Internal Revenue Service: Status of GAO Financial Audit and Related Financial Management Report Recommendations
Released: 2011-06-22T00:00:00

Letter

Background

Internal control is not one event, but a series of activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis.

Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires agencies to establish and maintain effective internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of its federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations.

Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, provides the implementing guidance for FMFIA, and prescribes the specific requirements for assessing and reporting on internal controls consistent with the Standards for Internal Control in the Federal Government (internal control standards) issued by the Comptroller General of the United States. The circular defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control and emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control–related activities.

FMFIA requires GAO to issue standards for internal control in the federal government. The internal control standards provide the overall framework for establishing and maintaining effective internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement.

As summarized in the internal control standards, internal control in the government is defined by the following five elements, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management.

Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources.

Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives.

Information and communication: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities.

Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved.

A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance that IRS maintained effective internal control with respect to financial reporting. While we use all five elements of internal control as a basis for evaluating the effectiveness of IRS’s internal controls, our ongoing evaluations and tests have focused heavily on control activities, where we have identified numerous internal control weaknesses and have provided recommendations for corrective action. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that are intended to accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. Control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results.

Scope and Methodology

To accomplish our objectives, we evaluated the effectiveness of corrective actions IRS implemented during fiscal year 2010 in response to open recommendations as part of our fiscal years 2010 and 2009 financial audits. To determine the current status of the recommendations, we (1) obtained IRS’s reported status of each recommendation and corrective action taken or planned as of March 2011, (2) compared IRS’s reported status to our fiscal year 2010 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation, and (3) performed additional follow-up work to assess IRS’s actions taken to address the open recommendations. For our recommendations to IRS regarding information security, this report includes only summary data on the number of those recommendations and their general makeup. Because of the sensitive nature of many of the issues related to our recommendations regarding information security, we have reported our recommendations for corrective action to IRS separately.

In order to determine how IRS’s open recommendations, including those identified in our June 2011 management report, fit within the agency’s management and internal control structure, we compared the open recommendations and the issues that gave rise to them to the (1) control activities listed in the internal control standards, (2) list of major factors and examples outlined in our Internal Control Management and Evaluation Tool, and (3) criteria and objectives for federal financial management as discussed in the Chief Financial Officers Act of 1990 Federal Accounting Standards Advisory Board’s (FASAB) Statement of Federal Financial Accounting Concepts No. 1, Objectives of Federal Financial Reporting. We also considered whether IRS had addressed, in whole or in part, the underlying control issues that gave rise to the recommendations; and other legal requirements and implementing guidance, such as OMB Circular No. A-123 and FMFIA. (CFO Act) and the Our work was performed from December 2010 through April 2011 in accordance with generally accepted government auditing standards.

IRS Faces Significant Financial Management Challenges

IRS continues to make progress in resolving its internal control weaknesses and addressing outstanding recommendations, but it still faces significant financial management challenges. Since we first began auditing IRS’s financial statements in fiscal year 1992, IRS has taken a significant number of actions that enabled us to conclude that it had effectively resolved several material weaknesses and significant deficiencies and to close almost 300 of our previously reported financial management–related recommendations. This includes 37 recommendations we are closing with this report based on actions IRS took through March 2011.

Nevertheless, IRS continues to face challenges in improving the effectiveness of its financial and operational management. Specifically, IRS continues to face management challenges in (1) resolving its two material weaknesses and one significant deficiency in internal control, (2) developing performance measures and managing for outcomes, and (3) addressing its remaining internal control issues, particularly those dealing with safeguarding of taxpayer receipts and information. Further, as in previous years’ audits, our fiscal year 2010 audit continued to identify additional internal control issues, resulting in 29 new recommendations for corrective action. These issues are discussed in detail in our June 2011 management report to IRS. In addition, as noted earlier, we also identified numerous issues related to information security during our fiscal year 2010 audit that we reported separately because of the sensitive nature of many of those issues.

We have made numerous recommendations to IRS over the years— including new recommendations resulting from our fiscal year 2010 financial audit—to address the issues comprising these weaknesses in internal control. Successfully implementing these recommendations would assist IRS in fully resolving these weaknesses. To its credit, IRS continues to work to address the issues underlying these and other internal control weaknesses.

Challenges in Resolving Two Long-standing Material Weaknesses and One Significant Deficiency in Internal Control

As we reported in our audit of IRS’s fiscal year 2010 financial statements, IRS continues to face significant challenges in resolving its two remaining long-standing material weaknesses in internal control concerning (1) unpaid tax assessments and (2) information security.

