This section discusses significant matters that we considered in performing our audit and in forming our conclusions. These matters include (1) six material weaknesses in IRS’ internal controls, (2) one reportable condition representing a significant weakness in IRS’ internal controls, (3) one instance of noncompliance with laws and regulations and noncompliance with the requirements of FFMIA, and (4) two other significant matters that represent important issues that should be brought to the attention of IRS management and other users of IRS’ Custodial Financial Statements and other reported financial information. During our audit of IRS’ fiscal year 1997 Custodial Financial Statements, we identified six material weaknesses that adversely affected IRS’ ability to safeguard assets from material loss, assure material compliance with relevant laws and regulations, and assure that there were no material misstatements in the financial statements. These weaknesses relate to IRS’ inadequate general ledger system, supporting subsidiary ledger for unpaid assessments, supporting documentation for unpaid assessments, controls over refunds, revenue accounting and reporting, and computer security. These material weaknesses were consistent in all significant respects with the material weaknesses cited by IRS in its fiscal year 1997 FIA report. Although we were able to apply substantive audit procedures to verify that IRS’ fiscal year 1997 Custodial Financial Statements were reliable, the six material weaknesses discussed in the following sections significantly increase the risk that future financial statements and other IRS reports may be materially misstated. The IRS’ general ledger system is not able to routinely generate reliable and timely financial information for internal and external users. The IRS’ general ledger does not capture or otherwise produce the information to be reported in the Statement of Custodial Assets and Liabilities; classify revenue receipts activity by type of tax at the detail transaction level to support IRS’ Statement of Custodial Activity and to make possible the accurate distribution of excise tax collections to the appropriate trust funds; use the standard federal accounting classification structure to produce some of the basic documents needed for the preparation of financial statements in the required formats, such as trial balances; and provide a complete audit trail for recorded transactions. As a result of these deficiencies, IRS is unable to rely on its general ledger to support its financial statements, which is a core purpose of a general ledger. These problems also prevent IRS from producing financial statements on a monthly or quarterly basis as a management tool, which is standard practice in private industry and some federal entities. The U.S. Government Standard General Ledger (SGL) establishes the general ledger account structure for federal agencies as well as the rules for agencies to follow in recording financial events. Implementation of the SGL is called for by the Core Financial System Requirements of the Joint Financial Management Improvement Program (JFMIP), and is required by the Office of Management and Budget (OMB) in its Circular A-127, Financial Management Systems. Implementation of financial management systems that comply with the SGL at the transaction level is also required by FFMIA. However, because of the problems discussed above, IRS’ general ledger does not comply with these requirements. As we previously reported, IRS’ general ledger was not designed to support financial statement preparation. To compensate for this deficiency, IRS utilizes specialized computer programs to extract information from its master files—its only detailed database of taxpayer information—to derive amounts to be reported in the financial statements. However, the amounts produced by this approach needed material audit adjustments to the Statement of Custodial Assets and Liabilities to produce reliable financial statements. Although we were able to verify that the adjusted balances were reliable as of and for the fiscal year ended September 30, 1997, this approach cannot substitute for a properly designed and implemented general ledger as a tool to account for and report financial transactions on a routine basis throughout the year. As we have reported in our previous financial audits, IRS does not have a detailed listing, or subsidiary ledger, which tracks and accumulates unpaid assessments on an ongoing basis. To compensate for the lack of a subsidiary ledger, IRS runs computer programs against its master files to identify and classify the universe of unpaid assessments. However, this approach required numerous audit adjustments to produce reliable balances. The lack of a detailed subsidiary ledger impairs IRS’ ability to effectively manage the unpaid assessments. For example, IRS’ current systems precluded it from ensuring that all parties liable for certain assessments get credit for payments made on those assessments. Specifically, payments made on unpaid payroll