Internal Revenue Service: Status of GAO Financial Audit and Related Financial Management Recommendations
Released: 2012-06-28T00:00:00

Letter

Background

Internal control is not one event, but rather a series of activities that should occur throughout an entity’s operations and on an ongoing basis. Internal control should be an integral part of each system that management uses to regulate and guide its operations, rather than as a separate system within an agency. In this sense, internal control is management control that should be built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis.

Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires agencies to establish and maintain effective internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of its federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations.

Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, provides the implementing guidance for FMFIA, and prescribes the specific requirements for assessing and reporting on internal controls consistent with the Standards for Internal Control in the Federal Government (internal control standards) issued by the Comptroller General of the United States. The circular defines management’s responsibilities related to internal control and the required process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control and emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control–related activities.

FMFIA requires GAO to issue standards for internal control in the federal government. The internal control standards provide the overall framework for establishing and maintaining effective internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement.

As summarized in the internal control standards, internal control in the government is defined by the following five elements, which also provide the basis against which internal controls are to be evaluated:

Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management.

Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources.

Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives.

Information and communication: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities.

Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved.

A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance that IRS maintained effective internal control with respect to financial reporting. While we use all five elements of internal control, including risk assessment and monitoring, as a basis for evaluating the effectiveness of IRS’s internal controls, our ongoing evaluations and tests have focused heavily on control activities, where we have identified numerous control deficiencies and have provided recommendations for corrective action. Control activities are the policies, procedures, techniques, and mechanisms that are intended to enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that are intended to accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. Control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results.

Scope and Methodology

To accomplish our objectives, we evaluated the effectiveness of corrective actions IRS implemented during fiscal year 2011 in response to open recommendations as part of our fiscal years 2011 and 2010 financial audits. To determine the status of the recommendations, we (1) obtained IRS’s reported status of each recommendation and corrective action taken or planned as of March 2012, (2) compared IRS’s reported status to our fiscal year 2011 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation, and (3) performed additional follow-up work to assess IRS’s actions taken to address the open recommendations. Because of the sensitive nature of many of the issues related to our recommendations regarding information security, we have reported our recommendations for corrective action related to information security issues to IRS separately.

GAO, Management Report: Improvements Are Needed to Enhance the Internal Revenue Service’s Internal Controls and Operating Effectiveness, GAO-12-683R (Washington, D.C.: June 25, 2012).

IRS had addressed, in whole or in part, the underlying control deficiencies that gave rise to the recommendations; and other legal requirements and implementing guidance, such as FMFIA and OMB Circular No. A-123.

Our work was performed from December 2011 through April 2012 in accordance with generally accepted government auditing standards.

IRS Faces Continuing Significant Financial Management Challenges

IRS continues to make progress in resolving its control deficiencies and addressing outstanding recommendations, but continues to face significant financial management challenges. Since we first began auditing IRS’s financial statements in fiscal year 1992, IRS has taken a significant number of actions that were sufficient to resolve several material weaknesses and significant control deficiencies and to close over 300 of our previously reported recommendations. This includes 38 recommendations we are closing with this report based on actions IRS took through March 2012.

Nevertheless, IRS continues to face challenges in establishing effective controls over its financial and operational management. Specifically, IRS continues to face management challenges in (1) resolving its two material weaknesses and one significant deficiency in internal control and (2) developing performance measures necessary to managing operational performance outcomes. Further, as in previous years’ audits, our fiscal year 2011 audit continued to identify additional internal control deficiencies, resulting in 30 new recommendations for corrective action. These deficiencies and related recommendations are discussed in detail in our June 2012 management report to IRS. In addition, as noted earlier, we also identified control deficiencies related to information security during our fiscal year 2011 audit that we reported separately with limited distribution because of the sensitive nature of many of those control deficiencies.