IRS’s continuing challenge in addressing its material weakness in internal control over unpaid tax assessments results from its (1) inability to use its general ledger and underlying subsidiary records to report federal taxes receivable, compliance assessments, and writeoffs in accordance with federal accounting standards without significant compensating procedures; (2) lack of transaction traceability for the reported balance in taxes receivable that comprises over 80 percent of IRS’s total assets as of September 30, 2010, and an effective transaction-based subledger for unpaid tax assessment transactions; and (3) inability to effectively prevent or timely detect and correct errors in taxpayer accounts. These control deficiencies are caused primarily by IRS’s continued reliance on software applications that were not designed to provide the accurate, complete, and timely transaction-level financial information that management needs to make well-informed decisions or to accumulate and report financial information in accordance with federal accounting standards. These problems are likely to continue to exist until these software applications are either significantly enhanced or replaced. Successfully addressing these issues is vital and is one of the goals of IRS’s ongoing systems-modernization effort.

IRS’s continuing challenge in addressing its material weakness in internal control over the management of information systems security is primarily due to IRS not having fully implemented key components of its information security program. Although IRS has processes in place intended to monitor and assess its internal controls, these processes were not always effective. For example, (1) IRS’s testing did not detect many of the vulnerabilities we identified and did not assess a key application in its current environment, and (2) IRS had not effectively validated corrective actions reported to resolve previously identified weaknesses. As we reported in our audit of IRS’s fiscal year 2010 financial statements, IRS has made progress in addressing numerous weaknesses in information security internal control. However, many of the weaknesses we reported in previous years remain unresolved and continue to place IRS systems at risk. For example, IRS (1) continued to allow individuals more access to sensitive information contained on its network than needed to perform their assigned duties, (2) had not completed actions to address a vulnerability in its procurement system that allowed users to enter commands that bypassed normal application security controls, and (3) continued to allow visitors unnecessary access to secured areas at one data center. In addition to unresolved issues, we identified additional internal control deficiencies, that, along with the unresolved deficiencies, continued to jeopardize the confidentiality, integrity, and availability of information processed by IRS’s key systems, and increased the risk of material misstatement for financial reporting. For example, IRS had not (1) appropriately secured the database associated with the online system IRS used to support and manage its computer access request, approval, and review process; (2) appropriately restricted permissions on the database that supported an application used for cost allocation of rent-related data, allowing database users to run operating system commands; (3) tested the Redesigned Revenue Accounting Control System (RRACS) application security in its current production environment, which would have enabled IRS to identify weaknesses compromising IRS’s ability to segregate incompatible duties and jeopardize the integrity of the application’s data, and (4) used encrypted protocols on a server supporting the Electronic Federal Tax Payment System and several internal routers, potentially exposing user IDs and passwords transmitted in clear text across the network to inappropriate disclosure and unauthorized use. Until IRS takes additional steps to implement more comprehensive testing and effective validation processes, its facilities, computing resources, and information will remain vulnerable to inappropriate use, modification, or disclosure, and agency management will have limited assurance of the integrity and reliability of its financial and taxpayer information.

In addition to the continuing challenges posed by the two long-standing material weaknesses concerning unpaid tax assessments and information security, our audit of IRS’s fiscal year 2010 financial statements also identified a significant deficiency in IRS’s internal control over tax refund disbursements. This significant deficiency, which is the collective result of (1) a multiyear pattern of our identifying and reporting deficiencies in IRS’s internal control over the processing of manual refunds; (2) the increasing magnitude of manual refunds disbursed; and (3) new deficiencies associated with the internal controls over the First-Time Home Buyer Credit (FTHBC), increases the risk that IRS may pay out duplicate or otherwise erroneous tax refunds to which individuals or businesses are not entitled and for which IRS must use resources attempting to recover. This new significant deficiency is an example of the danger of not effectively addressing control deficiencies as soon as they are identified so that they do not become a more serious problem. We have reported numerous control deficiencies associated with manual refund processing since 1999. Nine of those deficiencies and their associated recommendations remain open, two of which have been open since 2005.

Challenges in Developing and Implementing Performance Metrics to Assist in Managing for Outcomes

As we reported in our audit of IRS’s fiscal year 2010 financial statements, IRS continues to face challenges in developing and instutionalizing the use of financial management information to assist it in making operational decisions and in measuring the effectiveness of its programs. IRS has not developed cost-based (and when appropriate, revenue-based) outcome- oriented performance measures that would enhance its ability to manage for outcomes and integrated them into its routine management and decision-making processes or its externally reported performance metrics. Although IRS has developed projected direct tax return on investment estimates for new enforcement (tax collection) initiatives in its annual budget submissions, it has not developed similar direct tax return on investment outcome-oriented performance metrics to determine whether funded initiatives achieve their originally projected outcomes. Lacking such performance metrics inhibits IRS’s ability to more fully assess and monitor the relative merits of its existing programs, to evaluate new initiatives, or to consider alternatives and adjust its strategies as needed. Outcome-oriented performance metrics based on specific enforcement programs’ costs and revenues would assist IRS in improving its ability to (1) establish measurable outcome goals, (2) evaluate the relative merits of various program options, and (3) highlight opportunities for optimizing the allocation of resources. They could also assist IRS in more credibly demonstrating to Congress and the public that it is using its appropriations wisely.