tax withholdings for a troubled company, which can be collectible from multiple individuals, are not always credited to each responsible party to reflect the reduction in their tax liability. In 53 of 83 cases we reviewed involving multiple individuals and companies, we found that payments were not accurately recorded to reflect the reduction in the tax liability of each responsible party. In one case we reviewed, three individuals had multimillion dollar tax liability balances, as well as liens placed against their property, even though the tax had been fully paid by the company. While we were able to determine that the amounts reported in the fiscal year 1997 financial statements pertaining to taxes receivable, a component of unpaid assessments, were reliable, this was only after significant adjustments totaling tens of billions of dollars were made. The extensive reliance IRS must place on ad hoc procedures significantly increases the risk of material misstatement of unpaid assessments and/or other reports issued by IRS in the future. A proper subsidiary ledger for unpaid assessments, as recommended by the JFMIP Core Financial Systems Requirements, is necessary to provide management with complete, up-to-date information about the unpaid assessments due from each taxpayer, so that managers will be in a position to make informed decisions about collection efforts and collectibility estimates. This requires a subsidiary ledger that makes readily available to management the amount, nature, and age of all unpaid assessments outstanding by tax liability and taxpayer, and that can be readily and routinely reconciled to corresponding general ledger balances for financial reporting purposes. Such a system should also track and make available key information necessary to assess collectibility, such as account status, payment and default history, and installment agreement terms. In our audit of IRS’ fiscal year 1996 Custodial Financial Statements, we reported that IRS could not locate sufficient supporting documentation to (1) enable us to evaluate the existence and classification of unpaid assessments or (2) support its classification of reported revenue collections and refunds paid. During our fiscal year 1997 audit, IRS was able to locate and provide sufficient supporting documentation for fiscal year 1997 revenue and refund transactions we tested. However, IRS continued to experience significant problems locating and providing supporting documentation for unpaid assessments, primarily due to the age of the items. Documentation for transactions we reviewed, such as tax returns or installment agreements, had often been destroyed in accordance with IRS record retention policies or could not be located. In addition, the documentation IRS provided did not always include useful information, such as appraisals, asset searches, and financial statements. For example, estate case files we reviewed generally did not include audited financial statements or an independent appraisal of the estate’s assets, information that would greatly assist in determining the potential collectibility and potential underreporting of these cases. Additionally, the lack of documentation made it difficult to assess the classification and collectibility of unpaid assessments reported in the financial statements as federal tax receivables. Through our audit procedures, we were able to verify the existence and proper classification of unpaid assessments and obtain reasonable assurance that reported balances were reliable. However, this required material audit adjustments to correct misstated unpaid assessment balances identified by our testing. IRS did not have sufficient preventive controls over refunds to assure that inappropriate payments for tax refunds are not disbursed. Such inappropriate payments have taken the form of refunds improperly issued or inflated, which IRS did not identify because of flawed verification procedures, or fraud by IRS employees. For example, we found three instances where refunds were paid for inappropriate amounts. This occurred because IRS does not compare tax returns to the attached W-2s (Wage and Tax Statements) at the time the returns are initially processed, and consequently did not detect a discrepancy with pertinent information on the tax return. As we have reported in prior audits, such inconsistencies generally go undetected until such time as IRS completes its document matching program, which can take as long as 18 months. In addition, during fiscal year 1997, IRS identified alleged employee embezzlement of refunds totaling over $269,000. IRS is also vulnerable to issuance of duplicate refunds made possible by gaps in IRS’ controls. IRS reported this condition as a material weakness in its fiscal year 1997 FIA report. The control weaknesses over refunds are magnified by significant levels of invalid Earned Income Credit (EIC) claims. IRS recently reported that during the period January 1995 through April 1995, an estimated $4.4 billion (25 percent) in EIC claims filed were invalid. This