Challenges in Resolving Two Long-standing Material Weaknesses and One Significant Deficiency in Internal Control

As in past years, IRS continued to face significant challenges in resolving its remaining long-standing material weaknesses in internal control concerning (1) unpaid assessmentsyear 2011. and (2) information security in fiscal IRS’s continuing challenge in addressing its material weakness in internal control over unpaid assessments results from its (1) inability to rely on its general ledger and underlying subsidiary records to report federal taxes receivable, compliance assessments, and writeoffs in accordance with federal accounting standards without significant compensating procedures; (2) inability to trace reported taxes receivable to supporting transactions and maintain an effective transaction-based subledger for unpaid assessment transactions; and (3) inability to effectively prevent or timely detect and correct errors in taxpayer accounts. These control deficiencies are caused primarily by IRS’s continued reliance on software applications that were not designed to provide accurate, complete, and timely transaction-level financial information, as well as errors in taxpayer accounts. Consequently, IRS management is impaired in its ability to make well-informed decisions and to accumulate and report financial information in accordance with federal accounting standards. These problems are likely to continue to exist until these software applications are either significantly enhanced or replaced, and IRS remedies the control deficiencies that continue to result in significant errors in taxpayer accounts.

IRS’s continuing challenge in addressing its material weakness in internal control over information systems security is primarily due to both continuing and newly identified control deficiencies. As in past years, IRS continued to (1) rely on a procurement system that lacks reliable controls due to access control deficiencies and database maintenance that was not performed; (2) use unencrypted protocols for a sensitive tax processing application; and (3) have unresolved physical security control deficiencies. Further, in fiscal year 2011, we identified control deficiencies in IRS’s (1) system access and configuration controls and (2) controls intended to compensate and mitigate for known information security deficiencies. As a result of these control deficiencies considered collectively, IRS was (1) unable to rely upon its systems or compensating and mitigating controls to provide reasonable assurance that its financial statements were fairly presented, (2) unable to ensure the reliability of other financial management information produced by its systems, and (3) at increased risk of compromising confidential IRS and taxpayer information.

In addition to the continuing challenges posed by the two long-standing material weaknesses concerning unpaid assessments and information security, our audit of IRS’s fiscal year 2011 financial statements also identified a continuing significant deficiency in IRS’s internal control over tax refund disbursements, specifically, controls over the processing of claims for the First-time Homebuyer Credit (FTHBC) and over manual refunds. These control deficiencies related to the documentation of FTHBC claims, monitoring of manual refunds, and training of staff having key roles in refund processing.

Challenges in Developing and Implementing Performance Metrics to Assist in Managing for Outcomes

As in past years, IRS continues to face challenges in developing and institutionalizing the use of financial management information to assist it in making operational decisions and in measuring the effectiveness of its programs. IRS made progress during fiscal year 2011 in developing and integrating cost-based performance information into its operational decision-making processes. However, IRS has not yet fully integrated outcome-oriented cost-based performance data into each business units’ routine decision-making processes. IRS has also not yet integrated outcome-oriented performance data into its externally-reported performance metrics.

During fiscal year 2011, IRS continued to add to the number of programs and activities for which full cost, and applicable return on investment (ROI), information has been developed. Further, for the past several years, IRS has annually updated the data for each set of such information. Additionally during fiscal year 2011, management teams in several of IRS’s business units began to implement the use of available full cost information for decision making.

However, this progress in the use of programmatic full cost and ROI information, and related performance metrics, had not yet extended to IRS’s primary business unit responsible for developing and directing IRS’s corporate-wide enforcement activities to collect unpaid taxes. The integration of such information into both IRS’s strategic and routine enforcement-related management decisions could greatly enhance IRS’s ability to manage for outcomes by evaluating the efficiency and cost- effectiveness of its programs and activities, including comparing the efficiency and effectiveness of various existing enforcement collection strategies, staffing levels, and proposed changes.

Developing informative and reliable outcome-oriented performance metrics based on specific enforcement programs’ costs and revenues would assist IRS in improving its ability to (1) establish measurable outcome goals, (2) evaluate the relative merits of various program options, and (3) highlight opportunities for optimizing the allocation of resources. They could also assist IRS in more credibly demonstrating to Congress and the public that it is using its appropriations cost-effectively.

A lack of outcome-oriented performance metrics is inconsistent with federal financial management concepts as embodied in the Federal Accounting Standards Advisory Board’s (FASAB) Statement of Federal Financial Accounting Concepts No. 1, Objectives of Federal Financial Reporting. Specifically, in its discussion of financial reporting concepts, FASAB notes that federal financial data should provide accountability and decision-useful information on the costs of programs and the outputs and outcomes achieved, and it should provide data for evaluating service efforts, costs, and accomplishments.