IRS’s existing metrics focus on process-oriented workload measures of program outputs rather than on measuring program outcomes. For example, for its enforcement programs, IRS focuses on measuring discrete activities within its overall tax collection efforts, such as the percentage of various types of tax returns examined, criminal investigations completed, and the number of tax returns examined and closed. While such output measures can be useful elements in assessing performance, they are not designed to measure the contribution each of these activities makes to the collection of unpaid taxes, nor do they compare the cost of collection activities to the tax revenue generated. IRS’s enforcement metrics do not include revenue collected—a measure of outcome—compared to the cost of collection, which could provide useful information on the benefits of the enforcement programs. In addition, IRS’s publicly available performance metrics do not measure the internal cost of IRS’s programs either in the aggregate or per service or activity performed.

As we report in the “Status per IRS” section of appendix I in this report, IRS has reported that it considers our recommendation to develop outcome-oriented performance measures and related performance goals for IRS’s enforcement programs and activities to be closed. We do not agree. Part of IRS’s justification for closing the recommendation is that it uses estimates of the cost-benefit direct tax return on investment analysis to evaluate future scenarios and to support funding requests for new initiatives in its annual budget submissions. Using such estimates of prospective return on investment information is useful for budgetary decision making, but our recommendation is for IRS to develop outcome data on the actual results of its programs and activities. We have also previously recommended that IRS extend the use of return on investment in future budget proposals to include major enforcement programs, develop return on investment data for its enforcement programs using actual revenue and full cost data and compare actual results to the projected return on investment data included in its budget request, and provide Congress with information comparing projected savings to actual savings in the year following the budget’s implementation.

The intent of our recommendations is to encourage IRS to develop outcome-oriented performance metrics and to use them, along with other metrics, in resource-allocation decisions. While IRS has not developed or deployed such metrics for either funded initiatives or for ongoing enforcement programs and activities, IRS officials informed us they are considering options to collect direct tax return on investment data for newly funded enforcement initiatives.

IRS officials also contended that it is not prudent to rely exclusively on direct tax return on investment as the sole determinant of resource allocation. As we have reported previously, we acknowledge that IRS must consider other factors besides maximizing revenue collection and least-cost operations. The fairness of IRS’s implementation of the tax code and treatment of all taxpayers are important and we are cognizant of the many factors, such as coverage, that are important considerations when making resource-allocation decisions. These factors, and the decisions IRS makes about how to respond to them, have a significant effect on taxpayers, as well as on tax collections. We also acknowledge that IRS faces challenges in developing outcome-oriented performance metrics, such as return on investment, and integrating them into its resource allocation decision-making process. Furthermore, developing such an approach is important in order for IRS to make optimum use of its available resources and to be able to credibly demonstrate it is doing so to Congress and the public.

IRS’s lack of outcome-oriented performance metrics is inconsistent with federal financial management concepts as embodied in the Federal Accounting Standards Advisory Board’s Statement of Federal Financial Accounting Concepts No. 1, Objectives of Federal Financial Reporting. In its discussion of financial reporting concepts, FASAB notes that federal financial data should provide accountability and decision-useful information on the costs of programs and the outputs and outcomes achieved, and it should provide data for evaluating service efforts, costs, and accomplishments.

The absence of outcome metrics is also inconsistent with the objectives of the CFO Act of 1990. A key objective of the act was for agencies to routinely develop and use appropriate financial management information to evaluate program effectiveness, make fully informed operational decisions, and ensure accountability. While obtaining a clean audit opinion on its financial statements is important in itself, it is not the CFO Act’s end goal. Rather, the act’s end goal is modern financial management systems that provide reliable, timely, and useful financial information to support day-to-day decision making and oversight. Such systems and practices should also provide for the systematic measurement of both outputs and outcomes.

We have made several recommendations to IRS over the years to address its financial management challenges in developing internal full cost data for its programs and activities and for outcome-oriented performance measures. Successfully addressing the remaining open recommendations would enhance IRS’s ability to effectively manage for outcomes.

Challenges in Resolving Other Internal Control Issues

IRS’s actions over the years to resolve internal control weaknesses enabled us to close nearly 300 internal control–related recommendations. However, IRS also continues to face a challenge in addressing numerous other unresolved internal control issues in several aspects of its operations that, while neither individually nor collectively representing a material weakness or significant deficiency, nonetheless merit management attention to ensure they are fully and effectively addressed. IRS now has a total of 57 open audit recommendations resulting from internal control issues that we report as “other control issues” in appendix II of this report. While most were identified during our recent financial audits, some were identified in our audits from 2005 or earlier. It is incumbent upon IRS to effectively address these open recommendations and to improve its system of internal controls so that IRS can identify and correct potential weaknesses before they can grow into more serious problems.

Forty-four—77 percent—of the 57 “other” open recommendations address issues related either directly or indirectly to physically safeguarding of tax receipts and taxpayer information, a critical element of IRS’s responsibilities.