estimate does not reflect actual disbursements made for refunds involving EIC claims. However, it provides an indication of the magnitude of IRS’ and the federal government’s exposure to losses resulting from weak controls over refunds. While we were able to substantiate the amounts disbursed as refunds as reported on the fiscal year 1997 Custodial Financial Statements, IRS needs to have effective preventive controls in place to ensure that the federal government does not incur losses due to payment of inappropriate refunds. Once an inappropriate refund has been disbursed, IRS is compelled to expend both the time and expense to attempt to recover it, with dubious prospect of success. IRS is unable to currently determine the specific amount of revenue it actually collected for the Social Security, Hospital Insurance, Highway, and other relevant trust funds. As we previously reported, the primary reason for this weakness is that the accounting information needed to validate the taxpayer’s liability and record the payment to the proper trust fund is not provided at the time that taxpayers remit payments. Information is provided on the tax return, which can be received as late as 9 months after a payment is submitted. However, the information on the return only pertains to the amount of the tax liability, not the distribution of the amounts previously collected. As a result, IRS cannot report actual revenue collected for Social Security, Hospital Insurance, Highway, and other trust funds on a current basis nor can it accurately report revenue collected for individuals. Because of this weakness, IRS had to report Federal Insurance Contributions Act (FICA) and individual income tax collections in the same line item on its Statement of Custodial Activity for fiscal year 1997. However, requirements for the form and content of governmentwide financial statements require separate reporting of Social Security, Hospital Insurance, and individual income taxes collected. Beginning in fiscal year 1998, federal accounting standards will also require this reporting. Taxes collected by IRS on behalf of the federal government are deposited in the general revenue fund of the Department of the Treasury (Treasury), where they are subsequently distributed to the appropriate trust funds. Amounts representing Social Security and Hospital Insurance taxes are distributed to their respective trust funds based on information certified by the Social Security Administration (SSA). In contrast, for excise taxes, IRS certifies the amounts to be distributed based on taxes assessed, as reflected on the relevant tax forms. However, by law, distributions of excise taxes are to be based on taxes actually collected. The manner in which both FICA and excise taxes are distributed creates a condition in which the federal government’s general revenue fund subsidizes the Social Security, Hospital Insurance, Highway, and other trust funds. The subsidy occurs primarily because a significant number of businesses that file tax returns for Social Security, Hospital Insurance, and excise taxes ultimately go bankrupt or otherwise go out of business and never actually pay the assessed amounts. Additionally, with respect to Social Security and Hospital Insurance taxes, a significant number of self-employed individuals also do not pay the assessed amounts. While the subsidy is not necessarily significant with respect to excise taxes, it is significant for Social Security and Hospital Insurance taxes. At September 30, 1997, the estimated amount of unpaid taxes and interest in IRS’ unpaid assessments balance was approximately $44 billion for Social Security and Hospital Insurance, and approximately $1 billion for excise taxes. While these totals do not include amounts no longer in the unpaid assessments balance due to the expiration of the statutory collection period, they nevertheless give an indication of the cumulative amount of the subsidy. IRS places extensive reliance on computer systems to process tax returns, maintain taxpayer data, calculate interest and penalties, and generate refunds. Consequently, it is critical that IRS maintain adequate internal controls over these systems. We previously reported that IRS had serious weaknesses in the controls used to safeguard its computer systems, facilities, and taxpayer data. Our review of these controls as part of our audit of IRS’ fiscal year 1997 Custodial Financial Statements found that although many improvements have been made, overall controls continued to be ineffective. IRS’ controls over automated systems continued to exhibit serious weaknesses in (1) physical security, (2) logical security, (3) data communications management, (4) risk analysis, (5) quality assurance, (6) internal audit and security, and (7) contingency planning. Weaknesses in these areas can allow unauthorized individuals access to critical hardware and software where they may intentionally or inadvertently add, alter, or delete sensitive data or programs. IRS recognized these weaknesses in its fiscal year 1997 FIA report