Internal control is not one event, but a series of actions and activities that occur throughout an entity’s operations and on an ongoing basis. Internal control should be recognized as an integral part of each system that management uses to regulate and guide its operations rather than as a separate system within an agency. In this sense, internal control is management control that is built into the entity as a part of its infrastructure to help managers run the entity and achieve their goals on an ongoing basis. Section 3512 (c), (d) of Title 31, U.S. Code, commonly known as the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), requires agencies to establish and maintain internal control. The agency head must annually evaluate and report on the control and financial systems that protect the integrity of federal programs. The requirements of FMFIA serve as an umbrella under which other reviews, evaluations, and audits should be coordinated and considered to support management’s assertion about the effectiveness of internal control over operations, financial reporting, and compliance with laws and regulations. Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for Internal Control, provides the implementing guidance for FMFIA, and sets out the specific requirements for assessing and reporting on internal controls consistent with the internal control standards issued by the Comptroller General of the United States. The circular defines management’s responsibilities related to internal control and the process for assessing internal control effectiveness, and provides specific requirements for conducting management’s assessment of the effectiveness of internal control over financial reporting. The circular requires management to annually provide assurances on internal control in its performance and accountability report, and for each of the 24 Chief Financial Officers Act agencies to include a separate assurance on internal control over financial reporting, along with a report on identified material weaknesses and corrective actions. The circular also emphasizes the need for integrated and coordinated internal control assessments that synchronize all internal control-related activities. FMFIA requires GAO to issue standards for internal control in the federal government. The Standards for Internal Control in the Federal Government (i.e., internal control standards) provides the overall framework for establishing and maintaining effective internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. As summarized in the internal control standards, the minimum level of quality acceptable for internal control in the government is defined by the following five standards, which also provide the basis against which internal controls are to be evaluated: Control environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk assessment: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Control activities: Internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Information and communications: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. The third control standard—control activities—helps ensure that management’s directives are carried out. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives. In other words, they are the activities conducted in the everyday course of business that are intended to accomplish a control objective, such as ensuring IRS employees successfully complete background checks prior to being granted access to taxpayer information and receipts. As such, control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and achievement of effective results. A key objective in our annual audits of IRS’s financial statements is to obtain reasonable assurance about whether IRS maintained effective internal controls with respect to financial reporting, including safeguarding of assets, and compliance with laws and regulations. While we use all five internal control standards as a basis for evaluating the effectiveness of IRS’s internal controls, we place a heavy emphasis on testing control activities. Our evaluations and tests have resulted in the identification of issues in certain internal controls over the years and recommendations for corrective action. To accomplish our objectives, we evaluated the effectiveness of IRS’s corrective actions implemented in response to open recommendations during fiscal year 2007 as part of our fiscal years 2007 and 2006 financial audits. To determine the current status of the recommendations, we (1) obtained IRS’s reported status of each recommendation and corrective action taken or planned as of April 2008, and (2) compared IRS’s reported status to our fiscal year 2007 audit findings to identify any differences between IRS’s and our conclusions regarding the status of each recommendation. In order to determine how these recommendations fit within IRS’s management and internal control structure, we compared the open recommendations, and the issues that gave rise to them, to the control activities listed in the internal control standards and to the list of major factors and examples outlined in our Internal Control Management and Evaluation Tool. We also considered how the recommendations and the underlying issues were categorized in our prior reports; whether IRS had addressed, in whole or in part, the underlying control issues that gave rise to the recommendations; and other legal requirements and implementing guidance, such as OMB Circular No. A-123; FMFIA; and the Federal Information System Controls Audit Manual (FISCAM). Our work was performed from December 2007 through May 2008 in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Commissioner of Internal Revenue or his designee on June 9, 2008. We received comments from the Commissioner on June 24, 2008. IRS continues to make progress addressing its significant financial management challenges. Over the years since we first began auditing IRS’s financial statements in fiscal year 1992, IRS has taken actions enabling us to close over 200 of our financial management-related recommendations. This includes 18 recommendations we are closing based on actions IRS took during the period covered by our fiscal year 2007 financial audit. At the same time, however, our audits continue to identify additional internal control issues, resulting in our making further recommendations for corrective action, including 24 new financial management-related recommendations resulting from our fiscal year 2007 financial audit. These internal control issues, and the resulting recommendations, can be directly traced to the control activities in the internal control standards. As such, it is essential that they be fully addressed and resolved to strengthen IRS’s overall financial management and to assist it in efficiently and effectively achieving its goals and mission. In June 2007, we issued a report on the status of IRS’s efforts to implement corrective actions to address financial management recommendations stemming from our fiscal year 2006 and prior year financial audits and other financial management-related work. In that report, we identified 75 audit recommendations that at that time remained open and thus required corrective action by IRS. A significant number of these recommendations had been open for several years, either because IRS had not taken corrective action or because the actions taken had not yet fully and effectively resolved the issues that gave rise to the recommendations. IRS continued to work to address many of the internal control issues to which these open recommendations relate. In the course of performing our fiscal year 2007 financial audit, we identified numerous actions IRS took to address many of its internal control issues. On the basis of IRS’s actions, which we were able to substantiate through our audit, we are able to close 18 of these prior years’ recommendations. IRS considers another 23 of the prior years’ recommendations to be effectively addressed. However, we still consider them to be open either because we had not yet been able to verify the effectiveness of IRS’s actions—they occurred subsequent to completion of our audit testing and thus have not been verified, which is a prerequisite to our closing a recommendation—or because the actions taken did not fully address the issue that gave rise to the recommendation. However, continued efforts are needed by IRS to address its internal control issues. While we are able to close 18 financial management recommendations made in prior years, 57 recommendations from prior years remain open, a significant number of which have been outstanding for several years. In some cases, IRS may have effectively addressed the issues that gave rise to the recommendations subsequent to our fiscal year 2007 audit testing. However, in many cases, we determined based on the work performed for our fiscal year 2007 audit that IRS’s actions taken to date had not yet fully and effectively addressed the underlying internal control issues. Additionally, during our audit of IRS’s fiscal year 2007 financial statements, we identified additional issues that require corrective action by IRS. In a recent management report to IRS, we discussed these issues, and made 24 new recommendations to IRS to address them. Consequently, a total of 81 financial management-related recommendations were open at the end of fiscal year 2007 and need to be addressed by IRS. While most of our open recommendations can be addressed in the short term, a few recommendations, particularly those concerning IRS’s automated systems, are complex and will require several more years to fully and effectively address. We consider 71 recommendations to be short-term and 10 to be long-term. In addition to the 81 open recommendations from our financial audits and other financial management-related work, we have 76 open recommendations as a result of our assessment of IRS’s information security controls over key financial systems, data, and interconnected networks at IRS’s critical data processing facilities. One of those open recommendations relates to IRS’s need to implement an agencywide information security program, the lack of which was a key reason for the material weakness in IRS’s information systems security controls over its financial and tax processing systems. Unresolved, previously reported recommendations and newly identified ones related to information security increase the risk of unauthorized disclosure, modification, or destruction of financial and sensitive taxpayer data. Recommendations resulting from of the information security portion our annual audits of IRS’s financial statements are reported separately and are not included in this report primarily because of the sensitive nature of some of these issues. Linking the open recommendations from our financial audits and other financial management-related work, and the issues that gave rise to them, to internal control activities that are central to IRS’s tax administration responsibilities provides insight regarding their significance. The internal control standards define 11 control activities. These control activities can be further grouped into three broad categories: Safeguarding of assets and security activities: physical control over vulnerable assets, segregation of duties, controls over information processing, and access restrictions to and accountability for resources and records. Proper recording and documenting of transactions: appropriate documentation of transactions and internal control, accurate and timely reporting of transactions and events, and proper execution of transactions and events. Effective management review and oversight: reviews by management at the functional or activity level, establishment and review of performance measures and indicators, management of human capital, and top-level reviews of actual performance. Each of the open recommendations from our financial audits and financial management-related work, and the underlying issues that gave rise to them, can be traced back to 1 of the 11 control activities (grouped into three broad categories). Table 1 presents a summary of the open recommendations, each of which is categorized by the control activity to which it best relates. As table 1 indicates, 21 recommendations (26 percent) relate to issues associated with IRS’s lack of effective controls over safeguarding of assets and security activities. Another 33 recommendations (41 percent) relate to issues associated with IRS’s inability to properly record and document transactions. The remaining 27 open recommendations (33 percent) relate to issues associated with the lack of effective management review and oversight. On the following pages, we group the 81 open recommendations under the control activity to which the condition that gave rise to them most appropriately fits. We first define each control activity as presented in the internal control standards and briefly identify some of the key IRS operations that fall under that control activity. Although not comprehensive, the descriptions are intended to help explain why actions to strengthen these control activities are important for IRS to efficiently and effectively carry out its overall mission. For each recommendation, we also indicate whether it is a short-term or long-term recommendation. Given IRS’s mission, the sensitivity of the data it maintains, and its processing of trillions of dollars of tax receipts each year, one of the most important control activities at IRS is the safeguarding of assets. Internal control in this important area should be designed to provide reasonable assurance regarding prevention or prompt detection of unauthorized acquisition, use, or disposition of an agency’s assets. We have grouped together the four control activities in the internal control standards that relate to safeguarding of assets (including tax receipts) and security activities (such as limiting access to only authorized personnel): (1) physical control over vulnerable assets, (2) segregation of duties, (3) controls over information processing, and (4) access restrictions to and accountability for resources and records. Internal control standard: an agency must establish physical control to secure and safeguard vulnerable assets. Examples include security for and limited access to assets such as cash, securities, inventories, and equipment which might be vulnerable to risk of loss or unauthorized use. Such assets should be periodically counted and compared to control records. IRS is charged with collecting trillions of dollars in taxes each year, a significant amount of which is collected in the form of checks and cash accompanied by tax returns and related information. IRS collects taxes both at its own facilities as well as at lockbox banks that operate under contract with the Department of the Treasury’s Financial Management Service (FMS) to provide processing services for certain taxpayer receipts for IRS. IRS acts as custodian for (1) the tax payments it receives until they are deposited in the General Fund of the U.S. Treasury and (2) the tax returns and related information it receives until they are either sent to the Federal Records Center or destroyed. IRS is also charged with controlling many other assets, such as computers and other equipment, but IRS’s legal responsibility to safeguard tax returns and the confidential information taxpayers provide on tax returns makes the effectiveness of its internal controls with respect to physical security essential. IRS receives cash and checks mailed to its service centers or lockbox banks with accompanying tax returns and information or payment vouchers and payments made in person at its offices. While effective physical safeguards over receipts should exist throughout the year, it is especially important during the peak tax filing season. Each year during the weeks preceding and shortly after April 15, an IRS service center campus (SCC) or lockbox bank may receive and process daily over 100,000 pieces of mail containing returns, receipts, or both. The dollar value of receipts each service center and lockbox bank processes increases to hundreds of millions of dollars a day during the April 15 time frame. Of our 81 open recommendations, the following 9 open recommendations are designed to improve IRS’s