IRS processes billions of dollars annually in checks and currency and other valuable assets, and it must safeguard and account for them to prevent theft, fraud, and misuse. To do so, IRS has established physical security, accountability, and accounting policies, processes, and procedures to manage its activities involving transporting and accounting for tax receipts and for handling and storing taxpayer information. Although IRS has made substantial improvements in safeguarding taxpayer receipts and information since our financial audits first began identifying serious internal control issues in this area, the task of ensuring ongoing control over such critical responsibilities for IRS is a difficult one and requires constant vigilance. Each year, we continue to identify control issues related to IRS’s safeguarding of taxpayer receipts and information. For example, our fiscal year 2010 audit identified new internal control issues and made 18 additional recommendations that related either directly or indirectly to physically safeguarding taxpayer receipts and information. The internal control issues encompassed in our open recommendations cover critical physical security functions, such as transporting taxpayer receipts and sensitive taxpayer information among IRS facilities and lockbox banks and maintaining physical security at IRS facilities to prevent loss, theft, or the potential for fraud regarding tax receipts and taxpayer information; conducting inspections and audits of the design and operation of IRS’s physical security processes and controls designed to safeguard tax receipts and taxpayer information; conducting appropriate background investigations and screening of personnel, including contractors, with access to taxpayer information; and ensuring the proper destruction of documents and equipment to prevent the inappropriate release of sensitive taxpayer information.

In light of the volume of taxpayer receipts and sensitive taxpayer files that IRS is responsible for safeguarding, and the implications for IRS’s mission if they are lost, stolen, or the subject of fraud or misuse, it is critical that IRS fully and effectively resolve the internal control issues we have identified and work toward continually improving its internal controls to prevent new issues from arising.

Status of Recommendations Based on the Fiscal Year 2010 Financial Statement Audit

In June 2010, we issued a report on the status of IRS’s efforts to implement corrective actions to address financial management recommendations stemming from our fiscal year 2009 and prior year financial audits and other financial management–related work. In that report, we identified 85 audit recommendations that remained open and thus required corrective action by IRS. A significant number of these recommendations have been open for several years, either because IRS had not taken corrective action or because the actions taken had not yet effectively resolved the issues that gave rise to the recommendations.

IRS has continued to work to address many of the internal control issues to which these open recommendations relate. In the course of performing our fiscal year 2010 financial audit, we identified numerous actions IRS took to address many of its internal control issues. On the basis of IRS’s actions, which we were able to substantiate through our audit, we have closed 37 of our prior years’ recommendations. However, a total of 48 recommendations from prior years remain open, a significant number of which have been outstanding for several years. IRS considers another 13 of the prior years’ recommendations to be effectively addressed and therefore closed. However, we consider them to remain open. For 9 of the 13, in our view, IRS’s actions did not fully address the issue that gave rise to the recommendations. For the remaining 4, we have not yet been able to verify the effectiveness of IRS’s actions because IRS’s corrective actions are ongoing. (The “Status per IRS” and “Status per GAO” sections of app. I provide a summary of both IRS’s and our assessment of IRS’s actions on each recommendation.)

During our audit of IRS’s fiscal year 2010 financial statements, we identified additional issues that require corrective action. In our June 2011 management report to IRS, we discussed these issues, and made 29 new recommendations to address them. Consequently, a total of 77 financial management–related recommendations need to be addressed—48 from prior years and 29 new recommendations resulting from our fiscal year 2010 audit. We consider all of the new recommendations to be short- term. We also consider the majority of the recommendations outstanding from prior years to be short-term; however, a few, particularly those concerning the functionality of IRS’s automated systems, are complex and will require several more years to fully and effectively address.

In addition to the 77 open recommendations from our financial audits and other financial management–related work, there are 105 additional open recommendations stemming from our assessment of IRS’s information security controls over key financial systems, information, and interconnected networks conducted as an integral part of our annual financial audits. The issues that led to our previously reported and our newly identified recommendations related to information security increase the risk of unauthorized disclosure, modification, or destruction of financial and sensitive taxpayer data. Collectively, they constitute IRS’s material weakness in internal control over information security for its financial and tax processing systems. As discussed earlier in this report, recommendations resulting from the information security issues identified in our annual audits of IRS’s financial statements are reported separately because of the sensitive nature of many of these issues.

Appendix I presents a summary listing of (1) the 85 non-information- systems security–related recommendations based on our financial statement audits and other financial management–related work that we had not previously reported as closed and the 29 new recommendations based on our fiscal year 2010 financial audit, (2) IRS-reported corrective actions taken or planned as of March 2011, and (3) our analysis of whether the issues that gave rise to the recommendations have been effectively addressed, based primarily on the work performed during our fiscal year 2010 financial statement audit. The appendix lists the recommendations by the year in which the recommendation was made and by report number. Appendix II presents the 77 open recommendations that remained as a result of closing the aforementioned 37 recommendations and the addition of 29 new recommendations from our fiscal year 2010 audit. The recommendations have been arranged by related material weakness, significant deficiency, and compliance issue as described in our opinion report on IRS’s financial statements, as well as other control issues we have identified and discussed in our annual management report to IRS.

