selection controls and corrective actions are  implemented in a timely manner.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Commissioner of Internal  Revenue for review and comment. The Deputy Commissioner for  Services and Enforcement provided written comments, including planned  actions to implement each of our recommendations, dated November 23,  2015, which are summarized below and reprinted in appendix II. In an  email received November 24, 2015, the Deputy Commissioner indicated  through the IRS Office of Audit Coordination that IRS generally agreed  with our seven recommendations. The enclosure to IRS’s letter listed  specific actions planned to implement the recommendations.
IRS stated in its letter that the concept of fairness has both a collective  and individual component: (1) W&I pursues those individuals who fail to  comply with their tax obligations to ensure fairness to those who do and  to promote public confidence in the tax system; and (2) it discharges its  responsibilities with a focus on taxpayer rights. IRS can build on these  components to clarify how they relate to return selection, especially when  the components also cover what happens after return selection, such as  when pursuing noncompliance and interacting with taxpayers during the  audit. Documenting these clarifications in its definition, as well as the  examples of fair selections, would help staff involved in return selection to  know the specific actions that they should take to produce selections that  meet IRS’s definition of fairness.
We highlight this clarification because the letter discusses various  features of IRS’s audit program—such as existing objectives, measures,  and definitions of key concepts—that IRS stated relate to fair selection.  We agree that having these features is important. However, as our report  discusses, these features cited in IRS’s letter do not clarify what fair  selection of returns for audit entails and how IRS would know whether fair  selections are occurring, unless a taxpayer or other individual raises a  question about the fairness of return selection. IRS’s commitment to  applying tax law with fairness and integrity is contained in its mission  statement, as discussed in our report, but our recommendations focus on  clearly explaining how that aspect of the mission is operationalized for  audit selection.
IRS identified actions that specifically reflected or were generally  consistent with four of the recommendations we made. These include our  recommendation on communicating the definition of terms such as  fairness as well as related objectives, measures, and indicators to all staff  involved in audit selection; incorporating any new selection objectives into  the risk assessment process that IRS would modify in fulfilling our  recommendation on defining fairness; communicating and documenting  internal control responsibilities to all staff involved in audit selection; and  developing a means for IRS staff to elevate internal control concerns  about audit selection.
For our recommendation on defining and documenting “fairness” for  return selection activities, IRS’s letter listed a number of ways in which it  believes the selection process is fair. For example, IRS said that its audit  selections are fair because IRS policies state that audit selections should  be fair and that taxpayer rights should be a prime focus.  IRS’s letter also  cited its reliance on rules and automation rather than human intervention  and its desire to select the most noncompliant returns. While striving to be  fair and respectful of taxpayer rights as well as to weed out selection bias  or selections that focus on less noncompliant returns is important, IRS  has not provided a formal definition of what fairness entails. As a result,  individuals are left to define it for themselves.
Similarly, this recommendation also focused on defining and documenting  related objectives, measures, and indicators for audit selection. IRS  stated that it will review these areas to further ensure that audit selection  meets its mission to apply the tax law with integrity and fairness. As  discussed in our report, existing IRS objectives and measures did not  allow IRS to evaluate whether its selection decisions were fair. We  believe IRS should develop at least one objective and measure that  reflects its definition of fairness. Doing so would better enable IRS to  clarify how it operationalizes fairness in the selection process and assess  whether its actions are meeting that objective.
In regard to our recommendation on developing and implementing  procedures to ensure that all criteria or methods used in programs to  select returns for audit are consistently documented and approved, IRS  stated that it has procedures in place to document criteria and methods  used in return selection. However, we found instances, discussed in our  report, in which IRS’s documentation was not specific to return selection  as well as instances in which procedures were not fully documented.  Incomplete documentation makes it difficult for IRS to clearly  communicate how audit selection works and defend against accusations  that it is not appropriately following its processes and procedures. IRS  also stated that it would review existing procedures to ensure consistent  documentation and approval. Our report shows evidence of this need,  such as being able to show how the selection criteria and methods were  used consistently.
