Internal control is not one event, but a series of activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be recognized as an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires agencies to establish and maintain internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, provides the implementing guidance for FMFIA, and sets out the specific requirements for assessing and reporting on internal controls consistent with the internal control standards issued by the Comptroller General of the United States. The circular defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control in its performance and accountability report, and for each of the 24 Chief Financial Officers Act agencies to include a separate assurance on internal control over financial reporting, along with a report on identified material weaknesses and corrective actions. The circular also emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control-related activities. FMFIA requires GAO to issue standards for internal control in the federal government. The Standards for Internal Control in the Federal Government (i.e., internal control standards) provides the overall framework for establishing and maintaining effective internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in the internal control standards, internal control in the government is defined by the following five elements, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communications: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance that IRS maintained effective internal controls with respect to financial reporting, including safeguarding of assets, and compliance with laws and regulations. While we use all five elements of internal control as a basis for evaluating the effectiveness of IRS’s internal controls, our ongoing evaluations and tests have focused heavily on control activities to identify internal control weaknesses and offer recommendations for corrective action. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that are intended to accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. As such, control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. To accomplish our objectives, we evaluated the effectiveness of corrective actions IRS implemented during fiscal year 2008 in response to open recommendations as part of our fiscal years 2008 and 2007 financial audits. To determine the current status of the recommendations, we (1) obtained IRS’s reported status of each recommendation and corrective action taken or planned as of April 2009, (2) compared IRS’s reported status to our fiscal year 2008 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation, and (3) performed additional follow-up work regarding IRS’s actions taken to address the open recommendations. In order to determine how these recommendations fit within IRS’s management and internal control structure, we compared the open recommendations and the issues that gave rise to them, to the control activities listed in the internal control standards and to the list of major factors and examples outlined in our Internal Control Management and Evaluation Tool. We also considered how the recommendations and the underlying issues were categorized in our prior reports; whether IRS had addressed, in whole or in part, the underlying control issues that gave rise to the recommendations; and other legal requirements and implementing guidance, such as OMB Circular No. A-123; FMFIA; and the Federal Information System Controls Audit Manual (FISCAM). Our work was performed from December 2008 through May 2009 in accordance with generally accepted government auditing standards. Further details on our audit scope and methodology are included in our report on the results of our audits of IRS’s fiscal years 2008 and 2007 financial statements. We requested comments on a draft of this report from the Commissioner of Internal Revenue or his designee on May 26, 2009. We received comments from the Commissioner on June 11, 2009. We have reprinted IRS’s written comments in appendix III. IRS continues to make progress addressing its significant financial management challenges. Over the years since we first began auditing IRS’s financial statements in fiscal year 1992, IRS has taken actions that enabled us to close over 200 of our financial management-related recommendations. This includes 35 recommendations we are closing based on actions IRS took during the period covered by our fiscal year 2008 financial audit. At the same time, however, our audits continue to identify additional internal control issues, resulting in further recommendations for corrective action, including 16 new financial management-related recommendations resulting from our fiscal year 2008 financial audit. These internal control issues, and the resulting recommendations, can be directly traced to the control activities in the internal control standards. As such, it is essential that they be fully addressed and resolved to strengthen IRS’s overall financial management to efficiently and effectively achieve its goals and mission. In July 2008, we issued a report on the status of IRS’s efforts to implement corrective actions to address financial management recommendations stemming from our fiscal year 2007 and prior year financial audits and other financial management-related work. In that report, we identified 81 audit recommendations that remained open and thus required corrective action by IRS. A significant number of these recommendations had been open for several years, either because IRS had not taken corrective action or because the actions taken had not yet effectively resolved the issues that gave rise to the recommendations. IRS continued to work to address many of the internal control issues to which these open recommendations relate. In the course of performing our fiscal year 2008 financial audit, we identified numerous actions IRS took to address many of its internal control issues. On the basis of IRS’s actions, which we were able to substantiate through our audit, we are able to close 35 of these prior years’ recommendations. IRS considers another 18 of the prior years’ recommendations to be effectively addressed. However, we still consider them to be open either because we have not yet been able to verify the effectiveness of IRS’s actions or because, in our view, the actions taken did not fully address the issue that gave rise to the recommendation. Forty-six recommendations from prior years remain open, a significant number of which have been outstanding for several years. During our audit of IRS’s fiscal year 2008 financial statements, we identified additional issues that require corrective action. In a recent management report to IRS, we discussed these issues, and made 16 new recommendations to address them. Consequently, 62 financial management-related recommendations need to be addressed. While most of these can be addressed in the short term, a few, particularly those concerning IRS’s automated systems, are complex and will require several more years to fully and effectively address. We consider 52 recommendations to be short-term and 10 to be long-term. In addition to the 62 open recommendations from our financial audits and other financial management-related work, there are 74 open recommendations stemming from our assessment of IRS’s information security controls over key financial systems, information, and interconnected networks. Those 74 primarily relate to lack of an agencywide information security program, which was a key reason for the material weakness in IRS’s information systems security controls over its financial and tax processing systems. Unresolved, previously reported recommendations and newly identified recommendations related to information security increase the risk of unauthorized disclosure, modification, or destruction of financial and sensitive taxpayer data. Recommendations resulting from the information security issues identified in our annual audits of IRS’s financial statements are reported separately because of the sensitive nature of these issues. Appendix I presents a list of (1) the 81 recommendations based on our financial statement audits and other financial management-related work that we had not previously reported as closed, (2) IRS-reported corrective actions taken or planned as of April 2009, and (3) our analysis of whether the issues that gave rise to the recommendations have been effectively addressed based primarily on the work performed during our fiscal year 2008 financial statement audit. Appendix I includes recommendations based on our fiscal year 2008 financial statement audit. The appendix lists the recommendations by the date on which the recommendation was made and by report number. Appendix II presents the open recommendations arranged by related material weakness, significant deficiency, compliance issue, or other control issue as described in our opinion report on IRS’s financial statements. Linking the open recommendations from our financial audits and other financial management-related work, and the issues that gave rise to them, to internal control activities that are central to IRS’s tax administration responsibilities provides insight regarding their significance. The internal control standards define 11 control activities grouped into three broad categories as shown in table 1. The open recommendations from our financial audits and financial management-related work, and the underlying issues that gave rise to them, can be traced to one of the control activities. As table 1 indicates, 20 recommendations (32 percent) relate to issues associated with IRS’s lack of effective controls over safeguarding of assets and security activities. Another 24 recommendations (39 percent) relate to issues associated with IRS’s inability to properly record and document transactions. The remaining 18 open recommendations (29 percent) relate to issues associated with the lack of effective management review and oversight. On the following pages, we group the 62 open recommendations under the control activity to which the condition that gave rise to them most appropriately fits. We first define each control activity as presented in the internal control standards and briefly identify some of the key IRS operations that fall under that control activity. Although not comprehensive, the descriptions are intended to help explain why actions to strengthen these control activities are important for IRS to efficiently and effectively carry out its overall mission. For each recommendation, we also indicate whether it is a short-term or long-term recommendation. For those characterized as short-term, we believe that IRS has the capability to implement solutions within 2 years. Given IRS’s mission, the sensitivity of the data it maintains, and its processing of trillions of dollars of tax receipts each year, one of the most important control activities at IRS is the safeguarding of assets. Internal control in this important area should be designed to provide reasonable assurance regarding prevention or prompt detection of unauthorized acquisition, use, or disposition of an agency’s assets. We have grouped together the four control activities in the internal control standards that relate to safeguarding of assets (including tax receipts) and security activities (such as limiting access to only authorized personnel): (1) physical control over vulnerable assets, (2) segregation of duties, (3) controls over information processing, and (4) access restrictions to and accountability for resources and records. Internal control standard: An agency must establish physical control to secure and safeguard vulnerable assets. Examples include security for and limited access to assets such as cash, securities, inventories, and equipment which might be vulnerable to risk of loss or unauthorized use. Such assets should be periodically counted and compared to control records. IRS collects trillions of dollars in taxes each year, a significant amount of which is collected in the form of checks and cash accompanied by tax returns and related information. IRS collects taxes both at its own facilities as well as at lockbox banks that operate under contract with the Department of the Treasury’s (Treasury) Financial Management Service. IRS acts as custodian for (1) the tax payments it receives until they are deposited in the General Fund of the U.S. Treasury and (2) the tax returns and related information it receives until they are either sent to the Federal Records Center or destroyed. IRS is also charged with controlling many other assets, such as computers and other equipment, but IRS’s legal responsibility to safeguard tax returns and the confidential information taxpayers provide on tax returns makes the effectiveness of its internal controls with respect to physical security essential. While effective physical safeguards over receipts should exist throughout the year, such safeguards are especially important during the peak tax filing season. Each year during the weeks preceding and shortly after April 15, an IRS service center campus (SCC) or lockbox bank may receive and process daily over 100,000 pieces of mail containing returns, receipts, or both. The dollar value of receipts each SCC and lockbox bank processes increases to hundreds of millions of dollars a day during the April 15 time frame. The following 11 recommendations are designed to improve IRS’s physical controls over vulnerable assets. We consider all of them to be correctable on a short-term basis. (See table 2.) Internal control standard: Key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets. No one individual should control all key aspects of a transaction or event. IRS employees process trillions of dollars of tax receipts each year, of which hundreds of billions are received in the form of cash or checks, and for processing hundreds of billions of dollars in refunds to taxpayers. Consequently, it is critical that IRS maintain appropriate separation of duties to allow for adequate oversight of staff and protection of these vulnerable resources so that no single individual would be in a position of causing an error or irregularity, potentially converting the asset to personal use, and then concealing it. For example, when an IRS field office or lockbox bank receives taxpayer receipts and returns, it is responsible for depositing the cash and checks in a depository institution and forwarding the related information received to an SCC for further processing. In order to adequately safeguard receipts from theft, the person responsible for recording the information from the taxpayer receipts on a voucher should be different from the individual who prepares those receipts for transmittal to the SCC for further processing. Also, for procurement of goods and services, the person who places an order for goods and services should be different from the person who receives the goods and services. Such separation of duties will help to prevent the occurrence of fraud, theft of IRS assets, or both. Implementing the following three recommendations would help IRS improve its separation of duties, which will in turn strengthen its controls over tax receipts and refunds and procurement activities. All are short- term in nature. (See table 3.) Internal control standard: A variety of control activities are used in information processing. Examples include edit checks of data entered, accounting for transactions in numerical sequences, and comparing file totals with control totals. There are two broad groupings of information systems control—general control (for hardware such as mainframe, network, end-user environments) and application control (processing of data within the application software). General controls include entitywide security program planning, management, and backup recovery procedures and contingency and disaster planning. Application controls are designed to help ensure completeness, accuracy, authorization, and validity of all transactions during application processing. IRS relies extensively on computerized systems to support its financial and mission-related operations. To efficiently fulfill its tax processing responsibilities, IRS relies extensively on interconnected networks of computer systems to perform various functions, such as collecting and storing taxpayer data, processing tax returns, calculating interest and penalties, generating refunds, and providing customer service. As part of our annual audits of IRS’s financial statements, we assess the effectiveness of IRS’s information security controls over key financial systems, data, and interconnected networks at IRS’s critical data processing facilities that support the processing, storage, and transmission of sensitive financial and taxpayer data. From that effort over the years, we have identified information security control weaknesses that impair IRS’s ability to ensure the confidentiality, integrity, and availability of its sensitive financial and taxpayer data. As of January 2009, there were 74 open recommendations from our information security work designed to improve IRS’s information security controls. As discussed previously, recommendations resulting from our information security work are reported separately and are not included in this report primarily because of the sensitive nature of these issues. However, the following short-term recommendation