The absence of outcome metrics is also inconsistent with the objectives of the CFO Act. A key objective of the act was for agencies to routinely develop and use appropriate financial management information to evaluate program effectiveness, make fully informed operational decisions, and ensure accountability. While obtaining a clean audit opinion on its financial statements is important in itself, it is not the CFO Act’s end goal. Rather, the act’s end goal is modern financial management systems that provide reliable, timely, and useful financial information to support day-to-day decision making and oversight. Such systems and practices should also provide for the systematic measurement of both program outputs and outcomes.

We have made several recommendations to IRS over the years to address its financial management challenges in developing internal full cost data for its programs and activities and for outcome-oriented performance measures. Successfully addressing the remaining open recommendations would enhance IRS’s ability to effectively manage for outcomes.

Status of Recommendations Based on the Fiscal Year 2011 Financial Statement Audit

In June 2011, we reported on the status of IRS’s efforts to implement corrective actions to address recommendations stemming from our fiscal year 2010 and prior years’ financial statement audits and other financial management–related work. In that report, we identified 77 audit recommendations that remained open and thus required corrective action by IRS. A significant number of these recommendations had been open for several years, either because IRS had not taken corrective action or because the actions taken had not yet effectively resolved the control deficiencies that gave rise to the recommendations.

IRS has continued to work to address many of the control deficiencies related to these previously reported open recommendations. In the course of performing our fiscal year 2011 financial audit, we determined IRS took actions sufficient to address 38 of our prior years’ recommendations. However, a total of 39 recommendations from prior years remain open, a significant number of which have been outstanding for several years. IRS considers 16 of the prior years’ recommendations to be effectively addressed and therefore closed. However, we consider them to remain open. For 14 of the 16, in our view, IRS’s actions did not fully address the control deficiencies that gave rise to the recommendations. For the remaining two, we have not yet been able to verify the effectiveness of IRS’s actions. The “Status per IRS” and “Status per GAO” sections of appendix I provide a summary of both IRS’s and our assessment of IRS’s actions on each recommendation.

During our audit of IRS’s fiscal year 2011 financial statements, we identified additional control deficiencies that require corrective action. In our June 2012 management report to IRS, we discussed these control deficiencies, and made 30 new recommendations to address them. Consequently, a total of 69 financial management–related recommendations need to be addressed—39 from prior years and 30 new recommendations resulting from our fiscal year 2011 audit. We consider all of the new recommendations to be correctible in the short term. We also consider the majority of the recommendations outstanding from prior years to be correctible in the short term. However, a few, particularly those concerning the functionality of IRS’s automated systems, are complex and may reasonably require several more years to fully and effectively address.

In addition to the 69 open recommendations from our financial audits, there are 118 additional open recommendations stemming from our assessment of IRS’s information security controls over key financial systems, information, and interconnected networks conducted as an integral part of our annual financial audits. The control deficiencies that led to our previously reported and our newly identified recommendations related to information security increase the risk of unauthorized disclosure, modification, or destruction of financial and sensitive taxpayer data. Collectively, they constitute material weakness in IRS’s internal control over information security for its financial and tax processing systems. As discussed previously, we are reporting our recommendations resulting from the information security control deficiencies identified in our annual audits of IRS’s financial statements separately because of the sensitive nature of many of these control deficiencies.

Appendix I presents a summary of the status of IRS actions to address 107 GAO non-information security-related recommendations based on our financial audits–77 from our audits prior to fiscal year 2011 and 30 new recommendations based on the results of our fiscal year 2011 financial audit. Appendix I consists of the (1) recommendation, (2) GAO report in which the recommendation was made, (3) IRS-reported status of corrective actions taken or planned as of March 2012, and (3) our analysis of the status of IRS actions as to whether those actions effectively addressed the deficiencies that gave rise to the recommendation. Appendix I lists the recommendations by the year in which the recommendation was made and by GAO report number.

Appendix II presents the 69 open recommendations that remained at the end of our fiscal year 2011 audit as a result of closing the aforementioned 38 recommendations and adding 30 new recommendations, grouped by related material weakness, significant deficiency, and compliance issue as described in our audit report on IRS’s financial statements, as well as other control deficiencies we have identified and discussed in our annual management reports to IRS.

