Internal Revenue Service: Results of Fiscal Year 1998 Financial Statement Audit
Released: 1999-03-01T00:00:00

Letter

IRS’ Financial Reporting Controls Are Inadequate and Its Financial Management Systems Do Not Comply With FFMIA

IRS does not have internal controls over its financial reporting process adequate to provide reasonable assurance that its principal financial statements are reliable. As a result, IRS (1) was unable to prepare reliable statements of net cost, changes in net position, budgetary resources, and financing and (2) could not support material amounts reported on its balance sheet, including fund balance with Treasury, accounts payable, and net position. In addition, we found that property and equipment is likely to be materially understated. We found that the custodial and administrative general ledger systems which support the principal financial statements are not in conformance with the U.S. Government Standard General Ledger (SGL) at the transaction level and do not provide a complete audit trail for recorded transactions, material balances reported on IRS’ principal financial statements are not supported by detailed subsidiary records, and IRS’ principal financial statements are not subject to management oversight adequate to provide reasonable assurance that significant errors and omissions are identified and corrected before the principal financial statements are issued.

In an effort to overcome these deficiencies, IRS employs a costly, labor intensive, and time-consuming process involving extensive and complex analysis and ad hoc procedures to assist in preparing its principal financial statements. IRS continues to utilize specialized computer programs to extract information from databases underlying the administrative and custodial general ledgers to derive and/or support amounts to be reported in the principal financial statements. For example, IRS must use this process to identify the portion of its unpaid assessments that represent taxes receivable for financial reporting purposes. However, as in fiscal year 1997, the amounts produced by this approach needed material audit adjustments totaling tens of billions of dollars to produce reliable balances for custodial activities. With respect to IRS’ administrative activities, this approach was unsuccessful in producing reliable balances.

In addition, IRS’ basic approach was designed specifically for the narrowly defined purpose of preparing auditable balances at year-end only. This mechanism is not capable of producing reliable agencywide principal financial statements or financial performance information to measure results throughout the year as a management tool, which is standard practice in private industry and some federal entities.

We also found that IRS’ previously separate financial reporting processes for its custodial and administrative activities have not been integrated under unified supervision at the operational level. This unnecessarily complicates IRS’ year-end financial reporting process and hampers efforts to provide interim IRS-wide financial information as a management tool.

IRS’ complex and often manual financial reporting process requires extensive technical computer and accounting expertise and is highly vulnerable to human error. It is therefore critical that this process be adequately staffed and supervised and be subject to adequate management oversight at each stage as balances and disclosures are developed. However, IRS’ financial reporting process often lacked these basic controls. For example, during fiscal year 1998, key personnel with responsibilities for financial systems and reporting on IRS’ administrative activities left IRS and had not been replaced by year-end. Consequently, IRS was compelled to attempt to prepare its financial statements without the necessary staff. This occurred at the same time as the implementation of new federal accounting and reporting requirements that required IRS to prepare four new financial statements. In addition, throughout the process, we found numerous errors and omissions in financial reporting documentation as well as in the draft financial statements themselves, which likely would have been caught and corrected had these records been appropriately reviewed by management.

In our previous audit, we reported that IRS’ custodial financial management systems did not substantially comply with Federal Financial Management Systems Requirements (FFMSR), federal accounting standards, and the SGL at the transaction level, which are the core requirements of FFMIA. During fiscal year 1998, we found that this condition continued and that IRS’ administrative financial management systems also had significant problems. IRS (1) cannot reliably prepare four of the six principal financial statements required by the Office of Management and Budget, which prescribes the form and content of federal financial statements, (2) does not have a general ledger(s) that conforms to the SGL, (3) lacks a subsidiary ledger for its unpaid assessments, accounts payable, and undelivered orders, and (4) lacks an effective audit trail from its general ledgers back to subsidiary detailed records and transaction source documents.

In addition, IRS does not consistently capture costs as required by federal accounting standards to permit it to (1) routinely prepare reliable cost-based performance measures for inclusion in the management discussion and analysis that accompanies its principal financial statements or (2) prepare the information to be included in its annual performance plan as required by the Government Performance and Results Act (GPRA) of 1993. This deficiency also renders IRS unable to include reliable cost-based performance information in its budget submission to Congress.

IRS Continues to Lack a Subsidiary Ledger and Adequate Supporting Documentation for Unpaid Assessments

As we have previously reported, IRS does not have a subsidiary ledger which tracks and accumulates unpaid assessments and their status on an ongoing basis, the absence of which adversely affects its ability to effectively manage and accurately report unpaid assessments. To compensate for this, IRS runs computer programs against its master files—the only detailed record of taxpayer information it maintains—to identify, extract, and classify the universe of unpaid assessments for financial reporting purposes. However, this approach is only designed for the limited purpose of allowing IRS to report auditable financial statement totals at year-end and is not an adequate substitute for a reliable subsidiary ledger which provides an accurate outstanding balance for each taxpayer on an ongoing basis. Additionally, this approach still resulted in the need for tens of billions of dollars of audit adjustments to IRS’ principal financial statements to correct duplicate or otherwise misstated unpaid assessment balances identified by our testing.