is related to systems limitations and IRS’s need to enhance its computer programs. (See table 4.) Internal control standard: Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained. Periodic comparison of resources with the recorded accountability should be made to help reduce the risk of errors, fraud, misuse, or unauthorized alteration. Because IRS deals with a large volume of cash and checks, it is imperative that it maintain strong controls to appropriately restrict access to those assets, the records that track those assets, and sensitive taxpayer information. Although IRS has a number of both physical and information systems controls in place, some of the issues we have identified in our financial audits over the years pertain to ensuring that those individuals who have direct access to these cash and checks are appropriately vetted before being granted access to taxpayer receipts and information and to ensuring that IRS maintains effective access security control. The following five short-term recommendations were intended to help IRS improve its access restrictions to assets and records. (See table 5.) IRS has a number of internal control issues that relate to recording transactions, documenting events, and tracking the processing of taxpayer receipts or information. We have grouped three control activities together that relate to proper recording and documenting of transactions: (1) appropriate documentation of transactions and internal controls, (2) accurate and timely recording of transactions and events, and (3) proper execution of transactions and events. Internal control standard: Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals and may be in paper or electronic form. All documentation and records should be properly managed and maintained. IRS collects and processes trillions of dollars in taxpayer receipts annually both at its own facilities and at lockbox banks under contract to process taxpayer receipts for the federal government. Therefore, it is important that IRS maintain effective controls to ensure that all documents and records are properly and timely recorded, managed, and maintained both at its facilities and at the lockbox banks. IRS must adequately document and disseminate its procedures to ensure that they are available for IRS employees. IRS must also document its management reviews of controls, such as those regarding refunds and returned checks, credit card purchases, and reviews of taxpayer assistance centers (TAC). Finally, to ensure future availability of adequate documentation, IRS must ensure that its systems, particularly those now being developed and implemented, have appropriate capability to trace transactions. Resolving the following nine recommendations would assist IRS in improving its documentation of transactions and internal control procedures. Eight of these recommendations are short-term, and one is long-term. (See table 6.) Internal control standard: Transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from the initiation and authorization through its final classification in summary records. In addition, control activities help to ensure that all transactions are completely and accurately recorded. IRS maintains taxpayer records for tens of millions of taxpayers in addition to maintaining its own financial records. To carry out this responsibility, IRS often has to rely on outdated computer systems or manual work-arounds. Unfortunately, some of IRS’s recordkeeping difficulties we have reported on over the years will not be addressed until it can replace its aging systems, an effort that is long-term and partly depends on future funding. Implementation of the following 12 recommendations would strengthen IRS’s recordkeeping abilities. (See table 7.) Seven of these recommendations are short-term, and 5 are long-term regarding requirements for new systems for maintaining taxpayer records. Several of the recommendations listed deal with financial reporting processes, such as maintaining subsidiary records, recording budgetary transactions, and tracking program costs. Some of the issues that gave rise to several of our recommendations directly affect taxpayers, such as those involving duplicate assessments, errors in calculating and reporting manual interest, errors in calculating penalties, and recovery of trust fund penalty assessments. Seven of these recommendations have remained open at least 5 years and one over 10 years, reflecting the complex nature of the underlying systems issues that must be resolved to fully address some of these issues. Internal control standard: Transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of ensuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. Authorizations should be clearly communicated to managers and employees. Each year, IRS pays out hundreds of billions of dollars in tax refunds, some of which are distributed to taxpayers manually. IRS requires that all manual refunds be approved by designated officials. However, weaknesses in controls for authorizing such refunds expose the federal government to losses because of the issuance of improper refunds. Likewise, the failure to ensure that employees obtain appropriate authorizations to use purchase cards or initiate travel similarly leave the government open to fraud, waste, or abuse. Dealing with the following three short-term recommendations would improve IRS’s controls over its manual refund, travel, and purchase card transactions. (See table 8.) All personnel within IRS have an important role in establishing and maintaining effective internal controls, but IRS’s managers have additional review and oversight responsibilities. Management must set the objectives, put control activities in place, and monitor and evaluate controls to ensure that they are followed. Without adequate monitoring by managers, there is a risk that internal control activities may not be carried out effectively and in a timely manner. We have grouped three control activities related to effective management review and oversight: (1) reviews by management at the functional or activity level, (2) establishment and review of performance measures and indicators, and (3) management of human capital. Although we also include the control activity “top-level reviews of actual performance” in this grouping, we do not have any open recommendations to IRS related to this internal control activity. Internal control standard: Managers need to compare actual performance to planned or expected results throughout the organization and analyze significant differences. IRS employs over 100,000 full-time and seasonal employees. In addition, as discussed earlier, Treasury’s Financial Management Service contracts with banks to process tens of thousands of individual receipts, totaling hundreds of billions of dollars. Management oversight of operations is important at any organization, but is imperative at IRS given its mission. Implementing the following 11 short-term and 2 long-term recommendations would improve IRS’s management oversight of courier services, contractor facilities, penalty calculations, timely release of liens, issuance of manual refunds, and use of appropriated funds. (See table 9.) These recommendations were made because an internal control activity either did not exist or the existing control was not being adequately or consistently applied. Internal control standard: Activities need to be established to monitor performance measures and indicators. These controls could call for comparisons and assessments relating different sets of data to one another so that analyses of the relationships can be made and appropriate actions taken. Controls should also be aimed at validating the propriety and integrity of both organizational and individual performance measures and indicators. IRS’s operations include a vast array of activities encompassing educating taxpayers, processing of taxpayer receipts and data, disbursing hundreds of billions of dollars in refunds to millions of taxpayers, maintaining extensive information on tens of millions of taxpayers, and seeking collection from individuals and businesses that fail to comply with the nation’s tax laws. Within its compliance function, IRS has numerous activities, including identifying businesses and individuals that underreport income, collecting from taxpayers who do not pay taxes, and collecting from those receiving refunds for which they are not eligible. Although IRS has at its peak over 100,000 employees, it still faces resource constraints in attempting to fulfill its duties. It is vitally important for IRS to have sound performance measures to assist it in assessing its performance and targeting its resources to maximize the government’s return on investment. However, in past audits we have reported that IRS did not capture costs at the program or activity level to assist in developing cost-based performance measures for its various programs and activities. As a result, IRS is unable to measure the costs and benefits of its various collection and enforcement efforts to best target its available resources. The following short-term and two long-term recommendations are designed to assist IRS in (1) evaluating its operations, (2) determining which activities are the most beneficial, and (3) establishing a good system for oversight. (See table 10.) These recommendations call for IRS to measure, track, and evaluate the costs, benefits, or outcomes of its operations—particularly with regard to identifying its most cost-effective tax collection activities. Internal control standard: Effective management of an organization’s workforce—its human capital—is essential to achieving results and an important part of internal control. Management should view human capital as an asset rather than a cost. Only when the right personnel for the job are on board and are provided the right training, tools, structure, incentives, and responsibilities is operational success possible. Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs. Qualified and continuous supervision should be provided to ensure that internal control objectives are achieved. Performance evaluation and feedback, supplemented by an effective reward system, should be designed to help employees understand the connection between their performance and the organization’s success. As a part of its human capital planning, management should also consider how best to retain valuable employees, plan for their eventual succession, and ensure continuity of needed skills and abilities. IRS’s operations cover a wide range of technical competencies with specific expertise needed in tax-related matters; financial management; and systems design, development, and maintenance. Because IRS has tens of thousands of employees spread throughout the country, it is imperative that management keeps its guidance up-to-date and its staff properly trained. Putting the following two short-term recommendations into effect would assist IRS in its management of human capital. (See table 11.) For several years, we have reported material weaknesses, significant deficiencies, noncompliance with laws and regulations, and other control issues in our annual financial statement audits and related management reports. To assist IRS in addressing those control issues, appendix II provides summary information regarding the primary issue to which each open recommendation is related. To compile this summary, we analyzed the nature of the open recommendations to relate them to the material weaknesses, significant deficiency, compliance issue, and other control issues not associated with a material weakness or significant deficiency identified as part of our financial statement audit. Increased budgetary pressures and an increased public awareness of the importance of internal control require IRS to carry out its mission more efficiently and more effectively while protecting taxpayers’ information. Sound financial management and effective internal controls are essential if IRS is to efficiently and effectively achieve its goals. IRS has made substantial progress in improving its financial management since its first financial audit, as evidenced by unqualified audit opinions on its financial statements for the past 9 years, resolution of several material internal control weaknesses and significant deficiencies, and actions taken resulting in the closure of hundreds of financial management recommendations. This progress has been the result of hard work by many individuals throughout IRS and sustained commitment of IRS leadership. Nonetheless, more needs to be done to fully address the agency’s continuing financial management challenges. Further efforts are needed to address the internal control deficiencies that continue to exist. Effective implementation of the recommendations we have made and continue to make through our financial audits and related work could greatly assist IRS in improving its internal controls and achieving sound financial management. While we recognize that some actions—primarily those related to modernizing automated systems—will take a number of years to resolve, most of the open recommendations can be addressed in the short term. In commenting on a draft of this report, IRS expressed its appreciation for our acknowledgment of the agency’s progress in addressing its financial management changes as evidenced by our closure of 35 open financial management recommendations from prior GAO reports. IRS also commented that it is committed to implementing appropriate improvements to ensure that it maintains sound financial management practices. We will review the effectiveness of further corrective actions IRS has taken or will take to address all open recommendations as part of our audit of IRS’s fiscal year 2009 financial statements. We are sending copies of this report to the Chairmen and Ranking Members of the Senate Committee on Appropriations; Senate Committee on Finance; Senate Committee on Homeland Security and Governmental Affairs; and Subcommittee on Taxation, IRS Oversight and Long-Term Growth, Senate Committee on Finance. We are also sending copies to the Chairmen and Ranking Members of the House Committee on Appropriations; House Committee on Ways and Means; the Chairman and Vice Chairman of the Joint Committee on Taxation; the Secretary of the Treasury; the Director of OMB; the Chairman of the IRS Oversight Board; and other interested parties. The report is also available at no charge on the GAO Web site at http://www.gao.gov. If you or your staffs have any questions concerning this report, please contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. This appendix presents a list of (1) the 81 recommendations that we had not previously reported as closed, (2) Internal Revenue Service (IRS) reported corrective actions taken or planned as of April 2009, and (3) our analysis of whether the issues that gave rise to the recommendations have been effectively addressed. It also includes recommendations based on our fiscal year 2008 financial statement audit. The appendix lists the recommendations by the date on which the recommendation was made and by report number. Financial Management: Important IRS Revenue Information Is Unavailable or Unreliable (GAO/AIMD-94-22, Dec. 21, 1993) Open. The Deputy Commissioner, Services and Enforcement issued a memorandum in July 2008 emphasizing the need to use training modules and on-site assistance from the Servicewide Interest Program to ensure accurate calculations. Interest- related training was provided to personnel by January 2009, and additional guidance will be issued to Collection field personnel. SB/SE updated Internal Revenue Manual provisions and made upgrades to the commercial software program utilized to compute manual interest. SB/SE is developing a random sampling process to be completed by October 2009 to measure the accuracy of interest computations. Open. During our fiscal year 2006 audit, we tested a statistical sample of manual interest transactions and estimated that 18 percent of IRS’s manual interest population contains errors. We concluded that IRS controls over this area was still ineffective. The ineffectiveness of these controls contributes to errors in taxpayer records, which is a major component of the material weakness in IRS’s management of unpaid assessments. While IRS has undertaken several actions to strengthen controls over this area, such as updating guidance and providing training related to manual interest calculations, it has yet to develop a sampling methodology to monitor the accuracy of its manual interest computation and assess the effectiveness of its corrective actions. Consequently, we did not test IRS controls in this area as part of our fiscal year 2008 audit, as both we and IRS believed that the actions taken by IRS thus far would not improve the accuracy of the manual interest calculations. We will continue to monitor IRS’s actions to address this recommendation during future audits. Internal Revenue Service: Immediate and Long-Term Actions Needed to Improve Financial Management (GAO/AIMD-99-16, Oct. 30, 1998) Open. Small Business/Self- Employed (SB/SE) continues to request programming changes to increase Automated Trust Fund Recovery systemic processing to reduce the number of accounts requiring manual intervention. IRS reviews Trust Fund Recovery Penalty (TFRP) transactions to ensure accurate and