Open Recommendations Grouped by Internal Control Activity

Linking the open recommendations from our financial audits, and the control deficiencies that gave rise to them, to internal control activities that are central to IRS’s tax administration responsibilities provides insight regarding their significance to accomplishing IRS’s mission.

As discussed earlier, internal control standards define internal control as consisting of five elements—control environment, risk assessment, control activities, information and communication, and monitoring. For the control activities element, the internal control standards explain that an agency’s system of internal control should provide for an assessment of the risks the agency faces from both external and internal sources and that internal control activities should help ensure that management’s directives and related control objectives are carried out. The control activities element identified 11 specific control activities, which we have grouped into three categories, as shown in table 1. Each of the unresolved recommendations from our financial audits, and the underlying control deficiencies that gave rise to them, can be grouped into one of the 11 specific control activities as shown in table 1.

As shown in table 1, 18 (26 percent) of the unresolved recommendations relate to IRS’s controls over safeguarding of assets and security activities, 29 (42 percent) relate to control deficiencies associated with IRS’s ability to properly record and document transactions, and 22 (32 percent) relate to control deficiencies associated with IRS’s management review and oversight.

In the following section, we group the 69 open recommendations under the specific control activity to which the condition that gave rise to each recommendation most appropriately fits. We define each control activity as presented in the internal control standards and briefly identify some of the key IRS operations that fall under that control activity. Although not comprehensive, the descriptions are intended to help explain why actions to strengthen these control activities are important for IRS to efficiently and effectively carry out its overall mission.

Each control activity description includes a table of the related open recommendations. The tables list the recommendations by the year in which we made them (ID no.). At the end of our description of each recommendation, we also provide an assessment of whether the recommendation can be addressed in the short term or long term. We judged a recommendation to be correctible in the short term when we believe that IRS had the capability to implement solutions within 2 years of the year in which we first reported the control deficiency and made the recommendations.

Safeguarding of Assets and Security Activities

Given IRS’s mission, the sensitivity of the data it maintains, and its responsibility for processing trillions of dollars of tax receipts each year, one of the most important control activities at IRS is safeguarding assets. Internal control in this important area should be designed to provide reasonable assurance regarding prevention or prompt detection of unauthorized acquisition, use, or disposition of an agency’s assets. IRS has outstanding recommendations in the following three control activities related to safeguarding and securing assets: (1) physical control over vulnerable assets, (2) segregation of duties, and (3) access restrictions to, and accountability for, resources and records.

Internal control standard: An agency must establish physical control to secure and safeguard vulnerable assets. Examples include security for and limited access to assets such as cash, securities, inventories, and equipment which might be vulnerable to risk of loss or unauthorized use. Such assets should be periodically counted and compared to control records.

Of the trillions of dollars in taxes that IRS collects each year, hundreds of billions is collected in the form of checks and cash accompanied by tax returns and related information. IRS collects taxes both at its own facilities as well as at lockbox banks. IRS acts as custodian for (1) tax payments it receives until they are deposited in the General Fund of the U.S. Treasury and (2) tax returns and related information it receives until they are either sent to the Federal Records Center or destroyed. IRS is also charged with controlling many other assets, such as computers and other equipment. IRS’s legal responsibility to safeguard tax returns and the confidential information taxpayers provide on those returns makes the effectiveness of IRS’s internal controls over physical security essential to accomplishing its mission.

While effective physical safeguards over receipts should exist throughout the year, such safeguards are especially important during the peak tax filing season. Each year during the weeks preceding and shortly after April 15, an IRS service center or lockbox bank may receive and process daily over 100,000 pieces of mail containing returns, receipts, or both. The dollar value of receipts each service center and lockbox bank processes increases to hundreds of millions of dollars a day during this time frame.

The following 13 open recommendations in table 2 are designed to improve IRS’s physical controls over vulnerable assets. They include recommendations for IRS to improve controls over physical security at its Taxpayer Assistance Centers (TAC) and courier activities. We consider all of these recommendations to be correctable in the short term.

Internal control standard: Key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets. No one individual should control all key aspects of a transaction or event.