and has corrected a significant number of the computer security weaknesses identified in our previous reports. Additionally, IRS has centralized responsibility for security and privacy issues and added staff in this area. IRS is implementing plans to mitigate the remaining weaknesses by June 1999. In our fiscal year 1997 audit, we were able to verify the accuracy of the financial statement balances and disclosures originating in whole or in part from automated systems primarily through review and testing of supporting documentation. However, the absence of effective internal controls over IRS’ automated systems makes IRS vulnerable to losses, delays or interruptions in service, and compromising of the sensitive information entrusted to IRS by taxpayers. In addition to the material weaknesses discussed above, we identified one reportable condition that although not a material weakness, represents a significant deficiency in the design or operation of internal controls and could adversely affect IRS’ ability to meet the internal control objectives described in this report. This condition concerns weaknesses in IRS’ controls over its manually processed tax receipts. IRS’ controls over the receipt of cash and checks it manually receives from taxpayers are not adequate to assure that these payments will be properly credited to taxpayer accounts and deposited in the Treasury. To ensure that appropriate security over these receipts is maintained, IRS requires that lock box depositories receiving payments on its behalf use a surveillance camera to monitor staff when they open mail containing cash and checks. However, we found that payments received at the four IRS service centers where we tested controls over manual cash receipts were not subject to comparable controls. We found at these locations that (1) IRS allowed individuals to open mail unobserved, and relied on them to accurately report amounts received, and (2) payments received were not logged or otherwise recorded at the point of receipt to immediately establish accountability and thereby deter and detect diversion. In addition, at one service center, we observed payments being received by personnel who should not have been authorized to accept receipts. As a result of these weaknesses, IRS is vulnerable to losses of cash and checks received from taxpayers in payment of taxes due. In fact, between 1995 and 1997, IRS identified instances of actual or alleged employee embezzlement of receipts totaling about $4.6 million. These actual and alleged embezzlements underscore the need for effective internal controls over the IRS’ service center receipts process. Our tests of compliance with selected provisions of laws and regulations disclosed one instance of noncompliance that is reportable under generally accepted government auditing standards and OMB Bulletin 93-06 Audit Requirements for Federal Financial Statements. This concerns IRS’ noncompliance with a provision of the Internal Revenue Code concerning certification of excise taxes. We also noted that IRS’ financial management systems do not substantially comply with the requirements of FFMIA, which is reportable under OMB Bulletin 98-04. IRS policies and procedures for certification to Treasury of the distribution of the excise tax collections to the designated trust funds do not comply with the Internal Revenue Code. The Code requires IRS to certify the distribution of these excise tax collections to the recipient trust funds based on actual collections. However, as we have reported previously,and as discussed earlier in this report, IRS based its certifications of excise tax amounts to be distributed to specific trust funds on the assessed amount, or amount owed, as reflected on the tax returns filed by taxpayers. IRS has studied various options to enable it to make final certifications of amounts to be distributed based on actual collections and to develop the underlying information needed to support such certifications. IRS was in the process of finalizing its proposed solution at the conclusion of our fiscal year 1996 audit; however, through the end of our fiscal year 1997 audit, IRS still had not implemented its proposed solution. For example, in December 1997, IRS certified the third quarter of fiscal year 1997 based on assessments rather than collections. As the auditor of IRS’ Custodial Financial Statements, we are reporting under FFMIA on whether IRS’ financial management systems substantially comply with the Federal Financial Management System Requirements (FFMSR), applicable federal accounting standards, and the SGL at the transaction level. As indicated by the material weaknesses we discussed earlier, IRS’ systems do not substantially comply with these requirements. For example, as noted previously, IRS does not have a general ledger that conforms with the SGL. Additionally, IRS lacks a subsidiary ledger for its unpaid assessments, and lacks an effective audit trail from its general ledger back to transaction source documents. These are all requirements under FFMSR. The other three