Open Recommendations Grouped by Internal Control Activity

Linking the open recommendations from our financial audits and other financial management–related work, and the issues that gave rise to them, to internal control activities that are central to IRS’s tax administration responsibilities provides insight regarding their significance.

Internal control standards consist of five elements—control environment, risk assessment, control activities, information and communication, and monitoring. For the control activities element, the internal control standards explain that an agency’s system of internal control should provide for an assessment of the risks the agency faces from both external and internal sources and that internal control activities should help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. The control activities element defines 11 specific control activities, which we have grouped into three categories, as shown in table 1. Each of the unresolved recommendations from our financial audits and financial management–related work, and the underlying issues that gave rise to them, can be traced to one of the 11 specific control activities as shown in table 1.

As table 1 indicates, 29 (38 percent) of the unresolved recommendations relate to IRS’s controls over safeguarding of assets and security activities, 30 (39 percent) relate to issues associated with IRS’s ability to properly record and document transactions, and 18 (23 percent) relate to issues associated with IRS’s management review and oversight.

In the following section, we group the 77 open recommendations under the specific control activity to which the condition that gave rise to them most appropriately fits. We define each control activity as presented in the internal control standards and briefly identify some of the key IRS operations that fall under that control activity. Although not comprehensive, the descriptions are intended to help explain why actions to strengthen these control activities are important for IRS to efficiently and effectively carry out its overall mission. Each control activity description includes a table of the related open recommendations. The tables list the recommendations by the year in which we made them (ID no.). For each recommendation, we also indicate whether it is a short-term or long-term recommendation. We characterized a recommendation as short-term when we believe that IRS had the capability to implement solutions within 2 years of the year in which we first reported the recommendations. Note that for the internal control activity “top-level reviews of actual performance,” IRS addressed the outstanding recommendation from prior years that related to this control activity, and we identified no new issues during our fiscal year 2010 financial audit that relate to this control activity.

Safeguarding of Assets and Security Activities

Given IRS’s mission, the sensitivity of the data it maintains, and its processing of trillions of dollars of tax receipts each year, one of the most important control activities at IRS is the safeguarding of assets. Internal control in this important area should be designed to provide reasonable assurance regarding prevention or prompt detection of unauthorized acquisition, use, or disposition of an agency’s assets. IRS has outstanding recommendations in the following three control activities in the internal control standards that relate to safeguarding of assets (including buildings and equipment as well as tax receipts) and security activities (such as limiting access to only authorized personnel): (1) physical control over vulnerable assets, (2) segregation of duties, and (3) access restrictions to, and accountability for, resources and records.

Physical Control over Vulnerable Assets

Internal control standard: An agency must establish physical control to secure and safeguard vulnerable assets. Examples include security for and limited access to assets such as cash, securities, inventories, and equipment which might be vulnerable to risk of loss or unauthorized use. Such assets should be periodically counted and compared to control records.

Of the trillions of dollars in taxes that IRS collects each year, hundreds of billions is collected in the form of checks and cash accompanied by tax returns and related information. IRS collects taxes both at its own facilities as well as at lockbox banks. IRS acts as custodian for (1) the tax payments it receives until they are deposited in the General Fund of the U.S. Treasury and (2) the tax returns and related information it receives until they are either sent to the Federal Records Center or destroyed. IRS is also charged with controlling many other assets, such as computers and other equipment, but it is IRS’s legal responsibility to safeguard tax returns and the confidential information taxpayers provide on those returns that makes the effectiveness of IRS’s internal controls over physical security essential to accomplishing its mission.

While effective physical safeguards over receipts should exist throughout the year, such safeguards are especially important during the peak tax filing season. Each year during the weeks preceding and shortly after April 15, an IRS service center or lockbox bank may receive and process daily over 100,000 pieces of mail containing returns, receipts, or both. The dollar value of receipts each service center and lockbox bank processes increases to hundreds of millions of dollars a day during the April 15 time frame.

The following 22 open recommendations in table 2 are designed to improve IRS’s physical controls over vulnerable assets. They include recommendations for IRS to improve controls over (1) physical security at its Taxpayer Assistance Centers (TAC), (2) courier activities, (3) lockbox banks’ handling of unprocessable items, (4) the handling of hardcopy cash receipts, and (5) property and equipment disposal procedures. We consider all of these recommendations to be correctable on a short-term basis.

Internal control standard: Key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets. No one individual should control all key aspects of a transaction or event.