As discussed previously, IRS employees process hundreds of billions of dollars in tax receipts in the form of cash and checks. Consequently, it is critical that IRS maintain appropriate separation of duties so that no single individual would be in a position of causing an error or irregularity, or potentially converting the asset to personal use, and then concealing it. For example, when an IRS field office receives taxpayer receipts and returns, it is responsible for depositing the cash and checks in a depository institution and forwarding the related taxpayer information received for further processing, including updating the taxpayer’s tax account records. In order to adequately safeguard receipts from theft, the person responsible for recording the information from the taxpayer receipts on a voucher should not also update the taxpayer’s tax records.

Implementing the following recommendation in table 3 would help IRS improve its separation of duties, which will in turn strengthen controls over tax receipts. This recommendation is correctible in the short-term.

Internal control standard: Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained. Periodic comparison of resources with the recorded accountability should be made to help reduce the risk of errors, fraud, misuse, or unauthorized alteration.

Because IRS is responsible for maintaining accountability over a large volume of cash and checks, it is imperative that it maintain strong controls to appropriately restrict access to those assets, the records relied on to track those assets, and sensitive taxpayer information. Our financial audits over the years have identified control deficiencies related to (1) individuals having direct access to cash and checks receiving appropriate background investigations before being granted access to taxpayer receipts and information and (2) maintaining effective access security control. The following four short term recommendations in table 4 are intended to help IRS improve its access restrictions to assets and records.

IRS has a number of control deficiencies related to recording transactions, documenting events, and tracking the processing of taxpayer receipts or information. IRS has outstanding recommendations in the following three control activities related to proper recording and documenting of transactions: (1) appropriate documentation of transactions and internal controls, (2) accurate and timely recording of transactions and events, and (3) proper execution of transactions and events.

Internal control standard: Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals and may be in paper or electronic form. All documentation and records should be properly managed and maintained.

IRS collects and processes trillions of dollars in taxpayer receipts annually both at its own facilities and at lockbox banks under contract to process taxpayer receipts for the federal government. Therefore, it is important that IRS maintain effective controls to ensure that all documents and records are properly and timely recorded, managed, and maintained both at its facilities and at the lockbox banks. In this regard, it is critical that IRS adequately document and disseminate its procedures to ensure that they are available for IRS employees. IRS must also document its management reviews of controls, such as those regarding refunds and returned checks, document transmittals, and reviews of Taxpayers Assistance Center (TAC) operations. To ensure future availability of adequate documentation, IRS must ensure that (1) its systems, particularly those now being developed and implemented, have appropriate capability to identify and trace individual transactions and (2) all critical steps in its accounting processes are adequately documented. Resolving the following eight recommendations in table 5 would assist IRS in improving its documentation of transactions and related internal control procedures. All of these recommendations are correctible in the short term.

Internal control standard: Transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from the initiation and authorization through its final classification in summary records. In addition, control activities help to ensure that all transactions are completely and accurately recorded.

IRS has stewardship responsibility for maintaining sensitive records of tens of millions of taxpayers in addition to its responsibility for maintaining its own financial records. To maintain these records, IRS often has to rely on outdated computer systems or manual work-arounds. Unfortunately, some of IRS’s recordkeeping difficulties we have reported on over the years will not be fully addressed until it can replace its aging systems; an effort that is long term and, in part, dependent on obtaining future funding.

Implementation of the following 16 recommendations in table 6 would strengthen IRS’s recordkeeping abilities. Fifteen of these recommendations are short term, and one is long term regarding requirements for new systems for maintaining taxpayer records. Several of the recommendations listed deal with financial reporting processes, such as maintaining subsidiary records, recording budgetary transactions, and tracking program costs. Some of the control deficiencies that gave rise to several of our recommendations directly affect taxpayers, such as those involving duplicate assessments and errors in calculating and reporting interest and penalties. One of these recommendations has remained open for over 10 years, reflecting the complex nature of the underlying systems control deficiencies that must be resolved to fully address some of these control deficiencies.

Internal control standard: Transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of ensuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. Authorizations should be clearly communicated to managers and employees.

IRS has thousands of leases that must be managed and properly recorded in its property records. IRS also has thousands of employees whose time and attendance must be properly recorded and approved so that IRS can appropriately manage its payroll expenditures. The following five short term recommendations in table 7 would improve IRS’s controls over those areas.