material weaknesses we discussed above—controls over refunds, revenue accounting and reporting, and computer security—also are conditions indicating that IRS’ systems do not comply with FFMSR. In addition, the material weaknesses we noted above mean that IRS’ systems cannot produce reliable financial statements and related disclosures that conform with applicable federal accounting standards. Since IRS’ systems do not comply with FFMSR, applicable federal accounting standards, and the SGL, they also do not comply with OMB Circular A-127, Financial Management Systems. We have previously reported on many of these issues and made recommendations for corrective actions. IRS has drafted a plan of action intended to incrementally improve its financial reporting capabilities, which is scheduled to be fully implemented during fiscal year 1999. This plan is intended to bring IRS’ general ledger into conformance with the SGL and would be a step toward compliance with FFMSR. However, the plan falls short of fully meeting FFMSR requirements. For example, the plan will not provide for (1) full traceability of information through its systems (i.e., lack of an audit trail), (2) a subsidiary ledger to assist in distinguishing federal tax receivables from other unpaid assessments, and (3) reporting of revenue by tax type. As discussed later in this report, the latter example has implications for IRS’ ability to meet certain federal accounting standards required to be implemented in fiscal year 1998. IRS also has a longer-range plan to address the financial management system deficiencies noted in prior audits and in IRS’ own self-assessment. During future audits, we will monitor IRS’ implementation of these initiatives, and assess their effectiveness in resolving the material weaknesses discussed in this report. In addition to the material weaknesses and other reportable conditions and noncompliance with laws and regulations and FFMIA requirements discussed in the previous sections, we identified two other significant matters that we believe should be brought to the attention of IRS management and other users of IRS’ financial statements and other financial reports. These concern (1) the composition and collectibility of IRS’ unpaid assessments and (2) the importance of IRS successfully preparing its automated systems for the year 2000. As reflected in the supplemental information to IRS’ fiscal year 1997 Custodial Financial Statements, the unpaid assessments balance was about $214 billion as of September 30, 1997. This unpaid assessments balance has historically been referred to as IRS’ taxes receivable or accounts receivable. However, a significant portion of this balance is not considered a receivable. Also, a substantial portion of the amounts considered receivables is largely uncollectible. Under federal accounting standards, unpaid assessments require taxpayer or court agreement to be considered federal taxes receivable. Assessments not agreed to by taxpayers or the courts are considered compliance assessments and are not considered federal taxes receivable. Assessments with little or no future collection potential are called write-offs. Figure 1 depicts the components of the unpaid assessments balance as of September 30, 1997. Taxes Receivable - Uncollectible ($62) Compliance Assessments ($48) Of the $214 billion balance of unpaid assessments, $76 billion represents write-offs. Write-offs principally consist of amounts owed by bankrupt or defunct businesses, including many failed financial institutions resolved by the Federal Deposit Insurance Corporation (FDIC) and the former Resolution Trust Corporation (RTC). As noted above, write-offs have little or no future collection potential. In addition, $48 billion of the unpaid assessments balance represents amounts that have not been agreed to by either the taxpayer or a court. Due to the lack of agreement, these compliance assessments are likely to have less potential for future collection than those unpaid assessments that are considered federal taxes receivable. The remaining $90 billion of unpaid assessments represent federal taxes receivable. About $62 billion (70 percent) of this balance is estimated to be uncollectible due primarily to the taxpayer’s economic situation, such as individual taxpayers who are unemployed or have other financial problems. However, IRS may continue collection action for 10 years after the assessment or longer under certain conditions. Thus these accounts may still ultimately have some collection potential if the taxpayer’s economic condition improves. About $28 billion, or about 30 percent, of federal taxes receivable is estimated to be collectible. Components of the collectible balance include installment agreements with estates and individuals, as well as relatively newer amounts due from individuals and businesses who have a history of compliance. It is also important to note that of the unpaid assessments balance, about $136 billion (over 60 percent) represents interest and penalties, as depicted in figure 2, which are