physical controls over vulnerable assets. All are short-term in nature. (See table 2.) Internal control standard: Key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets. No one individual should control all key aspects of a transaction or event. IRS employees are responsible for processing trillions of dollars of tax receipts each year, of which hundreds of billions are received in the form of cash or checks, and for processing hundreds of billions of dollars in refunds to taxpayers. Consequently, it is critical that IRS maintain appropriate separation of duties to allow for adequate oversight of staff and protection of these vulnerable resources so that no single individual would be in a position of causing an error or irregularity, potentially converting the asset to personal use, and then concealing it. For example, when an IRS field office or lockbox bank receives taxpayer receipts and returns, it is responsible for depositing the cash and checks in a depository institution and forwarding the related information received to an SCC for further processing. In order to adequately safeguard receipts from theft, the person responsible for recording the information from the taxpayer receipts on a voucher should be different from the individual who prepares those receipts for transmittal to the SCC for further processing. Also, for procurement of goods and services, the person who places an order for goods and services should be different from the person who receives the goods and services. Such separation of duties will help to prevent the occurrence of fraud, theft of IRS assets, or both. The following three open recommendations would help IRS improve its separation of duties, which will in turn strengthen its controls over tax receipts and refunds and procurement activities. All are short-term in nature. (See table 3.) Internal control standard: A variety of control activities are used in information processing. Examples include edit checks of data entered, accounting for transactions in numerical sequences, and comparing file totals with control totals. There are two broad groupings of information systems control—general control (for hardware such as mainframe, network, end-user environments) and application control (processing of data within the application software). General controls include entitywide security program planning, management, and backup recovery procedures and contingency and disaster planning. Application controls are designed to help ensure completeness, accuracy, authorization, and validity of all transactions during application processing. IRS relies extensively on computerized systems to support its financial and mission-related operations. To efficiently fulfill its tax processing responsibilities, IRS relies extensively on interconnected networks of computer systems to perform various functions, such as collecting and storing taxpayer data, processing tax returns, calculating interest and penalties, generating refunds, and providing customer service. As part of our annual audits of IRS’s financial statements, we assess the effectiveness of IRS’s information security controls over key financial systems, data, and interconnected networks at IRS’s critical data processing facilities that support the processing, storage, and transmission of sensitive financial and taxpayer data. From that effort over the years, we have identified information security control weaknesses that impair IRS’s ability to ensure the confidentiality, integrity, and availability of its sensitive financial and taxpayer data. As of January 2008, there were 76 open recommendations from our information security work designed to improve IRS’s information security controls. As discussed previously, recommendations resulting from our information security work are reported separately and are not included in this report primarily because of the sensitive nature of these issues. However, the following open short-term recommendation is related to systems limitations and IRS’s need to enhance its computer programs. (See table 4.) Internal control standard: Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained. Periodic comparison of resources with the recorded accountability should be made to help reduce the risk of errors, fraud, misuse, or unauthorized alteration. Because IRS deals with a large volume of cash and checks, it is imperative that it maintain strong controls to appropriately restrict access to those assets, the records that track those assets, and sensitive taxpayer information. Although IRS has a number of both physical and information system controls in place, some of the issues we have identified in our financial audits over the years pertain to ensuring that those individuals who have direct access to these cash and checks are appropriately vetted before being granted access to taxpayer receipts and information and to ensuring that IRS maintains effective access security control. The following eight open short-term recommendations would help IRS improve its access restrictions to assets and records. (See table 5.) Proper Recording and Documenting of Transactions One of the largest obstacles continuing to face IRS management is the agency’s lack of an integrated financial management system capable of producing the accurate, useful, and timely information IRS managers need to assist in making well-informed day-to-day decisions. While IRS is making progress in modernizing its financial management capabilities, it nonetheless continues to face many pervasive internal control weaknesses related to its long-standing systems deficiencies that we have reported each year since we began auditing its financial statements in fiscal year 1992. These deficiencies can only be addressed as part of a longer-term effort to overhaul and integrate IRS’s financial management system structure. Because of the long-standing, pervasive nature of these deficiencies, their resolution is likely to require more than 2 additional years. Nevertheless, IRS also has a number of internal control issues that relate to recording transactions, documenting events, and tracking the processing of taxpayer receipts or information, which do not depend upon longer-term efforts to overhaul and integrate its information systems. We have grouped three control activities together that relate to proper recording and documenting of transactions: (1) appropriate documentation of transactions and internal controls, (2) accurate and timely recording of transactions and events, and (3) proper execution of transactions and events. Internal control standard: Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals and may be in paper or electronic form. All documentation and records should be properly managed and maintained. IRS collects and processes trillions of dollars in taxpayer receipts annually both at its own facilities and at lockbox banks under contract to process taxpayer receipts for the federal government. Therefore, it is important that IRS maintain effective controls to ensure that all documents and records are properly and timely recorded, managed, and maintained both at its facilities and at the lockbox banks. IRS must adequately document and disseminate its procedures to ensure that they are available for IRS employees. IRS must also document its management reviews of those controls, such as those regarding refunds and returned checks, credit card purchases, and reviews of TACs. Finally, to ensure future availability of adequate documentation, IRS must ensure that its systems, particularly those now being developed and implemented, have appropriate capability to trace transactions. The following 12 open recommendations would assist IRS in improving its documentation of transactions and internal control procedures. Eleven of these recommendations are short-term, and one is long-term. (See table 6.) Internal control standard: Transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from the initiation and authorization through its final classification in summary records. In addition, control activities help to ensure that all transactions are completely and accurately recorded. IRS is responsible for maintaining taxpayer records for tens of millions of taxpayers in addition to maintaining its own financial records. To carry out this responsibility, IRS often has to rely on outdated computer systems or manual work-arounds. Unfortunately, some of IRS’s recordkeeping difficulties we have reported on over the years will not be addressed until it can replace its aging systems, which is a long-term effort and depends on future funding. The following 18 open recommendations would strengthen IRS’s recordkeeping abilities. (See table 7.) Twelve of these recommendations are short-term, and 6 are long-term. They include specific recommendations regarding requirements for new systems for maintaining taxpayer records. Several of the recommendations listed affect financial reporting processes, such as subsidiary records and appropriate allocation of costs. Some of the issues that gave rise to several of our recommendations directly affect taxpayers, such as those involving duplicate assessments, errors in calculating and reporting manual interest, errors in calculating penalties, and recovery of trust fund penalty assessments. About 38 percent of these recommendations are 5 years or older and 1 is over 10 years old, reflecting the complex nature of the underlying system issues that must be resolved to fully address of some of these issues. Internal control standard: Transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of ensuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. Authorizations should be clearly communicated to managers and employees. IRS employs tens of thousands of people in its 10 SCCs, three computing centers, and numerous field offices throughout the United States. In addition, the number of staff increases significantly during the peak of the tax filing season. Because of the significant number of personnel involved, IRS must maintain effective control over which employees are authorized to either view or change sensitive taxpayer data. IRS’s ability to establish access rights and permissions for information systems is a critical control. Each year, IRS pays out hundreds of billions of dollars in tax refunds, some of which are distributed to taxpayers manually. IRS requires that all manual refunds be approved by designated officials. However, weaknesses in the authorization of such approving officials expose the federal government to losses because of the issuance of improper refunds. Likewise, the failure to ensure that employees obtain appropriate authorizations to use purchase cards or initiate travel similarly leave the government open to fraud, waste, or abuse. The following three open short-term recommendations would improve IRS’s controls over its manual refund, purchase card, and travel transactions. (See table 8.) Effective Management Review and Oversight All personnel within IRS have an important role in establishing and maintaining effective internal controls, but IRS’s managers have additional review and oversight responsibilities. Management must set the objectives, put control activities in place, and monitor and evaluate controls to ensure that they are followed. Without effective monitoring by managers, internal control activities may not be carried out consistently and on time. We have grouped three control activities together related to effective management review and oversight: (1) reviews by management at the functional or activity level, (2) establishment and review of performance measures and indicators, and (3) management of human capital. Although we also include the control activity “top-level reviews of actual performance” in this grouping, we do not have any open recommendations to IRS related to this internal control activity. Internal control standard: Managers need to compare actual performance to planned or expected results throughout the organization and analyze significant differences. IRS has over 71,000 full-time employees and hires over 23,000 seasonal personnel to assist during the tax filing season. In addition, as discussed earlier, Treasury’s Financial Management Service contracts with banks to process tens of thousands of individual receipts, totaling hundreds of billions of dollars. At any organization, management oversight of operations is important, but with an organization as vast in scope as IRS, management oversight is imperative. The following 18 short-term and one long-term open recommendations would improve IRS’s management oversight of lockbox banks, courier services, user fees, penalty calculations, issuance of manual refunds, and the timely release of liens. (See table 9.) Many of these recommendations were made to correct instances where an internal control activity either does not exist or where an established control is not being adequately or consistently applied. However, a number of these recommendations are aimed at enhancing IRS’s own assessment of its internal controls over financial reporting in accordance with the requirements of the revised OMB Circular No. A-123. Internal control standard: Activities need to be established to monitor performance measures and indicators. These controls could call for comparisons and assessments relating different sets of data to one another so that analyses of the relationships can be made and appropriate actions taken. Controls should also be aimed at validating the propriety and integrity of both organizational and individual performance measures and indicators. IRS’s operations include a vast array of activities encompassing educating taxpayers, processing of taxpayer receipts and data, disbursing hundreds of billions of dollars in refunds to millions of taxpayers, maintaining extensive information on tens of millions of taxpayers, and seeking collection from individuals and businesses that fail to comply with the nation’s tax laws. Within its compliance function, IRS has numerous activities, including identifying businesses and individuals that underreport income, collecting from taxpayers that do not pay taxes, and collecting from those receiving refunds for which they are not eligible. Although IRS has at its peak over 94,000 employees, it still faces resource constraints in attempting to fulfill its duties. Because of this, it is vitally important for IRS to have sound performance measures to assist it in assessing its performance and targeting its resources to maximize the government’s return on investment. However, in past audits we have reported that IRS did not capture costs at the program or activity level to assist in developing cost-based performance measures for its various programs and activities. As a result, IRS is unable to measure the costs and benefits of its various collection and enforcement efforts to best target its available resources. The following three long-term open recommendations are designed to assist IRS in evaluating its operations, determining which activities are the most beneficial, and establishing a good system for oversight. (See table 10.) These recommendations call for IRS to measure, track, and evaluate the costs, benefits, or outcomes of its operations—particularly with regard to identifying its most effective tax collection activities. Internal control standard: Effective management of an organization’s workforce—its human capital—is essential to achieving results and an important part of internal control. Management should view human capital as an asset rather than a cost. Only when the right personnel for the job are on board and are provided the right training, tools, structure, incentives, and responsibilities is operational success possible. Management should ensure that skill needs are continually assessed and that the organization is able to obtain a workforce that has the required skills that match those necessary to achieve organizational goals. Training should be aimed at developing and retaining employee skill levels to meet changing organizational needs. Qualified and continuous supervision should be provided to ensure that internal control objectives are achieved. Performance evaluation and feedback, supplemented by an effective reward system, should be designed to help