All personnel within IRS have an important role in establishing and maintaining effective internal control, but IRS’s managers have additional review and oversight responsibilities. Management must monitor and evaluate controls to ensure that they are followed. Without adequate monitoring by managers, there is a risk that internal control activities may not be carried out effectively and in a timely manner. IRS has outstanding recommendations in the following three control activities related to effective management review and oversight: (1) reviews by management at the functional or activity level, (2) establishment and review of performance measures and indicators, and (3) management of human capital.

Internal control standard: Managers need to compare actual performance to planned or expected results throughout the organization and analyze significant differences.

IRS is responsible for managing a large, complex organization. It employs and must oversee the activities of over 100,000 full-time and seasonal employees, which includes managing related personnel actions. IRS is also responsible for overseeing lockbox banks that process tens of thousands of individual receipts totaling hundreds of billions of dollars, monitoring the work of hundreds of contractors and numerous off-site processing facilities, issuing tax refunds, managing tax liens, and preparing financial records.

Effective management oversight of such large, complex operations is imperative for IRS to effectively and efficiently accomplish its mission. Implementing the following 17 short term and 1 long term recommendations in table 8 would improve IRS’s management oversight of its operations. One of these recommendations has remained open for over 10 years, reflecting the complexities of the deficiencies involved in ensuring that tax liens are released timely.

Internal control standard: Activities need to be established to monitor performance measures and indicators. These controls could call for comparisons and assessments relating different sets of data to one another so that analyses of the relationships can be made and appropriate actions taken. Controls should also be aimed at validating the propriety and integrity of both organizational and individual performance measures and indicators.

IRS’s operations include a wide range of activities, including educating taxpayers, processing taxpayer receipts and data, disbursing hundreds of billions of dollars in refunds to millions of taxpayers, maintaining extensive information on tens of millions of taxpayers, and seeking collection from individuals and businesses that fail to comply with the nation’s tax laws. Within its compliance function, IRS has numerous activities, including identifying businesses and individuals that underreport income, collecting from taxpayers who do not pay taxes, and collecting from those receiving refunds to which they are not entitled. Consequently, it is vitally important for IRS to have sound performance measures and related data to assist it in assessing its performance and targeting resources to maximize the return on investment.

The following long term recommendation in table 9 is designed to assist IRS in evaluating its operations and determining which activities are the most beneficial. This recommendation is directed at improving IRS’s ability to measure and evaluate program performance costs, benefits, and operational outcomes—particularly with regard to identifying its most cost-effective tax collection activities.

Internal control standard: Effective management of an organization’s workforce—its human capital—is essential to achieving results and an important part of internal control. Management should view human capital as an asset rather than a cost. Only when the right personnel for the job are on board and are provided the right training, tools, structure, incentives, and responsibilities is operational success possible. Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs. Qualified and continuous supervision should be provided to ensure that internal control objectives are achieved. Performance evaluation and feedback, supplemented by an effective reward system, should be designed to help employees understand the connection between their performance and the organization’s success. As a part of its human capital planning, management should also consider how best to retain valuable employees, plan for their eventual succession, and ensure continuity of needed skills and abilities.

IRS’s operations cover a wide range of technical activities requiring specific expertise in tax-related matters; financial management; and systems design, development, and maintenance. Because IRS has tens of thousands of employees spread throughout the country, it is imperative that management establish and maintain up-to-date guidance and provide appropriate training for its staff. Taking action to implement the following three recommendations in table 10, which are correctible in the short term, would assist IRS in its management of human capital.

Concluding Observations

Increased budgetary pressures and an increased public awareness of the importance of maintaining effective accountability over trillions of dollars of tax receipts and sensitive taxpayer data have served to provide additional pressure on IRS to carry out its mission more efficiently and effectively. As such, sound financial management and effective internal controls are essential if IRS is to efficiently and effectively achieve its goals.

IRS has made substantial progress in improving its financial management and internal control since its first financial audit, as evidenced by unqualified audit opinions on its financial statements for the past 12 years, resolution of several material internal control weaknesses, significant deficiencies, and other control deficiencies, and actions taken resulting in the closure of hundreds of financial management recommendations. This progress has been the result of hard work by many individuals throughout IRS and sustained commitment of IRS leadership. Nonetheless, more needs to be done to fully address the agency’s continuing financial management challenges—resolving material weaknesses and significant deficiencies in internal control; developing outcome-oriented performance metrics that can facilitate managing operations for outcomes; and correcting numerous other control deficiencies. Effective implementation of the recommendations we have made through our financial audits and related work could greatly assist IRS in improving its ability to effectively and efficiently carry out its mission.