As noted in the previous section, IRS employees process hundreds of billions of dollars in tax receipts in the form of cash and checks. Consequently, it is critical that IRS maintain appropriate separation of duties to allow for adequate oversight of staff and protection of these vulnerable resources so that no single individual would be in a position of causing an error or irregularity, or potentially converting the asset to personal use, and then concealing it. For example, when an IRS field office receives taxpayer receipts and returns, it is responsible for depositing the cash and checks in a depository institution and forwarding the related taxpayer information received, such as tax returns, to an IRS service center for further processing. In order to adequately safeguard receipts from theft, the person responsible for recording the information from the taxpayer receipts on a voucher should be different from the individual who prepares those receipts for transmittal to the service center for further processing.

Implementing the following recommendation in table 3 would help IRS improve its separation of duties, which will in turn strengthen controls over tax receipts. This recommendation is short-term in nature.

Internal control standard: Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained. Periodic comparison of resources with the recorded accountability should be made to help reduce the risk of errors, fraud, misuse, or unauthorized alteration.

Because IRS is responsible for maintaining accountability over a large volume of cash and checks, it is imperative that it maintain strong controls to appropriately restrict access to those assets, the records relied on to track those assets, and sensitive taxpayer information. Although IRS has a number of both physical and information systems controls in place, some of the issues we have identified in our financial audits over the years pertain to ensuring that (1) those individuals who have direct access to cash and checks are appropriately vetted, such as through appropriate background investigations, before being granted access to taxpayer receipts and information and (2) IRS maintains effective access security control. The following six short-term recommendations in table 4 are intended to help IRS improve its access restrictions to assets and records.

Proper Recording and Documenting of Transactions

IRS has a number of internal control issues related to recording transactions, documenting events, and tracking the processing of taxpayer receipts or information. IRS has outstanding recommendations in the following three control activities related to proper recording and documenting of transactions: (1) appropriate documentation of transactions and internal controls, (2) accurate and timely recording of transactions and events, and (3) proper execution of transactions and events.

Appropriate Documentation of Transactions and Internal Control

Internal control standard: Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals and may be in paper or electronic form. All documentation and records should be properly managed and maintained.

IRS collects and processes trillions of dollars in taxpayer receipts annually both at its own facilities and at lockbox banks under contract to process taxpayer receipts for the federal government. Therefore, it is important that IRS maintain effective controls to ensure that all documents and records are properly and timely recorded, managed, and maintained both at its facilities and at the lockbox banks. In this regard, it is critical that IRS adequately document and disseminate its procedures to ensure that they are available for IRS employees. IRS must also document its management reviews of controls, such as those regarding refunds and returned checks, document transmittals, and reviews of TAC operations. To ensure future availability of adequate documentation, IRS must ensure that (1) its systems, particularly those now being developed and implemented, have appropriate capability to identify and trace individual transactions and (2) all critical steps in its accounting processes are adequately documented. Resolving the following 13 recommendations in table 5 would assist IRS in improving its documentation of transactions and related internal control procedures. All of these recommendations have been classified as short-term.

Internal control standard: Transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from the initiation and authorization through its final classification in summary records. In addition, control activities help to ensure that all transactions are completely and accurately recorded.

IRS maintains sensitive records for tens of millions of taxpayers in addition to maintaining its own financial records. To maintain these records, IRS often has to rely on outdated computer systems or manual work-arounds. Unfortunately, some of IRS’s recordkeeping difficulties we have reported on over the years will not be fully addressed until it can replace its aging systems; an effort that is long-term and, in part, dependent on obtaining future funding.

Implementation of the following 15 recommendations in table 6 would strengthen IRS’s recordkeeping abilities. Thirteen of these recommendations are short-term, and 2 are long-term regarding requirements for new systems for maintaining taxpayer records. Several of the recommendations listed deal with financial reporting processes, such as maintaining subsidiary records, recording budgetary transactions, and tracking program costs. Some of the issues that gave rise to several of our recommendations directly affect taxpayers, such as those involving duplicate assessments, errors in calculating and reporting manual interest, errors in calculating penalties, and collection of trust fund recovery penalty assessments. Two of these recommendations have remained open for 10 years or more, reflecting the complex nature of the underlying systems issues that must be resolved to fully address some of these control deficiencies.

Internal control standard: Transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of ensuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. Authorizations should be clearly communicated to managers and employees.

Each year, IRS spends approximately $250 million to cover the cost of its employees’ travel in addition to entering into agreements with, and receiving services from, vendors. Failure to ensure that employees obtain appropriate authorizations for their travel or approval for procurements leaves the IRS open to fraud, waste, or abuse. IRS’s actions to address the following two short-term recommendations in table 7 would improve IRS’s controls over travel costs and approvals for the procurement of goods and services.

Effective Management Review and Oversight

All personnel within IRS have an important role in establishing and maintaining effective internal controls, but IRS’s managers have additional review and oversight responsibilities. Management must set the objectives, put control activities in place, and monitor and evaluate controls to ensure that they are followed. Without adequate monitoring by managers, there is a risk that internal control activities may not be carried out effectively and in a timely manner. IRS has outstanding recommendations in the following four control activities related to effective management review and oversight: (1) reviews by management at the functional or activity level, (2) establishment and review of performance measures and indicators, (3) management of human capital, and (4) top-level reviews of actual performance.