largely uncollectible. Interest and Penalties ($136) Interest and penalties are such a high percentage of the balance because IRS continues to accrue them through the 10-year statutory collection date, regardless of whether an account meets the criteria for financial statement recognition or has any collection potential. For example, interest and penalties continue to accrue on write-offs, such as FDIC and RTC cases, as well as on exam assessments where the taxpayers have not agreed to the validity of the assessments. The overall growth in unpaid assessments during fiscal year 1997 was wholly attributable to the accrual of interest and penalties. It is critical that IRS successfully prepare its automated systems in order to overcome the potential problems associated with the year 2000. The Year 2000 problem is rooted in the way dates are recorded and calculated in many computer systems. For the past several decades, systems have typically used two digits to represent the year in order to conserve on electronic data storage and reduce operating costs. With this two-digit format, however, the year 2000 is indistinguishable from the year 1900. As a result, system or application programs that use dates to perform calculations, comparisons, or sorting may generate incorrect results when working with years after 1999. IRS has underway one of the largest conversion efforts in the civilian sector. IRS has established a schedule to renovate its automated systems in five segments, with all renovation efforts scheduled for completion by January 1999 in order to allow a full year of operational testing. However, with less than 2 years remaining until the year 2000 arrives, the task of completing the conversion on time is formidable. If IRS is unable to make its automated systems Year 2000 compliant, IRS could be rendered unable to properly process tax returns, issue refunds, correctly calculate interest and penalties, effectively collect taxes, or prepare accurate financial statements and other financial reports. We are working with the Congress and the executive branch to monitor progress made by federal agencies and identify specific recommendations for resolving the Year 2000 problem, which we reported as a governmentwide high risk area and which the President has designated as a priority management objective. In addition to the weaknesses discussed above, we noted other, less significant matters involving IRS’ system of accounting controls and its operations which we will be reporting separately to IRS. The Custodial Financial Statements, including the accompanying notes, present fairly, in all material respects, and in conformity with a comprehensive basis of accounting other than generally accepted accounting principles, as described in note 1, IRS’ custodial assets and liabilities and custodial activity. Although the weaknesses described above precluded IRS’ internal controls from achieving the internal control objectives discussed previously, we were nevertheless able to obtain reasonable assurance that the Custodial Financial Statements were reliable through the use of substantive audit procedures. However, misstatements may nevertheless occur in other financial information reported by IRS as a result of the internal control weaknesses described above. As discussed in the notes to the fiscal year 1997 Custodial Financial Statements, IRS has attempted, to the extent practical, to implement early the provisions of Statement of Federal Financial Accounting Standards (SFFAS) No. 7, Accounting for Revenue and Other Financing Sources and Concepts for Reconciling Budgetary and Financial Accounting. SFFAS No. 7 is not effective until fiscal year 1998. However, the requirement that this standard be fully implemented in fiscal year 1998 has significant implications for IRS and its fiscal year 1998 Custodial Financial Statements. The significant internal control and system weaknesses discussed earlier may affect IRS’ ability to implement this standard until corrective actions have fully resolved these weaknesses. For example, as discussed earlier, IRS currently does not capture information at the time of receipt of payments from the taxpayer on how such payments are to be applied to the various trust funds. Consequently, IRS is presently unable to report collections of tax revenue by specific tax type as envisioned in SFFAS No. 7 and OMB’s Format and Instructions for the Form and Content of the Financial Statements of the U.S. Government (September 2, 1997). Other provisions of SFFAS No. 7 will also be difficult for IRS to implement in the short term until the significant internal control and systems issues reported in prior audits and discussed above are resolved. We evaluated IRS management’s assertion about the effectiveness of its internal controls designed to safeguard assets against loss from unauthorized acquisition, use, or assure the execution of transactions in accordance with laws governing the use of budget authority and other laws and regulations that have a direct and material effect on the