Without the information an effective subsidiary ledger should provide, IRS cannot ensure that payments and assessments are promptly posted to the appropriate taxpayer accounts. We found in our statistical sample of unpaid assessments that this problem resulted in inaccurate taxpayer account balances and led IRS to pursue collection efforts against taxpayers who had already paid their taxes in full. In addition, in our sample we found that IRS inappropriately issued refunds to taxpayers with outstanding tax assessment balances.

We previously reported that IRS had significant problems locating supporting documentation for unpaid assessment transactions. To address this issue, we worked closely with IRS and identified various forms of documentation to support these items, and we requested these documents in performing our fiscal year 1998 testing. While we did note some improvement, we continued to find that IRS experienced difficulties in providing supporting documentation. The lack of adequate supporting documentation made it difficult to assess the classification and collectibility of unpaid assessments reported in the principal financial statements as federal taxes receivable and may make it difficult for IRS to readily identify and focus collection efforts.

Vulnerabilities in Controls Over Refunds Continue to Exist

As in prior years, we continued to find that IRS does not have sufficient preventive controls over refunds to reduce to an acceptable level the risk that inappropriate payments for tax refunds will be disbursed. Inappropriate refund payments continued to be issued in fiscal year 1998 due to (1) IRS comparing the information on tax returns and third party data such as W-2s (Wage and Tax Statement) too late to identify and correct discrepancies between these documents, (2) significant levels of invalid Earned Income Tax Credit (EITC) claims, and (3) deficiencies in controls that allowed duplicate refunds to be issued. We also found instances of erroneous refunds being issued as a result of errors or delays in posting assessments to taxpayer accounts. Errors and posting delays such as these impair IRS’ ability to effectively offset refunds due taxpayers against amounts owed by the same taxpayers on another account.

Although IRS has detective (post-refund) controls in place, the lack of sufficient preventive controls exposes the government to potentially significant losses due to inappropriate disbursements for refunds. According to IRS’ records, IRS investigators identified over $17 million in alleged fraudulent refunds that had been disbursed during the first 9 months of calendar year 1998 and prevented the disbursement of an additional $65 million in alleged fraudulent refund claims. During calendar year 1997, IRS’ records indicate that intervention by IRS investigators prevented the disbursement of additional alleged fraudulent refund claims totaling over $1.5 billion. However, the full magnitude of invalid refunds disbursed by IRS is unknown.

In addition, rates of invalid EITC claims have historically been high. During fiscal year 1998, IRS reported that it processed EITC claims totaling over $29 billion, including over $23 billion (79 percent) in refunds. In an effort to minimize losses due to invalid EITC claims, IRS electronically screens tax returns claiming EITC to identify those exhibiting characteristics considered indicative of potentially questionable claims based on past experience and then selects those claims considered most likely to be invalid for detailed examination. During fiscal year 1998, IRS examiners reviewed over 290,000 tax returns claiming $662 million in EITC of which $448 million (68 percent) was found to be invalid. These examinations are an important control mechanism for detecting questionable claims and providing a deterrent to future invalid claims. However, because examinations are often performed after any related refunds are disbursed, they cannot substitute for effective preventive controls designed to identify invalid claims before refunds are disbursed.

In fiscal year 1998, IRS began implementing a 5-year EITC compliance initiative intended to expand customer service to increase taxpayers’ awareness of their rights and responsibilities related to EITC, strengthen enforcement of EITC requirements, and enhance research into the sources of EITC noncompliance. However, most of IRS’ efforts under that initiative had not progressed far enough at the time we completed our audit for us to make any judgment about their effectiveness.

While we were able to substantiate the amounts of refunds disbursed as reported on IRS’ fiscal year 1998 principal financial statements, IRS nevertheless lacks effective preventive controls to minimize its vulnerability to payment of inappropriate refunds. Once an inappropriate refund has been disbursed, IRS is compelled to expend both the time and expense to attempt to recover it, with dubious prospects of success.

Physical Security Over Manual Tax Receipts and Taxpayer Information Is Inadequate

As we have previously reported, IRS’ controls over cash, checks, and related hardcopy taxpayer data it manually receives from taxpayers are not adequate to reduce to an acceptably low level the risk that these payments will not be properly credited to taxpayer accounts and deposited in the Treasury or that proprietary taxpayer information will not be properly safeguarded. Strong physical security is critical to ensure that receipts are not lost or stolen or that sensitive taxpayer data are not compromised, and is thus critical to IRS’ customer service goals.