Reviews by Management at the Functional or Activity Level

Internal control standard: Managers need to compare actual performance to planned or expected results throughout the organization and analyze significant differences.

IRS employs over 100,000 full-time and seasonal employees. In addition, IRS is also responsible for overseeing lockbox banks processing tens of thousands of individual receipts, totaling hundreds of billions of dollars. Effective management oversight of operations is important at any organization, but is imperative at IRS given its mission.

Implementing the following 12 short-term and 1 long-term recommendations in table 8 would improve IRS’s management oversight of several areas of its operations, including monitoring of contractor and off-site processing facilities, release of tax liens, and issuance of manual refunds.

Internal control standard: Activities need to be established to monitor performance measures and indicators. These controls could call for comparisons and assessments relating different sets of data to one another so that analyses of the relationships can be made and appropriate actions taken. Controls should also be aimed at validating the propriety and integrity of both organizational and individual performance measures and indicators.

IRS’s operations include a wide range of activities, including educating taxpayers, processing taxpayer receipts and data, disbursing hundreds of billions of dollars in refunds to millions of taxpayers, maintaining extensive information on tens of millions of taxpayers, and seeking collection from individuals and businesses that fail to comply with the nation’s tax laws. Within its compliance function, IRS has numerous activities, including identifying businesses and individuals that underreport income, collecting from taxpayers who do not pay taxes, and collecting from those receiving refunds for which they are not entitled. Although IRS has at its peak over 100,000 employees, it still faces resource constraints in attempting to fulfill its duties. It is vitally important for IRS to have sound performance measures to assist it in assessing its performance and targeting its resources to maximize the government’s return on investment.

The following long-term recommendation in table 9 is designed to assist IRS in (1) evaluating its operations and (2) determining which activities are the most beneficial. This recommendation is directed at improving IRS’s ability to measure and evaluate the internal costs, direct benefits, and outcomes of its operations—particularly with regard to identifying its most cost-effective tax collection activities.

Internal control standard: Effective management of an organization’s workforce—its human capital—is essential to achieving results and an important part of internal control. Management should view human capital as an asset rather than a cost. Only when the right personnel for the job are on board and are provided the right training, tools, structure, incentives, and responsibilities is operational success possible. Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs. Qualified and continuous supervision should be provided to ensure that internal control objectives are achieved. Performance evaluation and feedback, supplemented by an effective reward system, should be designed to help employees understand the connection between their performance and the organization’s success. As a part of its human capital planning, management should also consider how best to retain valuable employees, plan for their eventual succession, and ensure continuity of needed skills and abilities.

IRS’s operations cover a wide range of technical activities requiring specific expertise in tax-related matters; financial management; and systems design, development, and maintenance. Because IRS has tens of thousands of employees spread throughout the country, it is imperative that management establish and maintain up-to-date guidance and provide appropriate training for its staff. Taking action to implement the following four short-term recommendations in table 10 would assist IRS in its management of human capital.

Concluding Observations

Increased budgetary pressures and an increased public awareness of the importance of internal control have served to provide additional pressure on IRS to carry out its mission more efficiently and effectively while continuing to protect taxpayers’ information.

Sound financial management and effective internal controls are essential if IRS is to efficiently and effectively achieve its goals. IRS has made substantial progress in improving its financial management and internal control since its first financial audit, as evidenced by unqualified audit opinions on its financial statements for the past 11 years, resolution of several material internal control weaknesses, significant deficiencies, and other control issues, and actions taken resulting in the closure of hundreds of financial management recommendations. This progress has been the result of hard work by many individuals throughout IRS and sustained commitment of IRS leadership. Nonetheless, more needs to be done to fully address the agency’s continuing financial management challenges— resolving material weaknesses and significant deficiencies in internal control; developing outcome-oriented performance metrics that can facilitate managing operations for outcomes; and correcting numerous other internal control issues. Effective implementation of the recommendations we have made through our financial audits and related work could greatly assist IRS in improving its internal controls and achieving sound financial management.

Agency Comments and Our Evaluation

In commenting on a draft of this report, IRS expressed its appreciation for our acknowledgment of the agency’s progress in addressing its financial management challenges as evidenced by our closure of 37 open financial management recommendations from prior GAO reports. IRS also commented that it is committed to implementing appropriate improvement to ensure that it maintains sound financial management practices. We will review the effectiveness of further corrective actions IRS has taken or will take to address all open recommendations as part of our audit of IRS’s fiscal year 2011 financial statements.