Custodial Financial Statements or are listed in OMB audit guidance and could have a material effect on the Custodial Financial Statements; and properly record, process, and summarize transactions to permit the preparation of reliable financial statements and to maintain accountability for assets. IRS management asserted that except for the material weaknesses in internal controls presented in the agency’s fiscal year 1997 FIA report on compliance with the internal control and accounting standards, internal controls provided reasonable assurance that the above internal control objectives were satisfied during fiscal year 1997. Management made this assertion based upon criteria established under FIA and OMB Circular A-123, Management Accountability and Control. Our internal control work would not necessarily disclose material weaknesses not reported by IRS. However, we believe that IRS’ internal controls, taken as a whole, were not effective in satisfying the control objectives discussed above during fiscal year 1997 because of the severity of the material weaknesses in internal controls described in this report, which were also cited by IRS in its fiscal year 1997 FIA report. Except as noted above, our tests of compliance with selected provisions of laws and regulations disclosed no other instances of noncompliance which we consider to be reportable under generally accepted government auditing standards or OMB Bulletin 93-06. Under FFMIA and OMB Bulletin 98-04, our tests disclosed, as discussed above, that IRS’ financial management systems do not substantially comply with the requirements for the following: federal financial management systems, applicable federal accounting standards, and the U.S. Government Standard General Ledger at the transaction level. However, the objective of our audit was not to provide an opinion on overall compliance with laws, regulations, and FFMIA requirements tested. Accordingly, we do not express such an opinion. IRS’ overview and supplemental information contain various data, some of which are not directly related to the Custodial Financial Statements. We do not express an overall opinion on this information. However, we compared this information for consistency with the Custodial Financial Statements and, based on our limited work, found no material inconsistencies. preparing the annual Custodial Financial Statements in conformity with the basis of accounting described in note 1; establishing, maintaining, and assessing internal controls to provide reasonable assurance that the broad control objectives of FIA are met; and complying with applicable laws and regulations and FFMIA requirements. We are responsible for obtaining reasonable assurance about whether (1) the Custodial Financial Statements are reliable (free of material misstatements and presented fairly, in all material respects, in conformity with the basis of accounting described in note 1), and (2) management’s assertion about the effectiveness of internal controls is fairly stated, in all material respects, based upon criteria established under the Federal Managers’ Financial Integrity Act of 1982 and OMB Circular A-123, Management Accountability and Control. We are also responsible for testing compliance with selected provisions of laws and regulations, for reporting on compliance with FFMIA requirements, and for performing limited procedures with respect to certain other information appearing in these annual Custodial Financial Statements. In order to fulfill these responsibilities, we examined, on a test basis, evidence supporting the amounts and disclosures in the Custodial Financial Statements; assessed the accounting principles used and significant estimates made by management in the preparation of the Custodial Financial Statements; evaluated the overall presentation of the Custodial Financial Statements; obtained an understanding of internal controls related to safeguarding assets, compliance with laws and regulations, including execution of transactions in accordance with budget authority and financial reporting; tested relevant internal controls over safeguarding, compliance, and financial reporting and evaluated management’s assertion about the effectiveness of internal controls; tested compliance with selected provisions of the following laws and regulations: Internal Revenue Code (appendix I), Debt Collection Act, as amended {31 U.S.C. § 3720A}, Government Management Reform Act of 1994 {31 U.S.C. § 3515, 3521 (e)-(f)}, and Federal Managers’ Financial Integrity Act of 1982 {31 U.S.C. § 3512(d)}; tested whether IRS’ financial management systems substantially comply with the requirements of the Federal Financial Management Improvement Act of 1996, including Federal Financial Management Systems Requirements, applicable federal accounting standards, and the U.S. Government Standard General Ledger at the transaction level. We did not evaluate all internal controls relevant to operating objectives as broadly defined by FIA, such as those controls relevant to preparing statistical reports and