employees understand the connection between their performance and the organization’s success. As a part of its human capital planning, management should also consider how best to retain valuable employees, plan for their eventual succession, and ensure continuity of needed skills and abilities. IRS’s operations cover a wide range of technical competencies with specific expertise needed in tax-related matters; financial management; and systems design, development, and maintenance. Because IRS has tens of thousands of employees spread throughout the country, it is imperative that management keeps its guidance up-to-date and its staff properly trained. The following five open short-term recommendations would assist IRS in its management of human capital. (See table 11.) For several years, we have reported material weaknesses, a significant deficiency, noncompliance with laws and regulations, and other control issues in our annual financial statement audits and related management reports. To assist IRS in addressing those control issues, Appendix II provides summary information regarding the primary issue to which each open recommendation is related. To compile this summary, we analyzed the nature of the open recommendations to relate them to the material weaknesses, significant deficiency, compliance issues, and other control issues not associated with a material weakness or significant deficiency identified as part of our financial statement audit. Increased budgetary pressures and an increased public awareness of the importance of internal control require IRS to carry out its mission more efficiently and more effectively while protecting taxpayers’ information. Sound financial management and effective internal controls are essential if IRS is to efficiently and effectively achieve its goals. IRS has made substantial progress in improving its financial management since its first financial audit, as evidenced by consecutive clean audit opinions on its financial statements for the past 8 years, resolution of several material internal control weaknesses, and actions taken resulting in the closure of hundreds of financial management recommendations. This progress has been the result of hard work by many individuals throughout IRS and sustained commitment of IRS leadership. Nonetheless, more needs to be done to fully address the agency’s continuing financial management challenges. Further efforts are needed to address the internal control deficiencies that continue to exist. Effective implementation of the recommendations we have made and continue to make through our financial audits and related work could greatly assist IRS in improving its internal controls and achieving sound financial management. While we recognize that some actions—primarily those related to modernizing automated systems—will take a number of years to resolve, most of our outstanding recommendations can be addressed in the short-term. In commenting on a draft of this report, IRS expressed its appreciation for our acknowledgment of the agency’s progress in addressing its financial management challenges as evidenced by our closure of 18 open financial management recommendations from GAO’s prior year report. IRS also commented that it is commited to implementing appropriate improvements to ensure that the IRS maintains sound financial management practices. We will review the effectiveness of further corrective actions IRS has taken or will take and the status of IRS’s progress in addressing all open recommendations as part of our audit of IRS’s fiscal year 2008 financial statements. We are sending copies of this report to the Chairmen and Ranking Members of the Senate Committee on Appropriations; Senate Committee on Finance; Senate Committee on Homeland Security and Governmental Affairs; and Subcommittee on Taxation, IRS Oversight and Long-Term Growth, Senate Committee on Finance. We are also sending copies to the Chairmen and Ranking Members of the House Committee on Appropriations; House Committee on Ways and Means; the Chairman and Vice Chairman of the Joint Committee on Taxation; the Secretary of the Treasury; the Director of OMB; the Chairman of the IRS Oversight Board; and other interested parties. Copies will be made available to others upon request. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you have any questions concerning this report, please contact me at (202) 512-3406 or sebastians@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. Open. The Internal Revenue Service’s (IRS) Exam Policy has expanded its action plan to include short-term actions for fiscal year 2008. By June 30, 2008, it plans to issue a memorandum to emphasize the importance of training employees who calculate interest and outline available training modules. By September 30, 2008, it plans to offer assistance reviews as requested to verify adherence to procedures, and to improve the process for employees to elevate issues to the program office for resolution. By January 1, 2009, Exam Policy will coordinate additional interest-related training to target field exam and collection personnel. Open. In testing a statistical sample of 45 manual interest transactions recorded during fiscal year 2006, we found eight errors relating to the calculation and recording of manually calculated interest. Based on this, we estimated that 18 percent of IRS’s manual interest population contains errors and concluded that IRS’s controls over this area remain ineffective. The ineffectiveness of these controls contributes to errors in taxpayer records, which is a major component of the material weakness in IRS’s unpaid assessments. During fiscal year 2007, IRS did not make any significant improvements to controls related to manual interest calculations. We will continue to evaluate IRS’s corrective actions in future audits. Internal Revenue Service: Immediate and Long-Term Actions Needed to Improve Financial Management (GAO/AIMD-99-16, Oct. 30, 1998) Open. IRS’s Small Business/Self- Employed (SB/SE) Division began a Trust Fund Recovery Penalty (TFRP) Database Cleanup Initiative in September 2006 that involved a combined systemic clean-up and systemically-assisted, manual cleanup. SB/SE completed the clean-up initiative in January 2008. According to IRS, one of the accomplishments of the clean-up initiative was to reduce cross- reference errors by 32.4 percent. IRS will continue to identify and submit work requests to address current programming shortfalls, corrections and enhancements to the Automated Trust Fund Recovery (ATFR) program and database. The Work Request Tracking System will improve the Area Office, Control Point Monitoring, and Campus Compliance components of the database. These enhancements and improvements include but are not limited to minimizing accounts requiring manual intervention, providing increased managerial oversight through the creation of various reports and improvements to the current inventory delivery system. Open. IRS has taken several actions to strengthen controls and correct programming or procedural deficiencies in the cross-referencing of payments. To ensure quality, timeliness, and accuracy of the TFRP process, IRS recently completed a quality review process that improved the accuracy rate of cross-references recorded in its master files. Additionally, IRS continues to monitor the accuracy and effectiveness of the TFRP process and all corrective actions already in place. However, IRS’s actions have not been completely successful in addressing this issue. As part of our fiscal year 2007 financial audit, we reviewed a statistical sample of 76 TFRP payments, made on accounts created since August 2001. We found nine instances in which IRS did not properly record the payments to all related taxpayer accounts. We estimate that 11.8 percent of these payments may not be properly recorded. Thus, we conclude that IRS’s controls over this area remain ineffective. The ineffectiveness of these controls contributes to errors in taxpayer records, which is a major component of our reported material weakness in IRS’s unpaid assessments. We will continue to review IRS’s corrective actions to address this issue during our fiscal year 2008 audit. Internal Revenue Service: Immediate and Long-Term Actions Needed to Improve Financial Management (GAO/AIMD-99-16, Oct. 30, 1998) Open. IRS is developing the Custodial Detailed Data Base (CDDB), which it believes will ultimately address many of the outstanding financial management recommendations. IRS implemented the first phase of the CDDB during fiscal year 2006. In fiscal year 2007, IRS enhanced the CDDB to process a larger percentage of accounts associated with unpaid payroll taxes and began journalizing unpaid assessment information from CDDB to the Interim Revenue and Accounting Control System (IRACS) weekly; the first step in establishing CDDB to serve as the subsidiary ledger for unpaid assessments. For fiscal year 2008, IRS is continuing to enhance the CDDB in order to process an even larger percentage of accounts associated with unpaid payroll taxes. Open. IRS’s development and use of CDDB has improved its ability to analyze and classify related taxpayer accounts associated with unpaid payroll taxes. However, CDDB is currently not able to analyze and classify 100 percent of such cases. In fiscal year 2007, IRS implemented CDDB programs to begin journalizing tax debt information from its master files to its general ledger weekly, a first step in establishing CDDB’s capability to serve as a subsidiary ledger for unpaid tax debt. However, IRS is presently unable to use CDDB as its subsidiary ledger for posting tax debt information to its general ledger in a manner that ensures reliable external reporting. Specifically, to report balances for taxes receivables and other unpaid tax assessments in its financial statements and required supplemental information, IRS must continue to apply statistical sampling and estimation techniques to master file data processed through CDDB at year-end. Even though CDDB is capable of analyzing master file data weekly to produce tax debt information classified into the various financial reporting categories (taxes receivables, compliance assessments, and write-offs), this information contains material inaccuracies. For example, over $20 billion in adjustments to the year-end gross taxes receivable balance produced by CDDB were needed to correct for errors. Full operational capability of CDDB is several years away and depends in part on the successful implementation of future system releases through 2009. The lack of a fully functioning subsidiary ledger capable of producing accurate, useful, and timely information with which to manage and report externally is a major component of our reported material weakness in IRS’s unpaid assessments. We will continue to monitor IRS’s development of CDDB during our fiscal year 2008 and future audits. Internal Revenue Service: Physical Security Over Taxpayer Receipts and Data Needs Improvement (GAO/AIMD-99-15, Nov. 30, 1998) Closed. Recommendation is no longer directly applicable to IRS’s current business operations. The Wage and Investment (W&I) Division is no longer organized by districts, and no longer has teller functions. The operations aspect of the recommendation has been addressed with procedures and processes in recommendation 99-22. Managerial aspects of the control logs and reviews are addressed in recommendations 02-16 and 05-33, where IRS addresses its monitoring activities and efforts to improve its current state of compliance. Closed. The original report issued in November 1998 directs the intent of this recommendation to the Customer Service Units at district offices that collected walk-in payments. Since that time IRS reorganized its operations into four operating divisions with particular responsibility for the collection of individual and corporate taxes, examination of returns, and taxpayer assistance. Specifically, the W&I Division’s Taxpayer Assistance Centers (TACs) now handle the collection of walk-in payment receipts. Therefore, we agree that recommendations 99-22, 02-16 and 05-33 address the substance of the weaknesses reported in the November 1998 report. We will continue to monitor those recommendations to assess IRS’s corrective actions. Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Open. IRS implemented the Area Office (AO) ATFR Web application. This implementation included the Web version of the Control Point Monitoring (CPM) portion of the application. The CPM acts as the conduit from the AO to the Campus for assessment. IRS drafted new Internal Revenue Manual (IRM) procedures to complement the CPM AO Web processing, and is currently testing these procedures. IRS plans to assess the results of the test and implement the IRM procedures as appropriate. IRS continues to identify and submit Work Requests and Information Technology Assets Management System tickets to enhance the assessment process and provide for efficiencies in the CPM process. These include but are not limited to the systemic generation of the Form 5942, redefining the current inventory assignment system and creating inventory and management reports. Open. To ensure quality, timeliness, and accuracy of the TFRP process, the IRS initiated a quality review process that focused on two primary areas, the first being consolidation of all TFRP work to one campus. Consolidation of all SB/SE ATFR work to the Ogden Campus was completed in September 2005. All W&I business unit TFRP work was transferred to SB/SE Campuses as of January 2006. The second area IRS undertook was the task of rewriting the ATFR area office user component to provide system flexibility that better replicates the realities of the current trust fund investigation/proposal process. IRS continues to monitor the accuracy and effectiveness of the TFRP process and all corrective actions already in place. According to IRS, it completed consolidation of ATFR work at its Ogden Campus by September 2005. However, during our fiscal year 2007 audit, we continued to find long delays in IRS’s processing and posting of TFRP assessments. In one case, we noted that IRS did not record the assessment against the responsible officer until 4 years after it made the determination that the officer was responsible for the TFRP. In another case, IRS did not record the TFRP assessment against the officer until almost 3 years after it made the determination that the officer was responsible for the TFRP. Such delays in recording taxpayer information contribute to errors in taxpayer records, which is a major component of our reported material weakness in IRS’s unpaid assessments. We will continue to review IRS’s corrective actions related to this issue as part of our fiscal year 2008 audit. Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Closed. All IRS field offices continue to provide training and to perform reviews to strengthen controls over remittances. The Large and Mid- sized Business (LMSB) requires each field executive to certify that each group either had in its possession or was able to obtain the stamp. LMSB obtained certifications from the LMSB Industry Headquarter Offices that field groups are maintaining and using the US Treasury stamps, and that they are covering these procedures periodically in group meetings or through issuance of memorandums. LMSB implemented a training module on July 28, 2006 on the responsibilities and procedures for payment processing and check handling. SB/SE collection group managers have been instructed to periodically review remittance packages transmitted by revenue officers and designated clerical employees using a random selection process. In addition, territory managers review the group manager’s control of those reviews. SB/SE Headquarters will be addressing this in interviews with territory managers as part of their operational reviews. Tax Exempt and Government Entities (TE/GE) continues to perform reviews to ensure adherence to the IRM procedures and to require managers to confirm that each group either had in its possession or was able to obtain the stamp. Open. The objective of this recommendation was to create a mechanism for IRS to monitor the status of pervasive weaknesses in controls over taxpayer receipts and information that we have found at IRS’s field offices over the years. The purpose of this monitoring is to facilitate the timely detection and effective resolution of issues and to verify the effectiveness of new and existing policies and procedures on an ongoing basis. During our fiscal year 2007 audit, we identified one instance at an SB/SE unit where employees did not have access to stamps needed to overstamp improper payee lines. Also, at five SB/SE field offices we found that there was no system in place or evidence maintained to track acknowledged document transmittals. Had IRS periodically reviewed the effectiveness of these controls in field offices as we recommended, these issues might have been detected and corrected. In addition, during our review of IRS’s response to this recommendation, we asked IRS to provide a list and blank copies of the reviews that are performed within the LMSB, SBSE, and TEGE business units that address key controls over (1) physical security, (2) procedural safeguards, and (3) the transfer of taxpayer receipts and information. While IRS provided extensive explanations of the various procedures and reviews that are performed, IRS did not provide copies of the reviews covering all three business units for our evaluation to assess the adequacy and frequency of these reviews. We will continue to assess IRS’s actions during our fiscal year 2008 audit. Internal Revenue Service: Custodial Financial Management Weaknesses (GAO/AIMD-99-193, Aug. 4, 1999) Open. The IRS is continuing to develop CDDB. Each release is providing more detail for unpaid assessments, and new functionality will be added for revenue and refunds in fiscal year 2008 to reduce the reliance on master file extracts and ad hoc procedures. The Chief Financial Officers (CFO) office has hired three additional staff and is cross-training existing staff to perform more of the ad hoc procedures to reduce the work on Modernization & Information Technology Services for financial reporting purposes. IRS continues to have contractor support to ensure that master file extracts and other ad hoc procedures are in place to continually develop reliable balances for financial reporting purposes while it finalizes CDDB and develops the IRACS redesign to be a compliant general ledger. Open. We will continue to assess IRS’s actions during our fiscal year 2008 audit. Internal Revenue Service: Serious Weaknesses Impact Ability to Report on and Manage Operations (GAO/AIMD-99-196, Aug. 9, 1999) Open. IRS now has 3 complete years of fully allocated cost data in the Integrated Financial System (IFS). The Statement of Net Costs is now produced from the cost accounting module of IFS. IRS also initiated a project in fiscal year 2007 to identify the issues associated with developing a methodology for determining the costs of performance measures within IRS. Open. We confirmed that IRS continued to improve its cost accounting capability in fiscal year 2007. However, while the cost accounting module of IFS successfully produced the Statement of Net Costs, it still does not provide IRS with the ability to produce full cost information for its performance measures. IRS states that it initiated a strategy to develop cost data for performance measures. We will continue to review and assess IRS’s initiatives during our fiscal year 2008 audit. Internal Revenue Service: Serious Weaknesses Impact Ability to Report on and Manage Operations (GAO/AIMD-99-196, Aug. 9, 1999) Closed. IRS continues to strengthen internal controls and procedures to enhance its ability to account for P&E in IFS. P&E, including capital leases, are recorded as assets when purchased. During fiscal year 2007, IRS revised the dollar threshold for review of P&E accounting transactions and conducted intensive reviews of the large-dollar transactions, increasing the accuracy of P&E reporting. IRS also improved its capability to capitalize assets or expense other items and to properly account for Business System Modernization costs in internal use software. Open. Our fiscal year 2007 P&E valuation testing revealed problems with the linking of the purchase of assets recorded in the general ledger system to the P&E inventory system, which indicates that IRS’s detailed P&E records do not yet fully reconcile to the financial records. We will continue to monitor IRS’s strategy in addressing these financial management system issues. Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO- 01-42, Nov. 17, 2000) Open. IRS has developed a workload delivery model that integrates the work plans of each source of assessment to evaluate the overall impact on downstream collection operations. IRS is continuing to look at case delivery practices from an overall perspective and make recommendations for changes to case routing and assignment priorities. IRS is also monitoring the nonfiler strategy and work plans to improve the identification of and selection of nonfiler cases to balance the working of nonfiler inventory with balance- due inventory. Additionally, IRS is also continuing the project to enhance its decision analytical models used for selecting cases based on their predicted collection potential to apply decision analytics to both delinquent accounts and unfiled returns; apply decision analytics to all categories of taxpayer not just small business, self- employed; expand the use of internal and external data sources to increase the portion of cases predicted by the models; ultimately develop alternative treatment strategies based on the least costly treatment indicated by the models; and update definitions for complex cases to improve routing to field collection. Open. According to IRS, SB/SE has initiated several projects to build additional decision analytical models to increase its ability to route cases to the appropriate resource. These projects utilize more sophisticated computer modeling and risk assessment techniques to improve the targeting of cases to pursue. The Collection Governance Council was established to ensure the inventory is balanced and resources are expended appropriately. IRS has estimated several billion dollars in additional tax collections have been realized through the use of the collection approach developed from the projects. Although these efforts have helped IRS target cases for collection, its ability to assess the relative merits of these efforts continues to be hindered by its inability to reliably measure how much it collects as a result of these efforts, relative to their associated costs. In addition, these efforts are primarily focused on SB/SE, thus they do not represent an integrated agencywide systemic approach to managing the collection of unpaid taxes across the scope of IRS’s activities. IRS has made some improvements in prioritizing its inventory of collection cases; but more needs to be done by IRS to address the full range of cost- benefit considerations. We will continue to review IRS’s initiatives to manage resource allocation levels for its collection efforts. Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO- 01-42, Nov. 17, 2000) Open. IRS continues to address and correct issues that cause late lien releases through a Lien Release Action Plan, and conducting reviews as a part of A-123. In April 2007 IRS’s review of lien releases found it had improved the timely release of liens to 88 percent, a 19 percentage point increase from the 69 percent timeliness rate in fiscal year 2006. IRS added new action items and corrective actions to address new and repeat issues. IRS’s goal is to reduce overall lien release error rates to below 5 percent by September 30, 2009. Open. IRS has taken a number of actions over the past several years to address this issue. IRS developed an action plan to incorporate the requirements of the revised OMB Circular No. A-123. The overall action addresses untimely lien releases, including identification of causes and where they occur organizationally. For example, IRS centralized all lien processing at its Cincinnati Service Center Campus in 2005. Additionally, in July 2006, IRS enhanced various lien-processing exception reports to include a cumulative listing of unresolved lien releases, allowing it to more readily track the release status and take corrective action. However, during our fiscal year 2007 audit, we continued to find delays in the release of liens. In its OMB No. A-123 testing of lien releases, IRS found 7 instances out of 59 cases tested in which it did not release the applicable federal tax lien within the statutory period. The time between the satisfaction of the liability and release of the lien ranged from 35 days to 135 days. Based on its sample, IRS estimated that for about 12 percent of unpaid tax assessment cases in which it had filed a tax lien that were resolved in fiscal year 2007, it did not release the lien within 30 days. IRS is 95 percent confident that the percentage of cases in which the lien was not released within 30 days does not exceed 21 percent. IRS’s ineffective controls over this area results in its non-compliance with Internal Revenue Code section 6325 which requires IRS to release its tax liens within 30 days of the date the related tax liability was fully satisfied, had become legally unenforceable, or the Secretary of the Treasury has accepted a bond for the assessed tax. We will continue to assess the affect of IRS’s actions and continue to review IRS’s testing of tax lien releases as part of our fiscal year 2008 audit. Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO- 01-42, Nov. 17, 2000) Open. IRS has taken steps to screen and examine Earned Income Tax Credit (EITC) claims and to address the collection of AUR and CAWR as part of the workload delivery model. For EITC IRS is pursuing estimating the full cost of these programs, and in the interim IRS is using information such as annual error rate estimates and high-level return on investment (ROI) computations for EITC base compliance activities and initiatives to make sound decisions about resource investments. IRS employs a ROI estimate for compliance activities that uses labor costs associated with protecting revenue for both pre-refund and post-refund activities. Since labor represents approximately 73 percent of the total IRS budget (2007) and 91 percent of the EITC budget, ROI calculations using labor costs provide valid cost/benefit data which are used, along with other data and program considerations, to make sound program decisions. The IRS released two reports that include ROI discussions and it is in the process of finalizing a summary report on the 3-year test to assess investments in a certification requirement versus other potential compliance investments. SB/SE is monitoring the nonfiler strategy and work plans to improve the identification of and selection of non- filer cases to balance the working of nonfiler inventory with balance-due inventory. SB/SE continues to review this model to ultimately develop alternative treatment strategies based on the least costly treatment indicated by the models. The CFO also initiated a cost pilot during fiscal year 2007 to determine the costs of several performance measures within AUR, and will share this information at the conclusion of the cost pilot. Open. In fiscal year 2008, we will continue to follow up on IRS’s progress on the various initiatives taken as well as IRS’s progress in estimating the full cost of these programs. Internal Revenue Service: Recommendations to Improve Financial and Operational Management (GAO- 01-42, Nov. 17, 2000) Closed. IRS continues to strengthen internal controls and procedures to enhance its ability to account for P&E in IFS. P&E, including capital leases, are recorded as assets when purchased. During fiscal year 2007, IRS revised the dollar threshold for review of P&E accounting transactions and conducted intensive reviews of the large-dollar transactions, increasing the accuracy of P&E reporting. IRS also improved its capability to capitalize assets or expense other items and to properly account for Business System Modernization costs in internal use software. Currently, IRS does not have a subsidiary ledger for leasehold improvements. A subsidiary ledger requires an enhancement to IFS. Funding for enhancements was denied for fiscal years 2007, 2008 and 2009. Depending on the amount of any future funding and prioritization of enhancements, it is not known when or if IRS can accomplish what was originally agreed to. Considering the age of this report and the long-term unknowns, IRS considers this action closed until further follow-up is required. Open. IRS implemented the first release of IFS on November 10, 2004, which allowed recording leasehold improvements as assets when purchased. A subsidiary ledger for leasehold improvements has not been developed. According to IRS, it lacks the funding to make the enhancements to IFS that are needed to develop a subsidiary ledger for leasehold improvements. Until it determines the amount of its future funding and prioritization of IFS enhancements, IRS will remain unsure of any additional actions it will take to accomplish this recommendation. We will continue to evaluate IRS’s efforts to enhance its ability to account for P&E assets, including leasehold improvements. Management Letter: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-01-880R, July 30, 2001) Closed. The CFO implemented IFS on November 10, 2004 which included a cost module. The cost module currently has 3 years of data which provide managers with basic cost data for decision making in relation to their activities. IRS continues to improve the allocation methodology so that it can determine the detail behind the allocated costs. Open. We confirmed that IRS has procedures for costing reimbursable agreements that provide the basic framework for the accumulation of both direct and indirect costs at the necessary level of detail. IRS has improved its methodology for allocating its costs of operations to its business units. However, further actions are needed for it to accumulate and report actual costs associated with specific reimbursable projects. We will continue to monitor IRS’s efforts to fully implement its cost accounting system and, once it has been fully implemented, evaluate the effectiveness of IRS’s procedures for developing cost information for its reimbursable agreements. Internal Revenue Service: Progress Made, but Further Actions Needed to Improve Financial Management (GAO- 02-35, Oct. 19, 2001) Open. IRS is exploring other system- based ways of capturing both time and costs associated with its projects and activities and does not anticipate implementing the requirement for employees to itemize their time in the near future. Open. IRS states that it is exploring other system-based ways of capturing both time and costs associated with its projects and activities and does not anticipate implementing the requirement for employees to itemize their time in the near future. We will continue to monitor IRS’s efforts to fully implement its cost accounting system. Once it has been fully implemented, we will evaluate the effectiveness of IRS’s procedures for developing cost information to use in resource allocation decisions, which is the underlying basis for our making this recommendation. Internal Revenue Service: Progress Made, but Further Actions Needed to Improve Financial Management (GAO- 02-35, Oct. 19, 2001) Closed. IRS now allocates all costs, both personnel and nonpersonnel, to the major program areas described in the Statement of Net Costs on a monthly basis. Open. We confirmed that IRS has improved its cost accounting capabilities by developing and implementing procedures for allocating its costs of operations to its business units and to the cost categories in its Statement of Net Cost on a monthly basis. However, the cost categories on the Statement of Net Cost are at a higher level than specific programs and activities. Therefore, further actions are still needed to enable IRS to allocate nonpersonnel costs to the detailed level of specific programs and activities. We will continue to monitor IRS’s efforts to fully implement its cost accounting system and, once it has been fully implemented, evaluate the effectiveness of IRS procedures for developing cost information for specific programs and activities to use in resource allocation decisions. Management