timely recording, including Performance Assurance System reviews by a daily random selection of closed cases, management reviews of a random selection of both closed and open casework, and Headquarters Operational Reviews. In addition to the above reviews, Campus Compliance Services is exploring the development and implementation of a statistically valid sampling plan to monitor the accuracy and timeliness of the cross-referencing of payments and credits to TFRP accounts. The frequency and process for performing these internal reviews will be considered during development. Open. IRS has made significant progress in this area over the past several years. For example, IRS established procedures to more clearly link each penalty assessment against a responsible corporate officer to a specific tax period of the business account and began phasing in the use of the Automated Trust Fund Recovery system intended to properly cross- reference payments received. IRS also enhanced the Automated Trust Fund Recovery system in fiscal year 2008 to begin automatically reducing the amounts owed on all related accounts when a payment is received from one related party. However, the system is currently unable to process all payments related to such cases. Consequently, IRS must continue to manually reduce the account balance on related accounts for some payments. Thus, the opportunity for errors and omissions continues to exist. Our most recent test indicates that IRS’s controls in this area are still not effective in ensuring that all TFRP payments are correctly credited to all related parties in a timely manner. We will continue to monitor IRS’s actions to address this recommendation during future audits. Internal Revenue Service: Immediate and Long-Term Actions Needed to Improve Financial Management (GAO/AIMD-99-16, Oct. 30, 1998) Open. IRS is developing the Custodial Detailed Data Base (CDDB), which it believes will ultimately address many of the outstanding financial management recommendations. IRS implemented the first phase of the CDDB during fiscal year 2006. In fiscal year 2008, IRS enhanced CDDB to record unpaid assessments, including accrued penalties and interest in the general ledger by the various financial reporting categories. The Chief Financial Officer’s (CFO) office continues to ensure the accuracy of the TFRP cross- referencing using weekly CDDB reports. The CFO provides SB/SE with identified errors so SB/SE can correct the taxpayers account and CDDB can correctly classify the transactions. CDDB is now classifying approximately 80 percent of the TFRP inventory where TFRP assessments are appropriately tracked for all taxpayers liable but counted only once for reporting purposes. Open. During fiscal year 2008, IRS enhanced CDDB to begin regularly recording unpaid assessments, including accrued penalties and interest, from its master files to its general ledger by the various financial reporting categories (taxes receivable, compliance assessments, and write- offs). These enhancements established CDDB’s capability to function as a subsidiary ledger for unpaid tax debt. However, due to inherent limitations in CDDB programs for classifying unpaid assessments into the correct financial reporting categories and inaccuracies in taxpayer records, IRS is still unable to use CDDB as its subsidiary ledger for external reporting of its unpaid assessments, and must continue to use a labor-intensive, manual compensating process to estimate the year-end balances of the various categories of unpaid tax assessments to avoid material misstatements to its financial statements. Specifically, IRS had to make over $28 billion in adjustments to the fiscal year-end 2008 gross taxes receivable balance produced by CDDB as part of its manual estimation process for financial reporting. Full operational capability of CDDB depends on the successful implementation of future system releases planned through 2009 and the ability of these releases to address current limitations in accurately classifying all of IRS’s unpaid assessments. The lack of a fully functioning subsidiary ledger capable of producing accurate, useful, and timely information with which to manage and report externally is a major component of the material weakness in IRS’s management of unpaid assessments. We will continue to monitor IRS’s development of CDDB during our fiscal year 2009 and future audits. Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Open. SB/SE completed the Control Point Monitor (CPM) pilot in May 2008 and prepared a CPM manual. The CPM serves as a conduit from the Area Office to the Campus for assessment. The CPM manual establishes specific timeframes in which the CPM must process/complete required TFRP actions. Implementation of the manual is currently being negotiated with the National Treasury Employees Union to address impact and implementation issues resulting from the changes to the CPM process. SB/SE has created a suite of managerial reports to provide oversight of the TFRP process. SB/SE continues to submit Work Requests and Information Technology Assets Management System tickets to enhance the assessment process to provide greater efficiencies in the processing and posting of TFRP assessments. Open. During our fiscal year 2008 audit, we continued to identify long delays in processing and posting TFRP assessments. Although IRS has developed a draft of the CPM manual to provide better guidance for the timely processing of TFRP assessments, the manual is currently undergoing internal reviews and awaiting final approval for official use. We will continue to monitor IRS’s actions to address this recommendation during our fiscal year 2009 audit. Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Closed. All IRS field offices continue to provide training and to perform reviews to strengthen controls over remittances. SB/SE conducts reviews with each territory manager. Headquarters staff ensures Territory managers are enforcing the requirement for group managers to randomly sample remittance packages for review. Each area director receives a report with any findings and recommendations for implementation. All Tax Exempt and Government Entities (TE/GE) Division Directors continue to perform operational reviews to ensure their subordinate groups are properly processing all checks. TE/GE provides training and notices on these procedures. During fiscal year 2008, all managers certified in their 2008 Annual Assurance Review that vulnerable assets, such as cash, securities, and equipment, are physically secured and access to them is controlled. TE/GE will also implement by September 2009 requirements to verify that control procedures are in place during operational reviews, and include information on proper check handling procedures during training for new hires and Revenue Agents. Large and Mid-sized Business (LMSB) has incorporated instructions on the use of the U.S. Treasury Stamp in training given to new hires as part of their on the job training and periodically in group meetings. The use of the U.S. Treasury Stamp has also been incorporated into the Internal Revenue Manual (IRM) and is part of IRS’s standard operating procedure used for processing payments. Open. The objective of this recommendation was to create a mechanism for IRS to monitor the status of pervasive weaknesses in controls over taxpayer receipts and information that we have found at IRS’s field offices over the years. The purpose of this monitoring is to facilitate the timely detection and effective resolution of issues and to verify the effectiveness of new and existing policies and procedures on an ongoing basis. During our fiscal year 2008 audit, we identified instances at (1) four SB/SE units where there was no segregation of duties between preparation of the payment posting vouchers and subsequent preparation of the related document transmittals and transmittal package; (2) four SB/SE units where a document transmittal form was not prepared when transmitting multiple Daily Report of Collection Activity forms to the Submission Processing (SP) Center; (3) three SB/SE units where there was no system in place to monitor acknowledged/ unacknowledged transmittals to the submission processing center; (4) five SB/SE units where there was no evidence of managerial review of document transmittals; and (5) all 10 field offices where there were no procedures in place to verify that names on the duress alarm contact list were current and that appropriate first responders were contacted in the event of an emergency. Had IRS periodically reviewed the effectiveness of these controls in field offices as we recommended, these issues might have been detected and corrected. We will continue to assess IRS’s actions during our fiscal year 2009 audit. Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Closed. IRS augmented its Modernization & Information Technology Services staff, and cross-trained employees to increase the appropriate depth of experience to perform the master file extractions and other ad hoc procedures for financial reporting purposes. Modernization & Information Technology Services reduced the Assembler Language Code programmer shortages and increased contractor support by 17 percent. IRS also continues to expand the use of CDDB during the annual audit, and the addition of trained Modernization & Information Technology Services and contractor staff ensures development of reliable balances for financial reporting purposes on a continuing basis. Closed. IRS hired additional staff in the Custodial Accounting Branch, which has responsibility for the custodial financial statements. Also, employees were cross-trained and current systems expanded to better support the financial reporting of revenue, refunds, and unpaid assessments. In addition, IRS reduced its shortage of assembly language programmers by holding training classes for employees. Internal Revenue Service: Serious Weaknesses Impact Ability to Report on and Manage Operations (GAO/AIMD-99-196, Aug. 9, 1999) Closed. IRS developed a cost accounting policy that provides guidance on managerial cost concepts for the agency, established an Office of Cost Accounting within the CFO, and completed several cost pilot projects to demonstrate the viability of its full cost methodology at the program level. Performance measures were enhanced, and the return on investment for the Earned Income Tax Credit program was completed with full cost information. As demonstrated by the cost pilots, IRS has the capability to use the cost data within the Integrated Financial System (IFS) and the associated workload and production data from IFS and its business unit systems to calculate the full costs of its products, services, and programs. The IFS contains 4 years of fully allocated cost data. Closed. IRS has taken several actions to address this recommendation and improve its cost accounting capability. For example, in fiscal year 2007, IRS developed and issued its first cost accounting policy to provide guidance on the concepts and requirements for managerial cost accounting within IRS. In addition, in fiscal year 2008, IRS (1) established an Office of Cost Accounting within its CFO, (2) completed several cost pilots to demonstrate its capability to use the cost data within IFS and the associated workload and production data from its business unit systems to calculate the full costs of its products, services, and programs, and (3) completed development of the return on investment for the Earned Income Tax Credit program that includes full cost information. However, IRS has not extended the cost pilot methodology to develop full cost information on the full range of IRS’s programs. Nevertheless, in order to provide recommendations more closely aligned with the current status, we have agreed with IRS to close this recommendation based on IRS’s progress to date and have reported the remaining issues, along with related recommendations for corrective action, in our June 2009 management report. See GAO-09-513R and recommendations 09-14 and 09-15 in this report. Internal Revenue Service: Serious Weaknesses Impact Ability to Report on and Manage Operations (GAO/AIMD-99-196, Aug. 9, 1999) Open. IRS has established strong internal controls and procedures to enhance its ability to account for property and equipment in IFS. IRS is looking at enhancing its asset- tracking system to more closely reconcile physical asset records to the financial records. This would enable targeted reconciliations to occur. Open. Our fiscal year 2008 property and equipment valuation testing revealed problems with the linking of the purchase of assets recorded in the general ledger system to the P&E inventory system, which indicates that IRS’s detailed P&E records do not fully reconcile to the financial records. We will continue to monitor IRS’s strategy in addressing these financial management systems issues. Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Closed. IRS is using a workload delivery model in the development and monitoring of an Enterprise Collection Plan that aligns performance measures across all collection organizations to match results against the corporate measures. Results of the model are used to project inventory receipt patterns by function and category of work, allowing for improved management of corporate collection inventory and resource allocation. New models were implemented in the Inventory Delivery System on January 12, 2009. The use of a rules engine has also been incorporated in the Inventory Delivery System to systemically make changes to case routing based on modeling predictions and rules. Collection Case Selection continues to provide ad hoc case assignments for testing case routing. Cases are selected based on a set of criteria and routed to different treatments to determine where like cases should be routed in the future. The CFO also included return on investment calculations for its collection initiatives in the 2007, 2008, and 2009 Budget Submissions. Closed. IRS has taken significant steps to address this recommendation. IRS built sophisticated computer modeling and risk assessment techniques with increased predictive power to improve IRS’s ability to route unpaid tax cases to the appropriate enforcement resource. IRS estimated that those changes have resulted in several billion dollars in additional tax collections. IRS has also established governance councils for IRS’s examination and collection activities. Finally, IRS has completed several actions to improve its ability to develop full cost information for its enforcement programs. Although IRS’s actions taken to date are important, they have not fully addressed the objectives of our recommendation, such as completing the development of full cost methodologies for IRS’s programs and activities. In order to provide recommendations more closely aligned with the current status, we have agreed with IRS to close this recommendation based on IRS’s progress to date and have reported the remaining issues, along with related recommendations for corrective action, in our June 2009 management report. See GAO-09-513R and recommendations 09-14, 09-15, and 09-16 in this report. Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Open. IRS continues to address issues that cause late lien releases through an internal Lien Release Action Plan and by conducting reviews as a part of its A-123 controls assessment process. Based on the annual sample of lien releases, the results of seven errors (liens released in an untimely manner) in 59 observations, yield a net most likely error of 12 percent, and (at greater than 95 percent confidence level), an upper error limit that could be as high as 21 percent. IRS added corrective actions to address issues found during the review. SB/SE is re-evaluating the fiscal years 2009 and 2010 overall lien release error rate goals and will submit changes to the Lien Release Action Plan. Open. IRS has taken a number of actions over the past several years to address this issue. However, during our fiscal year 2008 audit, we continued to find that IRS did not always release liens in a timely manner. In IRS’s own Office of Management and Budget (OMB) A- 123 testing of lien releases, it identified 7 instances out of 59 cases tested in which it did not release the applicable federal tax lien within the statutory 30- day period. The time between the satisfaction of the liability and release of the lien ranged from 33 days to more than 494 days. Based on these results, IRS estimated that for about 12 percent of unpaid tax assessment cases that were resolved in fiscal year 2008, in which it had filed a tax lien, it did not release the lien within 30 days of the resolution of the case. IRS is 95 percent confident that the percentage of cases in which the lien was not released within 30 days does not exceed 21 percent. IRS’s ineffective controls over this area results in its noncompliance with Internal Revenue Code Section 6325 which requires IRS to release its tax liens within 30 days of the date the related tax liability is fully satisfied. We will continue to monitor IRS’s actions to address this recommendation in future audits. Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Closed. IRS has taken steps to examine Earned Income Tax Credit claims, and to address the collection of Automated Underreporter and Combined Annual Wage Reporting as part of the workload delivery model. IRS updated the Earned Income Tax Credit error estimates and identified root causes of non- compliance. Additionally, in fiscal year 2008, IRS calculated a full- cost return on investment for Earned Income Tax Credit and completed an Automated Underreporter cost accounting pilot using IFS cost data. This pilot calculated the return on investment of Automated Underreporter case closures, which represented those cases that were closed after a notice was sent to the taxpayer. IRS established Exam and Collection governance bodies to improve collection efforts and implemented a modeling tool to better target collection efforts. Closed. IRS has taken significant steps to address this recommendation, including those listed in the “status per IRS” column. IRS’s cost pilot projects completed in fiscal year 2008, demonstrated IRS’s ability to determine the full cost of its programs. Although IRS’s actions taken to date are important, they have not fully addressed the objectives of our recommendation. For example, IRS’s cost pilot project methodology is time- consuming and requires intensive manual intervention, and IRS has not completed the task of developing methodologies for its programs and activities. In order to provide recommendations more closely aligned with the current status, we have agreed with IRS to close this recommendation based on IRS’s progress to date and have reported the remaining issues, along with related recommendations for corrective action, in our June 2009 management report. See GAO-09-513R and recommendations 09-14, 09-15, and 09-16 in this report. Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO-01-42, Nov. 17, 2000) Open. IRS will continue to pursue alternative approaches to enhance its ability to account for leasehold improvements. Open. We will continue to monitor IRS’s development of alternative approaches to enhance its ability to account for P&E assets. Management Letter: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-01-880R, July 30, 2001) Closed. The IRS is tracking and reporting the actual costs associated with reimbursable agreements through various business unit work load management tracking systems and IFS. The IRS Reimbursable Operating Guidelines established the procedures and processes for capturing direct and indirect costs associated with reimbursable agreements. Open. IRS has improved its methodology for allocating its costs of operations at the business unit level. However, further actions are needed for it to accumulate and report actual costs associated with specific reimbursable projects. We confirmed that IRS’s workload management tracking systems now capture details of time worked; however, these systems do not capture the full costs associated with specific reimbursable projects and do not interface with the general ledger (IFS) to capture all costs. We also noted that the fiscal year 2008 Reimbursable Operating Guidelines provide detail on determining the costs that should be included in the cost projection for a reimbursable agreement. However, the guidelines do not describe a process for determining the total actual costs incurred at the end of the agreement term, determining the difference between actuals and the original cost estimate, and refunding or billing for the difference. We will continue to monitor IRS’s efforts to fully implement its cost accounting system and, once it has been fully implemented, evaluate the effectiveness of IRS’s procedures for developing cost information for its reimbursable agreements. Internal Revenue Service: Progress Made, but Further Actions Needed to Improve Financial Management (GAO-02-35, Oct. 19, 2001) Closed. Employees itemize how their time is spent on specific projects/tasks in various workload management systems, and this information is utilized in the development of cost information which is used in resource allocation decisions. Closed. IRS has taken action to address our recommendation. We confirmed that IRS currently uses 24 separate functional tracking (workload management) systems for various categories of employees to itemize and track their time charges. Collectively, these systems now capture details of time worked by project for all employees. Internal Revenue Service: Progress Made, but Further Actions Needed to Improve Financial Management (GAO-02-35, Oct. 19, 2001) Closed. IFS allocates nonpersonnel costs to programs monthly and makes available cost data to managers, including the full cost of operating business units, and details on the allocated costs (i.e., building rent, depreciation, support costs, etc.). All business units can run cost reports as needed. Closed. IRS has taken actions to address this recommendation. We confirmed that IRS has improved its cost accounting capabilities by developing and implementing a methodology for allocating its costs of operations to its business units and to the cost categories on the Statement of Net Cost on a monthly basis. However, the cost categories on the Statement of Net Cost are at a higher level than specific programs and activities. Although IRS has developed full cost information on several IRS programs, IRS has not developed such information on the full range of IRS programs. However, in order to provide recommendations more closely aligned with the current status, we have agreed with IRS to close this recommendation based on IRS’s progress to date and have reported the remaining issues, along with related recommendations for corrective action, in our June 2009 management report. See GAO-09-513R and recommendations 09-14 and 09-15 in this report. Management Report: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-02-746R, July 18, 2002) Closed. Wage and Investment (W&I) has taken a number of actions to address this recommendation. Field Assistance emphasizes the requirement for including a document transmittal form listing the Daily Report of Collection Activity forms in transmittal packages, and ensuring that they are reconciled and reviewed. Territory managers review and discuss monthly reports with the group manager. Results of the reviews are forwarded to the area director. Operational reviews at all levels are conducted annually to ensure that field offices comply with the requirement to prepare Form 3210, which lists all Forms 795 being shipped to the SP Center. W&I completed its annual Filing Season Readiness Workshop for all taxpayer assistance center (TAC) managers, which addressed remittance and data security. New managers will attend the “Managing a TAC” course during fiscal year 2009, which provides ongoing training on payment processing and managerial reviews. Operational reviews completed for fiscal year 2008 revealed that the TAC managers are validating employee profiles to ensure restricted command codes were used according to guidelines. Open. While IRS has cited that it is taking a number of actions to ensure existing receipt control policy requirements for segregation of duties are followed, one of the main mechanisms it uses to enforce this policy is training. IRS conducts an annual Filing Season Readiness Workshop for TAC managers and provides training for new TAC managers on collecting taxpayer receipts and conducting managerial reviews. During our review of the handouts provided for the annual readiness workshop we noted several sections that discussed IRS’s policies related to segregation of duties. In contrast, we found that the “Managing a TAC” course for new TAC managers did not specifically address those policies. From our discussions with IRS officials, the Filing Season Readiness Workshop is conducted annually during the first quarter of the fiscal year. Consequently, new TAC managers assigned after the first quarter of the fiscal year will not receive the same level of training regarding segregation of duties. In addition, during our recent visits to selected TACs in March 2009, we found instances where segregation of duties related to accepting and recording walk-in payments were not implemented. Management Report: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-02-746R, July 18, 2002) Open. Agency-Wide Shared Services (AWSS) Personnel Security has taken several short and long term measures to reduce the instance of SETS errors. The short-term measures include (1) publishing instructions on the Personnel Security intranet site for SETS users to follow while reviewing bi-weekly SETS reports, (2) issuing bi-weekly emails to all SETS users with the most current reports to be used in identifying and reporting errors to NFC, and (3) compiling weekly extracts of all enter-on-duty dates where there were no fingerprint results or where the results were after the enter-on- duty date and sending those to each employment office for updates and feedback. The long- term measures included requesting revisions to SETS. Open. During our fiscal year 2008 audit, we continued to identify technical limitations and weaknesses with the SETS database. In addition, we found 248 instances where SETS was not updated in a timely manner or correctly for new-hire employees resulting in errors in the database. We will continue to assess IRS’s actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04-553R, April 26, 2004) Closed. IRS performs monthly unannounced testing of guard response to alarms and test results are reviewed by the Security Programs Office to enforce and ensure compliance. Test results on guard response to alarms are consistently 98 percent or higher, indicating substantial compliance with IRS guidelines. Test procedures were formalized in IRM 10.2.14 Methods of Providing Protection, issued on October 1, 2008. In addition, the Guard Program Specialists from the Security Programs Office conduct unannounced alarm tests whenever they visit a site to do a Quality Assurance check of security posture and programs. Physical Security and Emergency Preparedness (PSEP) continues to utilize the Audit Management Checklist as a repeatable process where service center campuses (SCC) quarterly validate the performance and documentation of monthly unannounced alarm testing. Open. During our fiscal year 2008 audit, we identified instances at two of the three SCCs we visited in which security guards did not respond to alarms within the time limit outlined in the IRM. In addition, at another SCC we visited, we identified an instance in which security guards did not fully investigate the source of an alarm. We will continue to evaluate IRS’s enforcement of these policies and procedures during our fiscal year 2009 audit. Management Report: Review of Controls over Safeguarding Taxpayer Receipts and Information at the Brookhaven Service Center Campus (GAO-05-319R, Mar 10, 2005) Closed. W&I Accounts Management continues to enforce the restricted area access through periodic training. Candling procedures are reinforced through monthly internal control reviews of the process. In January 2008, Accounts Management increased management oversight of internal controls by implementing formal monthly internal control reviews at the former Submission Processing rampdown sites. A revised review template was developed to evaluate the quality of IRS’s internal control performance, identify potential deficiencies, and allow corrective actions to be taken immediately. The monthly results from each field director are forwarded to the Director, Accounts Management, and GAO. AWSS provides training when notified by W&I that a new monitor has been selected or when an existing monitor requires refresher training. Each campus badge office provides training to the restricted area door monitors as it pertains to the control, issuance, and inventory of the non-photo badges that are assigned at each site. Closed. Accounts Management implemented a monthly review to monitor internal controls over taxpayer receipts and information at campuses selected for reductions in their submission processing functions. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. The Program, Planning, and Policy Office finalized and issued IRM 10.2.5 Identification Card on September 30, 2008. Section 10.2.5.6.2(2)a specifies that red photo ID cards may be issued to IRS contract employees who have a daily need on a continuing basis to be on site at a facility over a period of time, and who have been granted interim or final staff-like access to a facility/work area with sensitive systems or information. Before a red photo ID card may be issued, the contracting officer’s technical representative must provide the Physical Security Office with a copy of the Personnel Security & Investigation background investigation letter approving interim or final staff-like access. PSEP continues to utilize the Audit Management Checklist as a repeatable process where SCCs quarterly validate the filing of contractor background investigation documentation. Closed. We verified that IRS finalized and issued IRM 10.2.5 and continues to utilize the Audit Management Checklist to ensure that proper documentation is received and on file for contractors before they are granted staff-like access to service centers. During our fiscal year 2008 audit, we found no exceptions relating to SCCs granting contractors staff-like access before appropriate background investigations were completed. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. The Program, Planning, and Policy Office finalized and issued IRM 10.2.5 Identification Card on September 30, 2008. IRM 10.2.5.6.2(2)a specifies that the Form 5519, 13716-A or similar identification request Form 13760, and the interim or final background investigation letter must be retained and filed in the identification media file for each contractor for the life of the identification card. PSEP continues to utilize the Audit Management Checklist as a repeatable process where SCCs quarterly validate the filing of contractor background investigation documentation. Closed. We verified that IRS finalized and issued IRM 10.2.5 and continues to utilize the Audit Management Checklist to ensure that proper documentation is received and on file for contractors before they are granted staff-like access to service centers. During our fiscal year 2008 audit, we found no exceptions. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Open. IRS revised IRM 5.1.2.4, Daily Report of Collection Activity- Form 795/795A, to establish segregation of duties procedures with respect to the preparation of Payment Posting Vouchers, Document Transmittal forms, and transmittal packages in the Collection Field function. Open. During our fiscal year 2008 audit, we identified instances at four SB/SE units we visited where duties involving the preparation of payment posting vouchers, document transmittal forms, and transmittal packages were not segregated. Employees informed us that they were unaware of a related requirement in the IRM. We will continue to assess IRS’s actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. W&I Field Assistance continues to take actions to emphasize the requirement for including a document transmittal form listing the Daily Report of Collection Activity forms in transmittal packages. Operational reviews were conducted at all levels during fiscal years 2007 and 2008 to ensure that field offices comply with the requirement to prepare Form 3210, which lists all Forms 795 shipped to the SP Center. Further, IRM 1.4.11-11 was revised on October 7, 2008, to include the purpose, frequency, and documentation required for managerial reviews, which includes a review of Form 3210s, and trends and error reports. The outcome of the operational reviews revealed that managers are complying with the IRM procedures outlined for document transmittal. Open. During our fiscal year 2008 audit, we identified instances at four SB/SE units where a document transmittal form was not prepared when transmitting multiple Daily Report of Collection Activity forms to the SP Center. We will continue to evaluate this issue during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. The IRS enforces documentation requirements relating to authorizing officials charged with approving manual refunds. IRS created a standard authorization memorandum in September 2008 for all offices to use. This will negate the disparity among the campuses in creating local authorization forms. IRS issued its annual solicitation memorandum for authorizing officials charged with approving manual refunds in August 2008 and received the annual list of authorized signatures by October 31, 2008, per IRM 3.17.79.3.5(4) (d). SP completed a sample review as part of the Monthly Security Review Checklist per IRM 3.17.79.3.5(3), and completed a 100 percent review of the new annual list by December 31, 2008. Open. During our fiscal year 2008 audit, we continued to find that the documentation requirements on memorandums, which are submitted to the manual refund units listing officials authorized to approve manual refunds, were not always complete. For example, some of the memorandums did not contain the signatures of the Heads of Office that delegated officials the authority to approve manual refunds while others did not contain the authorizing official’s campus or field office organization information as required by the IRM. We verified that IRS created a standard authorization memorandum in September 2008. However, IRS implemented this corrective action and completed its review of the new annual list