ensuring efficient operations. We limited our internal control testing to those controls necessary to achieve the objectives outlined in our opinion on management’s assertion about the effectiveness of internal controls. As the auditor of IRS’ Custodial Financial Statements, we are reporting under FFMIA on whether the agency’s financial management systems substantially comply with the Federal Financial Management Systems Requirements, applicable federal accounting standards, and the U.S. Government Standard General Ledger at the transaction level. In making this report, we considered the implementation guidance for FFMIA issued by OMB on September 9, 1997. The IRS’ Custodial Financial Statements do not reflect the potential impact of any excess of taxes due in accordance with the Internal Revenue Code, over taxes actually assessed by IRS, often referred to as the “tax gap.” SFFAS No. 7 specifically excludes the “tax gap” from financial statement reporting requirements. Consequently, the Custodial Financial Statements do not consider the impact of the tax gap. We performed our work in accordance with generally accepted government auditing standards and OMB Bulletin 93-06. In commenting on a draft of this report, IRS stated that it generally agreed with the findings and conclusions in the report. IRS acknowledged the internal control weaknesses and noncompliance with laws and regulations we cited, and discussed initiatives underway to address many of the issues raised in the report. We will evaluate the effectiveness of IRS’ corrective actions as part of our audit of IRS’ fiscal year 1998 Custodial Financial Statements. However, we do not agree with IRS’ assertion that it needs a change in legislation to obtain information from taxpayers at the time of remittance to properly allocate excise tax payments to the various trust funds. We recognize that resolution of many of these issues could take several years. IRS agreed with our conclusion that its financial management systems do not comply with the Federal Financial Management Systems Requirements and the U.S. Government Standard General Ledger requirements of the Federal Financial Management Improvement Act of 1996. However, IRS believes that its current accounting and financial reporting process complies with applicable federal accounting standards. OMB’s September 9, 1997, memorandum on implementation guidance for FFMIA specifies two indicators that must be present to indicate compliance with federal accounting standards. First, the agency generally should receive an unqualified opinion on its financial statements. Second, there should be no material weaknesses in internal controls that affect the agency’s ability to prepare auditable financial statements and related disclosures. As we reported, IRS received an unqualified opinion on its financial statements. However, as discussed in this report, we identified six material weaknesses in IRS’ internal controls. As a result of these weaknesses, IRS’ financial management systems are unable to produce reliable financial statements and related disclosures without extensive ad hoc procedures and tens of billions of dollars in adjustments. Consequently, IRS’ financial management systems are not in compliance with applicable federal accounting standards requirements. IRS’ written comments are included in appendix II. Thomas Armstrong, Assistant General Counsel Andrea Levine, Attorney The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a legislative requirement, GAO examined the Internal Revenue Service's (IRS) custodial financial statements for fiscal year (FY) ending September 30, 1997. GAO noted that: (1) the IRS custodial financial statements were reliable in all material respects; (2) IRS management's assertion about the effectiveness of internal controls stated that except for the material weaknesses in internal controls presented in the agency's FY 1997 Federal Managers' Financial Integrity Act (FIA) report, internal controls were effective in satisfying the following objectives: (a) safeguarding assets from material loss; (b) assuring material compliance with laws governing the use of budget authority and with other relevant laws and regulations; and (c) assuring that there were no other material misstatements in the custodial financial statements; (3) however, GAO found that IRS' internal controls, taken as a whole, were not effective in satisfying these objectives; (5) due to the severity of the material weaknesses in IRS' financial accounting and reporting controls, all of which were reported in IRS' FY 1997 FIA report, extensive reliance on ad hoc programming and analysis was needed to develop financial statement line item balances, and the resulting amounts needed material audit adjustments to produce reliable custodial financial statements; and (6) one reportable noncompliance with selected provisions of laws and regulations GAO tested, and that IRS' financial management systems do not substantially comply with the requirements of the Federal Financial Management Improvement Act of 1996.