Report: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-02-746R, July 18, 2002) Open. During fiscal year 2007, IRS conducted Operational Reviews of its W&I Field Assistance area groups. These reviews included compliance with this recommendation. While groups were generally in compliance, IRS recognized the need for additional training. Field Assistance is conducting Filing Season Readiness training for Managers in fiscal year 2008 that includes remittance and security training. The fiscal year 2008 performance commitments address remittance security and shared responsibility for operational reviews. Operational reviews at all levels will be conducted during fiscal year 2008 to ensure consistency. Open. During our fiscal year 2007 audit, we visited 10 TACs and identified weaknesses over the payment processing and TAC managerial reviews that would address this recommendation at all 10 locations. We will review IRS’s additional planned corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Accounting Procedures and Internal Controls (GAO-02-746R, July 18, 2002) Closed. SETS data are reviewed on a bi-weekly basis to detect and correct errors. Monitoring SETS falls across a broad group of Chief Human Capital and Agency-Wide Shared Services (AWSS) staff. IRS provided guidance in November 2007 to all involved staff reminding them to monitor SETS systemic issues and immediately elevate those issues for NFC correction. Until a SETS replacement is developed, continuous monitoring will occur. Open. During our fiscal year 2007 audit, we continued to identify technical limitations and weaknesses with the SETS database. Specifically, during our analysis of the SETS data, we found multiple instances where (1) employees entered on duty either prior to the Office of Personnel Management completing their fingerprint check, IRS receiving their fingerprint check results, or both and (2) employees entered on duty with expired fingerprint check results (over 180 days old). The guidance provided to staff in November 2007 was subsequent to the completion of our fiscal year 2007 audit. We will evaluate IRS’s additional corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04- 553R, April 26, 2004) Closed. IRS continues to conduct on-site reviews looking at logs for desk and work area, date stamp, cash, candling, shred, and mail. IRS uses the data collection instrument (DCI) entitled “Processing-Internal Controls” and uses the results of these reviews to roll them into a calculation to determine each bank’s score in the new bank performance measurement process. In addition, lockbox personnel are required to perform similar reviews monthly and report results to the lockbox field coordinators. The report must contain the date of review, shifts reviewed, results of the review (even when no items are found) and include a reviewer and site manager’s initials; a signature as required by the Lockbox Processing Guidelines (LPG); or both. Additional reviews are performed on the monthly F9535/Discovered Remittance, candling log, disk checks/audits, and shred reports received from the lockbox site by the lockbox field coordinators. Closed. We verified that IRS established and implemented a Processing Internal Controls and Physical Security DCIs. These DCIs are used to assess the required managerial reviews that are performed at each lockbox bank. Management Report: Improvements Needed in IRS’s Internal Controls and Accounting Procedures (GAO-04- 553R, April 26, 2004) Closed. IRS continues to perform monthly unannounced testing of guard response to alarms, and documentation from these reviews is maintained at each service center campus. Roll-up documentation from Physical Security Area managers is provided to the Program, Planning, and Policy Office (PPPO) for reports to higher-level management. PPPO also conducts random unannounced spot checks when on-site at campuses and computing centers. Open. During our fiscal year 2007 audit, we identified instances at two of five SCCs we visited in which security guards did not respond properly to alarms. We will evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: Review of Controls over Safeguarding Taxpayer Receipts and Information at the Brookhaven Service Center Campus (GAO-05-319R, Mar 10, 2005) Closed. Accounts Management is enforcing adherence to existing instructions for securing access to restricted areas through trained security monitors at consolidated sites. These clerks receive training annually, as well as periodic briefings, on the issuance and inventory of badges and the security of taxpayer information and receipts. Candling procedures are reinforced through training and team meetings. Local management ensures that correct procedures are followed when reviewing equipment and candling logs. Open. During our fiscal year 2007 audit, we identified instances at one SCC we visited with reduced submission processing functions where (1) neither the door monitor nor the payment processing supervisor in the receipt and control area inspected visitors’ belongings when they exited the restricted area and (2) the inside envelope of the 3210 transmittal package did not contain a statement indicating that the information inside is for limited official use. We will continue to assess IRS’s actions during our fiscal year 2008 audit. Management Report: Review of Controls over Safeguarding Taxpayer Receipts and Information at the Brookhaven Service Center Campus (GAO-05-319R, Mar 10, 2005) Closed. IRS has developed and implemented a methodology for estimating mail volumes and resource requirements for use in future submission processing consolidations. IRS used the prior campus consolidation experiences from both Brookhaven and Memphis in its projections for the Philadelphia Campus Support Department. Closed. During our fiscal year 2007 audit, IRS W&I staff provided us with a methodology and estimation for anticipated rapid changes in mail volume at future SCCs selected for significant reductions in their submission processing functions. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. PPPO issued notification in February 2007 reminding Physical Security area directors that required documentation from contracting officers’ technical representatives is needed to support the issuance of identification media before granting staff-like access to contractors, and that all forms must remain on file. The Audit Management Checklist is also used to ensure that proper documentation is received and filed. All IRMs have been updated and renumbered. IRM 10.2.5 Identification Card specifies that Form 5519, 13716-A or similar identification request form (13760), and the interim or final background investigation letter must be retained and filed in the identification media file on each contractor for the life of the identification card. Open. During our fiscal year 2007 audit, we identified four contractors at one of five SCCs we visited who were granted staff-like access before background investigations had been completed. Also, we obtained and reviewed SCC contractor background investigation data from all 10 SCCs and found that 3 SCCs permitted five contractors staff-like access before their background investigations had been completed. In addition, IRM series 10.2 mentioned in IRS’s response to this recommendation is currently in draft, under review, and waiting to be finalized. We will evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. PPPO issued notification in February 2007 reminding Physical Security area directors that documentation from the contracting officer’s technical representative is needed to support the issuance of identification media before granting staff-like access to contractors, and that all forms remain on file. The Audit Management Checklist is also used to ensure that proper documentation is received and filed. All IRMs have been updated and renumbered. IRM 10.2.5 Identification Card specifies that Form 5519, 13716-A or similar identification request form (13760), and the interim or final background investigation letter must be retained and filed in the identification media file on each contractor for the life of the identification card. Open. As of the time of our audit, the IRM 10.2 series was in draft, under review, and waiting to be finalized. We will monitor its final implementation and continue to evaluate IRS’s policies and procedures related to background investigations for contractors during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. Submission Processing issued an annual reminder memorandum to the courier contractors on February 27, 2007. Additionally, the lockbox banks security team verified that all lockbox bank sites issued an annual reminder memorandum to courier contractors reminding them to adhere to all courier service procedures in the Lockbox Security Guidelines (LSG). Closed. We verified that reminder memorandums were issued to the SCC and lockbox bank couriers. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. Submission Processing revised the LSG 2.5 during 2007 to provide for periodic verification that couriers adhere to IRS policy while transporting taxpayer receipts and information. In IRS’s campuses, IRS ensures couriers sign, date, and note the time of pickup on Form 10160, Receipt for Transport of IRS Deposit. When the couriers drop off the deposit, IRS ensures Form 10160 is date and time stamped. Each campus reviews the form and notes any time discrepancies. Couriers are questioned if discrepancies are found and the information is noted in the Courier Incident Log. If inconsistencies are noted, the centers use their discretion to determine whether it is necessary to trail the couriers. Closed. We verified that IRS revised its LSG to include provisions for periodic verification that couriers adhere to IRS procedures for transporting taxpayer receipts and information. We also noted that procedures were established at the campuses involving the review of the returned Form 10160. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Open. SB/SE revised IRM 5.1.2, 1.4.50, 4.20.3, and 4.20.4 to address this recommendation. The Director, Examination sent a memorandum to all Examination area directors on October 17, 2006 reminding them of the payment processes outlined in IRM 5.1.2, and requiring periodic reviews of payment processing procedures during their group operational reviews. Although SB/SE believes its current field payment processing procedures sufficiently addresses segregation of duties, it is currently conducting a risk assessment to identify potential weaknesses. Open. The status information provided by IRS did not clearly address segregation of duties within the SB/SE business units. When we issued this recommendation, we noted that (1) individuals responsible for preparing payment posting vouchers were the same individuals who recorded the information from those vouchers on the document transmittal and mailed those forms to the IRS service center and (2) there was no independent review or reconciliation of documents or payments before they were mailed by their preparer. During our recent visits to selected SB/SE units in March 2008, we found that this condition continued to exist. Duties involving the preparation of payment posting vouchers, document transmittal forms, and transmittal packages were not segregated. Employees informed us that there was no related requirement in the IRM. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Open. W&I Field Assistance has taken a number of actions to emphasize the requirement for including a document transmittal form listing the Daily Report of Collection Activity forms in transmittal packages, and ensuring that they are reconciled and reviewed by the secretary, initial assistant representative, or manager in offices where these positions are located. Territory managers review and discuss the monthly Trends and Patterns reports with the group manager. Results of the reviews are forwarded to the area director. Operational reviews at all levels will be conducted annually to ensure that field offices comply with the requirement to prepare Form 3210, which lists all Forms 795 being shipped to the Submission Processing Center. Open. During our visits to several SB/SE business units, we found that a document transmittal form was not being used to transmit multiple Daily Report of Collection Activity forms to the respective service center campus. We will continue to assess IRS’s actions during our fiscal year 2008 audit. Beginning in March 2008 Collection began annual reviews of a sample of groups in each area to ensure the reviews described in IRM 1.4.50 are taking place. The results of the headquarters review will be documented in the area operational review. SB/SE is currently reviewing the language in IRM 1.4.50, Collection Group Manager, Territory Manager and Area Director Operational Aid to determine if clarification is needed. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. The procedures to prevent the generation or disbursement of refunds associated with AUR accounts are in place and included in IRM 3.8.45. Employees are required to conduct Integrated Data Retrieval System (IDRS) research after receiving an unidentified remittance to determine if there is an open account that allows for posting of the remittance. Submission Processing issued a Hot Topic on January 25, 2007, which added procedures to IRM 3.17.10 to check for cases that can be identified as an AUR payment and research IDRS for CP2000 Indicators: TC 922, “F” Freeze Code, and campus under reporter programs. Closed. We confirmed that IRS updated IRM 3.8.45 and IRM 3.17.10 to include the requirement that employees conduct IDRS research after receiving unidentified remittances. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. IRS issued its annual memorandum in August 2007 and received the annual list of authorized signatures by October 31, 2007, per IRM 3.17.79.3.5(4)(d). Submission Processing completed a sample review as part of the Monthly Security Review Checklist per 3.17.79.3.5(3), and completed a 100 percent review of the new annual list in November 2007. Open. During our fiscal year 2007 audit, we continued to find that the documentation requirements on memorandums, which are submitted to the manual refund units listing officials authorized to approve manual refunds, were incomplete. The annual memorandums issued, the annual list of authorized signatures, and the reviews performed noted in IRS’s response to this recommendation were subsequent to our fieldwork. We will follow up on IRS’s efforts to improve the documentation requirements during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. IRS issued guidance on enforcing requirements for monitoring accounts and reviewing monitoring of accounts via Hot Topics on April 30, 2007 and again on July 13, 2007. Department managers provided subordinate managers and the employees refresher training using IRM 21.4.4 and 3.17.79 as reference materials to reinforce the monitoring requirements. Accounts Management completed refresher training at all campuses from January through May 2007. SB/SE Campus Compliance Services (CCS) continues to stress the importance of following all IRM procedures for the manual refunds. To ensure that the campuses continue to comply with all IRM provisions for manual refunds, the CCS directors are covering this topic in both filing & payment compliance and campus reporting compliance operations during their fiscal year 2008 campus reviews. The Taxpayer Advocate Service (TAS) has specific IRM requirements and controls for all employees and managers to monitor the posting of manual refunds to prevent duplicate refunds, and to document in the Taxpayer Advocate Management Information System (TAMIS) that all actions were completed. TAS also updated its manual refund training on March 12, 2007, re-emphasizing the requirement to monitor manual refunds to prevent duplicate refunds. Open. We verified that IRS issued the Hot Topics, which included providing managers and the employees training to reinforce monitoring requirements. However, during our fiscal year 2007 audit, we continued to find instances where the manual refund initiators, leads, or both did not monitor accounts to prevent duplicate refunds. We also found that some