For our recommendation on having additional procedures for monitoring  audit selection controls and corrective actions, IRS stated that it will  review the processes in place for documentation and timely  implementation of selection controls and corrective actions to further  ensure the controls and actions are implemented in a timely manner.  However, our report indicated a need to do more than a review by  developing additional monitoring procedures.
As arranged with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  date of this letter. At that time, we will send copies to Secretary of the  Treasury, Secretary of Labor, IRS and SEC. In addition, the report will be  available at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-9110 or lucasjudyj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report (1) describes the Wage and Investment (W&I) process for  selecting tax returns for audit; and (2) determines how well W&I’s  procedures for selecting tax returns for audit support its mission and goal  to apply the tax law with integrity and fairness to all.
To describe the W&I process for selecting returns for review and audit,  we reviewed documentation on program procedures from the Internal  Revenue Manual (IRM) and Internal Revenue Service (IRS) documents  describing audit procedures. We also interviewed IRS officials who  oversee or who work on W&I’s audit selection process. For context, we  compiled statistical information for fiscal years 2013 and 2014 about W&I  audit program closures from IRS’s Compliance Data Warehouse (CDW)  and Examination Operational Automation Database (EOAD). CDW  provides a variety of tax return, enforcement, compliance and other data.  EOAD has information on the type of issue audited. Our data reliability  assessment included reviewing relevant documentation, interviewing  knowledgeable IRS officials, and reviewing the data to identify obvious  errors or outliers. Based on our testing of the data and review of  documentation and interviews, we determined that these data were  reliable for the purposes of this report. We categorized the data by project  codes with input from W&I audit officials. Because of the recent  realignment of audit duties among divisions, some of the project codes in  our analysis—such as those associated with the Discretionary Exam  Business Rules—are no longer worked by W&I.
To determine how well W&I’s procedures for selecting tax returns for  audit support its mission, we reviewed W&I’s audit selection procedures  and related internal controls intended to help W&I achieve its stated  mission of “applying the tax law with integrity and fairness to all.” We  then assessed whether these relevant W&I procedures followed selected  internal control standards from Standards for Internal Control in the  Federal Government. We also interviewed relevant IRS officials  concerning their understanding of W&I’s mission, objectives, and internal  controls related to W&I’s audit selection. In addition, we reviewed the  Internal Revenue Service’s Strategic Plan FY2014-2017, IRM sections  related to W&I’s mission statement and program objectives, IRS’s policy  statement for audits, information technology controls, W&I’s fiscal year  2014 program letter, and other IRS documentation related to W&I’s audit  selection process, including internal risk assessment documents and  annual meeting notes.
To determine which internal control standards were most relevant for our  review, we used the five internal control standards in Standards for  Internal Control in the Federal Government as primary criteria and used  our Internal Control Management and Evaluation Tool to identify specific  factors that could be used to operationalize the internal control standards,  in conjunction with observations from our preliminary audit work. We  assessed whether W&I’s audit selection process addressed the selected  internal control standards by reviewing documentation and interviewing  IRS officials familiar with the selection process. The controls we chose  applied to the processes and procedures that W&I officials described or  for which they provided documentation regarding how audits were  selected. While we relied on documentation demonstrating whether the  standards were addressed, we did not test whether they were  systemically applied.
To determine IRS’s definition of fairness and integrity as it applied to  W&I’s audit selection, we reviewed W&I’s mission statement and other  documentation related to how W&I selects audits for examination and  interviewed relevant IRS officials concerning their understanding of how  integrity and fairness applies to W&I audit selection activities.
We conducted this performance audit from October 2014 to December  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Internal Revenue Service
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Tom Short (Assistant Director),  Lisette Baylor, Sara Daleski, David Dornisch, Eric Gorman, David Hayes,  Ted Hu, Melissa King, Jeffrey Knott, Sabine Paul, Susan Sato, Stewart  Small, and A.J. Stephens made key contributions to this report.