subsequent to our fiscal year 2008 field work. We will evaluate IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Open. IRS continued to enforce the requirements for monitoring accounts and reviewing monitoring of accounts for manual refunds in fiscal year 2008. SB/SE Campus Compliance Services covered this topic in both Filing & Payment Compliance and Campus Reporting Compliance Operations during fiscal year 2008 reviews to ensure compliance with all IRM provisions for manual refunds. Submission Processing conducted refresher training at all sites by September 30, 2008, in team meetings and annual continuing professional education classroom training using IRM 21.4.4 and 3.17.79 as reference materials to reinforce the monitoring requirements. As a result of recent findings and quarterly review of the manual refund process in Accounts Management, both the monitoring and supervisory review process are being examined to identify means for improvement. Once the review is complete, consideration will be given to implementing any recommendations. Accounts Management continues its quarterly reviews of the manual refund process. Open. During our fiscal year 2008 audit, we found instances where the manual refund initiators did not monitor accounts to prevent duplicate refunds and supervisors did not review the monitoring of accounts. IRS’s review of the monitoring and supervisory review process for manual refunds has not been completed. We will continue to evaluate IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Open. IRS continued to enforce the requirements for documenting monitoring actions and supervisory review for manual refunds in fiscal year 2008. SB/SE Campus Compliance Services covered this topic in both Filing & Payment Compliance and Campus Reporting Compliance Operations during their fiscal year 2008 campus reviews to ensure all campuses continue to comply with all IRM provisions for manual refunds. Submission Processing conducted refresher training at all sites by September 30, 2008, in team meetings and annual continuing professional education classroom training using IRM 21.4.4 and 3.17.79 as reference materials to reinforce the monitoring requirements. As a result of recent findings and quarterly review of the manual refund process in Accounts Management, both the monitoring and supervisory review process are being examined to identify means for improvement. Once the review is complete, consideration will be given to implementing any recommendations. Accounts Management continues its quarterly reviews of the manual refund process. Open. During our fiscal year 2008 audit, we continued to find instances where the manual refund initiators did not document their monitoring of accounts to prevent duplicate refunds. IRS’s review of the monitoring and supervisory review process for manual refunds has not been completed. We will continue to evaluate IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. Accounts Management has procedures in place for the periodic supervisory review and documentation of the Form 3210 reconciliation process, which is designed to follow up on unacknowledged forms. This process is designed to provide a timely account of any discrepancy between the documents listed on the Form 3210 and those received. For the last 3 years, conference calls have been conducted with each directorate to reinforce the correct processing of Form 3210s. Recent actions to address the recommendation include having “Form 3210 Processing” as an agenda item on the Refund Inquiry Units’ conference call. In addition, the quarterly Accounts Management internal control Form 3210 review now requires that the Refund Inquiry Unit be included in the review. Open. During our fiscal year 2008 audit, we identified an instance at one SCC where the Refund Inquiry Unit manager did not perform or document periodic reviews of forms used to transmit returned refund checks. We will continue to evaluate IRS’s actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. IRS has procedures in place to ensure compliance with tracking acknowledgement copies of document transmittals. W&I Account Management continues to analyze the results of its quarterly reviews. Field Assistance revised the IRM provisions during 2007 to provide procedures for requiring TACs to follow up with SP Centers when acknowledgments are not received within 10 days. Field Assistance revised other IRM provisions to include more detail for processing Form 3210. The IRM provides guidance to maintain centralized files for acknowledged Form 3210 for three years, and provides guidance for handling unacknowledged Form 3210. Offices transmitting receipts have a system to track acknowledged copies of document transmittals. All TE/GE Division Directors continue to use the Quick Reference Guide for Processing Checks, including a check sheet and flowchart developed for the TE/GE Exam Managers to use when performing operational reviews to ensure their subordinate groups are properly processing all checks. TE/GE will also implement by September 2009 requirements for each Examination Area Manager to verify tracking measures are in place in all their groups. LMSB has completed all its planned actions with regard to this recommendation and will continue to issue an annual executive memorandum on Form 3210 procedures around July 2009. Open. During our fiscal year 2008 audit, we identified instances at three SB/SE units and two TACs where there was no system in place to monitor acknowledged/ unacknowledged transmittals to the SP Center. We will continue to assess IRS’s actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. IRS revised the IRM on October 1, 2008, to include more detail for processing Form 3210. IRM 1.4.11.19.1 provides guidance to maintain centralized files for acknowledged Form 3210 for 3 years. Operational Reviews revealed that managers are in compliance with conducting and documenting the document transmittal review that includes the reconciliation process of Forms 3210 and 795. All managers were reminded to conduct these reviews at the Filing Season Readiness Workshop completed by December 15, 2008. The Refund Inquiry Unit continues to be included in the Accounts Management quarterly internal control review of document transmittal procedures. The review checklist includes the timely follow- up and documentation of Form 3210 acknowledgements as well as the required periodic managerial review. For TE/GE, each front line Examination group manager will ensure they complete reviews of document transmittals, and TE/GE is adding an additional question to TE/GE’s 2009 Annual Assurance Review to certify all managers addressed this issue by June 2009. Open. During our fiscal year 2008 audit, we identified instances at five SB/SE units and eight TACs where there was no evidence of managerial review of document transmittals and one instance at a SCC where the Refund Inquiry Unit manager did not perform or document periodic reviews of forms used to transmit returned refund checks. Moreover, the corrective actions cited by IRS were implemented after our fiscal year 2008 fieldwork. We will continue to evaluate IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. IRS continues to work to improve security and control access issues in the TACs. Of the 401 TAC locations, 183 have been built to design standard, with another 14 scheduled for completion by the end of January 2009. Forty-five projects have been approved to implement the TAC model in 2009, with another 30 projects pending final approval and funding. Forty-four projects are in development for implementation from 2010 through 2014. IRS will work to address any concerns with the space design/layout of TAC space and continue to roll out the TAC Design Model in the remaining locations. While implementation of the TAC Model Design is the ideal solution, implementation of compensating controls such as theater ropes or other barriers, signage and minor alterations/reconfigurations have been incorporated in many TAC locations as an interim measure. Using a variety of criteria including security, safety and health concerns, IRS has identified priority locations for the implementation of the TAC Design Model. Open. We will continue to evaluate IRS’s actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. Field Assistance uses the TAC Security Remittance Review Database, which requires managers to conduct and document their reviews to ensure the protection of data and compliance with remittance and security procedures. Field Assistance implemented the TAC Security Remittance Review Database during the first quarter of fiscal year 2007. Since implementation, IRS has had numerous problems with the system due to technological limitations. Some of the problems IRS encountered include erroneously deleted information and an inability to save and transmit reports. IRS has attempted to secure funding and assistance to convert the database to a user-friendly Web version. The system was converted to a Web- modified application effective the second quarter of fiscal year 2009. This is only a temporary resolution until funding is secured. While the database was being revised, the area offices were still responsible for completing the reviews using Data Collection Instruments for the first quarter. In addition, IRS also tested the Web design prior to its implementation and has initiated a review process to engage headquarters, areas and territory management staff to identify and correct the database entries. The process will include sampling and conducting operational reviews as assurance of the database integrity. To enhance everyone’s understanding of the process, talking points will be developed for discussions between the territory and group managers. Open. IRS continues to implement its new process for providing oversight of TACs not having a manager permanently on-site during our fiscal year 2008 audit. Because the process was not fully functional, we were unable to test its implementation during our audit fieldwork. We will continue to assess IRS’s actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. IRM 10.2.14 Methods of Providing Protection will be revised by September 30, 2009, to state: “A record of all instances involving the activation of any alarm regardless of the circumstances that may have caused the activation, must be documented in a Daily Activity Report/Event Log, or other log book and maintained for 2 years.” Open. During our review and evaluation, we found that IRS’s corrective actions relating to the recordation of all instances involving alarm activations in the Daily Activity Report/Event Log, or other log book, were not included in the final version of the IRM. We will continue to assess IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. IRS performs monthly unannounced testing of guard response to alarms, and test results are reviewed by the Security Programs Office to enforce and ensure compliance. According to IRS, test results on guard response to alarms are consistently 98 percent or higher, indicating substantial compliance with IRS guidelines. Test procedures were formalized in IRM 10.2.14 Methods of Providing Protection issued on October 1, 2008. PSEP continues to utilize the Audit Management Checklist as a repeatable process, and SCCs validate quarterly the performance and documentation of monthly unannounced alarm testing. Closed. IRS revised IRM 10.2.14 to include requirements to perform and document monthly tests of intrusion detection alarms, including guard responses to alarms. Also, IRS’s Audit Management Checklist contains review steps for physical security analysts to determine whether SCCs and respective annex facilities that process taxpayer receipts and/or information perform and document monthly tests of intrusion alarms. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. This item remains closed since fiscal year 2006, with AWSS continuing to regularly follow up on disposal actions. During fiscal year 2008, IRS implemented a new wizard tool that caused a system glitch which prevented IRS from updating all disposals within 10 work days. Several IRS staff were aware of the glitch and were working on the issue. As a result, the disposal action that should have been updated in 10 days was actually updated in 15 work days. Open. In fiscal year 2006, IRS re- engineered the P&E asset retirement and disposal process to generate exception reports that enable management to regularly monitor the aging of transactions during the disposal process. However, our testing in fiscal years 2007 and 2008 noted that disposals shown on the exception report were not always being recorded in a timely manner. During our fiscal year 2009 audit, we will verify that the new software enhancement is operating as intended. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS revised the language in Lockbox Security Guidelines (LSG) 2.17.8 (9) to mitigate the risk as outlined in the Lockbox Electronic Bulletin issued on July 17, 2008. As of September 1, 2008, all lockbox sites use file encryption, and are in compliance with the requirements as outlined in the Lockbox Electronic Bulletin. Closed. IRS revised its LSG to require lockbox banks to encrypt backup media containing taxpayer information. IRS has included this issue as one of the areas tested during its annual reviews of information technology security at its lockbox banks. During our fiscal year 2008 internal control testing, we did not identify any instances where lockbox banks were not encrypting backup media containing federal taxpayer information. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS revised the language in LSG 2.17.8 (9) to mitigate the risk as outlined in the Lockbox Electronic Bulletin issued on July 17, 2008. As of September 1, 2008, all lockbox sites store backup media containing federal taxpayer information at an off-site location and are in compliance with the requirements as outlined in the Lockbox Electronic Bulletin. Closed. IRS revised its LSG to require lockbox banks to store backup media containing taxpayer information at an off-site location. IRS has included this issue as one of the areas tested during its annual information technology security reviews at lockbox banks. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS revised the Information Technology Data Collection Instruments, which are used during the annual reviews of lockbox banks, and the related instructions (1) to ensure that the data/image transmissions sent through the Lockbox Electronic Network are encrypted prior to transmission and (2) to validate that all backup media containing personally identifiable information is stored and protected as required in the Lockbox Electronic Bulletin. Closed. IRS revised its Information Technology Data Collection Instrument to test whether lockbox banks are (1) encrypting personally identifiable information prior to transmission and (2) storing backup media containing personally identifiable information at an appropriate off-site location. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. PSEP developed and implemented an action plan requiring all SCCs to (1) perform and validate completion of an assessment of their CCTV to ascertain if it provided an unobstructed view of the exterior of the campus perimeter, and (2) identify problems and planned corrective actions to mitigate the identified problems. All SCCs validated completion of the CCTV assessment and a total of 16 problems were identified. Progress on corrective actions was monitored and reported to PSEP management on a monthly basis. All corrective actions were addressed: 14 were resolved by the installation of CCTV cameras and/or removal of obstructions, and 2 were determined by management to meet an acceptable level of risk. PSEP continues to utilize the Audit Management Checklist as a repeatable process where SCCs quarterly validate CCTV coverage of the campus fence line and perimeter. The reported corrective actions were completed January 10, 2008. PSEP will continue to place emphasis on CCTV camera coverage, as well as perform regularly scheduled risk assessments of IRS facilities. Open. On January 10, 2008, IRS completed an assessment of its CCTVs in all SCCs to ascertain whether they provided an unobstructed view of its campuses’ exterior perimeter. However, IRS’s assessment did not account for the CCTV weaknesses that were reported in the Fresno SCC’s January 2007 risk assessment, which continued to exist during our April 2009 visit. During our visit, we found that the CCTVs did not provide an unobstructed view of the building exterior or fence line, many of the CCTVs were not wired properly and could not be used to their full potential. While these weaknesses were reported in the January 2007 risk assessment, Fresno was one of the four SCCs that did not report any specific weaknesses to the PSEP management that requested the assessment of the CCTVs. In view of the weaknesses we observed, it is unclear how the Fresno campus reached its conclusion that no CCTV problems were reportable to the PSEP requestors performing the assessment. We will continue to assess IRS’s actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. All W&I functions, except Accounts Management, conducted training during 2007 and 2008 for manual refund initiators to ensure they fulfill their responsibilities to monitor manual refunds and document their monitoring actions to prevent the issuance of duplicate refunds. W&I Compliance completed its training for manual refund initiators in the W&I campuses in April 2008. SP conducted refresher training during fiscal years 2007 and 2008 (continuing professional education) and will include again in the fiscal year 2009 continuing professional education. SP management reviews history sheets annotated with taxpayer identification numbers, tax period, transaction code, date, and initials of initiator. Accounts Management manual refund training has been delayed due to the Economic Stimulus Package workload. Accounts Management is re-examining manual refund monitoring procedures and will reschedule the training in fiscal year 2009 once the review is complete and any changes implemented. Open. During our fiscal year 2008 audit, we found instances where the manual refund initiators did not receive training on the most current requirements to help ensure that they fulfill their responsibilities to monitor manual refunds. We will continue to evaluate IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. On January 20, 2008, SB/SE implemented the programming to check for outstanding liabilities associated with both the primary and secondary Social Security numbers on a joint tax return for offsetting to any outstanding TFRP liability before issuance of a refund. Closed. We verified that IRS implemented the programming change to check for outstanding liabilities associated with both the primary and secondary Social Security numbers on a joint tax return for offsetting to any outstanding TFRP liability before issuance of a refund. We reviewed the accounts of a number of taxpayers who (1) were assessed a TFRP, (2) filed a joint personal income tax return with a spouse, (3) listed her or his Social Security number as the second one on the tax return, and (4) had credits on the personal income tax account. In each of these cases, we verified that IRS’s computer program identified the outstanding TFRP and applied the credits to the TFRP balance before sending any refund to the taxpayer. Additionally, according to IRS, their analysis identified over $10 million of refund offsets that have occurred from January 2008 to March 2009 as a result of this corrective action. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. SB/SE implemented a system change in January 2007 to correct the failure-to-pay (FTP) penalty calculation program. In June 2008, SB/SE conducted a review of the programming change and determined the program is correctly charging the reduced rate on subsequent assessments. There was a small subpopulation of accounts that the system change did not correct. IRS worked on an additional system change to correct penalty calculation programming affecting the remainder of the cases and completed its corrective action in August 2008. Closed. We verified that IRS’s system corrected the FTP penalty calculation program. We reviewed the accounts of a number of taxpayers for whom: (1) IRS increased the FTP penalty rate assessed against the taxpayer for failing to pay taxes owed from 0.5 percent to 1 percent when the taxpayer failed to pay following repeated notification of the taxes due, (2) the taxpayer subsequently paid off the balance for the specific tax period, and (3) following its system change, IRS assessed the taxpayer additional taxes owed for the same tax period and a related FTP penalty. In each of these cases, we verified that the FTP penalties were calculated in accordance with the applicable IRM guidance. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS implemented in January 2007 and August 2008 the change to the FTP penalty calculation program and also recalculated the FTP amount using the correct rate on all open taxpayer accounts with this penalty. Closed. We verified that IRS’s system change resulted in FTP penalties being calculated in accordance with the applicable IRM guidance on open taxpayer accounts. We reviewed the accounts of a number of taxpayers from IRS’s unpaid assessment inventory for whom: (1) IRS had increased the FTP penalty rate assessed against the taxpayer for failing to pay taxes owed from 0.5 percent to 1 percent when the taxpayer failed to pay following repeated notification of the taxes due, (2) the taxpayer subsequently paid off the balance for the specific tax period, and (3) IRS assessed the taxpayer additional taxes owed for the same tax period, with related FTP penalties. In each of these cases, we verified that the total recorded FTP penalty assessments on the account were in accordance with the applicable IRM guidance. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. SB/SE published IRM 5.1.2.5.3 in September 2008 with revisions to 5.1.2.5.3.1(1) through (7) directing employees to make the specific determinations and to take the specific actions contained in this recommendation. Closed. IRS revised its IRM in September 2008 to include instructions specifically addressing this recommendation. The IRM now instructs IRS employees to (1) determine if the payment is sufficient to cover the tax liability of the tax period specified on the payment, (2) perform additional research and resolve any outstanding issues on the account, including determining if there are any freeze codes that will delay credit posting, (3) determine whether the taxpayer has outstanding balances in other tax periods, and (4) apply available credits to satisfy the outstanding balances in other tax periods. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. SB/SE published IRM 5.1.2.5.3 in September 2008 with revisions to 5.1.2.5.3.1(1) through (7) directing employees to make the specific determinations and to take the specific actions contained in this recommendation. Closed. IRS revised its IRM in September 2008 to include instructions specifically addressing this recommendation. The IRM now instructs IRS employees to (1) determine if the payment is sufficient to cover the tax liability of the tax period specified on the payment, (2) perform additional research and resolve any outstanding issues on the account, including determining if there are any freeze codes that will delay credit posting, (3) determine whether the taxpayer has outstanding balances in other tax periods, and (4) apply available credits to satisfy the outstanding balances in other tax periods. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. SB/SE has requested Counsel guidance related to lien releases after discharge to determine if a memorandum is needed. SB/SE will issue a memorandum to employees by May 2009, if necessary. Open. As part of its own fiscal year 2008 OMB A-123 testing of lien releases, IRS tested a statistical sample of taxpayer accounts requiring a lien release during 2008. In its testing, IRS again identified a case in which it did not release the applicable federal tax lien within the statutory 30- day period because it did not update the taxpayer’s account in a timely manner to reflect that the taxpayer had been discharged of the taxes in a bankruptcy court. The untimely recording of bankruptcy discharges results in the untimely release of tax liens and is directly related to IRS’s noncompliance with Internal Revenue Code Section 6325 which requires IRS to release its tax liens within 30 days of the date the related tax liability is fully satisfied. We will continue to review IRS’s corrective actions to address this recommendation during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. W&I Compliance continues to use the Installment Agreement Account Listings (IAAL) report to monitor user fee activity. In January 2008, IRS implemented enhancements to the report and increased the frequency of the sweep process from quarterly to weekly. Closed. IRS runs edit checks to test the validity of recorded installment agreements, including the user fees, which results in the identification of potential errors that are then listed on the IAAL. We verified that IRS improved its IAAL report process by grouping items that appear on the IAAL into tiers based on priority and establishing time frames by tier for investigating and resolving these potential errors. In addition, we confirmed that IRS now performs managerial reviews on IAAL cases processed by its collection operations. IRS also increased the frequency of its computer sweep recovery process, which is intended to identify unrecorded user fees, from a few times a year to once a week, thus increasing the timeliness and accuracy of recorded individual taxpayer user fees. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. W&I Compliance uses a weekly sweep process to reconcile installment agreement payments and adjusts those with discrepancies or errors to ensure that fees are accurately posted to the user fee account. Closed. W&I Compliance’s weekly sweep process is designed to identify and correct for unrecorded user fees collected with the initial installment agreement payment. We verified that IRS’s improvements to its installment agreement user fees monitoring process will help ensure that errors in recorded installment agreement user fees are identified and corrected in a more timely manner. Additionally, we did not identify any instances of errors in recorded installment agreement user fees during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. W&I Compliance uses the Installment Agreement Account Listings report to identify accounts with user fee errors, underpayments, and overpayments that require adjustments. W&I consolidated the report listing at one location to provide improved oversight of the process. Both W&I and SB/SE program analysts, managers, operations management, and headquarters staff conduct reviews of the report listing. In January 2008, IRS implemented enhancements to the report and increased the frequency of the sweep process used to correct accounts from quarterly to weekly. IRS also updated IRM 5.19.1 in January 2008 to include requirements for case analysis and documentation. Closed. We verified that IRS conducts managerial and operational reviews on its W&I Compliance Service Collection Operations, the division responsible for making the appropriate adjustments for errors in recorded installment agreement user fees. Additionally, we did not identify any errors in recorded installment agreement user fees tested during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. The IRS plans to implement the following procedures to ensure that sufficient secured space is maintained for Automated Data Processing (ADP) and Non-ADP assets: Requesters needing space are to initiate an Employee Resource Center ticket requesting “Property Consultation” services, which initiates Real Estate and Facilities Management (REFM) activity to work with the requester on obtaining the needed secured storage space. When Modernization & Information Technology Services property managers need secure storage, narrative associated with the Employee Resource Center work ticket must state: “Need to consult with local REFM staff on providing a secure storage alternative for ADP equipment.” This procedure is to be used for asset distribution staging or when assets are to be excessed. This policy is effective March 30, 2009. Open. IRS completed its corrective action plan after the end of our fiscal year 2008 audit. We will review IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. AWSS Procurement issued policy Change Notice 07-08, which contains a revision to Policy and Procedure Memorandum 46.5, Receipt, Quality Assurance and Acceptance. The revision limits situations in which contracting officers may perform receipt and acceptance. In addition to the Policy and Procedure Memorandum 46.5, the IRS Acquisition Procedure Subpart 1003.90—Separation of Duties and Management Controls—requires separation of duties for requisition approval, certification of funds, contract award, and receipt and acceptance. Procurement runs Web Request Tracking System reports to review the instances where contracting officers performed receipt and acceptance to ensure that the receipt and acceptance falls within exceptions/procedures outlined in the Policy and Procedure Memorandum 46.5. Open. During our fiscal year 2008 audit, we noted that IRS revised its policy to reflect the situations under which contracting officers may perform receipt and acceptance functions. In addition, the IRS Acquisition procedures require that no employee shall perform more than one of the following four functions: (1) requisition approval for supplies and/or services, (2) certify the availability of funds, (3) conduct the procurement and execute the contractual document, and (4) receive the supplies or services. However, during our fiscal year 2008 audit testing, we continued to find instances where individuals were performing incompatible functions. We will continue to review actions taken by IRS during our fiscal year 2009 audit. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07-692R, May 18, 2007) Closed. IRS revised its A-123 guidance to include templates and procedures for compiling, referencing, and reviewing audit working papers to ensure that the results of internal control tests are clear and complete to explain how control procedures were tested, what results were achieved, and how conclusions were derived from those results. During the fiscal year 2008 cycle, the Office of Corporate Planning and Internal Control assigned test team leaders and independent Office of Corporate Planning and Internal Control reviewers to examine workpapers to ensure the test team sufficiently documented their work to support their conclusions. The A-123 guidance requires that each set of work papers include a summary of findings statement setting out the conclusion reached after performing the transaction testing. Closed. During our fiscal year 2008 IRS financial audit, we verified that IRS revised its A-123 guidance to include templates that clearly outline how to document and explain what control tests were performed, the scope of control tests, and the results of internal control tests performed. IRS’s A-123 guidance also requires that each set of workpapers include a summary of findings statement that clearly concludes on results of test procedures performed by staff. We verified that IRS’s workpapers documenting A-123 testing substantially conformed to the A-123 guidance. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07-692R, May 18, 2007) Closed. During the development of fiscal year 2008 A-123 internal control test plans, IRS analyzed and documented open recommendations related to the internal control process/transaction being tested. IRS considered the open recommendation findings while developing the process/transaction test plan. IRS will continue to incorporate the open recommendation findings while planning A-123 testing. Closed. During fiscal year 2008, we verified that IRS included a requirement in its A-123 guidance to determine the adequacy and value of management actions taken in response to audits performed by GAO and the Treasury Inspector General for Tax Administration relating to financial reporting. We also verified that IRS review staff followed the A-123 guidance in performing internal control reviews. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07-692R, May 18, 2007) Open. IRS will continue to work with Treasury and Modernization & Information Technology Services to fully implement A-123 requirements for evaluating controls over information technology relating to financial statement reporting. IRS will identify areas where the work conducted under FISMA does not meet A-123 requirements and consider information security findings and recommendations to ensure testing procedures meet A- 123 requirements. Open. We will follow up during future audits to assess IRS’s progress in implementing this recommendation. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07-692R, May 18, 2007) Open. IRS revised a limited set of fiscal year 2008 test plans to pilot the requirement to include an analysis of the design for each transaction control set tested. This project is planned for completion during the fiscal year 2009 A-123 cycle. Open. We verified that IRS revised a limited number of A-123 test plans to include an analysis of the design of internal controls tested. During our fiscal year 2009 audit, we will continue to review the remaining test plans as IRS revises them. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07-692R, May 18, 2007) Closed. In fiscal year 2007, IRS established an internal crosswalk between A-123 tests and laws and regulations significant to financial reporting. In fiscal year 2008, IRS updated the crosswalk to a listing of laws and regulations which were expanded to include all specific public laws and took the additional step of incorporating GAO audit methodology into the linkage. Closed. We obtained and reviewed IRS’s laws and regulations crosswalk and verified that IRS had identified and planned appropriate procedures to test controls over laws and regulations considered significant to financial reporting. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07-692R, May 18, 2007) Open. IRS is considering alternative procedures for testing transactions to provide assurance for the last 3 months of the fiscal year. Although implementation of such procedures is not necessary until elimination of the outstanding material weaknesses, IRS intends to propose follow-up procedures before the end of the fiscal year. Open. We will follow up during future audits to assess IRS’s progress in implementing this recommendation. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07-692R, May 18, 2007) Closed. Members of the IRS A-123 workgroup completed the United States Department of Agriculture Graduate School course, Audit Evidence and Working Papers, covering methods for collecting and documenting types of evidence needed to support audit reports and to meet professional standards, during the fall of 2007. IRS used concepts from this course and best practices from previous cycles to improve the curriculum over previous years for the annual IRS A-123 Training Workshop to improve proficiency in documentation and analysis in the transactional testing. The training also covers the process to be followed when reviewing or performing tests of internal controls, developing a determination as to whether or not the controls are functioning properly, and evaluating the materiality of errors. The Office of Corporate Planning and Internal Control is currently developing an IRM provision for reference to reinforce the A-123 guidance provided during the training. Closed. We verified that IRS developed an appropriate annual training workshop designed to ensure that their A-123 review staff enhance their skills in workpaper documentation, identification and testing of internal controls, and evaluation and documentation of test results. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Open. IRS instituted the use of trace identification numbers for revenue and refund transactions in fiscal year 2008 to provide traceability from the general ledger for tax transactions back to source documentation and throughout IRS financial management systems. IRS is currently developing additional internal controls for tax revenue transactions processed outside of the Electronic Federal Tax Payment System, and for transactions recorded into IRACS requiring manual transcription. IRS is working to revise each appropriate IRM provision and requested programming to implement system controls in payment systems to prevent, detect, and correct such transcription and input errors by fiscal year 2010. IRS is also developing the Redesign Revenue Accounting Control System, an enhancement of IRACS that will incorporate the United States Standard General Ledger. IRS plans to implement Redesign Revenue Accounting Control System in January 2010. Open. During our future audits, we will continue to evaluate IRS’s progress in achieving transaction traceability for tax revenues processed outside of the Electronic Funds Transaction Payment System and taxes receivable transactions. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Open. Revenue Financial Management documented the procedures the statistician performs in each step of the unpaid assessments estimation process by June 2008. Revenue Financial Management is enhancing each of these procedures to include additional steps based on the fiscal year 2008 audit. Revenue Financial Management will provide the new procedures by May 2009. Open. During our fiscal year 2008 audit, we continued to find errors in IRS’s unpaid assessment estimates that were not detected by IRS’s internal reviews. IRS corrected these errors after we brought them to its attention. However, until IRS fully documents the specific procedures performed by its statistician in each step of the unpaid assessment estimation process and the specific procedures for reviewers to follow in their reviews, IRS faces increased risk that errors in this process will not be prevented or detected and corrected. We will continue to review IRS’s corrective actions to address this recommendation during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Open. In June 2008, Revenue Financial Management documented the procedures reviewers should follow during their review of the statistical estimates. Revenue Financial Management is adding additional levels of review and oversight for fiscal year 2009 and is finalizing a Memorandum of Understanding with the Office of Program Evaluation and Risk Analysis to perform an independent review. Open. During our fiscal year 2008 audit, we continued to find errors in IRS’s unpaid assessment estimates that were not detected by IRS’s internal reviews. IRS corrected these errors after we brought them to its attention. However, until IRS fully documents the specific procedures performed by its statistician in each step of the unpaid assessment estimation process and the specific procedures for reviewers to follow in their reviews, IRS faces increased risk that errors in this process will not be prevented or detected and corrected. We will continue to review IRS’s corrective actions to address this recommendation during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. In January 2009, IRS implemented programming changes to the Business Master File computer program where accuracy-related penalties assessed subsequent to the programming change will carry the same date as the related deficiency assessment. Open. IRS completed its corrective action after the end of our fiscal year 2008 audit. We will review IRS’s corrective action to address this recommendation during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. IRS assembled a team of interest and penalty subject matter experts to perform a review of master file programming of penalty and interest computations. The review included a general random sample of open modules as well as a sample of modules impacted by recent implementation of programming changes. SB/SE performed the review the week of May 19, 2008. SB/SE will continue to perform these reviews periodically and implement any necessary changes to programming as a result. Closed. We confirmed that IRS completed its review of existing master file computer programs that affect penalty calculations and documented a listing of instances in which programs are not functioning in accordance with the intent of the IRM. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. IRS formed a cross- functional working group to address penalty and interest programming issues in August 2007. This group meets biweekly and continues to identify and assess penalty and interest issues. When issues that need correction are identified, programming changes are requested and IRS performs subsequent testing to ensure that the programming change resolved the issue. Resolutions of these identified issues are in various stages. Other issues are being discussed with Modernization & Information Technology Services to determine the most effective way to implement programming changes, and on certain cases an impact analysis determined correction is not cost effective at this time. Solutions to identified systemic differences between IRS systems that cannot be fixed under the current processing system are being addressed by modernization efforts. Open. Although IRS completed its review of master file computer programs that affect penalty calculations and has planned a series of corrective actions, it has not yet completed all of the required programming corrections. We will continue to review IRS’s corrective actions to address this recommendation during our fiscal year 2009 and future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. Managers follow IRM 1.4.11 as comprehensive guidance for conducting reviews at all TACs. TAC managers use the one-day receipt per TAC per quarter process to ensure at least once per quarter, the manager performs a one day review of all payment receipts as well as the documents associated with the receipts for all employees with payment receipts on the date chosen for review. Area directors are responsible for the oversight of all TAC activities including outlying post of duties. IRM 1.4.11.6.2 outlines the scheduled routine visit requirement for each TAC and Exhibit 1.4.11-11 gives a description of all required reviews for each TAC, including the frequency. Validation of completion is documented through operational reviews. The results of the operational reviews indicate a summary of findings, which included a corrective action report, completed annually. Open. IRM 1.4.11 provides guidance for managerial reviews and frequency of these reviews at outlying TACs. Also, the IRM outlines the TAC Security Remittance Review Database process and requires managers to input the results of their reviews into the database. However, the database was not fully implemented in fiscal year 2008. As a result, we were unable to fully test its implementation during our audit fieldwork. We will review IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. The Director of Field Assistance issued a quarterly reminder to managers to conduct required reviews on September 30, 2008. Field Assistance continues to review the monthly reports received from field offices, including the status of corrective actions noted during operational reviews, to ensure completion of needed improvements. Open. We will review IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. IRM 1.4.11.19.4.1.1 was revised in April 2008 to mandate the use of the “restrict” command code in all cases. Group managers will continue to be reminded of the existing requirements to restrict command codes as part of the Form 809 Annual Reconciliation Review. During this review, group managers use a check sheet as shown in IRM 3.8.45.29.15, which includes this validity check. The result of the review is sent to territory managers and Submission Processing. Furthermore, restricted IDRS command codes are addressed in ongoing operational reviews. IRM 1.4.11.19.4 guidance is provided to restrict the 809 book holders profile when ordering the initial 809 receipt book. IRM 1.4.11.19.4.1.1 establishes the requirement for group managers to use restrict command codes from an 809 book holders profile. IRM 1.4.11-15 TAC Payment Processing Checklist is completed as part of the payment processing review conducted quarterly, which includes a question addressing restrict command codes. Finally, IRM 1.4.11.19.4.1.1.1 covers the annual reconciliation of official receipts, which managers can use as an annual monitoring process in addition to operational reviews. Closed. IRS mandated the use of the restrict command codes to TAC employees accepting cash payments to limit their IDRS access rights and ability to adjust taxpayer accounts. These procedures are monitored during operational reviews conducted by area and territory managers, at which time group managers are reminded of the existing requirements to restrict command codes. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. Guidance concerning armed first responders to TAC duress alarms was reissued via email to area directors for distribution on August 19, 2008, and subsequently finalized in IRM 10.2.14, Methods of Providing Protection, issued October 1, 2008. The IRM specifies, “An armed ‘First Responder’ (guard police) must be listed as the first responder, as the shortest possible response time is critical with priority notification. The alarm notification priority protocols are: (1) First Priority: on-site guards are notified; (2) Second Priority, Federal Protective Service is notified, and (3) Third Priority, local police who will be notified last.” The TAC Scheduled Duress Alarm Test Report was revised to include a section to indicate the date the notification list for first responders was last updated. The reports are rolled up from the Areas/Territories to the Security Programs office quarterly. The revised report was instituted via e-mail on July 24, 2008. PSEP continues to utilize the Audit Management Checklist as a repeatable process where Territory offices validate that proper first responders are listed for notification. Closed. IRS established procedures in the IRM requiring quarterly verification that individuals designated as first responders to TAC duress alarms are appropriately qualified and geographically located to respond to the potentially dangerous situations in an effective and timely manner. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. IRS finalized and issued IRM 10.2.14, Methods of Providing Protection on October 1, 2008. IRM 10.2.14.9.2(7)a specifies: “An armed ‘First Responder’ (guard police) must be listed as the first responder, as the shortest possible response time is critical with priority notification. The alarm notification priority protocols are: (1) First Priority: on-site guards are notified; (2) Second Priority, Federal Protective Service is notified, and (3) Third Priority, local police who will be notified last.” The TAC Scheduled Duress Alarm Test Report was revised to include a section to indicate the date the notification list for first responders was last updated. The reports are rolled up from the Areas/Territories to the Security Programs office quarterly. The revised report form was instituted via e-mail on July 24, 2008. PSEP continues to utilize the Audit Management Checklist as a repeatable process where Territory offices validate that proper first responders are listed for notification. Closed. IRS revised the IRM to specify the qualifications and geographical proximity requirements for individuals designated as first responders and included a provision for PSEP to conduct quarterly reviews of this issue. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Open. AWSS has been working with the General Services Administration (GSA) since March 2008 to implement a process for procuring services from GSA to perform contractor background investigations. AWSS prepared and submitted a draft interagency agreement to GSA for consideration in June 2008. IRS received and reviewed the GSA comments, and is finalizing the interagency agreement for pricing and services. GSA has submitted a draft three-phase schedule for completion of the background investigations that would complete enter-on-duty determinations for all facilities by November 2009. Implementation is contingent upon GSA successfully completing its actions. Open. During our fiscal year 2008 audit, we identified instances at three TACs where IRS did not have documentary evidence demonstrating the completion of favorable background investigations for contractors performing janitorial services during non-operating hours. We will review IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Open. IRS developed a Performance Work Statement for a National Document Destruction Contract. IRS expects full contract implementation by October 1, 2009. Implementing a national contract will standardize these requirements and ensure consistency. In the interim, the current contracts require a review of contractor performance through site visits and to ensure that contractors comply with all security requirements for employee clearance prior to performing the work. AWSS distributed a message to the Real Estate and Facilities Management Territory Managers and Logistics Chiefs on January 23, 2009, reinforcing the requirement to review their existing shred contracts to ensure they comply with the security requirements stated in their respective contracts. Open. As stated in IRS’s response, the Performance Work Statement for a National Document Destruction Contract will not be fully implemented until the first quarter of fiscal year 2010. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Open. IRS developed a Performance Work Statement for a National Document Destruction Contract. IRS expects full contract implementation by October 1, 2009. Implementing a national contract will standardize these requirements and ensure consistency. In the interim, the current contracts require a review of contractor performance through site visits and to ensure that contractors comply with all security requirements for employee clearance prior to performing the work. IRS distributed a message on January 23, 2009, reinforcing the requirement to review their existing shred contracts to ensure they comply with the security requirements stated in their respective contracts. Open. As stated in IRS’s response, the Performance Work Statement for a National Document Destruction Contract will not be fully implemented until the first quarter of fiscal year 2010. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Open. IRS developed a Performance Work Statement for a National Document Destruction Contract. IRS expects full contract implementation by October 1, 2009. Implementing a national contract will standardize these requirements and ensure consistency. In the interim, the current contracts require a review of contractor performance through site visits, in order to ensure that contractors comply with all security requirements for employee clearance prior to performing the work. IRS distributed a message on January 23, 2009, reinforcing the requirement to review their existing shredding contracts to ensure they comply with the security requirements stated in their respective contracts. Open. As stated in IRS’s response, the Performance Work Statement for a National Document Destruction Contract will not be fully implemented until the first quarter of fiscal year 2010. In addition, during our fiscal year 2008 audit, we identified an instance at one of three SCCs we visited where shredding service contractor employees did not go through background investigations before they were granted access to taxpayer or other sensitive information. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. The Human Capital Office issued a notice in September 2007 to each Employment Branch Chief to reinforce this policy; and the office also sends periodic reminders to the Employment Offices during monthly calls with the employment staffs. The Human Capital Office also issued Alert 731-2 on September 29, 2008, to all Employment Offices clarifying the guidance provided in Policy No. 15. In October 2008, Policy and Programs received written confirmation from every Employment Office that Policy No. 15 was being followed and that the correct Form 13094 was being used. Open. During our fiscal year 2008 audit, we identified four juveniles hired in fiscal year 2008 who were not provided a revised Form 13094. We will review IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. The Human Capital Office revised Form 13094 in December 2007 and provided the form and accompanying instructions to the employment staff in January 2008. The Human Capital Office also issued Alert 731-2 on September 29, 2008, to all Employment Offices clarifying the guidance provided in Policy No. 15. In October 2008, Policy and Programs received written confirmation from every Employment Office that Policy No. 15 was being followed and that the correct Form 13094 was being used. Open. During our fiscal year 2008 audit, we identified five instances where the IRS employment office staff did not verify the information on Form 13094 by contacting the reference directly and documenting the details of that contact. We will review IRS’s corrective actions during our fiscal year 2009 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. W&I Submission Processing issued a memorandum in April 2008 to the operations manager of Receipt and Control, reiterating the requirement to follow procedures in IRM 3.45.1 to conduct supervisory reviews of the deposit encoding tapes and the recapitulation of remittances, deposit tickets, and to sign or initial the documents as evidence that the reviews were completed. Receipt and Control is also following IRM 3.45.1 to conduct and document supervisory reviews of the TE/GE deposits. Closed. We verified that IRS issued a memorandum to its operations manager of Receipt and Control to reinforce procedures in its IRM requiring signed supervisory review of TE/GE user fee deposits. Additionally, during our fiscal year 2008 audit, we did not identify any instances where IRS did not document supervisory review of the TE/GE user fee deposits tested. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. The electronic Purchase Card Module eliminated the paper statement of accounts being mailed to purchase cardholders using the Purchase Card Module. The purchase cardholder and approving official electronically reconcile and approve the transactions, which is evidence of their signature approving the transactions. The system maintains history on the user login name and date of the action. Closed. We confirmed that IRS modified its existing guidelines and fully implemented the Purchase Card Module. During our fiscal year 2008 audit, we noted that the purchase card approving official’s signature attesting to the review and reconciliation of the monthly statement is now captured electronically by the Purchase Card Module. However, we also noted that the purchase card approving officials were not always electronically reconciling and approving transactions within the required timeframes documented in IRS’s existing guidelines. Timely reconciliation and approval of transactions is necessary to help ensure that purchase card transactions are valid and appropriate. Thus, we are closing this recommendation and opening a new recommendation to address this additional issue in our June 2009 management report. See GAO-09-513R and recommendation 09-10 in this report. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. IRS provides purchase cardholders with funding approval requirements during initial and refresher training. The guidelines outlining funding requirements are also available online in the Purchase Card Guide and on the program specific Web site. As IRS converted purchase cardholders to the Purchase Card Module, it highlighted this requirement in the transition guidelines. Closed. We confirmed that IRS modified its existing guidelines and fully implemented the Purchase Card Module. During our fiscal year 2008 audit, we noted that purchase cardholders obtained funding approval electronically through the Purchase Card Module prior to making a purchase. The Purchase Card Module directly interfaces with the funding requisition function of IRS’s Web- based Requisition Tracking System to verify funds availability. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. Citibank reports previously received by purchase card approving officials were eliminated with implementation of the Purchase Card Module. All documentation for purchase card activity is maintained electronically in the Purchase Card Module with the exception of packing slips/receipts, which are maintained by the cardholder. The documentation is available for review by the approving official, but approving officials are not required to maintain copies of documentation already maintained by the cardholder. Closed. Even though IRS did not modify its existing guidelines to require the purchase card approving official to maintain copies of the purchase cardholder’s supporting documentation, we confirmed that IRS now has compensating internal control procedures in place to close this recommendation. IRS’s existing guidelines require the purchase cardholder to maintain the supporting documentation and for approving officials to ensure that the cardholders have all required documentation. During our fiscal year 2008 audit, we noted that the purchase cardholders maintained appropriate supporting documentation. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. The requirement to maintain supporting documentation for all purchase card activity for 3 years is outlined in current guidance and training material provided to cardholders. The documentation is available for review by the approving official, but is maintained by the cardholder. Closed. Even though IRS did not modify its existing guidelines, we confirmed that the current guidelines require cardholders to maintain supporting documentation for 3 years. IRS’s existing guidelines require the purchase cardholder to maintain the supporting documentation and for approving officials to ensure that the cardholders have all required documentation. During our fiscal year 2008 audit, we noted that the purchase cardholders maintained appropriate supporting documentation. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. Modernization & Information Technology Services issued a memorandum dated September 5, 2008, and Directive (Asset Management Policy Directive AM 034) dated August 18, 2008, to all organizations reiterating the IRS policy that new assets must be inputted into the inventory system within 10 days of receipt. Closed. During our fiscal year 2008 audit, IRS’s Associate Chief Information Officer for End User Equipment Services, in response to our recommendations, issued a memorandum to all personnel responsible for updating inventory. The memorandum reiterated IRS’s existing policy requiring that new assets be inputted into the inventory system within 10 days of receipt. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Closed. AWSS issued communications to all employees reiterating the policy requiring all employees to obtain approval of travel authorizations before the initiation of travel through periodic notices on the IRS intranet with links to Travel Times. In Travel Times, IRS has issued: Travel Authorization Reminders (October 2007 and February 2008) and Travel Authorization Reminder News from the business units (December 2007, February 2008, and May 2008). Furthermore, IRS is continuing to implement GovTrip and as of January 1, 2009, has 25,775 GovTrip users. All users must file a travel authorization before travel begins, and GovTrip will not allow a voucher to be created without a signed/approved authorization. Open. We confirmed that IRS issued communications to staff reiterating the policy that all employees receive travel authorization before commencing travel, and that IRS continues to implement its GovTrip system with full implementation expected by approximately July 2009. However, during our fiscal year 2008 audit, we continued to identify instances where IRS staff did not obtain approval of travel authorizations in advance of travel. We will continue to review actions being taken by IRS to address this recommendation during our fiscal year 2009 audit. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. Management Report: Improvements Are Needed to Enhance IRS’s Internal Controls and Operating Effectiveness (GAO-09-513R, June 2009) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will verify IRS’s corrective actions during future audits. The Internal Revenue Service (IRS) does not have financial management systems adequate to enable it to accurately generate and report, in a timely manner, the information needed to both prepare financial statements and manage operations on an ongoing basis. To overcome these systemic deficiencies with respect to preparation of its annual financial statements, IRS was compelled to employ compensating procedures. Specifically, IRS (1) did not have an adequate general ledger system for tax-related transactions, and (2) was unable to readily determine the costs of its activities and programs and did not have cost-based performance information to assist in making or justifying resource allocation decisions. As a result, IRS does not have data to assist in managing operations on a day-to-day basis and to provide an informed basis for making or justifying resource allocation decisions. IRS has serious internal control issues that affected its management of unpaid tax assessments. Specifically, IRS (1) lacked a subsidiary ledger for unpaid tax assessments that would allow it to produce accurate, useful, and timely information with which to manage and report externally, and (2) experienced errors and delays in recording taxpayer information, payments, and other activities. Significant information security weaknesses continue to jeopardize the confidentiality, availability, and integrity of information processed by IRS’s key systems, increasing the risk of material misstatement for financial reporting. For example, sensitive information, such as user identification and passwords for mission-critical applications, continued to be readily available to any user on IRS’s internal network. These IDs and passwords could be used by a malicious user to compromise data flowing to and from IFS. Other continuing weaknesses included the existence of passwords that were not complex enough to avoid being guessed or cracked. In addition, although IRS had improved its application of vendor-supplied system patches that protect against known vulnerabilities, it still had not patched systems in a timely manner. The agency’s procurement system, which processed approximately $1.8 billion of obligations in fiscal year 2008, also remained at risk because previously reported weaknesses had not been corrected. These weaknesses included (1) not restricting user’s ability to bypass application controls, (2) continuing to use unencrypted protocols, and (3) not removing separated employees’ access in a timely manner. These outstanding weaknesses increase the risk that data processed by the agency’s financial management systems are not reliable. Material Weakness: Controls over Information Systems Security Although IRS has made some progress in addressing previous weaknesses we identified in its information systems security controls and physical security controls, these and new weaknesses in information systems security continue to impair IRS’s ability to ensure the confidentiality, integrity, and availability of financial and tax-processing systems. As of January 2009, there were 74 open recommendations from our information systems security work designed to help IRS improve its information systems security controls. Those recommendations are reported separately and are not included in this report primarily because of the sensitive nature of some of the issues. Weaknesses in control over tax revenue and refunds continue to hamper IRS’s ability to optimize the use of its limited resources to collect unpaid taxes and minimize payment of improper refunds. Specifically, IRS has not (1) developed performance metrics and goals on the cost of, and the revenue collected from, IRS’s various enforcement programs and activities, with the exception of the Earned Income Tax Credit program; or (2) fully established and implemented the financial management structure and processes to provide IRS key financial management data on costs and enforcement tax revenue. These deficiencies inhibit IRS’s ability to appropriately assess and routinely monitor the relative merits of its various enforcement initiatives and adjust its strategies as needed. This, in turn, can significantly affect both the level of enforcement tax revenue collected and improper refunds disbursed. IRS did not always release the applicable federal tax lien within 30 days of the tax liability being either paid off or abated, as required by the Internal Revenue Code (section 6325). The Internal Revenue Code grants IRS the power to file a lien against the property of any taxpayer who neglects or refuses to pay all assessed federal taxes. The lien serves to protect the interest of the federal government and as a public notice to current and potential creditors of the government’s interest in the taxpayer’s property. The recommendations listed below pertain to issues that do not rise individually or in the aggregate to the level of a significant deficiency or a material weakness. However, these issues do represent weaknesses in various aspects of IRS’s control environment that should be addressed. In addition to the contact named above, the following individuals made major contributions to this report: William J. Cordrey, Assistant Director; Ray Bush; Stephanie Chen; Nina Crocker; Oliver Culley; Charles Ego; Doreen Eng; Charles Fox; Valerie Freeman; Ted Hu; Richard Larsen; Delores Lee; Gail Luna; Julie Phillips; John Sawyer; Christopher Spain; Cynthia Teddleton; Lien To; LaDonna Towler; and Gary Wiggins.

Summary: In its role as the nation's tax collector, the Internal Revenue Service (IRS) has a demanding responsibility to annually collect trillions of dollars in taxes, process hundreds of millions of tax and information returns, and enforce the nation's tax laws. Since its first audit of IRS's financial statements in fiscal year 1992, GAO has identified a number of weaknesses in IRS's financial management operations. In related reports, GAO has recommended corrective actions to address those weaknesses. Each year, as part of the annual audit of IRS's financial statements, GAO makes recommendations to address any new weaknesses identified and follows up on the status of IRS's efforts to address the weaknesses GAO identified in previous years' audits. The purpose of this report is to (1) provide the status of audit recommendations and actions needed to fully address them and (2) demonstrate how the recommendations relate to control activities central to IRS's mission and goals. IRS has made significant progress in improving its internal controls and financial management since its first financial statement audit in 1992, as evidenced by 9 consecutive years of clean audit opinions on its financial statements, the resolution of several material internal control weaknesses, and actions resulting in the closure of over 200 financial management recommendations. This progress has been the result of hard work throughout IRS and sustained commitment at the top levels of the agency. However, IRS still faces financial management challenges. At the beginning of GAO's audit of IRS's fiscal year 2008 financial statements, 81 financial management-related recommendations from prior audits remained open because IRS had not fully addressed the issues that gave rise to them. During the fiscal year 2008 financial audit, IRS took actions that GAO considered sufficient to close 35. At the same time, GAO identified additional internal control issues resulting in 16 new recommendations. In total, 62 recommendations remain open. To assist IRS in evaluating and improving internal controls, GAO categorized the 62 open recommendations by various internal control activities, which, in turn, were grouped into three broad control categories. The continued existence of internal control weaknesses that gave rise to these recommendations represents a serious obstacle that IRS needs to overcome. Effective implementation of GAO's recommendations can greatly assist IRS in improving its internal controls and achieving sound financial management and can help enable it to more effectively carry out its tax administration responsibilities. Most can be addressed in the short term (the next 2 years). However, a few recommendations, particularly those concerning IRS's automated systems, are complex and will require several more years to effectively address.