of the supervisors did not review the initiators’ or leads’ work to ensure that the monitoring of accounts was performed. We will continue to review IRS’s monitoring and review efforts during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. Submission Processing (SP) issued guidance on enforcing requirements for monitoring accounts and reviewing monitoring of accounts via Hot Topics on April 30, 2007 and again on July 13, 2007. Department managers provided subordinate managers and the employees refresher training using IRM 21.4.4 and 3.17.79 as reference materials to reinforce the monitoring requirements. Accounts Management completed refresher training at all campuses from January through May 2007. IRS continues to use the Manual Refund Check Sheet and monthly security reviews to ensure compliance with IRM requirements, and these reviews are forwarded monthly to SP headquarters for consolidation and review by headquarters analysts and management. The SB/SE Campus Compliance Services continues to stress the importance of following all IRM procedures for the manual refunds. To ensure that the campuses continue to comply with all IRM provisions for manual refunds, the CCS directors are covering this topic in both filing & payment compliance and campus reporting compliance operations during their fiscal year 2008 campus reviews. The TAS has specific IRM requirements and controls for all employees and managers to monitor the posting of manual refunds until posted to prevent duplicate refunds, and to document in TAMIS that all actions were completed. TAS also updated its manual refund training on March 12, 2007, re-emphasizing the requirement to monitor manual refunds to prevent duplicate refunds. Open. We verified that IRS issued the Hot Topics, which included providing managers and employees training to reinforce the monitoring requirements. However, during our fiscal year 2007 audit, we continued to find instances where the requirement for documenting monitoring actions and documenting supervisory review were not enforced. We will continue to review IRS’s monitoring and review efforts during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. IRS issued a Hot Topic on January 10, 2007 and again on March 30, 2007 as a reminder to ensure adherence to the existing process of enforcing the requirement that command code profiles be reviewed at least once annually. The Manual Refund Unit has included a signed and dated copy of the Command Code: RSTRK input (action performed through the use of IDRS in the file with the authorization memorandums to verify compliance with IRM 3.17.79.1.7. The Monthly Security Review Checklist was updated to add this review. Closed. During our fiscal year 2007 audit, we found that the requirements that command code profiles be reviewed at least once annually were enforced. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-05-247R, Apr 27, 2005) Closed. IRS updated IRM 10.8.34 IDRS Security Handbook replacing the IDRS Security Law Enforcement Manual (LEM) 25.10.3. Section 10.8.34.5.3.1 (3) – (6) prohibits managers from being in the same IDRS unit as the employees they review. Section 10.8.34.8.2.2.5 (2) (f) requires managers to review reports monthly to ensure profiles have appropriate restrictions. Section 10.8.34.8.2.2.5 (2) (m) prohibits employees from reviewing their own profile or any other report data pertaining to themselves. IRS also updated the IDRS section of the annual FMFIA Self-Assessment Tool for Managers with item 4.50 requiring the quarterly review of IDRS user profiles in accordance with the IRM, and item 4.52 requiring managers to indicate that they completed a review of IDRS security reports and appropriate action has been taken to correct weaknesses. Closed. During our fiscal year 2007 audit, we found no instances of staff members reviewing their own command codes. We verified that IRS has updated IRM 10.8.34 IDRS Security Handbook, which has replaced IDRS Security LEM 25.10.3. We also verified that section 10.8.34.5.3.1 (3) – (6) prohibits managers from being in the same IDRS unit as the employees they oversee; section 10.8.34.8.2.2.5 (2) (f) requires managers to review reports monthly to ensure that profiles have appropriate restrictions; and section 10.8.34.8.2.2.5 (2) (m) prohibits employees from reviewing their own profile or any other report data pertaining to themselves. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. W&I’s Accounts Management will confirm during the site operational reviews that managers are performing a follow-up and documentation acknowledgement of receipt of Form 3210. This item will be monitored during the fiscal year 2008 quarterly reviews. During fiscal year 2007, IRS completed conference calls prior to each directorates filing season readiness (FSR) certification, and will continue to provide directions during the fiscal year 2008 FSR conference calls to enforce management controls to complete, review, approve, and follow up on receipt of Forms 3210 in Accounts Management. Open. We will continue to evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. LMSB has issued procedures to the field on the responsibilities for using receipt transmittals. LMSB employees are reminded annually through executive memorandum of Form 3210 procedures and responsibilities. LMSB has also issued memos to the field to remind and reinforce the use of Form 3210 and establishment of a follow-up system for unacknowledged 3210s. A Closing Checklist for LMSB Cases which includes Form 3210 requirement reminders was created to assist LMSB employees when transmitting cases. LMSB Technical training has certified that Form 3210 procedures and responsibilities are included in revenue agent training materials. LMSB Human Capital Office has included the requirement that Industry Territory Managers review Form 3210 utilization and follow-up procedures during operational reviews in a memorandum dated December 13, 2006. Open. During our fiscal year 2007 audit, we identified instances at one SCC and four TACs where there was no system in place or evidence maintained to track acknowledged document transmittals. We will continue to evaluate IRS’s corrective actions during our fiscal year 2008 audit. IRMs 21.3.4.7 and 1.4.11.19.1 were revised during 2007 to provide procedures for requiring TACs to follow-up with SP centers when acknowledgements are not received within 10 days. Similarly, W&I Accounts Management revised IRMs 21.5.4.2 and 1.4.16 for this requirement. W&I Field Assistance will conduct operational reviews during and after filing season to monitor compliance, and is currently enhancing the existing TAC Security and Remittance Review Database to provide more comprehensive and quantitative data for analysis. Reviews conducted during 2007 showed that offices transmitting receipts have a system to track acknowledged copies of document transmittals. Planned reviews will enforce existing requirements for both organizations. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. LMSB has issued procedures to the field on the responsibilities for using receipt transmittals. LMSB employees are reminded annually through executive memorandum of Form 3210 procedures and responsibilities. LMSB has also issued memos to the field to remind and reinforce the use of Form 3210 and establishment of a follow-up system for unacknowledged 3210s. A closing checklist for LMSB cases was created to assist LMSB employees when transmitting cases. LMSB technical training has certified that Form 3210 procedures and responsibilities are included in revenue agent training materials. LMSB Human Capital Office has included the requirement that Industry Territory Managers review Form 3210 utilization and follow-up procedures during operational reviews in a memorandum dated December 13, 2006. Closed. During our fiscal year 2007 audit, we verified that the IRM includes procedures for LMSB and TE/GE units to follow up with the destination sites if remittance transmittals are not returned within 10 days or if all remittances were not marked with a distinctive checkmark. Also, we verified that the IRM contains Field Assistance (TAC) procedures for monitoring document transmittal acknowledgements. IRMs 21.3.4.7 and 1.4.11.19.1 were revised to provide procedures for requiring TACs to follow-up with SP centers when acknowledgements are not received within 10 days. IRM 1.4.11.19.1 Maintaining Form 795/795A Centralized Files provides instruction to document follow-up of unacknowledged document transmittals. To help reinforce the importance of the follow-up managers are required to attend classroom training. New and acting managers attended “Managing a TAC” training in 2007, and all managers attend a filing season readiness workshop. W&I Accounts Management revised IRMs 21.5.4.2 and 1.4.16 for this requirement. Planned reviews will enforce existing requirements. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. LMSB has issued procedures to the field on the responsibilities for using receipt transmittals. LMSB employees are reminded annually through executive memorandum of Form 3210 procedures and responsibilities. LMSB has also issued memos to the field to remind and reinforce the use of Form 3210 and establishment of a follow-up system for unacknowledged 3210s. A closing checklist for LMSB cases was created to assist LMSB employees when transmitting cases. LMSB technical training has certified that Form 3210 procedures and responsibilities are included in revenue agent training materials. LMSB Human Capital Office has included the requirement that Industry Territory Managers review Form 3210 utilization and follow-up procedures during operational reviews in a memorandum dated December 13, 2006. Open. During our fiscal year 2007 audit, we identified instances at seven TACs where there was no evidence of managerial review of document transmittals and one instance at one of five SCCs we visited in which one Refund Inquiry Unit manager did not document his review of the document transmittals. We will continue to evaluate IRS’s corrective actions during our fiscal year 2008 audit. IRM 1.4.11.19.5 Field Assistance Manager Review outlines instructions for managers to perform a minimum of two reviews per quarter per employee for payment processing and reconciliation procedures that include 3210 and 795 segregation of duties. A certification template has been created and placed in the IRM 1.4.11-10 for managers to confirm the review being conducted. To help reinforce the importance of the follow-up managers are required to attend classroom training. New and acting managers attended “Managing a TAC” training in 2007 and all managers will attend a Filing Season Readiness Workshop. During the training the requirement to conduct reviews and document results will be emphasized. W&I Accounts Management revised IRMs 21.5.4.2 and 1.4.16 for this requirement. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. W&I Field Assistance (FA) and AWSS are currently implementing plans to correct security and control access issues in TACs. Field Assistance identified 120 locations and AWSS completed a detailed analysis on each one. Most locations were identified as space and design issues that require implementation of the TAC Model Design. For locations that were not space and design issues, AWSS provided the funding and implemented corrective actions. Most of the security and control access issues affect small TACs. FA and AWSS have developed a strategic TAC Model implementation plan and the new “Mini TAC Model Design” to correct security and control access issues in the remaining offices. Open. During our fiscal year 2007 audit, we identified instances at two TACs where the controlled area was not equipped with physical security controls adequate to deter and prevent unauthorized access to restricted areas or office space occupied by other IRS units. We will continue to evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Open. Effective November 27, 2007, FA managers are no longer required to document visits to outlying TACs by using a checklist. Instead, new processes were implemented that will better gauge managers’ adherence to remittance and physical security internal controls. The new process includes the following: (1) A performance commitment for each level of FA management (director, area director, territory manager (TM), and TAC manager). The commitment requires managers to conduct and document reviews to ensure protection of data and equipment and ensure compliance with remittance and security procedures. (2) Implementation of a tiered operational review approach. This will allow FA to determine if TAC managers are performing required reviews, conducting periodic visits, and focusing on actions that mitigate control weaknesses. Headquarters (HQ) reviews focus on the Area Offices, Area Office operational reviews focus on TMs, and TM reviews focus on each TAC manager. (3) TAC managers and TMs using DCIs to conduct physical security and remittance reviews. (4) TAC managers inputting review results into the TAC Security and Remittance Review Database. Database information will be analyzed at the headquarters level to identify top issues needing attention and to develop corrective actions. Open. IRS no longer requires TAC managers to document their visits to outlying TACs by using a checklist but has implemented new procedures involving FA managers at all levels to ensure that periodic reviews are performed and centrally documented. However, these changes occurred subsequent to our fiscal year 2007 audit. We will assess, during our fiscal year 2008 audit, whether the new procedures will effectively mitigate the risks that the previous recommendation of documenting supervisory visits was originally designed to address. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. In January 2006, the lockbox bank LSG 2.2.3.1.5 (6) was revised to add the requirement that banks maintain a logbook of incident reports and any applicable supporting documentation, and note corrective follow-up actions taken on each incident. IRS reinforced the requirement to maintain a logbook in sequential date order in the 2007 LSG. For SCCs, the requirement for all activations of alarms to be logged in security console logs has been on the Audit Management Checklist since June 2006. Interim IRM 1.16.12A Security Guard Service and Explosive Detection Dogs, issued in November 2006, states the requirement for the guard console blotter/event log to be annotated to record and document the guard force response to each alarm activation exercise. Draft IRM 10.2.14 Methods of Providing Protection (awaiting finalization) states, “A record of all instances involving the activation of any alarm regardless of the circumstances that may have caused the activation, must be documented in a Daily Activity Report/Event Log, or other log book and maintained for two-years.” The IRM 1.16 series is being changed to 10.2. Open. As of the time of our audit, the IRM changes were in draft, under review, and waiting to be finalized. During our fiscal year 2007 audit, we identified three instances at one of four lockbox banks we visited in which the activation of intrusion alarms were not recorded by security guards. We will continue to evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. W&I issued a memorandum on April 5, 2007, to address this issue. Additionally, a letter was issued to the Director, Security and Law Enforcement of Homeland Security, to ensure that security officers are aware of their duties and responsibilities at key post of duty. Closed. We did not identify any instances where key posts of duty were left unattended by security guards during our fiscal year 2007 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. IRS continues to use the Security Review Check List to document the effectiveness of the initial and final candling process, and to talk to employees who perform initial and final candling as part of the monthly campus and national office security reviews. Closed. We verified that IRS revised its Security Review Checklist to document, through observation, the effectiveness of the initial and final candling process. During our fiscal year 2007 audit, we non-statistically selected and reviewed several campus security review reports and found no instances where the reports did not document the number of employees who were questioned about their knowledge of candling procedures and the responses received from the employees. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. As of January 1, 2007, IRS revised LSG section 2.2.3.1(6) k to restrict access of all delivery personnel. The IRS Lockbox Security Review Team observed the lockbox site’s process of delivery personnel while on-site to ensure compliance with the LSG requirement. In addition, section 2.2.2.13.1 (CCTV Cameras) (2)g of the LSG was revised to add that cameras must capture images of all persons entering and exiting perimeter doors and other critical ingress/egress points, including but not limited to the computer room and closets containing main utility feeds. AWSS continues to complete compliance reviews, risk assessments, and quarterly audit management checklist reviews. Since April 2006, the service center campuses have been providing quarterly verification that all guards have been reminded to inspect and scrutinize all badges of personnel accessing IRS facilities. During the past year, IRS has accessed closed- circuit television (CCTV) capabilities and is currently taking corrective actions to allow the unobstructed surveillance of campus fence lines and the facility perimeters. Closed. We verified that IRS refined the scope and nature of its periodic security reviews by (1) performing periodic tests of whether lockbox personnel are only allowing authorized individuals to access the facility and verifying that CCTVs are capturing key areas and (2) conducting quarterly assessments of the integrity of perimeter access controls. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. IRM 1.16.12 was revised and documents the requirements to test, document, report and follow-up on service center campus intrusion detection alarms. Physical Security area directors began implementing the new procedures in January 2007. Test results are rolled-up to PPPO for quarterly reports for upper management. Open. IRS officials informed us that the IRM section is in draft and currently in the review stage. We will follow up on the finalization of this IRM and continue to assess IRS’s actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. This recommendation remains closed, as IRS reported in fiscal year 2006. AWSS reports that the re-engineered process is working as intended. Aging record reports are monitored monthly, and AWSS staff follows up on disposal actions to identify issues or problems. Closed. During fiscal year 2006, IRS re-engineered the P&E asset retirement and disposal process. The new process generates exception reports that enable management to monitor the aging of transactions during the disposal process. Our fiscal year 2007 review of P&E internal controls showed that anomaly reports are now being generated when an asset remains in a disposal code for an extended period of time. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-06-543R, May 12, 2006) Closed. This recommendation remains closed as IRS reported in fiscal year 2006. AWSS reports that the reengineered process is working as intended. Aging record reports are monitored monthly and AWSS staff follows up on disposal actions to identify issues or problems. Open. During fiscal year 2006, IRS re- engineered the P&E asset retirement and disposal process. The new process generates exception reports that enable management to monitor the aging of transactions during the disposal process. While our fiscal year 2007 review of P&E internal controls showed that anomaly reports are now being generated when an asset remains in a disposal code for an extended period of time, our audit testing revealed that disposals are still not being recorded in a timely manner. Our inquiries of IRS management revealed that management is not always reviewing the anomaly reports as required by the reengineered process. We will continue to evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. IRS is currently evaluating this recommendation to determine the best means to safeguard (e.g. encryption) and/or retain taxpayer data. To assist in the evaluation process, IRS plans to complete a cost-benefit analysis to determine the best solution. The tentative date for completion of the cost-benefit analysis and any resulting solution is September 30, 2008. In the interim, to mitigate the risk of losing personally identifiable information (PII), IRS plans to incorporate specific guidelines in the calendar year 2008 LSG to clearly require that all lockbox sites store backup media containing PII in locked containers. The calendar year 2008 LSG was issued on December 19, 2007. Open. During our fiscal year 2007 audit, we identified instances at all four lockbox banks we visited where backup data tapes containing federal taxpayer information were not encrypted. We will evaluate IRS’s planned corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. IRS is currently evaluating this recommendation to determine the best means to safeguard (e.g. encryption) and/or retain taxpayer data. To assist in the evaluation process, IRS plans to complete a cost- benefit analysis to determine the best solution. The tentative date for completion of the cost-benefit analysis and any resulting solution is September 30, 2008. In the interim, to mitigate the risk of losing PII, IRS plans to incorporate specific guidelines in the calendar year 2008 LSG to clearly require that all lockbox sites store backup media containing PII in locked containers. The calendar year 2008 LSG was issued in December 19, 2007. Open. During our fiscal year 2007 audit, we identified instances at all four lockbox banks we visited where backup media containing federal taxpayer information was not stored at an off-site location. We will evaluate IRS’s planned corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. IRS is currently evaluating this recommendation to determine the best means to safeguard (e.g. encryption) and/or retain taxpayer data. To assist in the evaluation process, IRS plans to complete a cost-benefit analysis to determine the best solution. The tentative date for completion of the cost-benefit analysis and any resulting solution is September 30, 2008. In the interim, to mitigate the risk of losing PII, IRS plans to incorporate specific guidelines in the calendar year 2008 LSG to clearly require all lockbox sites store backup media containing PII in locked containers. The calendar year 2008 LSG was issued in December 19, 2007. For the Lockbox Electronic Network (LEN), it electronically transmits all transactional data, including federal taxpayer information, from the lockbox banks to IRS via the Martinsburg Computing Center, which is currently going to the Tennessee Computing Center. The electronic transmission securely transmits the data through the use of Virtual Private Network devices like the devices used at the computing centers which will encrypt the data as it is being transmitted. Effective March 2008, the LEN is being used to transmit the data to the SP centers. Cartridges will only be used in the event of an emergency or contingency situation where the LEN transmission fails. Open. We will continue to evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. All SCCs conducted an assessment of the CCTV systems concerning unobstructed views of fence lines and perimeter, and identified problems that were documented in an action plan developed in May 2007 and completed by February 2008. Open. During our fiscal year 2007 audit, we identified instances at three of five SCCs we visited where security cameras did not provide an unobstructed view of the entire perimeter of the facility. We will evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. Procedures were implemented requiring Physical Security analysts to document issues/problems during quarterly reviews, establish corrective action due dates, and track progress to ensure implementation of all corrective actions. The new procedures and reporting formats were implemented in June 2007. Compliance with the procedures is monitored during Physical Security area director operational reviews and random sampling by PPPO. Closed. We verified that IRS revised its procedures and reporting formats to require its Physical Security analysts to (1) document concerns identified during quarterly physical security reviews, (2) establish corrective action implementation dates, and (3) track those actions to ensure and monitor implementation. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. Employees have been instructed to recognize only IRM 3.17.79 and IRM 21 as the official authoritative guidance for processing manual refunds. Submission Processing (SP) conducted a conference call with designated campus planning and analysis staff, SP Headquarters staff and the IRM owner for 21.4.4, and issued a Hot Topic on April 30, 2007. SP also provided sites with this information and contacted authors of IRM 21.4.4 and IRM 4.4.19. Accounts Management and SB/SE Compliance will review the IRM to ensure that instructions are correct and that related training course modules are correct. Closed. IRS’s action satisfies the intent of this recommendation. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. W&I reinforced IRM 3.17.79.0 and 21.4.4 as the official authoritative guidance for processing manual refunds. SP provided sites with this information and also contacted authors of IRM 21.4.4 and IRM 4.4.19. The Account Management analyst and the SB/SE Compliance analyst will review the IRM to ensure that instructions are correct and that related training course modules are accurate. Closed. IRS’s action satisfies the intent of this recommendation. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. All W&I business functions conducted training by July 2007, except for Compliance, which is planned to be completed by April 2008. SP management reviews history sheets annotated with taxpayer identification numbers, tax period, transaction code, date, and initials of initiator. SP conducted team refresher training by July 30, 2007. This refresher training will also be included in fiscal year 2008 continuing professional education. A manual refunds refresher course was distributed by the Accounts Management Program Management/Process Assurance and training was completed by June 2007. The course emphasized the required monitoring of manual refunds and the documentation of monitoring actions. Accounts Management will conduct additional training by July 15, 2008, for employees who initiate manual refunds. Open. We will review IRS’s records of training during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS submitted a work request on June 26, 2007, to update its computer programs to check for outstanding liabilities associated with both the primary and secondary Social Security numbers on a joint tax return and offsetting to any outstanding TFRP liability before issuance of a refund. The programming change was implemented on January 20, 2008. Open. The programming change was initiated after our fiscal year 2007 audit was complete. We will evaluate the effectiveness of IRS’s corrective action during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS counsel said that it was acceptable for the revenue officer to also freeze the refund of any spouse at the time of approval of recommendation for a TFRP assessment or at the time the TFRP assessment is made, Therefore, IRS’s SB/SE issued interim guidance on July 23, 2007, for input of transaction code 130 to freeze potential individual master file refunds for all individuals determined responsible for the TFRP. Closed. Based on our review of the IRS interim guidance issued on July 23, 2007, we verified that IRS instructed revenue officers making TFRP assessments to research whether responsible officers are filing jointly with their spouses and to place refund freezes on the joint accounts. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS implemented a system change in January 2007 to correct the penalty calculation program. Open. We will evaluate the effectiveness of IRS’s corrective action during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS implemented a system change in January 2007 that corrected debit balance taxpayer accounts affected by the programming error. Open. We will evaluate the effectiveness of IRS’s corrective action during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. The Deputy Commissioner for Services and Enforcement issued a memorandum to all functions titled “Service wide Action to Prevent Late Lien Releases,” in January 2007. The memorandum directed manual lien releases when systemic processes do not release liens. Based on the memorandum, IRS revised several IRM sections. In addition, IRS plans to revise IRM 5.1.2 by May 2008 to include all four elements contained in this recommendation. Open. During our fiscal year 2007 audit, we identified issues that resulted in the untimely release of a tax lien. We will continue to review IRS’s corrective actions to address this issue during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. IRS completed programming changes in January 2007 that allow lien releases regardless of freeze codes. In addition, the Deputy Commissioner for Services and Enforcement issued a memorandum to all functions titled “Service wide Action to Prevent Late Lien Releases,” in January 2007. The memorandum directed manual lien releases when systemic processes do not release liens. Based on the memorandum IRS revised several IRM sections. Finally, IRS plans to revise IRM 5.1.2 by May 2008 to include all of the elements contained in this recommendation. Open. During our fiscal year 2007 audit, we identified issues that resulted in the untimely release of a tax lien. We will continue to review IRS’s corrective actions to address this issue during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. In order to facilitate timely lien releases, IRS put a new “My Eureka” report in place for the Centralized Insolvency Office. IRS generates and resolves issues on this report weekly. IRS revised IRM 5.9.17.11.6 in March 2007 to reference the report and request manual lien releases. Campus Compliance analysts conduct reviews quarterly to ensure appropriate actions are taken. However, IRS’s fiscal year 2007 OMB Circular No. A-123 review of its lien release process identified two lien release errors associated with bankruptcy discharges. Therefore, IRS has added new action items to the Lien Release Action Plan, to establish new controls and oversight by management in CIO and Field Insolvency to ensure that IRM guidelines are followed and new procedures for Field Insolvency. In addition, IRS identified an instance where Field Insolvency failed to release a lien after an Exempt/Abandoned Asset review. Therefore, Collection Policy will review Field Insolvency by June 30, 2008, and consider the addition of new corrective actions to reduce lien errors based on this issue. Open. During our fiscal year 2007 audit, we identified issues that resulted in the untimely release of a tax lien. We will continue to review IRS’s corrective actions to address this issue during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. The IRM for the Centralized Lien Unit (CLU) provides specific direction to date stamp and maintain billing support vouchers (BSVs) as evidence of timely releases of federal tax liens. In November 2006 CLU began a new process of scanning BSVs, and associating BSVs with Specific Lien Identification (SLID) numbers in order to ensure that BSVs are retrievable and show that liens were timely released. IRS trained employees on this process as it was rolled out. In May 2007 IRS completed the 2007 OMB Circular No. A-123 review on the timeliness of lien releases. The review found that BSVs were stamped appropriately in all cases reviewed. Closed. In our review of IRS’s fiscal year 2007 OMB circular No. A-123 lien testing results, we verified that IRS was able obtain the date stamped billing vouchers for all of its sample items. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. The collection activity reports (CAR) capture data each month on installment agreement activity. The number of installment agreements, number of user fees paid and user fee dollar amounts are extracted from the installment agreement reports. These reports are utilized by Headquarters to conduct month-to-month and year- to-year comparisons for trend analysis. Headquarters will monitor collections on the CAR and balance those collections against what is projected and what is in the financial system, and use historical trends to identify issues. Open. IRS’s actions to monitor and analyze installment agreement user fee collections at headquarters were initiated after our fiscal year 2007 audit was completed. We will review and evaluate IRS’s efforts to monitor installment agreement user fee activity during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. A sweep process that collects paid fees and records them in the user fee account has been established. Effective January 2008, the sweep is run weekly to ensure accurate and more timely accounting of fee dollars. Open. The action described in IRS’s response does not fully ensure that recorded installment agreement user fees correctly reflect user fees earned and collected from taxpayers because it is not designed for that purpose. IRS’s sweep (recovery) process is designed to identify and correct for unrecorded user fees collected with the initial installment agreement payment but incorrectly posted against the taxpayer’s debt (tax module). We will continue to review and evaluate IRS’s efforts to address issues related to installment agreement user fees during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. Steps to ensure appropriate assessment and collection of user fees are already in place. The user fee category on the Installment Agreement Accounts Listing (IAAL) compares unpaid and overpaid user fee money and makes adjustments accordingly. The IAAL for W&I is consolidated at one site. For both W&I and SBSE, the IAAL is subjected to Planning and Analysis Support, Managerial, Operations and Headquarters review. Open. IRS was in the process of updating its operating procedures to account for and record new installment agreement user fee amounts when we completed our fiscal year 2007 audit. We will review and evaluate IRS’s use of the IAAL and Managerial, Operations, and Headquarters review processes during our fiscal year 2008 audit. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Open. IRS is identifying locations that need additional secured storage space and will obtain the necessary space as appropriate. Scheduled completion date is October 1, 2009. Processes and procedures are in place for business units to request space, either secured or non- secured. AWSS negotiated processes and procedures with the business units that are now part of AWSS’s Senior Commissioner Representative Handbook. Business units needing secured space must follow established guidance. Also, processes have been set for business units to approve and fund their space requests. Open. IRS has implemented a plan to obtain additional secured storage space as deemed necessary, with a scheduled completion date of October 1, 2009. We will monitor IRS’s corrective actions during our fiscal years 2008 and 2009 audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-07-689R, May 11, 2007) Closed. IRS updated the IRM in September 2007 and sent a reminder to those with acquisition authority about the IRS acquisition procedures developed in December 2002. The update included reference to Policy and Procedures Memorandum No. 46.5, “Receipt, Quality Assurance and Acceptance,” reiterating requirements for separation of duties. Open. Our fiscal year 2007 review of internal controls over property and equipment revealed that at least one IRS employee was permitted to place orders with vendors and perform receipt and acceptance functions when the orders were delivered. We will continue to evaluate IRS’s corrective actions during our fiscal year 2008 audit. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07- 692R, May 18, 2007) Open. In the fiscal year 2007 A-123 cycle, IRS expanded its A-123 guidance, improved review procedures, and improved training. As IRS prepares for the fiscal year 2008 A-123 cycle, it plans to continue to further enhance its in- house training and has instituted procedures to address the clarity and completeness of its explanations. Open. We will follow up during future audits to assess IRS’s progress in implementing its OMB Circular No. A- 123 review procedures. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07- 692R, May 18, 2007) Open. In fiscal year 2007, IRS made progress on this recommendation by adding a requirement to test plan templates to document audits reviewed. During the fiscal year 2008 planning phase, IRS plans to fully document the existing reviews and audits. Open. We will follow up during future audits to assess IRS’s progress in implementing its OMB Circular No. A- 123 review procedures. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07- 692R, May 18, 2007) Open. IRS plans to continue to work with the Department of the Treasury and GAO to fully implement OMB Circular No. A-123 requirements for evaluating controls over information technology relating to financial statement reporting. Open. We will follow up during future audits to assess IRS’s progress in implementing its OMB Circular No. A- 123 review procedures. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07- 692R, May 18, 2007) Open. IRS is piloting a limited set of fiscal year 2008 test plans, which include an analysis of the design for each transaction control set tested, with full implementation expected in the fiscal year 2009 A-123 cycle. Open. We will follow up during future audits to assess IRS’s progress in implementing its OMB Circular No. A- 123 review procedures. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07- 692R, May 18, 2007) Open. In fiscal year 2007, IRS established an internal crosswalk between A-123 tests and laws and regulations significant to financial reporting. IRS plans to further refine this linkage for the fiscal year 2008 A-123 process. Open. We will follow up during future audits to assess IRS’s progress in implementing its OMB Circular No. A- 123 review procedures. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07- 692R, May 18, 2007) Open. Although implementation of such procedures is not necessary until elimination of the outstanding material weaknesses, IRS plans to develop follow-up procedures that provide assurance for the last 3 months of the fiscal year. Open. We will follow up during future audits to assess IRS’s progress in implementing its OMB Circular No. A- 123 review procedures. Management Report: IRS’s First Year Implementation of the Requirements of the Office of Management and Budget’s (OMB) Revised Circular No. A-123 (GAO-07- 692R, May 18, 2007) Open. IRS has enhanced training at the beginning of each A-123 cycle to include an external course designed for financial auditors on preparing workpapers. IRS evaluated results from fiscal year 2007 and has incorporated improvements to the fiscal year 2008 training to ensure its curriculum addresses issues in testing approach, testing methodology, workpaper reviews, and lessons learned. Open. We will follow up during future audits to assess IRS’s progress in implementing its OMB Circular No. A- 123 review procedures. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. Management Report: Improvements Needed in IRS’s Internal Controls (GAO-08-368R, June 2008) Because this is a recent recommendation, GAO did not obtain information on IRS’s status in addressing it. Open: This is a recent recommendation. We will review IRS’s corrective actions during future audits. IRS does not have financial management systems adequate to enable it to accurately generate and report, in a timely manner, the information needed to both prepare financial statements and manage operations on an ongoing basis. To overcome these systemic deficiencies with respect to preparation of its annual financial statements, IRS was compelled to employ extensive compensating procedures. Specifically, IRS (1) did not have an adequate general ledger system for tax-related transactions, and (2) was unable to readily determine the costs of its activities and programs and did not have cost-based performance information to assist in making or justifying resource allocation decisions. As a result, IRS does not have real-time data needed to assist in managing operations on a day-to-day basis and to provide an informed basis for making or justifying resource allocation decisions. IRS has serious internal control issues that affected its management of unpaid tax assessments. Specifically, (1) IRS lacked a subsidiary ledger for unpaid tax assessments that would allow it to produce accurate, useful, and timely information with which to manage and report externally, and (2) IRS experienced errors and delays in recording taxpayer information, payments, and other activities. IRS does not, at present, have agencywide cost-benefit information, related cost-based performance measures, or a systematic process for ensuring it is using its resources to maximize its ability to collect what is owed and minimize the disbursements of improper tax refunds in the context of its overall mission and responsibilities. These deficiencies inhibit IRS’s ability to appropriately assess and routinely monitor the relative merits of its various initiatives and adjust its strategies as needed. This, in turn, can significantly affect both the level of tax revenue collected and the magnitude of improper refunds paid. Significant weaknesses in information security controls continue to threaten the confidentiality, integrity, and availability of IRS’s financial processing systems and information. IRS has weaknesses in controls for protecting access to systems and information, as well as other information security controls that affect key financial systems—particularly IFS and IRACS. For example, sensitive information, including user identification, passwords, and software code for mission-critical applications, was accessible on an internal Web site to anyone who could connect to IRS’s internal network—without having to log in to the network. The information gained through this access could be used to alter data flowing to and from IFS. In addition, configuration flaws in the mainframe allowed users unrestricted access to all programs and data on the mainframe, including IRACS. Because this access was not controlled by the security system, no security violation logs would be created, reducing IRS’s ability to detect unauthorized access. Weaknesses also existed in other areas, such as protecting against unauthorized physical access to sensitive computer resources and patching servers to protect against known vulnerabilities. Material Weakness: Controls over Information Systems Security Although IRS has made some progress in addressing previous weaknesses we identified in its information systems security controls and physical security controls, these and new weaknesses in information systems security continue to impair IRS’s ability to ensure the confidentiality, integrity, and availability of financial and tax-processing systems. As of January 2008, there were 76 open recommendations from our information systems security work designed to help IRS improve its information systems security controls. Our recommendations resulting from our information systems security work are reported separately and are not included in this report primarily because of the sensitive nature of some of those issues. IRS manually processes hundreds of billions of dollars of hard-copy taxpayer receipts and related taxpayer information at its service center campuses, field office taxpayer assistance centers, other field office units, and commercial lockbox banks. However, we have identified weaknesses in IRS’s controls designed to safeguard these taxpayer receipts and information which increase the risk that receipts in the form of checks, cash, and the like could be misappropriated or that the information could be compromised. IRS did not always release the applicable federal tax lien within 30 days of the tax liability being either paid off or abated, as required by the Internal Revenue Code. The Internal Revenue Code grants IRS the power to file a lien against the property of any taxpayer who neglects or refuses to pay all assessed federal taxes. The lien serves to protect the interest of the federal government and as a public notice to current and potential creditors of the government’s interest in the taxpayer’s property. Under section 6325 of the Internal Revenue Code, IRS is required to release federal tax liens within 30 days after the date the tax liability is satisfied or has become legally unenforceable or the Secretary of the Treasury has accepted a bond for the assessed tax. The recommendations listed below do not rise to the level of a significant deficiency or a material weakness. However, these issues do represent weaknesses in various aspects of IRS's control environment that should be addressed. In addition to the contact named above, the following individuals made major contributions to this report: William J. Cordrey, Assistant Director; Gloria Cano; Stephanie Chen; Nina Crocker; John Davis; Charles Ego; Charles Fox; Valerie Freeman; Ted Hu; Delores Lee; John Sawyer; Angel Sharma; Peggy Smith; Cynthia Teddleton; and Gary Wiggins.

Summary: In its role as the nation's tax collector, the Internal Revenue Service (IRS) has a demanding responsibility in annually collecting trillions of dollars in taxes, processing hundreds of millions of tax and information returns, and enforcing the nation's tax laws. Since its first audit of IRS's financial statements in fiscal year 1992, GAO has identified a number of weaknesses in IRS's financial management operations. In related reports, GAO has recommended corrective action to address those weaknesses. Each year, as part of the annual audit of IRS's financial statements, GAO not only makes recommendations to address any new weaknesses identified but also follows up on the status of weaknesses GAO identified in previous years' audits. The purpose of this report is to (1) assist IRS management in tracking the status of audit recommendations and actions needed to fully address them and (2) demonstrate how the recommendations relate to control activities central to IRS's mission and goals. IRS has made significant progress in improving its internal controls and financial management since its first financial statement audit in 1992, as evidenced by 8 consecutive years of clean audit opinions on its financial statements, the resolution of several material internal control weaknesses, and actions resulting in the closure of over 200 financial management recommendations. This progress has been the result of hard work throughout the agency and sustained commitment at the top levels of the agency. However, IRS still faces financial management challenges. At the beginning of GAO's audit of IRS's fiscal year 2007 financial statements, 75 financial management-related recommendations from prior audits remained open because IRS had not fully addressed the issues that gave rise to them. During the fiscal year 2007 financial audit, IRS took actions that enabled GAO to close 18 of those recommendations. At the same time, GAO identified additional internal control issues resulting in 24 new recommendations. In total, 81 recommendations remain open at the end of fiscal 2007. To assist IRS in evaluating and improving internal controls, GAO categorized the 81 open recommendations by various internal control activities, which, in turn, were grouped into three broad control categories. The continued existence of internal control weaknesses that gave rise to these recommendations represents a serious obstacle that IRS needs to overcome. Effective implementation of GAO's recommendations can greatly assist IRS in improving its internal controls and achieving sound financial management and can help enable it to more effectively carry out its tax administration responsibilities. Most can be addressed in the short term (the next 2 years). However, a few recommendations, particularly those concerning IRS's automated systems, are complex and will require several more years to fully and effectively address.