We are sending copies of this report to the Chairmen and Ranking Members of the Senate Committee on Appropriations; Senate Committee on Finance; Senate Committee on Homeland Security and Governmental Affairs; and Subcommittee on Taxation, IRS Oversight and Long-Term Growth, Senate Committee on Finance. We are also sending copies to the Chairmen and Ranking Members of the House Committee on Appropriations; House Committee on Ways and Means; the Chairman and Vice Chairman of the Joint Committee on Taxation; the Secretary of the Treasury; the Director of OMB; the Chairman of the IRS Oversight Board; and other interested parties. The report is also available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staffs have any questions concerning this report, please contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Appendix I: Status of GAO Recommendations from Internal Revenue Service Financial Audits and Related Management Reports

This appendix presents a list of (1) the 85 recommendations that we had not previously reported as closed, (2) Internal Revenue Service (IRS) reported corrective actions taken or planned as of March 2011, and (3) our analysis of whether the issues that gave rise to the recommendations have been effectively addressed. It also includes 29 recommendations based on our fiscal year 2010 financial statement audit. Table 11 lists the recommendations by the year and recommendation number (ID no.) and also identifies the report in which the recommendation was made.

Appendix II: Open Recommendations Arranged by Material Weakness, Significant Deficiency, Compliance, or Other Control Issue

For several years, we have reported material weaknesses, significant deficiencies, noncompliance with laws and regulations, and other control issues in our annual financial statement audits and related management reports. Appendix II provides summary information regarding the primary issue to which each open recommendation is most closely related. To compile this summary, we analyzed the nature of the open recommendations to relate them to the material weaknesses, significant deficiency, compliance issue, or other control issues (not associated with a material weakness, significant deficiency, or compliance issue) identified as part of our financial statement audit.

Material Weakness: Unpaid Tax Assessments

The Internal Revenue Service (IRS) has weaknesses in its internal control over the management of unpaid tax assessments resulting from the agency’s (1) inability to use its general ledger and underlying subsidiary records to report federal taxes receivable, compliance assessments, and writeoffs in accordance with federal accounting standards without significant compensating procedures, (2) lack of transaction traceability for the reported balance in taxes receivable that comprises over 80 percent of IRS’s total assets as of September 30, 2010, and an effective transaction-based subledger for unpaid tax assessment transactions, and (3) inability to effectively prevent or timely detect and correct errors in taxpayer accounts. The recommendations in table 12 address these weaknesses.

Material Weakness: Information Security

IRS has serious internal control weaknesses over information security that result primarily from IRS not having fully implemented key components of its information security program. These weaknesses, collectively, represent a material weakness. For example, (1) IRS’s testing did not detect many of the vulnerabilities we identified and did not assess a key application in its current environment, and (2) IRS did not effectively validate corrective actions reported to resolve previously identified weaknesses. Although IRS has made some progress in addressing previous weaknesses we identified in its information systems and physical security controls, as of March 2011, there were 105 open recommendations designed to help IRS improve its information systems security controls.

Those recommendations are reported separately and are not included in this report primarily because of the sensitive nature of some of the issues.

Significant Deficiency: Tax Refund Disbursements

IRS has significant internal control weaknesses over its tax refund disbursements. In our audit of IRS’s fiscal year 2010 financial statements, we reported a significant deficiency in IRS’s internal control over tax refund disbursements that resulted from (1) a multiyear pattern of our identifying deficiencies in IRS’s internal control over the processing of manual refunds, which we have reported for several years; (2) the increasing magnitude of manual tax refunds disbursed; and (3) new deficiencies associated with the First-Time Home Buyer Credit (FTHBC). This significant deficiency increases the risk that IRS may pay out duplicate or otherwise erroneous tax refunds to which individuals or businesses are not entitled and for which IRS must spend resources attempting to recover. The recommendations in table 13 address our findings.

Release of Federal Tax Liens

IRS continues to be noncompliant with the laws and regulations governing the release of federal tax liens. We found IRS did not always release applicable federal tax liens within 30 days of tax liabilities being either paid off or abated, as required by the Internal Revenue Code (section 6325). The Internal Revenue Code grants IRS the power to file a lien against the property of any taxpayer who neglects or refuses to pay all assessed federal taxes. The lien serves to protect the interest of the federal government and as a public notice to current and potential creditors of the government’s interest in the taxpayer’s property. The recommendation in table 14 addresses our finding.

Other Control Issues

The 57 recommendations listed in table 15 pertain to issues that do not rise individually or in the aggregate to the level of a material weakness or significant deficiency in internal control, or to a reportable noncompliance with laws and regulations. However, these issues do represent weaknesses in various aspects of IRS’s internal controls that should be addressed.

Appendix III: Comments from the Internal Revenue Service

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, the following individuals made major contributions to this report: William J. Cordrey, Assistant Director; Crystal Alfred; Russell Brown; Ray B. Bush; Stephanie Chen; Jeremy Choi; Oliver Culley; Charles Ego; Doreen Eng; Charles Fox; Valerie Freeman; Ryan Guthrie; Ted Hu; Richard Larsen; Tuan Lam; Delores Lee; Jenny Li; Cynthia Ma; Joshua Marcus; Julie Phillips; John Sawyer; Christopher Spain; Cynthia Teddleton; Lien To; LaDonna Towler; Cherry Vasquez; Gary Wiggins; and Ting-Ting Wu.