Agency Comments and Our Evaluation

In commenting on a draft of this report, the IRS Commissioner expressed his appreciation for our acknowledgment of the agency’s progress in addressing its financial management challenges as evidenced by our closure of 38 open financial management recommendations from prior GAO reports. The IRS Commissioner also stated that the agency is committed to implementing appropriate improvements to ensure that it maintains sound financial management practices. We will review the effectiveness of further corrective actions IRS has taken or will take to address all open recommendations as part of our audit of IRS’s fiscal year 2012 financial statements.

We are sending copies of this report to the Chairmen and Ranking Members of the Senate Committee on Appropriations; Senate Committee on Finance; Senate Committee on Homeland Security and Governmental Affairs; and Subcommittee on Taxation, IRS Oversight and Long-Term Growth, Senate Committee on Finance. We are also sending copies to the Chairmen and Ranking Members of the House Committee on Appropriations; House Committee on Ways and Means; the Chairman and Vice Chairman of the Joint Committee on Taxation; the Secretary of the Treasury; the Acting Director of OMB; the Chairman of the IRS Oversight Board; and other interested parties. The report is also available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions concerning this report, please contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Appendix I: Status of GAO Recommendations from Internal Revenue Service Financial Audits and Related Management Reports

This appendix presents a summary of (1) the 77 previous GAO recommendations that were open as of the beginning of our fiscal year 2011 financial audit, (2) Internal Revenue Service (IRS) reported status and corrective actions taken or planned for such recommendations as of March 2012, and (3) our analysis of whether the control deficiencies that gave rise to the recommendations have been effectively addressed. It also includes a summary of the status of the 30 new recommendations identified as part of our fiscal year 2011 financial statement audit. Table 11 lists the recommendations by the year and recommendation number (ID no.) and also identifies the report in which the recommendation was made.

Appendix II: Open Recommendations Arranged by Material Weakness, Significant Deficiency, Compliance, or Other Control Deficiencies

For several years, we have reported material weaknesses, significant deficiencies, noncompliance with laws and regulations, and other control deficiencies in our annual financial statement audits and related management reports. Appendix II provides summary information regarding the primary issue to which each open recommendation is most closely related. To compile this summary, we analyzed the nature of the open recommendations to relate them to the material weaknesses, significant deficiency, compliance issue, or other control deficiencies (not associated with a material weakness, significant deficiency, or compliance issue) identified as part of our financial statement audit.

Material Weakness: Unpaid Assessments

The Internal Revenue Service (IRS) has a material weakness in its internal control over the management of unpaid assessments resulting from the agency’s (1) inability to rely on its general ledger for tax transactions and underlying subsidiary records to report federal taxes receivable, compliance assessments, and writeoffs in accordance with federal accounting standards without significant compensating procedures, (2) lack of transaction traceability for the reported balance in taxes receivable that comprises over 80 percent of IRS’s total assets as of September 30, 2011, and an effective transaction-based subledger for unpaid tax assessment transactions, and (3) inability to effectively prevent or timely detect and correct errors in taxpayer accounts. The recommendations in table 12 address our related findings.

Material Weakness: Information Security

IRS has control deficiencies over information security that result primarily from IRS not having fully implemented key components of its information security program. These weaknesses, collectively, represent a material weakness. For example, (1) IRS’s testing did not detect many of the vulnerabilities we identified and did not assess a key application in its current environment, and (2) IRS did not effectively validate corrective actions reported to resolve previously identified control deficiencies. Although IRS has made some progress in addressing previous control deficiencies we identified in its information systems and physical security controls, as of March 2012, there were 118 open recommendations designed to help IRS improve its information systems security controls. Those recommendations are reported separately and are not included in this report primarily because of the sensitive nature of some of the issues.