However, we found that (1) unattended checks and tax returns were often stored in open and easily accessible areas, (2) hundreds of millions of dollars of receipts in the form of checks, and in one case cash, were transported from IRS field offices to financial institutions by unarmed couriers who often used unmarked civilian vehicles including, in one instance, a bicycle, and (3) individuals were hired and entrusted with access to cash, checks, and sensitive taxpayer data before completion of background or fingerprint checks. This problem is particularly acute during peak filing season when IRS typically hires thousands of temporary employees. IRS’ investigations of 80 thefts at service centers between January 1995 and July 1997 found that 15 percent of these were committed by individuals who had previous arrest records or convictions that were not identified prior to their employment. At commercial lockbox banks IRS contracts with to process tax receipts, we found similar weaknesses, including the use of unarmed couriers and the hiring of temporary employees before background checks are completed.

In fiscal years 1997 and 1998, IRS identified 56 actual or alleged cases of employee theft of receipts at IRS field offices and lockbox banks totaling about $1 million. An additional 100 cases were opened during the period in which the amount potentially stolen was not quantified. Further, the magnitude of thefts not identified by IRS is unknown. The weaknesses we identified also expose taxpayers to increased risk of losses due to financial crimes committed by individuals who inappropriately gain access to confidential information entrusted to IRS. For example, this information — which includes names, addresses, social security and bank account numbers, and details of financial holdings —may be used to commit identity fraud. Although receipts and taxpayer information will always be vulnerable to theft, IRS has a responsibility to protect the government and taxpayers from such losses.

IRS Did Not Reconcile Its Fund Balance With Treasury

Throughout fiscal year 1998, IRS did not reconcile its administrative fund balance with Treasury accounts. Such reconciliations are required by Treasury policy and are analogous to companies or individuals reconciling their checkbooks to monthly bank statements.

When in January 1999, IRS’ contractor provided what it considered to be reconciliations of IRS’ Treasury fund balance for the 12 months of fiscal year 1998, we found amounts on the reconciliations for Treasury and IRS balances did not agree with Treasury and IRS records and reconciling items listed on the reconciliations were not investigated and resolved.

Similarly, IRS has not been investigating and resolving amounts in its administrative suspense accounts. As of September 30, 1998, IRS had items totaling a net credit balance of over $100 million in its fund balance with Treasury suspense account, including some items dating back to 1989 appropriations.

The lack of timely, thorough reconciliations makes it difficult if not impossible for IRS to determine if operating funds have been properly spent or if reported amounts for operating expenses, assets, and liabilities are reliable. Without performing such reconciliations, IRS has no assurance that its fund balance with Treasury is accurate. The lack of appropriate reconciliations also impacts IRS’ ability to ensure that it complies with the law governing the use of its budget authority. Because this fundamental internal control was not followed, we were unable to conclude whether IRS’ fund balance with Treasury account was reliable at September 30, 1998. Additionally, we were unable to test to determine whether IRS had complied with the Anti-Deficiency Act, as amended.

Controls Over Property and Equipment Are Deficient

As we have reported in prior year audits, IRS’ controls over its property and equipment (P&E) records are not adequate to ensure that these records provide a complete and reliable record of P&E assets. Without current and accurate records, IRS cannot ensure that the P&E items it owns are not lost or stolen, that new purchases of equipment are appropriately capitalized in its accounting records, or that related principal financial statement balances are reliable.

IRS does not have policies and procedures in place to ensure that material P&E are recorded in IRS’ financial statements. For example, IRS’ computer systems information shows substantial funding available and used for computer systems, such as mainframe consolidation and a new receipts processing system. IRS’ computer systems information also shows evidence of contractor services related to design, plans, and specifications for computer hardware and software projects—costs required to be capitalized under federal accounting standards. Finally, IRS’ financial records show equipment-related expenses of $339 million in fiscal year 1998.

Although this significant P&E activity occurred, only about $30 million was recognized as P&E additions in fiscal year 1998. We also saw evidence of substantial unrecorded capital expenditures in fiscal year 1997. These problems are compounded by IRS’ use of a $50,000 minimum financial statement cost capitalization threshold, which is permitted by Treasury policy. This amount far exceeds the cost of most of the P&E items IRS purchases and results in a material distortion of IRS’ reported P&E in its financial statements. Based on assets included in IRS’ property systems, we found that $1.2 billion, or 69 percent of IRS’ gross P&E, was not included as property and equipment in the financial statements because of the use of this threshold to capitalize P&E assets. Consequently, P&E balances are likely to be materially understated.