Significant Deficiency: Tax Refund Disbursements

IRS has several control deficiencies over its tax refund disbursements. In our audit of IRS’s fiscal year 2011 financial statements, we reported a significant deficiency in IRS’s internal control over tax refund disbursements that resulted from (1) IRS not having effectively addressed the deficiencies in internal control over manual tax refunds that we have reported in previous years, (2) additional deficiencies in internal control over manual tax refunds we identified during our fiscal year 2011 audit, and (3) continued deficiencies in IRS’s internal control over processing of claims for the First-time Homebuyer Credit (FTHBC). These control deficiencies related to the monitoring of manual refunds, training of staff having key roles in refund processing, and documentation of FTHBC claims. The recommendations in table 13 address our related findings.

Compliance with Laws and Regulations: Release of Federal Tax Liens

IRS continues to be noncompliant with the laws and regulations governing the release of federal tax liens. We found IRS did not always release applicable federal tax liens within 30 days of tax liabilities being either paid off or abated, as required by the Internal Revenue Code (section 6325). The Internal Revenue Code grants IRS the power to file a lien against the property of any taxpayer who neglects or refuses to pay all assessed federal taxes. The lien serves to protect the interest of the federal government and as a public notice to current and potential creditors of the federal government’s interest in the taxpayer’s property. The recommendation in table 14 addresses our related finding.

Other Control Deficiencies

IRS’s actions over the years to resolve control deficiencies enabled us to close over 300 internal control–related recommendations. However, IRS also continues to face a challenge in addressing numerous other unresolved control deficiencies in several aspects of its operations that, while neither individually nor collectively representing a material weakness or significant deficiency, nonetheless merit management attention to ensure they are fully and effectively addressed. IRS now has a total of 57 open audit recommendations resulting from control deficiencies that we report in table 15. While most were identified during our recent financial audits, some were identified in our audits since 2005. It is incumbent upon IRS to effectively address these open recommendations and to improve its system of internal controls so that IRS can identify and correct potential control deficiencies before they can grow into more serious problems.

Twenty-five —over 40 percent—of the 57 “other” open recommendations address control deficiencies related either directly or indirectly to physical safeguarding of tax receipts and taxpayer information, a critical element of IRS’s responsibilities.

IRS processes billions of dollars annually in checks and currency, which it must safeguard and account for to prevent theft, fraud, and misuse. To do so, IRS has established physical security, accountability, and accounting policies, processes, and procedures to manage its activities involving transporting and accounting for tax receipts and for handling and storing taxpayer information. Although IRS has made substantial improvements in safeguarding taxpayer receipts and information since our financial audits first began identifying serious control deficiencies in this area, the task of ensuring ongoing control over such critical responsibilities for IRS is a difficult one and requires constant vigilance. Each year, we continue to identify control deficiencies related to IRS’s safeguarding of taxpayer receipts and information. For example, our fiscal year 2011 audit identified new control deficiencies, and we made additional recommendations that related either directly or indirectly to physically safeguarding taxpayer receipts and information. The control deficiencies encompassed in our open recommendations cover critical physical security functions, such as transporting taxpayer receipts and sensitive taxpayer information among IRS facilities and lockbox banks and maintaining physical security at IRS facilities to prevent loss, theft, or the potential for fraud regarding tax receipts and taxpayer information; conducting inspections and audits of the design and operation of IRS’s physical security processes and controls designed to safeguard tax receipts and taxpayer information; and conducting appropriate background investigations and screening of personnel, including contractors, with access to taxpayer information.

In light of the volume of taxpayer receipts and sensitive taxpayer files that IRS is responsible for safeguarding, and the implications for IRS’s mission if they are lost, stolen, or the subject of fraud or misuse, it is critical that IRS fully and effectively resolve the control deficiencies we have identified and work toward continually improving its internal controls to prevent new issues from arising.

Appendix III: Comments from the Internal Revenue Service

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, the following individuals made major contributions to this report: William J. Cordrey, Assistant Director; Crystal Alfred; Ray B. Bush; Sunny Chang; Stephanie Chen; Jeremy Choi; Nina Crocker; Doreen Eng; Charles Fox; Ted Hu; Tuan Lam; Delores Lee; Jenny Li; Cynthia Ma; Joshua Marcus; Marc Oestreicher; Julie Phillips; James Rinaldi; John Sawyer; Christopher Spain; Cynthia Teddleton; Lien To; LaDonna Towler; Cherry Vasquez; and Gary Wiggins.