In addition to the P&E completeness problem, IRS’ policies and procedures for recording P&E transactions impede its ability to reconcile the general ledger to related P&E subsidiary records. IRS’ field offices record individual property acquisitions and dispositions on site throughout the year. However, IRS’ accounting system expenses property purchases during the year, then records adjustments at year-end to reflect P&E dispositions and to move property purchases from expenses to P&E based on field office subsidiary records. As a result, IRS has no assurance that the amounts it records in its general ledger and underlying P&E subsidiary systems, respectively, are complete and agree with each other. IRS is compelled to manually adjust the general ledger at year-end to force it to agree with its P&E subsidiary records.

However, the reliability of these subsidiary P&E records is highly questionable. In many cases, the items in the records that we selected for testing could not be located by IRS, including a Chevrolet Blazer motor vehicle and a laser printer costing over $300,000. Additionally, a significant number of items that we selected from the floor of IRS’ field offices were not included in IRS’ detailed property records. Physical inventories we observed being performed by IRS personnel at two IRS field offices produced similar results. We also found instances where different IRS field offices had recorded substantially identical items at significantly different costs.

These discrepancies and reported problems reflect weaknesses in IRS property management controls that impair its ability to ensure that P&E are used only in accordance with IRS policy and that related records are accurate. It is important to note that IRS has itself reported deficiencies in its property management controls for the last 17 consecutive years.

Controls Over Computer Security Are Inadequate

IRS places extensive reliance on its computer information systems to perform basic functions, such as processing tax returns, maintaining sensitive taxpayer data, calculating interest and penalties, and generating refunds. Consequently, weaknesses in controls over its computer information systems could render IRS unable to perform these vital functions or result in the unauthorized disclosure, modification, or destruction of taxpayer data. In December 1998, we reported that while significant weaknesses in computer information controls remain, IRS had made significant progress in improving its computer security. For example, IRS has centralized responsibility for its security and privacy issues in its Office of Systems Standards and Evaluation. This Office is implementing a servicewide security program to manage risk and has led IRS’ efforts in mitigating about 75 percent of the weaknesses identified in one of our previous reports.

Serious weaknesses, however, continue to exist in (1) security program management, (2) access control, (3) application software development and change controls, (4) system software, (5) segregation of duties, and (6) service continuity. Continued weaknesses in these areas can allow unauthorized individuals access to critical hardware and software where they may intentionally or inadvertently add, alter, or delete sensitive data or programs. Such individuals can also obtain personal taxpayer information and use it to commit financial crimes in the taxpayers’ name (identity fraud), such as fraudulently establishing credit, running up debts, and taking over and depleting banks accounts.

Significant Efforts Will Be Needed to Resolve IRS’ Financial Management Issues

IRS continues to be plagued by serious internal control and systems deficiencies that hinder its ability to achieve lasting financial management improvements. IRS has acknowledged the issues and concerns identified in our fiscal year 1998 audit and the Commissioner and Deputy Commissioner of Operations have pledged their commitment to addressing these long-standing issues. IRS already has a number of initiatives underway to try to address continued weaknesses with respect to its unpaid assessments. Additionally, significant progress continues to be made on the serious computer security issues we have reported for several years.

Most recently, IRS has established a corrective action team under the direction of the Chief Financial Officer to formulate a detailed plan for addressing the issues identified in our audit. IRS expects to complete the formulation of this plan by March 31, 1999. IRS also plans to bring in outside experts to assist its staff in resolving the issues relating to its administrative operations. IRS has stated that while its financial management systems were not designed to meet current systems and financial reporting standards, it is in the process of planning and implementing interim solutions until enhanced systems are available over the next several years.

We have assisted IRS in formulating corrective actions to address its serious internal control and financial management issues by providing numerous recommendations over the years. We will continue to provide such assistance as necessary as IRS faces its significant financial and other management challenges. We recognize that IRS’ financial management systems were not designed to meet current systems and financial reporting standards, that these problems did not occur overnight, and that the task ahead of IRS to fully correct its systems-related deficiencies will take years to achieve. We do, however, believe that serious internal control issues can be addressed in the near term through a dedicated effort on the part of IRS management.

We realize that IRS’ ability to successfully meet the financial management challenges it faces must be balanced with the competing demands placed on its resources by its customer service and tax law compliance responsibilities. However, it is critical that IRS rise to the challenges posed by these financial management issues, because its success in achieving all aspects of its strategic objectives depends in part upon reliable financial management information and effective internal controls. It is also important to recognize that several of the financial management issues we have raised in our financial audits directly or indirectly affect IRS’ ability to meet its customer service and tax law compliance responsibilities.

Mr. Chairman, this concludes my prepared statement. I would be pleased to answer any questions.

Components of IRS’ $222 Billion of Unpaid Assessments (Dollars in Billions)

Taxes Receivable - Collectible ($26)

Taxes Receivable - Uncollectible ($55)

Compliance Assessments ($22)

Write-offs ($119)

The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent.

U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.